feat: 支持审计日志，操作日志

chore: audit log first
chore: 火山vod 上传后等待3秒
2026-07-12 08:17:32 +08:00 · 2026-07-12 02:29:54 +08:00 · 2026-07-10 19:24:42 +08:00 · 2026-07-09 19:09:08 +08:00 · 2026-07-09 16:42:48 +08:00 · 2026-07-09 16:39:08 +08:00
139 changed files with 2799 additions and 1471 deletions
@@ -1,412 +0,0 @@
-# 插件依赖按需加载方案
-
-## 背景与目标
-
-### 当前问题
- `packages/ui/certd-server/node_modules` 包含 50+ 个插件的所有依赖，体积庞大
- 大量云厂商 SDK（AWS、阿里云、腾讯云、华为云等）只在特定插件中使用
- 用户通常只使用少数几个插件，但必须安装所有依赖
-
-### 目标
-实现依赖的按需下载和加载：
-1. 插件依赖独立管理，不占用主 `node_modules` 空间
-2. 只有当用户首次使用某插件时，才动态下载该插件需要的依赖
-3. 依赖安装完成后，通过 `await import()` 从独立路径加载
-4. 保持现有插件代码的最小改动
-
-## 当前架构分析
-
-### 插件加载机制
- 插件位于 `packages/ui/certd-server/src/plugins/` 下（50+ 个插件目录）
- `AutoLoadPlugins` 类在启动时扫描 `dist/plugins` 目录并动态导入
- 插件注册到不同的 registry：`accessRegistry`, `pluginRegistry`, `dnsProviderRegistry` 等
- 插件代码已经使用 `await import()` 进行懒加载（如 `await import("@aws-sdk/client-acm")`）
-
-### 重型依赖分布
-从 `packages/ui/certd-server/package.json` 分析，以下依赖体积大且仅特定插件使用：
-
-**云厂商 SDK（按插件分组）：**
- **AWS 插件**：`@aws-sdk/client-acm`, `@aws-sdk/client-cloudfront`, `@aws-sdk/client-iam`, `@aws-sdk/client-route-53`, `@aws-sdk/client-s3`, `@aws-sdk/client-sts`
- **阿里云插件**：`@alicloud/openapi-client`, `@alicloud/pop-core`, `@alicloud/tea-typescript`, `@alicloud/fc20230330` 等
- **腾讯云插件**：`tencentcloud-sdk-nodejs`, `cos-nodejs-sdk-v5`
- **华为云插件**：`@huaweicloud/huaweicloud-sdk-cdn`, `@huaweicloud/huaweicloud-sdk-core` 等
- **Azure 插件**：`@azure/arm-dns`, `@azure/identity`
- **Google Cloud 插件**：`@google-cloud/dns`, `@google-cloud/publicca`
- **火山引擎插件**：`@volcengine/openapi`, `@volcengine/tos-sdk`
-
-**网络/工具库：**
- `ssh2`, `socks`, `socks-proxy-agent`（SSH 相关插件）
- `ali-oss`, `qiniu`, `basic-ftp`（存储/传输插件）
- `nodemailer`（邮件通知插件）
-
-**通用依赖（保留在主 package.json）：**
- `@midwayjs/*` 系列（框架核心）
- `@certd/*` 系列（项目内部包）
- `axios`, `lodash-es`, `dayjs`, `js-yaml` 等基础工具
-
-## 设计方案
-
-### 架构概览
-
-```
-packages/ui/certd-server/
-├── package.json                    # 主依赖（框架、通用工具）
-├── node_modules/                   # 主依赖安装目录
-├── optional-deps/                  # 新增：可选依赖管理目录
-│   ├── package.json                # 可选依赖总配置（用于 pnpm install）
-│   ├── pnpm-lock.yaml              # 可选依赖锁文件
-│   └── node_modules/               # 可选依赖安装目录
-├── src/
-│   └── modules/
-│       └── dependency/             # 新增：依赖管理模块
-│           ├── dependency-manager.ts    # 核心：依赖管理器
-│           ├── dependency-registry.ts   # 依赖注册表（插件 -> 依赖映射）
-│           └── types.ts                 # 类型定义
-```
-
-### 核心组件
-
-#### 1. 依赖管理器（DependencyManager）
-
-**职责：**
- 检查依赖是否已安装
- 动态执行 `pnpm install` 安装缺失依赖
- 提供从 `optional-deps/node_modules` 加载依赖的方法
- 并发控制：避免多个插件同时触发安装
-
-**关键方法：**
