feat(secrets-mcp): 审计页、audit_log user_id、OAuth 登录与仪表盘 footer

- audit_log 增加 user_id；业务写审计透传 user_id - Web /audit 与侧边栏；Dashboard 版本 footer 贴底（margin-top: auto） - 停止 API Key 鉴权成功写入登录审计 - 文档、CI、release-check 配套更新 Made-with: Cursor
2026-03-21 11:12:11 +08:00
parent ee028d45c3
commit f2344b7543
19 changed files with 361 additions and 69 deletions
--- a/.gitea/workflows/secrets.yml
+++ b/.gitea/workflows/secrets.yml
@@ -59,12 +59,10 @@ jobs:
            echo "将创建新版本 ${tag}"
          fi

-      - name: 严格拦截重复版本
+      - name: 检测重复版本
        if: steps.ver.outputs.tag_exists == 'true'
        run: |
-          echo "错误: 版本 ${{ steps.ver.outputs.tag }} 已存在，禁止重复发版。"
-          echo "请先 bump crates/secrets-mcp/Cargo.toml 中的 version，并执行 cargo build 同步 Cargo.lock。"
-          exit 1
+          echo "提示: 版本 ${{ steps.ver.outputs.tag }} 已存在，将复用现有 tag 继续构建。"

      - name: 创建 Tag
        if: steps.ver.outputs.tag_exists == 'false'
@@ -230,16 +228,32 @@ jobs:
          RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
        run: |
          [ -z "$RELEASE_TOKEN" ] && exit 0
+          command -v jq >/dev/null 2>&1 || (sudo apt-get update -qq && sudo apt-get install -y -qq jq)
+
          tag="${{ needs.version.outputs.tag }}"
          bin="target/${{ env.MUSL_TARGET }}/release/${{ env.MCP_BINARY }}"
          archive="${{ env.MCP_BINARY }}-${tag}-x86_64-linux-musl.tar.gz"
          tar -czf "$archive" -C "$(dirname "$bin")" "$(basename "$bin")"
          sha256sum "$archive" > "${archive}.sha256"
-          release_url="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}/assets"
+          release_api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/${{ needs.version.outputs.release_id }}"
+          release_url="${release_api}/assets"
          curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
-            -F "attachment=@${archive}" "$release_url"
-          curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
-            -F "attachment=@${archive}.sha256" "$release_url"
+            "$release_api" -o /tmp/release-assets.json
+
+          for asset_name in "$archive" "${archive}.sha256"; do
+            asset_ids=$(jq -r --arg name "$asset_name" '.assets[]? | select(.name == $name) | .id' /tmp/release-assets.json)
+            if [ -n "$asset_ids" ]; then
+              while IFS= read -r asset_id; do
+                [ -z "$asset_id" ] && continue
+                echo "删除已有产物: ${asset_name} (${asset_id})"
+                curl -fsS -X DELETE -H "Authorization: token $RELEASE_TOKEN" \
+                  "${release_url}/${asset_id}"
+              done <<< "$asset_ids"
+            fi
+
+            curl -fsS -H "Authorization: token $RELEASE_TOKEN" \
+              -F "attachment=@${asset_name}" "$release_url"
+          done

  deploy-mcp:
    name: 部署 secrets-mcp
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -6,7 +6,7 @@

 1. 涉及 `crates/**`、根目录 `Cargo.toml`/`Cargo.lock`、`secrets-mcp` 行为变更的提交，默认视为**需要发版**，除非明确说明「本次不发版」。
 2. 发版前检查 `crates/secrets-mcp/Cargo.toml` 的 `version`，再查 tag：`git tag -l 'secrets-mcp-*'`。
-3. 若当前版本对应 tag 已存在，须先 bump `version`，再 `cargo build` 同步 `Cargo.lock` 后提交。
+3. 若当前版本对应 tag 已存在，默认允许复用现有 tag 继续构建；仅在需要新的发布版本时再 bump `version` 并 `cargo build` 同步 `Cargo.lock`。
 4. 提交前优先运行 `./scripts/release-check.sh`（版本/tag + `fmt` + `clippy --locked` + `test --locked`）。

