Add files via upload

internal/app/app.go

@@ -96,6 +96,7 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 	}
 
 	auditSvc := audit.NewService(db, cfg, log.Logger)
+	audit.RegisterConversationCreateHook(auditSvc)
 	auditSvc.PurgeExpired()
 	audit.StartRetentionLoop(auditSvc, log.Logger)
 

internal/audit/conversation_create.go

@@ -0,0 +1,55 @@
+package audit
+
+import (
+	"strings"
+
+	"cyberstrike-ai/internal/database"
+	"cyberstrike-ai/internal/security"
+
+	"github.com/gin-gonic/gin"
+)
+
+// RegisterConversationCreateHook records platform audit rows for every new conversation.
+func RegisterConversationCreateHook(s *Service) {
+	if s == nil {
+		return
+	}
+	database.SetConversationCreateHook(func(conv *database.Conversation, meta database.ConversationCreateMeta) {
+		detail := map[string]interface{}{
+			"title":  conv.Title,
+			"source": meta.Source,
+		}
+		if meta.WebShellConnectionID != "" {
+			detail["webshell_connection_id"] = meta.WebShellConnectionID
+		}
+		s.Record(nil, Entry{
+			Category:     "conversation",
+			Action:       "create",
+			Result:       "success",
+			Message:      "创建对话",
+			ResourceType: "conversation",
+			ResourceID:   conv.ID,
+			Detail:       detail,
+			ClientIP:     meta.ClientIP,
+			SessionHint:  meta.SessionHint,
+		})
+	})
+}
+
+// ConversationCreateMeta builds audit metadata for conversation creation.
+func ConversationCreateMeta(source string) database.ConversationCreateMeta {
+	return database.ConversationCreateMeta{Source: strings.TrimSpace(source)}
+}
+
+// ConversationCreateMetaFromGin includes client IP and session hint when available.
+func ConversationCreateMetaFromGin(c *gin.Context, source string) database.ConversationCreateMeta {
+	m := ConversationCreateMeta(source)
+	if c == nil {
+		return m
+	}
+	m.ClientIP = c.ClientIP()
+	if token := c.GetString(security.ContextAuthTokenKey); token != "" {
+		m.SessionHint = sessionHint(token)
+	}
+	return m
+}

internal/audit/resource_availability.go

@@ -0,0 +1,86 @@
+package audit
+
+import (
+	"strings"
+
+	"cyberstrike-ai/internal/database"
+)
+
+var auditActionsResourceRemoved = map[string]bool{
+	"delete":                  true,
+	"item_delete":             true,
+	"connection_delete":       true,
+	"listener_delete":         true,
+	"session_delete":          true,
+	"task_delete":             true,
+	"execution_delete":        true,
+	"execution_delete_batch":  true,
+	"delete_queue":            true,
+	"delete_batch_task":       true,
+	"markdown_delete":         true,
+}
+
+// ApplyResourceAvailability sets log.ResourceAvailable when the linked resource can be checked.
+func ApplyResourceAvailability(db *database.DB, log *database.AuditLog) {
+	if log == nil || strings.TrimSpace(log.ResourceID) == "" {
+		return
+	}
+	if auditActionsResourceRemoved[log.Action] {
+		f := false
+		log.ResourceAvailable = &f
+		return
+	}
+	if db == nil {
+		return
+	}
+	available, known := resourceStillExists(db, log.ResourceType, log.ResourceID)
+	if known {
+		log.ResourceAvailable = &available
+	}
+}
+
+func resourceStillExists(db *database.DB, resourceType, resourceID string) (bool, bool) {
+	resourceID = strings.TrimSpace(resourceID)
+	if resourceID == "" {
+		return false, false
+	}
+	t := strings.TrimSpace(resourceType)
+	if t == "" {
+		if len(resourceID) > 8 && !strings.HasPrefix(resourceID, "c2_") {
+			t = "conversation"
+		} else {
+			return false, false
+		}
+	}
+	switch t {
+	case "conversation":
+		ok, err := db.ConversationExists(resourceID)
+		return ok, err == nil
+	case "vulnerability":
+		_, err := db.GetVulnerability(resourceID)
+		if err != nil {
+			return false, strings.Contains(err.Error(), "不存在")
+		}
+		return true, true
+	case "batch_queue":
+		_, err := db.GetBatchQueue(resourceID)
+		return err == nil, true
+	case "c2_listener":
+		_, err := db.GetC2Listener(resourceID)
+		return err == nil, true
+	case "c2_session":
+		_, err := db.GetC2Session(resourceID)
+		return err == nil, true
+	case "c2_task":
+		_, err := db.GetC2Task(resourceID)
+		return err == nil, true
+	case "webshell_connection":
+		c, err := db.GetWebshellConnection(resourceID)
+		return err == nil && c != nil, true
+	case "tool_execution":
+		_, err := db.GetToolExecution(resourceID)
+		return err == nil, true
+	default:
+		return false, false
+	}
+}

