feat(secrets-mcp): 审计页、audit_log user_id、OAuth 登录与仪表盘 footer

- audit_log 增加 user_id；业务写审计透传 user_id
- Web /audit 与侧边栏；Dashboard 版本 footer 贴底（margin-top: auto）
- 停止 API Key 鉴权成功写入登录审计
- 文档、CI、release-check 配套更新

Made-with: Cursor

crates/secrets-mcp/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "secrets-mcp"
-version = "0.1.6"
+version = "0.1.7"
 edition.workspace = true
 
 [[bin]]

crates/secrets-mcp/src/auth.rs

@@ -9,7 +9,6 @@ use axum::{
 use sqlx::PgPool;
 use uuid::Uuid;
 
-use secrets_core::audit::log_login;
 use secrets_core::service::api_key::validate_api_key;
 
 /// Injected into request extensions after Bearer token validation.
@@ -35,15 +34,6 @@ fn log_client_ip(req: &Request) -> Option<String> {
         .map(|c| c.ip().to_string())
 }
 
-fn log_user_agent(req: &Request) -> Option<String> {
-    req.headers()
-        .get(axum::http::header::USER_AGENT)
-        .and_then(|v| v.to_str().ok())
-        .map(str::trim)
-        .filter(|value| !value.is_empty())
-        .map(ToOwned::to_owned)
-}
-
 /// Axum middleware that validates Bearer API keys for the /mcp route.
 /// Passes all non-MCP paths through without authentication.
 pub async fn bearer_auth_middleware(
@@ -54,7 +44,6 @@ pub async fn bearer_auth_middleware(
     let path = req.uri().path();
     let method = req.method().as_str();
     let client_ip = log_client_ip(&req);
-    let user_agent = log_user_agent(&req);
 
     // Only authenticate /mcp paths
     if !path.starts_with("/mcp") {
@@ -95,15 +84,6 @@ pub async fn bearer_auth_middleware(
 
     match validate_api_key(&pool, raw_key).await {
         Ok(Some(user_id)) => {
-            log_login(
-                &pool,
-                "api_key",
-                "bearer",
-                user_id,
-                client_ip.as_deref(),
-                user_agent.as_deref(),
-            )
-            .await;
             tracing::debug!(?user_id, "api key authenticated");
             let mut req = req;
             req.extensions_mut().insert(AuthUser { user_id });

crates/secrets-mcp/src/web.rs

@@ -17,6 +17,7 @@ use secrets_core::audit::log_login;
 use secrets_core::crypto::hex;
 use secrets_core::service::{
     api_key::{ensure_api_key, regenerate_api_key},
+    audit_log::list_for_user,
     user::{
         OAuthProfile, bind_oauth_account, find_or_create_user, get_user_by_id,
         unbind_oauth_account, update_user_key_setup,
@@ -50,6 +51,22 @@ struct DashboardTemplate {
     version: &'static str,
 }
 
+#[derive(Template)]
+#[template(path = "audit.html")]
+struct AuditPageTemplate {
+    user_name: String,
+    user_email: String,
+    entries: Vec<AuditEntryView>,
+    version: &'static str,
+}
+
+struct AuditEntryView {
+    created_at: String,
+    action: String,
+    target: String,
+    detail: String,
+}
+
 // ── App state helpers ─────────────────────────────────────────────────────────
 
 fn google_cfg(state: &AppState) -> Option<&OAuthConfig> {
@@ -103,6 +120,7 @@ pub fn web_router() -> Router<AppState> {
         .route("/auth/google/callback", get(auth_google_callback))
         .route("/auth/logout", post(auth_logout))
         .route("/dashboard", get(dashboard))
+        .route("/audit", get(audit_page))
         .route("/account/bind/google", get(account_bind_google))
         .route(
             "/account/bind/google/callback",
@@ -364,6 +382,49 @@ async fn dashboard(
     render_template(tmpl)
 }
 