 ## 项目结构
@@ -149,7 +149,7 @@ git tag -l 'secrets-mcp-*'
 ## CI/CD

 - **触发**：任意分支 `push`，且路径含 `crates/**`、`deploy/**`、根目录 `Cargo.toml`、`Cargo.lock`（见 `.gitea/workflows/secrets.yml`）。
- **版本与 tag**：从 `crates/secrets-mcp/Cargo.toml` 读版本；若远程已存在同名 `secrets-mcp-<version>` tag，**工作流失败**（须先 bump 版本并 `cargo build` 同步 `Cargo.lock`）；否则由 CI 创建并推送该 tag。
+- **版本与 tag**：从 `crates/secrets-mcp/Cargo.toml` 读版本；若远程已存在同名 `secrets-mcp-<version>` tag，则复用现有 tag 继续构建；否则由 CI 创建并推送该 tag。
 - **质量与构建**：`fmt` / `clippy --locked` / `test --locked` → `x86_64-unknown-linux-musl` 发布构建 `secrets-mcp`。
 - **Release（可选）**：`secrets.RELEASE_TOKEN`（Gitea PAT）用于创建草稿 Release、上传 `tar.gz` + `.sha256`、构建成功后发布；未配置则跳过 API Release，仅 tag + 构建。
 - **部署（可选）**：仅 `main`、`feat/mcp`、`mcp` 分支在构建成功时跑 `deploy-mcp`；需 `vars.DEPLOY_HOST`、`vars.DEPLOY_USER`、`secrets.DEPLOY_SSH_KEY`。勿把 OAuth/DB 等写进 workflow，用 `deploy/.env.example` 在目标机配置。
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1949,7 +1949,7 @@ dependencies = [

 [[package]]
 name = "secrets-mcp"
-version = "0.1.6"
+version = "0.1.7"
 dependencies = [
 "anyhow",
 "askama",
--- a/README.md
+++ b/README.md
@@ -165,7 +165,7 @@ deploy/                 # systemd、.env 示例
 见 [`.gitea/workflows/secrets.yml`](.gitea/workflows/secrets.yml)。

 - **触发**：任意分支 `push`，且变更路径包含 `crates/**`、`deploy/**`、根目录 `Cargo.toml` / `Cargo.lock`。
- **流水线**：解析 `crates/secrets-mcp/Cargo.toml` 版本 → **若 `secrets-mcp-<version>` 的 tag 已存在则整次运行失败**（避免重复发版）→ 否则自动打 tag → `cargo fmt` / `clippy --locked` / `test --locked` → 交叉编译 `x86_64-unknown-linux-musl` 的 `secrets-mcp`。
+- **流水线**：解析 `crates/secrets-mcp/Cargo.toml` 版本 → 若 `secrets-mcp-<version>` 的 tag 已存在则**复用现有 tag 继续构建**，否则自动打 tag → `cargo fmt` / `clippy --locked` / `test --locked` → 交叉编译 `x86_64-unknown-linux-musl` 的 `secrets-mcp`。
 - **Release（可选）**：配置仓库 Secret `RELEASE_TOKEN`（Gitea PAT，明文勿 base64）时，会通过 API 创建**草稿** Release、在 Linux 构建成功后上传 `tar.gz` 与 `.sha256`，再自动将草稿**正式发布**；未配置则跳过创建 Release 与产物上传，仅保留 tag 与构建结果。
 - **部署（可选）**：仅在 `main`、`feat/mcp` 或 `mcp` 分支且构建成功时，若已配置 `vars.DEPLOY_HOST`、`vars.DEPLOY_USER` 与 `secrets.DEPLOY_SSH_KEY`，则 `deploy-mcp` 通过 SCP/SSH 更新目标机二进制并 `systemctl restart secrets-mcp`。
 - **通知（可选）**：`vars.WEBHOOK_URL` 为飞书 Webhook 时，构建/部署/发布节点会推送简要状态。
--- a/crates/secrets-core/src/audit.rs
+++ b/crates/secrets-core/src/audit.rs
@@ -36,9 +36,10 @@ pub async fn log_login(
    let actor = current_actor();
    let detail = login_detail(user_id, provider, client_ip, user_agent);
    let result: Result<_, sqlx::Error> = sqlx::query(
-        "INSERT INTO audit_log (action, namespace, kind, name, detail, actor) \
-         VALUES ($1, $2, $3, $4, $5, $6)",
+        "INSERT INTO audit_log (user_id, action, namespace, kind, name, detail, actor) \
+         VALUES ($1, $2, $3, $4, $5, $6, $7)",
    )
+    .bind(user_id)
    .bind(ACTION_LOGIN)
    .bind(NAMESPACE_AUTH)
    .bind(kind)
@@ -58,6 +59,7 @@ pub async fn log_login(
 /// Write an audit entry within an existing transaction.
 pub async fn log_tx(
    tx: &mut Transaction<'_, Postgres>,
+    user_id: Option<Uuid>,
    action: &str,
    namespace: &str,
    kind: &str,
@@ -66,9 +68,10 @@ pub async fn log_tx(
 ) {
    let actor = current_actor();
    let result: Result<_, sqlx::Error> = sqlx::query(
-        "INSERT INTO audit_log (action, namespace, kind, name, detail, actor) \
-         VALUES ($1, $2, $3, $4, $5, $6)",
+        "INSERT INTO audit_log (user_id, action, namespace, kind, name, detail, actor) \
+         VALUES ($1, $2, $3, $4, $5, $6, $7)",
    )
+    .bind(user_id)
    .bind(action)
    .bind(namespace)
    .bind(kind)
--- a/crates/secrets-core/src/db.rs
+++ b/crates/secrets-core/src/db.rs
@@ -67,6 +67,7 @@ pub async fn migrate(pool: &PgPool) -> Result<()> {
        -- ── audit_log: append-only operation log ─────────────────────────────────
        CREATE TABLE IF NOT EXISTS audit_log (
            id          BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+            user_id     UUID,
            action      VARCHAR(32)  NOT NULL,
            namespace   VARCHAR(64)  NOT NULL,
            kind        VARCHAR(64)  NOT NULL,
@@ -76,8 +77,10 @@ pub async fn migrate(pool: &PgPool) -> Result<()> {
            created_at  TIMESTAMPTZ  NOT NULL DEFAULT NOW()
        );