internal/audit/retention.go

@@ -6,13 +6,16 @@ import (
 	"go.uber.org/zap"
 )
 
+// auditRetentionPurgeInterval is how often PurgeExpired runs while the process is up (startup also purges once).
+const auditRetentionPurgeInterval = time.Hour
+
 // StartRetentionLoop periodically purges expired audit rows.
 func StartRetentionLoop(s *Service, logger *zap.Logger) {
 	if s == nil {
 		return
 	}
 	go func() {
-		ticker := time.NewTicker(24 * time.Hour)
+		ticker := time.NewTicker(auditRetentionPurgeInterval)
 		defer ticker.Stop()
 		for range ticker.C {
 			s.PurgeExpired()

internal/audit/service.go

@@ -65,14 +65,20 @@ func (s *Service) Record(c *gin.Context, e Entry) {
 	if strings.TrimSpace(e.Actor) == "" {
 		e.Actor = "admin"
 	}
-	if e.SessionHint == "" && c != nil {
-		if token := c.GetString(security.ContextAuthTokenKey); token != "" {
-			e.SessionHint = sessionHint(token)
-		}
-	}
 	maxDetail := s.cfg.Audit.MaxDetailBytesEffective()
 	detail := SanitizeDetail(e.Detail, maxDetail)
 
+	sessionHintVal := e.SessionHint
+	if sessionHintVal == "" && c != nil {
+		if token := c.GetString(security.ContextAuthTokenKey); token != "" {
+			sessionHintVal = sessionHint(token)
+		}
+	}
+	clientIPVal := e.ClientIP
+	if clientIPVal == "" {
+		clientIPVal = clientIP(c)
+	}
+
 	row := &database.AuditLog{
 		ID:           "audit_" + strings.ReplaceAll(uuid.New().String(), "-", ""),
 		CreatedAt:    time.Now(),
@@ -81,8 +87,8 @@ func (s *Service) Record(c *gin.Context, e Entry) {
 		Action:       e.Action,
 		Result:       e.Result,
 		Actor:        e.Actor,
-		SessionHint:  e.SessionHint,
-		ClientIP:     clientIP(c),
+		SessionHint:  sessionHintVal,
+		ClientIP:     clientIPVal,
 		UserAgent:    userAgent(c),
 		ResourceType: e.ResourceType,
 		ResourceID:   e.ResourceID,

internal/audit/types.go

@@ -11,5 +11,6 @@ type Entry struct {
 	ResourceType string
 	ResourceID   string
 	Message      string
-	Detail       map[string]interface{}
+	Detail   map[string]interface{}
+	ClientIP string // optional when c is nil (robot, batch, DB hook)
 }

internal/handler/agent.go

@@ -560,7 +560,7 @@ func (h *AgentHandler) AgentLoop(c *gin.Context) {
 	conversationID := req.ConversationID
 	if conversationID == "" {
 		title := safeTruncateString(req.Message, 50)
-		conv, err := h.db.CreateConversation(title)
+		conv, err := h.db.CreateConversation(title, audit.ConversationCreateMetaFromGin(c, "agent_loop"))
 		if err != nil {
 			h.logger.Error("创建对话失败", zap.Error(err))
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
@@ -725,10 +725,14 @@ func (h *AgentHandler) AgentLoop(c *gin.Context) {
 }
 
