merge: 合并远程 ft_wyt 分支，解决权限与日志模块冲突

- 冲突解决原则：本地权限治理(require_admin/current_user/资源ACL)与远程 op_log 日志装饰器双向保留
- platform.py: 9 处冲突，@op_log 与管理员校验叠加，避免远程丢失 require_admin 的安全回归
- logging.py: 合并 get_client_ip 与 user_id_var，X-Trace-Id 优先 + ContextVar 卫生处理
- op_log.py: 采纳远程将变量计算上移到函数顶部的结构
- compute_poller.py: 中文日志 + 失败去重限流/断连重置逻辑
- data_process.py: 保留租户归属字段 + biz_logger 成功日志

backend/app/api/v1/endpoints/platform.py

@@ -913,6 +913,7 @@ async def _fine_tune_preflight_with_job_payload(
 
 
 @router.post("/login")
+@op_log(module=OpModule.SYSTEM, action=OpAction.LOGIN, target_type="user", target_name_param="username")
 async def login(payload: dict[str, Any] = Body(...), request: Request = None) -> dict[str, Any]:
     store = get_platform_store()
     ip = request.client.host if request and request.client else "unknown"
@@ -930,6 +931,7 @@ async def login(payload: dict[str, Any] = Body(...), request: Request = None) ->
 
 
 @router.post("/logout")
+@op_log(module=OpModule.SYSTEM, action=OpAction.LOGOUT, target_type="user")
 async def logout(payload: dict[str, Any] = Body(...), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     store = get_platform_store()
     session_id = payload.get("session_id", "")
@@ -1179,6 +1181,7 @@ async def users(current_user: dict = Depends(require_admin)) -> dict[str, Any]:
 
 
 @router.post("/users")
+@op_log(module=OpModule.SYSTEM, action=OpAction.CREATE, target_type="user", target_name_param="username")
 async def create_user(payload: dict[str, Any] = Body(...), current_user: dict = Depends(require_admin)) -> dict[str, Any]:
     payload = dict(payload)
     payload.setdefault("password", "123456")
@@ -1187,6 +1190,7 @@ async def create_user(payload: dict[str, Any] = Body(...), current_user: dict =
 
 
 @router.put("/users/{user_id}")
+@op_log(module=OpModule.SYSTEM, action=OpAction.UPDATE, target_type="user", target_name_param="user_id")
 async def update_user(user_id: str, payload: dict[str, Any] = Body(...), current_user: dict = Depends(require_admin)) -> dict[str, Any]:
     try:
         return ok(get_platform_store().update_user(user_id, payload))
@@ -1195,6 +1199,7 @@ async def update_user(user_id: str, payload: dict[str, Any] = Body(...), current
 
 
 @router.delete("/users/{user_id}")
+@op_log(module=OpModule.SYSTEM, action=OpAction.DELETE, target_type="user", target_name_param="user_id")
 async def delete_user(user_id: str, current_username: str | None = Query(default=None), current_user: dict = Depends(require_admin)) -> dict[str, Any]:
     try:
         get_platform_store().delete_user(user_id, deleted_by=str(current_user.get("id") or "system"))
@@ -1212,6 +1217,7 @@ async def delete_user(user_id: str, current_username: str | None = Query(default
 
 
 @router.post("/users/{user_id}/reset-password")
+@op_log(module=OpModule.SYSTEM, action=OpAction.UPDATE, target_type="user_password", target_name_param="user_id")
 async def reset_user_password(
     user_id: str,
     payload: dict[str, Any] = Body(default={}),
@@ -1228,6 +1234,7 @@ async def reset_user_password(
 
 
 @router.post("/users/me/password")
+@op_log(module=OpModule.SYSTEM, action=OpAction.UPDATE, target_type="user_password")
 async def change_my_password(
     payload: dict[str, Any] = Body(...),
     current_user: dict = Depends(get_current_user),
@@ -1310,6 +1317,7 @@ async def trained_models(current_user: dict = Depends(get_current_user)) -> dict
 
 
 @router.delete("/model-manage/trained-models/{model_id}")
+@op_log(module=OpModule.MODEL_MANAGE, action=OpAction.DELETE, target_type="trained_model", target_name_param="model_id")
 async def delete_trained_model(model_id: str, type: str = Query(default="merged"), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     if not has_resource_access("trained_model", model_id, current_user, "delete"):
         raise fail(403, "no permission to delete this trained model")
@@ -1424,6 +1432,7 @@ async def test_online_model(payload: dict[str, Any] = Body(...), current_user: d
 
 
 @router.post("/model-manage")
+@op_log(module=OpModule.MODEL_MANAGE, action=OpAction.CREATE, target_type="model", target_name_param="name")
 @audit_log(
     action=AuditActions.CREATE_MODEL,
     target_type="model",
@@ -1465,6 +1474,7 @@ async def model_detail(model_id: str, current_user: dict = Depends(get_current_u
 
