feat(platform): add audit logs and activity feed

backend/hermes/app/api/roles.py

@@ -3,12 +3,14 @@ import logging
 from fastapi import APIRouter, Depends, HTTPException, Response, status
 from sqlalchemy import select
 from sqlalchemy.orm import Session
+from starlette.requests import Request
 
 from app.core.rbac import require_permission
 from app.db.database import get_db
 from app.models.user import User
 from app.repositories.rbac_repository import RbacRepository
 from app.schemas.rbac import RoleCreate, RolePermissionUpdate, RoleResponse, RoleUpdate
+from app.services.audit_service import sanitize, write_audit_log
 
 logger = logging.getLogger(__name__)
 
@@ -80,6 +82,7 @@ def get_role(
 )
 def create_role(
     role: RoleCreate,
+    request: Request,
     db: Session = Depends(get_db),
     current_user: User = Depends(require_permission("roles.create")),
 ):
@@ -87,17 +90,30 @@ def create_role(
     ensure_permission_ids_exist(db, role.permission_ids)
 
     logger.info("roles.create", extra={"actor_user_id": current_user.id})
-    return RbacRepository.create_role(db, role)
+    created_role = RbacRepository.create_role(db, role)
+    write_audit_log(
+        db,
+        action="roles.create",
+        entity_type="roles",
+        entity_id=created_role.id,
+        entity_label=created_role.name,
+        actor=current_user,
+        request=request,
+        after_data=created_role,
+    )
+    return created_role
 
 
 @router.put("/{role_id}", response_model=RoleResponse)
 def update_role(
     role_id: int,
     role: RoleUpdate,
+    request: Request,
     db: Session = Depends(get_db),
     current_user: User = Depends(require_permission("roles.update")),
 ):
     db_role = get_role_or_404(db, role_id)
+    before_data = sanitize(db_role)
     ensure_unique_role_name(db, role.name, role_id)
     ensure_permission_ids_exist(db, role.permission_ids)
 
@@ -105,16 +121,31 @@ def update_role(
         "roles.update",
         extra={"actor_user_id": current_user.id, "target_role_id": role_id},
     )
-    return RbacRepository.update_role(db, db_role, role)
+    updated_role = RbacRepository.update_role(db, db_role, role)
+    write_audit_log(
+        db,
+        action="roles.update",
+        entity_type="roles",
+        entity_id=updated_role.id,
+        entity_label=updated_role.name,
+        actor=current_user,
+        request=request,
+        before_data=before_data,
+        after_data=updated_role,
+    )
+    return updated_role
 
 
 @router.delete("/{role_id}", status_code=status.HTTP_204_NO_CONTENT)
 def delete_role(
     role_id: int,
+    request: Request,
     db: Session = Depends(get_db),
     current_user: User = Depends(require_permission("roles.delete")),
 ):
     db_role = get_role_or_404(db, role_id)
+    before_data = sanitize(db_role)
+    entity_label = db_role.name
     if db_role.is_system:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
@@ -133,6 +164,16 @@ def delete_role(
         extra={"actor_user_id": current_user.id, "target_role_id": role_id},
     )
     RbacRepository.delete_role(db, db_role)
+    write_audit_log(
+        db,
+        action="roles.delete",
+        entity_type="roles",
+        entity_id=role_id,
+        entity_label=entity_label,
+        actor=current_user,
+        request=request,
+        before_data=before_data,
+    )
     return Response(status_code=status.HTTP_204_NO_CONTENT)
 
 
@@ -140,14 +181,28 @@ def delete_role(
 def update_role_permissions(
     role_id: int,
     permission_update: RolePermissionUpdate,
+    request: Request,
     db: Session = Depends(get_db),
     current_user: User = Depends(require_permission("roles.assign")),
 ):
     db_role = get_role_or_404(db, role_id)
+    before_data = sanitize(db_role)
     ensure_permission_ids_exist(db, permission_update.permission_ids)
 
     logger.info(
         "roles.permissions_update",
         extra={"actor_user_id": current_user.id, "target_role_id": role_id},
     )
-    return RbacRepository.update_role_permissions(db, db_role, permission_update)
+    updated_role = RbacRepository.update_role_permissions(db, db_role, permission_update)
+    write_audit_log(
+        db,
+        action="roles.permissions_update",
+        entity_type="roles",
+        entity_id=updated_role.id,
+        entity_label=updated_role.name,
+        actor=current_user,
+        request=request,
+        before_data=before_data,
+        after_data=updated_role,
+    )
+    return updated_role