+        ALTER TABLE audit_log ADD COLUMN IF NOT EXISTS user_id UUID;
        CREATE INDEX IF NOT EXISTS idx_audit_log_created  ON audit_log(created_at DESC);
        CREATE INDEX IF NOT EXISTS idx_audit_log_ns_kind  ON audit_log(namespace, kind);
+        CREATE INDEX IF NOT EXISTS idx_audit_log_user_id  ON audit_log(user_id) WHERE user_id IS NOT NULL;

        -- ── entries_history ───────────────────────────────────────────────────────
        CREATE TABLE IF NOT EXISTS entries_history (
--- a/crates/secrets-core/src/models.rs
+++ b/crates/secrets-core/src/models.rs
@@ -174,6 +174,20 @@ pub struct OauthAccount {
    pub created_at: DateTime<Utc>,
 }

+/// A single audit log row, optionally scoped to a business user.
+#[derive(Debug, Serialize, Deserialize, sqlx::FromRow)]
+pub struct AuditLogEntry {
+    pub id: i64,
+    pub user_id: Option<Uuid>,
+    pub action: String,
+    pub namespace: String,
+    pub kind: String,
+    pub name: String,
+    pub detail: Value,
+    pub actor: String,
+    pub created_at: DateTime<Utc>,
+}
+
 // ── TOML ↔ JSON value conversion ──────────────────────────────────────────────

 /// Convert a serde_json Value to a toml Value.
--- a/crates/secrets-core/src/service/add.rs
+++ b/crates/secrets-core/src/service/add.rs
@@ -346,6 +346,7 @@ pub async fn run(pool: &PgPool, params: AddParams<'_>, master_key: &[u8; 32]) ->