 // ProcessMessageForRobot 供机器人（企业微信/钉钉/飞书）调用：与 /api/agent-loop/stream 相同执行路径（含 progressCallback、过程详情），仅不发送 SSE，最后返回完整回复
-func (h *AgentHandler) ProcessMessageForRobot(ctx context.Context, conversationID, message, role string) (response string, convID string, err error) {
+func (h *AgentHandler) ProcessMessageForRobot(ctx context.Context, platform, conversationID, message, role string) (response string, convID string, err error) {
 	if conversationID == "" {
 		title := safeTruncateString(message, 50)
-		conv, createErr := h.db.CreateConversation(title)
+		src := "robot"
+		if strings.TrimSpace(platform) != "" {
+			src = "robot:" + strings.TrimSpace(platform)
+		}
+		conv, createErr := h.db.CreateConversation(title, audit.ConversationCreateMeta(src))
 		if createErr != nil {
 			return "", "", fmt.Errorf("创建对话失败: %w", createErr)
 		}
@@ -1427,10 +1431,12 @@ func (h *AgentHandler) AgentLoopStream(c *gin.Context) {
 		title := safeTruncateString(req.Message, 50)
 		var conv *database.Conversation
 		var err error
+		meta := audit.ConversationCreateMetaFromGin(c, "agent_loop_stream")
 		if req.WebShellConnectionID != "" {
-			conv, err = h.db.CreateConversationWithWebshell(strings.TrimSpace(req.WebShellConnectionID), title)
+			meta.Source = "webshell_chat"
+			conv, err = h.db.CreateConversationWithWebshell(strings.TrimSpace(req.WebShellConnectionID), title, meta)
 		} else {
-			conv, err = h.db.CreateConversation(title)
+			conv, err = h.db.CreateConversation(title, meta)
 		}
 		if err != nil {
 			h.logger.Error("创建对话失败", zap.Error(err))
@@ -2559,7 +2565,7 @@ func (h *AgentHandler) executeBatchQueue(queueID string) {
 
 		// 创建新对话
 		title := safeTruncateString(task.Message, 50)
-		conv, err := h.db.CreateConversation(title)
+		conv, err := h.db.CreateConversation(title, audit.ConversationCreateMeta("batch_task"))
 		var conversationID string
 		if err != nil {
 			h.logger.Error("创建对话失败", zap.String("queueId", queueID), zap.String("taskId", task.ID), zap.Error(err))

internal/handler/audit.go

@@ -116,6 +116,7 @@ func (h *AuditHandler) GetLog(c *gin.Context) {
 		c.JSON(http.StatusNotFound, gin.H{"error": "审计记录不存在"})
 		return
 	}
+	audit.ApplyResourceAvailability(h.db, row)
 	c.JSON(http.StatusOK, gin.H{"log": row})
 }
 

internal/handler/conversation.go

@@ -49,7 +49,7 @@ func (h *ConversationHandler) CreateConversation(c *gin.Context) {
 		title = "新对话"
 	}
 
-	conv, err := h.db.CreateConversation(title)
+	conv, err := h.db.CreateConversation(title, audit.ConversationCreateMetaFromGin(c, "api"))
 	if err != nil {
 		h.logger.Error("创建对话失败", zap.Error(err))
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})

internal/handler/eino_single_agent.go

@@ -90,7 +90,7 @@ func (h *AgentHandler) EinoSingleAgentLoopStream(c *gin.Context) {
 		zap.String("conversationId", req.ConversationID),
 	)
 
-	prep, err := h.prepareMultiAgentSession(&req)
+	prep, err := h.prepareMultiAgentSession(&req, c, "eino_agent_stream")
 	if err != nil {
 		sendEvent("error", err.Error(), nil)
 		sendEvent("done", "", nil)
@@ -326,7 +326,7 @@ func (h *AgentHandler) EinoSingleAgentLoop(c *gin.Context) {
 
 	h.logger.Info("收到 Eino ADK 单代理非流式请求", zap.String("conversationId", req.ConversationID))
 
-	prep, err := h.prepareMultiAgentSession(&req)
+	prep, err := h.prepareMultiAgentSession(&req, c, "eino_agent")
 	if err != nil {
 		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 		return

internal/handler/multi_agent.go

@@ -107,7 +107,7 @@ func (h *AgentHandler) MultiAgentLoopStream(c *gin.Context) {
 		zap.String("conversationId", req.ConversationID),
 	)
 