+async fn audit_page(
+    State(state): State<AppState>,
+    session: Session,
+) -> Result<Response, StatusCode> {
+    let Some(user_id) = current_user_id(&session).await else {
+        return Ok(Redirect::to("/").into_response());
+    };
+
+    let user = match get_user_by_id(&state.pool, user_id)
+        .await
+        .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?
+    {
+        Some(u) => u,
+        None => return Ok(Redirect::to("/").into_response()),
+    };
+
+    let rows = list_for_user(&state.pool, user_id, 100)
+        .await
+        .map_err(|e| {
+            tracing::error!(error = %e, "failed to load audit log for user");
+            StatusCode::INTERNAL_SERVER_ERROR
+        })?;
+
+    let entries = rows
+        .into_iter()
+        .map(|row| AuditEntryView {
+            created_at: row.created_at.format("%Y-%m-%d %H:%M:%S UTC").to_string(),
+            action: row.action,
+            target: format_audit_target(&row.namespace, &row.kind, &row.name),
+            detail: serde_json::to_string_pretty(&row.detail).unwrap_or_else(|_| "{}".to_string()),
+        })
+        .collect();
+
+    let tmpl = AuditPageTemplate {
+        user_name: user.name.clone(),
+        user_email: user.email.clone().unwrap_or_default(),
+        entries,
+        version: env!("CARGO_PKG_VERSION"),
+    };
+
+    render_template(tmpl)
+}
+
 // ── Account bind/unbind ───────────────────────────────────────────────────────
 
 async fn account_bind_google(
@@ -577,3 +638,11 @@ fn render_template<T: Template>(tmpl: T) -> Result<Response, StatusCode> {
     })?;
     Ok(Html(html).into_response())
 }
+
+fn format_audit_target(namespace: &str, kind: &str, name: &str) -> String {
+    if namespace == "auth" {
+        format!("{}/{}", kind, name)
+    } else {
+        format!("[{}/{}] {}", namespace, kind, name)
+    }
+}

crates/secrets-mcp/templates/audit.html

@@ -0,0 +1,142 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <link rel="icon" href="/favicon.svg?v={{ version }}" type="image/svg+xml">
+    <title>Secrets — Audit</title>
+    <style>
+        *, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+        @import url('https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;600&family=Inter:wght@400;500;600&display=swap');
+        :root {
+            --bg: #0d1117; --surface: #161b22; --surface2: #21262d;
+            --border: #30363d; --text: #e6edf3; --text-muted: #8b949e;
+            --accent: #58a6ff; --accent-hover: #79b8ff;
+        }
+        body { background: var(--bg); color: var(--text); font-family: 'Inter', sans-serif; min-height: 100vh; }
+        .layout { display: flex; min-height: 100vh; }
+        .sidebar {
+            width: 220px; flex-shrink: 0; background: var(--surface); border-right: 1px solid var(--border);
+            padding: 24px 16px; display: flex; flex-direction: column; gap: 20px;
+        }
+        .sidebar-logo { font-family: 'JetBrains Mono', monospace; font-size: 16px; font-weight: 600;
+                        color: var(--text); text-decoration: none; padding: 0 10px; }
+        .sidebar-logo span { color: var(--accent); }
+        .sidebar-menu { display: flex; flex-direction: column; gap: 6px; }
+        .sidebar-link {
+            padding: 10px 12px; border-radius: 8px; color: var(--text-muted); text-decoration: none;
+            border: 1px solid transparent; font-size: 13px; font-weight: 500;
+        }
+        .sidebar-link:hover { background: var(--surface2); color: var(--text); }
+        .sidebar-link.active {
+            background: rgba(88,166,255,0.12); color: var(--text); border-color: rgba(88,166,255,0.35);
+        }
+        .content-shell { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+        .topbar {
+            background: var(--surface); border-bottom: 1px solid var(--border); padding: 0 24px;
+            display: flex; align-items: center; gap: 12px; min-height: 52px;
+        }
+        .topbar-spacer { flex: 1; }
+        .nav-user { font-size: 13px; color: var(--text-muted); }
+        .btn-sign-out {
+            padding: 5px 12px; border-radius: 6px; border: 1px solid var(--border);
+            background: none; color: var(--text); font-size: 12px; text-decoration: none; cursor: pointer;
+        }
+        .btn-sign-out:hover { background: var(--surface2); }
+        .main { padding: 32px 24px 40px; flex: 1; }
+        .card { background: var(--surface); border: 1px solid var(--border); border-radius: 12px;
+                padding: 24px; width: 100%; max-width: 1180px; margin: 0 auto; }
+        .card-title { font-size: 20px; font-weight: 600; margin-bottom: 8px; }
+        .card-subtitle { color: var(--text-muted); font-size: 13px; margin-bottom: 20px; }
+        .empty { color: var(--text-muted); font-size: 14px; padding: 20px 0; }
+        table { width: 100%; border-collapse: collapse; }
+        th, td { text-align: left; vertical-align: top; padding: 12px 10px; border-top: 1px solid var(--border); }
+        th { color: var(--text-muted); font-size: 12px; font-weight: 600; }
+        td { font-size: 13px; }
+        .mono { font-family: 'JetBrains Mono', monospace; }
+        .detail {
+            background: var(--bg); border: 1px solid var(--border); border-radius: 8px;
+            padding: 10px; white-space: pre-wrap; word-break: break-word; font-size: 12px;
+            max-width: 460px;
+        }
+        @media (max-width: 900px) {
+            .layout { flex-direction: column; }
+            .sidebar {
+                width: 100%; border-right: none; border-bottom: 1px solid var(--border);
+                padding: 16px; gap: 14px;
+            }
+            .sidebar-menu { flex-direction: row; }
+            .sidebar-link { flex: 1; text-align: center; }
+            .main { padding: 20px 12px 28px; }
+            .card { padding: 16px; }
+            .topbar { padding: 12px 16px; flex-wrap: wrap; }
+            table, thead, tbody, th, td, tr { display: block; }
+            thead { display: none; }
+            tr { border-top: 1px solid var(--border); padding: 12px 0; }
+            td { border-top: none; padding: 6px 0; }
+            td::before {
+                display: block; color: var(--text-muted); font-size: 11px;
+                margin-bottom: 4px; text-transform: uppercase;
+            }
+            td.col-time::before { content: "Time"; }
+            td.col-action::before { content: "Action"; }
+            td.col-target::before { content: "Target"; }
+            td.col-detail::before { content: "Detail"; }
+            .detail { max-width: none; }
+        }
+    </style>
+</head>
+<body>
+<div class="layout">
+<aside class="sidebar">
+    <a href="/dashboard" class="sidebar-logo"><span>secrets</span></a>
+    <nav class="sidebar-menu">
+        <a href="/dashboard" class="sidebar-link">MCP</a>
+        <a href="/audit" class="sidebar-link active">审计</a>
+    </nav>
+</aside>
+
+<div class="content-shell">
+<div class="topbar">
+    <span class="topbar-spacer"></span>
+    <span class="nav-user">{{ user_name }}{% if !user_email.is_empty() %} · {{ user_email }}{% endif %}</span>
+    <form action="/auth/logout" method="post" style="display:inline">
+        <button type="submit" class="btn-sign-out">退出</button>
+    </form>
+</div>
+
+<main class="main">
+    <section class="card">
+        <div class="card-title">我的审计</div>
+        <div class="card-subtitle">展示最近 100 条与当前用户相关的新审计记录。</div>
+
+        {% if entries.is_empty() %}
+        <div class="empty">暂无审计记录。</div>
+        {% else %}
+        <table>
+            <thead>
+                <tr>
+                    <th>时间</th>
+                    <th>动作</th>
+                    <th>目标</th>
+                    <th>详情</th>
+                </tr>
+            </thead>
+            <tbody>
+                {% for entry in entries %}
+                <tr>
+                    <td class="col-time mono">{{ entry.created_at }}</td>
+                    <td class="col-action mono">{{ entry.action }}</td>
+                    <td class="col-target mono">{{ entry.target }}</td>
+                    <td class="col-detail"><pre class="detail">{{ entry.detail }}</pre></td>
+                </tr>
+                {% endfor %}
+            </tbody>
+        </table>
+        {% endif %}
+    </section>
+</main>
+</div>
+</div>
+</body>
+</html>