    crate::audit::log_tx(
        &mut tx,
+        params.user_id,
        "add",
        params.namespace,
        params.kind,
--- a/crates/secrets-core/src/service/audit_log.rs
+++ b/crates/secrets-core/src/service/audit_log.rs
@@ -0,0 +1,23 @@
+use anyhow::Result;
+use sqlx::PgPool;
+use uuid::Uuid;
+
+use crate::models::AuditLogEntry;
+
+pub async fn list_for_user(pool: &PgPool, user_id: Uuid, limit: i64) -> Result<Vec<AuditLogEntry>> {
+    let limit = limit.clamp(1, 200);
+
+    let rows = sqlx::query_as(
+        "SELECT id, user_id, action, namespace, kind, name, detail, actor, created_at \
+         FROM audit_log \
+         WHERE user_id = $1 OR (user_id IS NULL AND detail->>'user_id' = $1::text) \
+         ORDER BY created_at DESC, id DESC \
+         LIMIT $2",
+    )
+    .bind(user_id)
+    .bind(limit)
+    .fetch_all(pool)
+    .await?;
+
+    Ok(rows)
+}
--- a/crates/secrets-core/src/service/delete.rs
+++ b/crates/secrets-core/src/service/delete.rs
@@ -137,7 +137,7 @@ async fn delete_one(
    };

    snapshot_and_delete(&mut tx, namespace, kind, name, &row, user_id).await?;
-    crate::audit::log_tx(&mut tx, "delete", namespace, kind, name, json!({})).await;
+    crate::audit::log_tx(&mut tx, user_id, "delete", namespace, kind, name, json!({})).await;
    tx.commit().await?;

    Ok(DeleteResult {
@@ -240,6 +240,7 @@ async fn delete_bulk(
        .await?;
        crate::audit::log_tx(
            &mut tx,
+            user_id,
            "delete",
            namespace,
            &row.kind,
--- a/crates/secrets-core/src/service/mod.rs
+++ b/crates/secrets-core/src/service/mod.rs
@@ -1,5 +1,6 @@
 pub mod add;
 pub mod api_key;
+pub mod audit_log;
 pub mod delete;
 pub mod env_map;
 pub mod export;
--- a/crates/secrets-core/src/service/rollback.rs
+++ b/crates/secrets-core/src/service/rollback.rs
@@ -274,6 +274,7 @@ pub async fn run(

    crate::audit::log_tx(
        &mut tx,
+        user_id,
        "rollback",
        namespace,
        kind,
--- a/crates/secrets-core/src/service/update.rs
+++ b/crates/secrets-core/src/service/update.rs
@@ -241,6 +241,7 @@ pub async fn run(

    crate::audit::log_tx(
        &mut tx,
+        params.user_id,
        "update",
        params.namespace,
        params.kind,
--- a/crates/secrets-mcp/Cargo.toml
+++ b/crates/secrets-mcp/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "secrets-mcp"
-version = "0.1.6"
+version = "0.1.7"
 edition.workspace = true

 [[bin]]
--- a/crates/secrets-mcp/src/auth.rs
+++ b/crates/secrets-mcp/src/auth.rs
@@ -9,7 +9,6 @@ use axum::{
 use sqlx::PgPool;
 use uuid::Uuid;

-use secrets_core::audit::log_login;
 use secrets_core::service::api_key::validate_api_key;

 /// Injected into request extensions after Bearer token validation.
@@ -35,15 +34,6 @@ fn log_client_ip(req: &Request) -> Option<String> {
        .map(|c| c.ip().to_string())
 }

-fn log_user_agent(req: &Request) -> Option<String> {
-    req.headers()
-        .get(axum::http::header::USER_AGENT)
-        .and_then(|v| v.to_str().ok())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .map(ToOwned::to_owned)
-}
-
 /// Axum middleware that validates Bearer API keys for the /mcp route.
 /// Passes all non-MCP paths through without authentication.
 pub async fn bearer_auth_middleware(
@@ -54,7 +44,6 @@ pub async fn bearer_auth_middleware(
    let path = req.uri().path();
    let method = req.method().as_str();
    let client_ip = log_client_ip(&req);
-    let user_agent = log_user_agent(&req);

    // Only authenticate /mcp paths
    if !path.starts_with("/mcp") {
@@ -95,15 +84,6 @@ pub async fn bearer_auth_middleware(

    match validate_api_key(&pool, raw_key).await {
        Ok(Some(user_id)) => {
-            log_login(
-                &pool,
-                "api_key",
-                "bearer",
-                user_id,
-                client_ip.as_deref(),
-                user_agent.as_deref(),
-            )
-            .await;
            tracing::debug!(?user_id, "api key authenticated");
            let mut req = req;
            req.extensions_mut().insert(AuthUser { user_id });
--- a/crates/secrets-mcp/src/web.rs
+++ b/crates/secrets-mcp/src/web.rs
@@ -17,6 +17,7 @@ use secrets_core::audit::log_login;
 use secrets_core::crypto::hex;
 use secrets_core::service::{
    api_key::{ensure_api_key, regenerate_api_key},
+    audit_log::list_for_user,
    user::{
        OAuthProfile, bind_oauth_account, find_or_create_user, get_user_by_id,
        unbind_oauth_account, update_user_key_setup,
@@ -50,6 +51,22 @@ struct DashboardTemplate {
    version: &'static str,
 }