-	prep, err := h.prepareMultiAgentSession(&req)
+	prep, err := h.prepareMultiAgentSession(&req, c, "multi_agent_stream")
 	if err != nil {
 		sendEvent("error", err.Error(), nil)
 		sendEvent("done", "", nil)
@@ -347,7 +347,7 @@ func (h *AgentHandler) MultiAgentLoop(c *gin.Context) {
 
 	h.logger.Info("收到 Eino DeepAgent 非流式请求", zap.String("conversationId", req.ConversationID))
 
-	prep, err := h.prepareMultiAgentSession(&req)
+	prep, err := h.prepareMultiAgentSession(&req, c, "multi_agent")
 	if err != nil {
 		status, msg := multiAgentHTTPErrorStatus(err)
 		c.JSON(status, gin.H{"error": msg})

internal/handler/multi_agent_prepare.go

@@ -5,9 +5,11 @@ import (
 	"strings"
 
 	"cyberstrike-ai/internal/agent"
+	"cyberstrike-ai/internal/audit"
 	"cyberstrike-ai/internal/database"
 	"cyberstrike-ai/internal/mcp/builtin"
 
+	"github.com/gin-gonic/gin"
 	"go.uber.org/zap"
 )
 
@@ -22,7 +24,7 @@ type multiAgentPrepared struct {
 	UserMessageID      string
 }
 
-func (h *AgentHandler) prepareMultiAgentSession(req *ChatRequest) (*multiAgentPrepared, error) {
+func (h *AgentHandler) prepareMultiAgentSession(req *ChatRequest, c *gin.Context, source string) (*multiAgentPrepared, error) {
 	if len(req.Attachments) > maxAttachments {
 		return nil, fmt.Errorf("附件最多 %d 个", maxAttachments)
 	}
@@ -33,10 +35,13 @@ func (h *AgentHandler) prepareMultiAgentSession(req *ChatRequest) (*multiAgentPr
 		title := safeTruncateString(req.Message, 50)
 		var conv *database.Conversation
 		var err error
+		meta := audit.ConversationCreateMetaFromGin(c, source)
 		if strings.TrimSpace(req.WebShellConnectionID) != "" {
-			conv, err = h.db.CreateConversationWithWebshell(strings.TrimSpace(req.WebShellConnectionID), title)
+			meta.Source = source + "_webshell"
+			meta.WebShellConnectionID = strings.TrimSpace(req.WebShellConnectionID)
+			conv, err = h.db.CreateConversationWithWebshell(meta.WebShellConnectionID, title, meta)
 		} else {
-			conv, err = h.db.CreateConversation(title)
+			conv, err = h.db.CreateConversation(title, meta)
 		}
 		if err != nil {
 			return nil, fmt.Errorf("创建对话失败: %w", err)

internal/handler/robot.go

@@ -133,7 +133,7 @@ func (h *RobotHandler) getOrCreateConversation(platform, userID, title string) (
 	} else {
 		t = safeTruncateString(t, 50)
 	}
-	conv, err := h.db.CreateConversation(t)
+	conv, err := h.db.CreateConversation(t, database.ConversationCreateMeta{Source: "robot:" + platform})
 	if err != nil {
 		h.logger.Warn("创建机器人会话失败", zap.Error(err))
 		return "", false
@@ -188,7 +188,7 @@ func (h *RobotHandler) setRole(platform, userID, roleName string) {
 // clearConversation 清空当前会话（切换到新对话）
 func (h *RobotHandler) clearConversation(platform, userID string) (newConvID string) {
 	title := "新对话 " + time.Now().Format("01-02 15:04")
-	conv, err := h.db.CreateConversation(title)
+	conv, err := h.db.CreateConversation(title, database.ConversationCreateMeta{Source: "robot:" + platform + ":new"})
 	if err != nil {
 		h.logger.Warn("创建新对话失败", zap.Error(err))
 		return ""
@@ -242,7 +242,7 @@ func (h *RobotHandler) HandleMessage(platform, userID, text string) (reply strin
 		h.cancelMu.Unlock()
 	}()
 	role := h.getRole(platform, userID)
-	resp, newConvID, err := h.agentHandler.ProcessMessageForRobot(ctx, convID, text, role)
+	resp, newConvID, err := h.agentHandler.ProcessMessageForRobot(ctx, platform, convID, text, role)
 	if err != nil {
 		h.logger.Warn("机器人 Agent 执行失败", zap.String("platform", platform), zap.String("userID", userID), zap.Error(err))
 		if errors.Is(err, context.Canceled) {