 
 @router.put("/model-manage/{model_id}")
+@op_log(module=OpModule.MODEL_MANAGE, action=OpAction.UPDATE, target_type="model", target_name_param="model_id")
 @audit_log(
     action=AuditActions.UPDATE_MODEL,
     target_type="model",
@@ -1481,6 +1491,7 @@ async def update_model(model_id: str, payload: dict[str, Any] = Body(...), curre
 
 
 @router.put("/model-manage/{model_id}/purpose")
+@op_log(module=OpModule.MODEL_MANAGE, action=OpAction.UPDATE, target_type="model_purpose", target_name_param="model_id")
 async def update_model_purpose(model_id: str, payload: dict[str, Any] = Body(...), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     # 基座模型（配置模型）只有管理员可以修改用途
     if not is_admin(current_user):
@@ -1492,6 +1503,7 @@ async def update_model_purpose(model_id: str, payload: dict[str, Any] = Body(...
 
 
 @router.delete("/model-manage/{model_id}")
+@op_log(module=OpModule.MODEL_MANAGE, action=OpAction.DELETE, target_type="model", target_name_param="model_id")
 async def delete_model(model_id: str, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     # 基座模型（配置模型）只有管理员可以删除
     if not is_admin(current_user):
@@ -1691,6 +1703,7 @@ async def dataset_version_content(file_id: str, version_id: str, current_user: d
 
 
 @router.post("/dataset-manage/versions/{file_id}")
+@op_log(module=OpModule.DATASET, action=OpAction.CREATE, target_type="dataset_version", target_name_param="file_id")
 async def create_dataset_version(file_id: str, payload: dict[str, Any] = Body(...), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     try:
         store = get_platform_store()
@@ -1715,6 +1728,7 @@ async def activate_dataset_version(file_id: str, payload: dict[str, Any] = Body(
 
 
 @router.delete("/dataset-manage/versions/{file_id}/{version_id}")
+@op_log(module=OpModule.DATASET, action=OpAction.DELETE, target_type="dataset_version", target_name_param="version_id")
 async def delete_dataset_version(file_id: str, version_id: str, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     try:
         store = get_platform_store()
@@ -1913,6 +1927,7 @@ async def _sync_training_dataset_to_compute_node(
 
 
 @router.post("/dataset-manage/upload/{dataset_id}")
+@op_log(module=OpModule.DATASET, action=OpAction.UPLOAD, target_type="dataset_file", target_name_param="dataset_id")
 async def upload_dataset_files(
     dataset_id: str,
     files: list[UploadFile] = File(default=[]),
@@ -2080,6 +2095,7 @@ async def dataset_list(current_user: dict = Depends(get_current_user)) -> dict[s
 
 
 @router.post("/dataset-manage")
+@op_log(module=OpModule.DATASET, action=OpAction.CREATE, target_type="dataset", target_name_param="name")
 @audit_log(
     action=AuditActions.CREATE_DATASET,
     target_type="dataset",
@@ -2110,6 +2126,7 @@ async def dataset_detail(dataset_id: str, current_user: dict = Depends(get_curre
 
 
 @router.put("/dataset-manage/{dataset_id}")
+@op_log(module=OpModule.DATASET, action=OpAction.UPDATE, target_type="dataset", target_name_param="dataset_id")
 @audit_log(
     action=AuditActions.UPDATE_DATASET,
     target_type="dataset",
@@ -2175,6 +2192,7 @@ async def fine_tune_list(current_user: dict = Depends(get_current_user)) -> dict
 
 
 @router.post("/fine-tune")
+@op_log(module=OpModule.FINE_TUNE, action=OpAction.CREATE, target_type="fine_tune", target_name_param="name")
 @audit_log(
     action=AuditActions.CREATE_FINE_TUNE,
     target_type="fine_tune",
@@ -2418,6 +2436,7 @@ async def fine_tune_gpu_status(task_id: str, current_user: dict[str, Any] = Depe
 
 
 @router.put("/fine-tune/{task_id}")
+@op_log(module=OpModule.FINE_TUNE, action=OpAction.UPDATE, target_type="fine_tune", target_name_param="task_id")
 async def update_fine_tune(task_id: str, payload: dict[str, Any] = Body(...), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     if not has_resource_access("fine-tune", task_id, current_user, "write"):
         raise fail(403, "no permission to update this task")
@@ -2452,6 +2471,7 @@ async def stop_fine_tune_alt(task_id: str, current_user: dict = Depends(get_curr
 
 
 @router.post("/fine-tune/{task_id}/retry")
+@op_log(module=OpModule.FINE_TUNE, action=OpAction.RETRY, target_type="fine_tune", target_name_param="task_id")
 async def retry_fine_tune(task_id: str, payload: dict[str, Any] | None = Body(default=None), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     store = get_platform_store()
     payload = payload or {}
@@ -2883,6 +2903,7 @@ async def model_eval_start(payload: dict[str, Any] = Body(...), current_user: di
 