+#[derive(Template)]
+#[template(path = "audit.html")]
+struct AuditPageTemplate {
+    user_name: String,
+    user_email: String,
+    entries: Vec<AuditEntryView>,
+    version: &'static str,
+}
+
+struct AuditEntryView {
+    created_at: String,
+    action: String,
+    target: String,
+    detail: String,
+}
+
 // ── App state helpers ─────────────────────────────────────────────────────────

 fn google_cfg(state: &AppState) -> Option<&OAuthConfig> {
@@ -103,6 +120,7 @@ pub fn web_router() -> Router<AppState> {
        .route("/auth/google/callback", get(auth_google_callback))
        .route("/auth/logout", post(auth_logout))
        .route("/dashboard", get(dashboard))
+        .route("/audit", get(audit_page))
        .route("/account/bind/google", get(account_bind_google))
        .route(
            "/account/bind/google/callback",
@@ -364,6 +382,49 @@ async fn dashboard(
    render_template(tmpl)
 }

+async fn audit_page(
+    State(state): State<AppState>,
+    session: Session,
+) -> Result<Response, StatusCode> {
+    let Some(user_id) = current_user_id(&session).await else {
+        return Ok(Redirect::to("/").into_response());
+    };
+
+    let user = match get_user_by_id(&state.pool, user_id)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    {
+        Some(u) => u,
+        None => return Ok(Redirect::to("/").into_response()),
+    };
+
+    let rows = list_for_user(&state.pool, user_id, 100)
+        .await
+        .map_err(|e| {
+            tracing::error!(error = %e, "failed to load audit log for user");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    let entries = rows
+        .into_iter()
+        .map(|row| AuditEntryView {
+            created_at: row.created_at.format("%Y-%m-%d %H:%M:%S UTC").to_string(),
+            action: row.action,
+            target: format_audit_target(&row.namespace, &row.kind, &row.name),
+            detail: serde_json::to_string_pretty(&row.detail).unwrap_or_else(|_| "{}".to_string()),
+        })
+        .collect();
+
+    let tmpl = AuditPageTemplate {
+        user_name: user.name.clone(),
+        user_email: user.email.clone().unwrap_or_default(),
+        entries,
+        version: env!("CARGO_PKG_VERSION"),
+    };
+
+    render_template(tmpl)
+}
+
 // ── Account bind/unbind ───────────────────────────────────────────────────────

