Audit Log

backend/app/services/user_service.py

@@ -13,6 +13,7 @@ from app.core.security import hash_password
 from app.models.tenant import Tenant
 from app.models.user import User
 from app.schemas.user import UserCreateRequest, UserUpdateRequest
+from app.services.audit_service import log_audit
 
 
 class UserService:
@@ -61,6 +62,15 @@ class UserService:
         )
         self.db.add(user)
         await self.db.flush()  # ottieni l'ID
+        await log_audit(
+            self.db,
+            "user.created",
+            tenant_id=tenant_id,
+            user_id=created_by.id,
+            resource_type="user",
+            resource_id=user.id,
+            payload={"email": user.email, "role": user.role},
+        )
         return user
 
     async def get_user(self, user_id: uuid.UUID, tenant_id: uuid.UUID) -> User:
@@ -110,13 +120,26 @@ class UserService:
         if user.is_super_admin and not updated_by.is_super_admin:
             raise ForbiddenError("Non puoi modificare un super_admin")
 
+        changes: dict = {}
         if data.full_name is not None:
+            changes["full_name"] = data.full_name
             user.full_name = data.full_name
         if data.role is not None:
+            changes["role"] = data.role
             user.role = data.role
         if data.is_active is not None:
+            changes["is_active"] = data.is_active
             user.is_active = data.is_active
 
+        await log_audit(
+            self.db,
+            "user.updated",
+            tenant_id=tenant_id,
+            user_id=updated_by.id,
+            resource_type="user",
+            resource_id=user_id,
+            payload={"changes": changes},
+        )
         return user
 
     async def reset_password(
@@ -143,3 +166,12 @@ class UserService:
 
         # Soft delete (disabilita invece di eliminare)
         user.is_active = False
+        await log_audit(
+            self.db,
+            "user.deleted",
+            tenant_id=tenant_id,
+            user_id=deleted_by.id,
+            resource_type="user",
+            resource_id=user_id,
+            payload={"email": user.email},
+        )