 
 @router.delete("/model-eval/{task_id}")
+@op_log(module=OpModule.MODEL_EVAL, action=OpAction.DELETE, target_type="eval_task", target_name_param="task_id")
 async def model_eval_delete(task_id: str, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     if not has_resource_access("eval", task_id, current_user, "delete"):
         raise fail(403, "no permission to delete this eval task")
@@ -2902,6 +2923,7 @@ async def dimension_list(current_user: dict = Depends(get_current_user)) -> dict
 
 
 @router.post("/dimension")
+@op_log(module=OpModule.MODEL_EVAL, action=OpAction.CREATE, target_type="dimension", target_name_param="name")
 async def dimension_create(payload: dict[str, Any] = Body(...), current_user: dict = Depends(require_admin)) -> dict[str, Any]:
     return ok(get_platform_store().create_dimension(payload))
 
@@ -2915,6 +2937,7 @@ async def dimension_detail(dimension_id: str, current_user: dict = Depends(get_c
 
 
 @router.put("/dimension/{dimension_id}")
+@op_log(module=OpModule.MODEL_EVAL, action=OpAction.UPDATE, target_type="dimension", target_name_param="dimension_id")
 async def dimension_update(dimension_id: str, payload: dict[str, Any] = Body(...), current_user: dict = Depends(require_admin)) -> dict[str, Any]:
     try:
         return ok(get_platform_store().update_dimension(dimension_id, payload))
@@ -2923,6 +2946,7 @@ async def dimension_update(dimension_id: str, payload: dict[str, Any] = Body(...
 
 
 @router.delete("/dimension/{dimension_id}")
+@op_log(module=OpModule.MODEL_EVAL, action=OpAction.DELETE, target_type="dimension", target_name_param="dimension_id")
 async def dimension_delete(dimension_id: str, current_user: dict = Depends(require_admin)) -> dict[str, Any]:
     get_platform_store().delete_dimension(dimension_id)
     return ok({"deleted": dimension_id})
@@ -2943,6 +2967,7 @@ async def model_compare_list(current_user: dict = Depends(get_current_user)) ->
 
 
 @router.post("/model-compare")
+@op_log(module=OpModule.INFERENCE, action=OpAction.CREATE, target_type="compare_task", target_name_param="name")
 async def model_compare_create(payload: dict[str, Any] = Body(...), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     bind_active_tenant(payload, current_user)
     payload.setdefault("created_by", current_user.get("id"))
@@ -3785,6 +3810,7 @@ async def compute_node_detail(node_id: str, current_user: dict = Depends(get_cur
 
 
 @router.post("/compute/nodes")
+@op_log(module=OpModule.COMPUTE, action=OpAction.CREATE, target_type="compute_node", target_name_param="name")
 async def create_compute_node(payload: dict[str, Any] = Body(...), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     if not is_admin(current_user):
         raise fail(403, "admin permission required")
@@ -3797,6 +3823,7 @@ async def create_compute_node(payload: dict[str, Any] = Body(...), current_user:
 
 
 @router.put("/compute/nodes/{node_id}")
+@op_log(module=OpModule.COMPUTE, action=OpAction.UPDATE, target_type="compute_node", target_name_param="node_id")
 async def update_compute_node(node_id: str, payload: dict[str, Any] = Body(...), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     if not is_admin(current_user):
         raise fail(403, "admin permission required")
@@ -3809,6 +3836,7 @@ async def update_compute_node(node_id: str, payload: dict[str, Any] = Body(...),
 
 
 @router.delete("/compute/nodes/{node_id}")
+@op_log(module=OpModule.COMPUTE, action=OpAction.DELETE, target_type="compute_node", target_name_param="node_id")
 async def delete_compute_node(node_id: str, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     if not is_admin(current_user):
         raise fail(403, "admin permission required")
@@ -4123,6 +4151,7 @@ async def compute_job_detail(job_id: str, current_user: dict = Depends(get_curre
 
 
 @router.post("/compute/jobs/{job_id}/stop")
+@op_log(module=OpModule.COMPUTE, action=OpAction.STOP, target_type="compute_job", target_name_param="job_id")
 async def compute_job_stop(job_id: str, current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     task = _task_for_compute_job(job_id)
     if task and not has_resource_access("fine-tune", task["id"], current_user, "write"):
@@ -4166,6 +4195,7 @@ async def compute_job_logs(
 
 
 @router.post("/compute/jobs/{job_id}/retry")
+@op_log(module=OpModule.COMPUTE, action=OpAction.RETRY, target_type="compute_job", target_name_param="job_id")
 async def compute_job_retry(job_id: str, payload: dict[str, Any] | None = Body(default=None), current_user: dict = Depends(get_current_user)) -> dict[str, Any]:
     store = get_platform_store()
     payload = payload or {}