 async fn account_bind_google(
@@ -577,3 +638,11 @@ fn render_template<T: Template>(tmpl: T) -> Result<Response, StatusCode> {
    })?;
    Ok(Html(html).into_response())
 }
+
+fn format_audit_target(namespace: &str, kind: &str, name: &str) -> String {
+    if namespace == "auth" {
+        format!("{}/{}", kind, name)
+    } else {
+        format!("[{}/{}] {}", namespace, kind, name)
+    }
+}
--- a/crates/secrets-mcp/templates/audit.html
+++ b/crates/secrets-mcp/templates/audit.html
@@ -0,0 +1,142 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <link rel="icon" href="/favicon.svg?v={{ version }}" type="image/svg+xml">
+    <title>Secrets — Audit</title>
+    <style>
+        *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+        @import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;600&family=Inter:wght@400;500;600&display=swap');
+        :root {
+            --bg: #0d1117; --surface: #161b22; --surface2: #21262d;
+            --border: #30363d; --text: #e6edf3; --text-muted: #8b949e;
+            --accent: #58a6ff; --accent-hover: #79b8ff;
+        }
+        body { background: var(--bg); color: var(--text); font-family: 'Inter', sans-serif; min-height: 100vh; }
+        .layout { display: flex; min-height: 100vh; }
+        .sidebar {
+            width: 220px; flex-shrink: 0; background: var(--surface); border-right: 1px solid var(--border);
+            padding: 24px 16px; display: flex; flex-direction: column; gap: 20px;
+        }
+        .sidebar-logo { font-family: 'JetBrains Mono', monospace; font-size: 16px; font-weight: 600;
+                        color: var(--text); text-decoration: none; padding: 0 10px; }
+        .sidebar-logo span { color: var(--accent); }
+        .sidebar-menu { display: flex; flex-direction: column; gap: 6px; }
+        .sidebar-link {
+            padding: 10px 12px; border-radius: 8px; color: var(--text-muted); text-decoration: none;
+            border: 1px solid transparent; font-size: 13px; font-weight: 500;
+        }
+        .sidebar-link:hover { background: var(--surface2); color: var(--text); }
+        .sidebar-link.active {
+            background: rgba(88,166,255,0.12); color: var(--text); border-color: rgba(88,166,255,0.35);
+        }
+        .content-shell { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+        .topbar {
+            background: var(--surface); border-bottom: 1px solid var(--border); padding: 0 24px;
+            display: flex; align-items: center; gap: 12px; min-height: 52px;
+        }
+        .topbar-spacer { flex: 1; }
+        .nav-user { font-size: 13px; color: var(--text-muted); }
+        .btn-sign-out {
+            padding: 5px 12px; border-radius: 6px; border: 1px solid var(--border);
+            background: none; color: var(--text); font-size: 12px; text-decoration: none; cursor: pointer;
+        }
+        .btn-sign-out:hover { background: var(--surface2); }
+        .main { padding: 32px 24px 40px; flex: 1; }
+        .card { background: var(--surface); border: 1px solid var(--border); border-radius: 12px;
+                padding: 24px; width: 100%; max-width: 1180px; margin: 0 auto; }
+        .card-title { font-size: 20px; font-weight: 600; margin-bottom: 8px; }
+        .card-subtitle { color: var(--text-muted); font-size: 13px; margin-bottom: 20px; }
+        .empty { color: var(--text-muted); font-size: 14px; padding: 20px 0; }
+        table { width: 100%; border-collapse: collapse; }
+        th, td { text-align: left; vertical-align: top; padding: 12px 10px; border-top: 1px solid var(--border); }
+        th { color: var(--text-muted); font-size: 12px; font-weight: 600; }
+        td { font-size: 13px; }
+        .mono { font-family: 'JetBrains Mono', monospace; }
+        .detail {
+            background: var(--bg); border: 1px solid var(--border); border-radius: 8px;
+            padding: 10px; white-space: pre-wrap; word-break: break-word; font-size: 12px;
+            max-width: 460px;
+        }
+        @media (max-width: 900px) {
+            .layout { flex-direction: column; }
+            .sidebar {
+                width: 100%; border-right: none; border-bottom: 1px solid var(--border);
+                padding: 16px; gap: 14px;
+            }
+            .sidebar-menu { flex-direction: row; }
+            .sidebar-link { flex: 1; text-align: center; }
+            .main { padding: 20px 12px 28px; }
+            .card { padding: 16px; }
+            .topbar { padding: 12px 16px; flex-wrap: wrap; }
+            table, thead, tbody, th, td, tr { display: block; }
+            thead { display: none; }
+            tr { border-top: 1px solid var(--border); padding: 12px 0; }
+            td { border-top: none; padding: 6px 0; }
+            td::before {
+                display: block; color: var(--text-muted); font-size: 11px;
+                margin-bottom: 4px; text-transform: uppercase;
+            }
+            td.col-time::before { content: "Time"; }
+            td.col-action::before { content: "Action"; }
+            td.col-target::before { content: "Target"; }
+            td.col-detail::before { content: "Detail"; }
+            .detail { max-width: none; }
+        }
+    </style>
+</head>
+<body>
+<div class="layout">
+<aside class="sidebar">
+    <a href="/dashboard" class="sidebar-logo"><span>secrets</span></a>
+    <nav class="sidebar-menu">
+        <a href="/dashboard" class="sidebar-link">MCP</a>
+        <a href="/audit" class="sidebar-link active">审计</a>
+    </nav>
+</aside>
+
+<div class="content-shell">
+<div class="topbar">
+    <span class="topbar-spacer"></span>
+    <span class="nav-user">{{ user_name }}{% if !user_email.is_empty() %} · {{ user_email }}{% endif %}</span>
+    <form action="/auth/logout" method="post" style="display:inline">
+        <button type="submit" class="btn-sign-out">退出</button>
+    </form>
+</div>
+
+<main class="main">
+    <section class="card">
+        <div class="card-title">我的审计</div>
+        <div class="card-subtitle">展示最近 100 条与当前用户相关的新审计记录。</div>
+
+        {% if entries.is_empty() %}
+        <div class="empty">暂无审计记录。</div>
+        {% else %}
+        <table>
+            <thead>
+                <tr>
+                    <th>时间</th>
+                    <th>动作</th>
+                    <th>目标</th>
+                    <th>详情</th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for entry in entries %}
+                <tr>
+                    <td class="col-time mono">{{ entry.created_at }}</td>
+                    <td class="col-action mono">{{ entry.action }}</td>
+                    <td class="col-target mono">{{ entry.target }}</td>
+                    <td class="col-detail"><pre class="detail">{{ entry.detail }}</pre></td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        {% endif %}
+    </section>
+</main>
+</div>
+</div>
+</body>
+</html>
--- a/crates/secrets-mcp/templates/dashboard.html
+++ b/crates/secrets-mcp/templates/dashboard.html
@@ -16,13 +16,29 @@
        }
        body { background: var(--bg); color: var(--text); font-family: 'Inter', sans-serif; min-height: 100vh; }