crates/secrets-mcp/templates/dashboard.html

@@ -16,13 +16,29 @@
         }
         body { background: var(--bg); color: var(--text); font-family: 'Inter', sans-serif; min-height: 100vh; }
 
-        /* Nav */
-        .nav { background: var(--surface); border-bottom: 1px solid var(--border);
-               padding: 0 24px; display: flex; align-items: center; gap: 12px; height: 52px; }
-        .nav-logo { font-family: 'JetBrains Mono', monospace; font-size: 15px; font-weight: 600;
-                    color: var(--text); text-decoration: none; }
-        .nav-logo span { color: var(--accent); }
-        .nav-spacer { flex: 1; }
+        .layout { display: flex; min-height: 100vh; }
+        .sidebar {
+            width: 220px; flex-shrink: 0; background: var(--surface); border-right: 1px solid var(--border);
+            padding: 24px 16px; display: flex; flex-direction: column; gap: 20px;
+        }
+        .sidebar-logo { font-family: 'JetBrains Mono', monospace; font-size: 16px; font-weight: 600;
+                        color: var(--text); text-decoration: none; padding: 0 10px; }
+        .sidebar-logo span { color: var(--accent); }
+        .sidebar-menu { display: flex; flex-direction: column; gap: 6px; }
+        .sidebar-link {
+            padding: 10px 12px; border-radius: 8px; color: var(--text-muted); text-decoration: none;
+            border: 1px solid transparent; font-size: 13px; font-weight: 500;
+        }
+        .sidebar-link:hover { background: var(--surface2); color: var(--text); }
+        .sidebar-link.active {
+            background: rgba(88,166,255,0.12); color: var(--text); border-color: rgba(88,166,255,0.35);
+        }
+        .content-shell { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+        .topbar {
+            background: var(--surface); border-bottom: 1px solid var(--border); padding: 0 24px;
+            display: flex; align-items: center; gap: 12px; min-height: 52px;
+        }
+        .topbar-spacer { flex: 1; }
         .nav-user { font-size: 13px; color: var(--text-muted); }
         .lang-bar { display: flex; gap: 2px; background: var(--surface2); border-radius: 6px; padding: 2px; }
         .lang-btn { padding: 3px 9px; border: none; background: none; color: var(--text-muted);
@@ -32,11 +48,19 @@
                         background: none; color: var(--text); font-size: 12px; cursor: pointer; }
         .btn-sign-out:hover { background: var(--surface2); }
 