-        /* Nav */
-        .nav { background: var(--surface); border-bottom: 1px solid var(--border);
-               padding: 0 24px; display: flex; align-items: center; gap: 12px; height: 52px; }
-        .nav-logo { font-family: 'JetBrains Mono', monospace; font-size: 15px; font-weight: 600;
-                    color: var(--text); text-decoration: none; }
-        .nav-logo span { color: var(--accent); }
-        .nav-spacer { flex: 1; }
+        .layout { display: flex; min-height: 100vh; }
+        .sidebar {
+            width: 220px; flex-shrink: 0; background: var(--surface); border-right: 1px solid var(--border);
+            padding: 24px 16px; display: flex; flex-direction: column; gap: 20px;
+        }
+        .sidebar-logo { font-family: 'JetBrains Mono', monospace; font-size: 16px; font-weight: 600;
+                        color: var(--text); text-decoration: none; padding: 0 10px; }
+        .sidebar-logo span { color: var(--accent); }
+        .sidebar-menu { display: flex; flex-direction: column; gap: 6px; }
+        .sidebar-link {
+            padding: 10px 12px; border-radius: 8px; color: var(--text-muted); text-decoration: none;
+            border: 1px solid transparent; font-size: 13px; font-weight: 500;
+        }
+        .sidebar-link:hover { background: var(--surface2); color: var(--text); }
+        .sidebar-link.active {
+            background: rgba(88,166,255,0.12); color: var(--text); border-color: rgba(88,166,255,0.35);
+        }
+        .content-shell { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+        .topbar {
+            background: var(--surface); border-bottom: 1px solid var(--border); padding: 0 24px;
+            display: flex; align-items: center; gap: 12px; min-height: 52px;
+        }
+        .topbar-spacer { flex: 1; }
        .nav-user { font-size: 13px; color: var(--text-muted); }
        .lang-bar { display: flex; gap: 2px; background: var(--surface2); border-radius: 6px; padding: 2px; }
        .lang-btn { padding: 3px 9px; border: none; background: none; color: var(--text-muted);
@@ -32,11 +48,19 @@
                        background: none; color: var(--text); font-size: 12px; cursor: pointer; }
        .btn-sign-out:hover { background: var(--surface2); }