-        /* Main: column so footer can sit at bottom of viewport when content is short */
+        /* Main content column */
         .main { display: flex; flex-direction: column; align-items: center;
-                padding: 48px 24px 24px; min-height: calc(100vh - 52px); }
+                padding: 24px 20px 8px; min-height: 0; }
+        .app-footer {
+            margin-top: auto;
+            text-align: center;
+            padding: 4px 20px 12px;
+            font-size: 12px;
+            color: #9da7b3;
+            font-family: 'JetBrains Mono', monospace;
+        }
         .card { background: var(--surface); border: 1px solid var(--border); border-radius: 12px;
-                padding: 32px; width: 100%; max-width: 980px; }
+                padding: 24px; width: 100%; max-width: 980px; }
         .card-title { font-size: 18px; font-weight: 600; margin-bottom: 24px; }
         /* Form */
         .field { margin-bottom: 12px; }
@@ -123,28 +147,40 @@
                             background: none; color: var(--text); font-size: 13px; cursor: pointer; }
         .btn-modal-cancel:hover { background: var(--surface2); }
 
-        @media (max-width: 720px) {
-            .config-tabs { grid-template-columns: 1fr; }
+        @media (max-width: 900px) {
+            .layout { flex-direction: column; }
+            .sidebar {
+                width: 100%; border-right: none; border-bottom: 1px solid var(--border);
+                padding: 16px; gap: 14px;
+            }
+            .sidebar-menu { flex-direction: row; }
+            .sidebar-link { flex: 1; text-align: center; }
         }
 
-        .app-footer {
-            margin-top: auto;
-            width: 100%;
-            max-width: 980px;
-            flex-shrink: 0;
-            text-align: center;
-            padding-top: 28px;
-            font-size: 12px;
-            color: #9da7b3;
-            font-family: 'JetBrains Mono', monospace;
+        @media (max-width: 720px) {
+            .config-tabs { grid-template-columns: 1fr; }
+            .topbar { padding: 12px 16px; flex-wrap: wrap; }
+            .main { padding: 16px 12px 6px; }
+            .app-footer { padding: 4px 12px 10px; }
+            .card { padding: 18px; }
         }
+
     </style>
 </head>
 <body data-has-passphrase="{{ has_passphrase }}" data-base-url="{{ base_url }}">
 
-<nav class="nav">
-    <a href="/dashboard" class="nav-logo"><span>secrets</span></a>
-    <span class="nav-spacer"></span>
+<div class="layout">
+<aside class="sidebar">
+    <a href="/dashboard" class="sidebar-logo"><span>secrets</span></a>
+    <nav class="sidebar-menu">
+        <a href="/dashboard" class="sidebar-link active">MCP</a>
+        <a href="/audit" class="sidebar-link">审计</a>
+    </nav>
+</aside>
+
+<div class="content-shell">
+<div class="topbar">
+    <span class="topbar-spacer"></span>
     <span class="nav-user">{{ user_name }}{% if !user_email.is_empty() %} · {{ user_email }}{% endif %}</span>
     <div class="lang-bar">
         <button class="lang-btn" onclick="setLang('zh-CN')">简</button>
@@ -154,7 +190,7 @@
     <form action="/auth/logout" method="post" style="display:inline">
         <button type="submit" class="btn-sign-out" data-i18n="signOut">退出</button>
     </form>
-</nav>
+</div>
 
 <div class="main">
 <div class="card">
@@ -258,9 +294,11 @@
     </div>
 
 </div>
-
+</div>
 <footer class="app-footer">{{ version }}</footer>
 </div>
+</div>
+</div>
 
 <!-- ── Change passphrase modal ──────────────────────────────────────────────── -->
 <div class="modal-bd" id="change-modal">