-        /* Main: column so footer can sit at bottom of viewport when content is short */
+        /* Main content column */
        .main { display: flex; flex-direction: column; align-items: center;
-                padding: 48px 24px 24px; min-height: calc(100vh - 52px); }
+                padding: 24px 20px 8px; min-height: 0; }
+        .app-footer {
+            margin-top: auto;
+            text-align: center;
+            padding: 4px 20px 12px;
+            font-size: 12px;
+            color: #9da7b3;
+            font-family: 'JetBrains Mono', monospace;
+        }
        .card { background: var(--surface); border: 1px solid var(--border); border-radius: 12px;
-                padding: 32px; width: 100%; max-width: 980px; }
+                padding: 24px; width: 100%; max-width: 980px; }
        .card-title { font-size: 18px; font-weight: 600; margin-bottom: 24px; }
        /* Form */
        .field { margin-bottom: 12px; }
@@ -123,28 +147,40 @@
                            background: none; color: var(--text); font-size: 13px; cursor: pointer; }
        .btn-modal-cancel:hover { background: var(--surface2); }

-        @media (max-width: 720px) {
-            .config-tabs { grid-template-columns: 1fr; }
+        @media (max-width: 900px) {
+            .layout { flex-direction: column; }
+            .sidebar {
+                width: 100%; border-right: none; border-bottom: 1px solid var(--border);
+                padding: 16px; gap: 14px;
+            }
+            .sidebar-menu { flex-direction: row; }
+            .sidebar-link { flex: 1; text-align: center; }
        }

-        .app-footer {
-            margin-top: auto;
-            width: 100%;
-            max-width: 980px;
-            flex-shrink: 0;
-            text-align: center;
-            padding-top: 28px;
-            font-size: 12px;
-            color: #9da7b3;
-            font-family: 'JetBrains Mono', monospace;
+        @media (max-width: 720px) {
+            .config-tabs { grid-template-columns: 1fr; }
+            .topbar { padding: 12px 16px; flex-wrap: wrap; }
+            .main { padding: 16px 12px 6px; }
+            .app-footer { padding: 4px 12px 10px; }
+            .card { padding: 18px; }
        }
+
    </style>
 </head>
 <body data-has-passphrase="{{ has_passphrase }}" data-base-url="{{ base_url }}">

-<nav class="nav">
-    <a href="/dashboard" class="nav-logo"><span>secrets</span></a>
-    <span class="nav-spacer"></span>
+<div class="layout">
+<aside class="sidebar">
+    <a href="/dashboard" class="sidebar-logo"><span>secrets</span></a>
+    <nav class="sidebar-menu">
+        <a href="/dashboard" class="sidebar-link active">MCP</a>
+        <a href="/audit" class="sidebar-link">审计</a>
+    </nav>
+</aside>
+
+<div class="content-shell">
+<div class="topbar">
+    <span class="topbar-spacer"></span>
    <span class="nav-user">{{ user_name }}{% if !user_email.is_empty() %} · {{ user_email }}{% endif %}</span>
    <div class="lang-bar">
        <button class="lang-btn" onclick="setLang('zh-CN')">简</button>
@@ -154,7 +190,7 @@
    <form action="/auth/logout" method="post" style="display:inline">
        <button type="submit" class="btn-sign-out" data-i18n="signOut">退出</button>
    </form>
-</nav>
+</div>

 <div class="main">
 <div class="card">
@@ -258,9 +294,11 @@
    </div>

 </div>
-
+</div>
 <footer class="app-footer">{{ version }}</footer>
 </div>
+</div>
+</div>

 <!-- ── Change passphrase modal ──────────────────────────────────────────────── -->
 <div class="modal-bd" id="change-modal">
--- a/scripts/release-check.sh
+++ b/scripts/release-check.sh
@@ -12,12 +12,13 @@ echo "==> 当前 secrets-mcp 版本: ${version}"
 echo "==> 检查是否已存在 tag: ${tag}"

 if git rev-parse "refs/tags/${tag}" >/dev/null 2>&1; then
-  echo "错误: 已存在 tag ${tag}"
-  echo "请先 bump crates/secrets-mcp/Cargo.toml 中的 version，再执行 cargo build 同步 Cargo.lock。"
-  exit 1
+  echo "提示: 已存在 tag ${tag}，将按重复构建处理，不阻断检查。"
+  echo "如需创建新的发布版本，请先 bump crates/secrets-mcp/Cargo.toml 中的 version。"
+else
+  echo "==> 未发现重复 tag，将创建新版本"
 fi

-echo "==> 未发现重复 tag，开始执行检查"
+echo "==> 开始执行检查"
 cargo fmt -- --check
 cargo clippy --locked -- -D warnings
 cargo test --locked