-```typescript
-class DependencyManager {
-  // 确保依赖已安装，返回依赖模块
-  async ensureAndImport<T>(packageName: string): Promise<T>
-  
-  // 检查依赖是否已安装
-  async isInstalled(packageName: string): Promise<boolean>
-  
-  // 安装依赖（带锁，避免并发）
-  async installDependencies(packages: string[]): Promise<void>
-  
-  // 从 optional-deps/node_modules 加载依赖
-  async loadModule<T>(packageName: string): Promise<T>
-}
-```
-
-**实现要点：**
- 使用文件锁（如 `proper-lockfile`）防止并发安装
- 安装前检查 `optional-deps/node_modules/{packageName}` 是否存在
- 安装命令：`pnpm install --dir optional-deps --ignore-workspace`
- 加载时使用绝对路径：`import('file:///absolute/path/to/optional-deps/node_modules/package')`
-
-#### 2. 依赖注册表（DependencyRegistry）
-
-**职责：**
- 维护插件名称到依赖列表的映射
- 提供依赖查询接口
-
-**数据结构：**
-```typescript
-interface PluginDependencyConfig {
-  pluginName: string;
-  dependencies: {
-    packageName: string;
-    version: string;
-    optional?: boolean;  // 是否可选（安装失败不阻塞）
-  }[];
-}
-
-// 示例注册
-dependencyRegistry.register('plugin-aws', [
-  { packageName: '@aws-sdk/client-acm', version: '^3.964.0' },
-  { packageName: '@aws-sdk/client-cloudfront', version: '^3.964.0' },
-  { packageName: '@aws-sdk/client-route-53', version: '^3.964.0' },
-]);
-```
-
-#### 3. 插件集成
-
-**改造现有插件代码：**
-
-改造前（`plugin-aws/libs/aws-client.ts`）：
-```typescript
-const { ACMClient, ImportCertificateCommand } = await import("@aws-sdk/client-acm");
-```
-
-改造后：
-```typescript
-import { DependencyManager } from "../../../modules/dependency/dependency-manager.js";
-
-const depManager = new DependencyManager();
-const { ACMClient, ImportCertificateCommand } = await depManager.ensureAndImport("@aws-sdk/client-acm");
-```
-
-**简化方案（推荐）：**
-
-创建辅助函数，减少改动量：
-```typescript
-// src/modules/dependency/import-helper.ts
-export async function importOptionalDep<T>(packageName: string): Promise<T> {
-  const depManager = new DependencyManager();
-  return await depManager.ensureAndImport<T>(packageName);
-}
-
-// 插件中使用
-import { importOptionalDep } from "../../../modules/dependency/import-helper.js";
-const { ACMClient } = await importOptionalDep("@aws-sdk/client-acm");
-```
-
-### 实施步骤
-
-#### 阶段一：基础设施搭建
-1. 创建 `optional-deps/` 目录结构
-2. 生成 `optional-deps/package.json`（包含所有可选依赖）
-3. 实现 `DependencyManager` 核心逻辑
-4. 实现依赖安装锁机制
-5. 编写单元测试
-
-#### 阶段二：依赖迁移
-6. 从主 `package.json` 移除可选依赖
-7. 将依赖添加到 `optional-deps/package.json`
-8. 创建依赖注册表，映射插件到依赖
-
-#### 阶段三：插件改造
-9. 创建 `import-helper.ts` 辅助函数
-10. 逐步改造插件代码，使用 `importOptionalDep` 加载依赖
-11. 优先改造重型依赖（AWS、阿里云、腾讯云等）
-
-#### 阶段四：测试与优化
-12. 端到端测试：验证依赖按需安装和加载
-13. 性能优化：缓存已加载的模块
-14. 错误处理：安装失败时的降级策略
-15. 文档：编写使用说明和迁移指南
-
-## 关键技术决策
-
-### 1. 依赖分组策略
-**选择：按插件分组**
- 每个插件声明自己需要的依赖
- 优点：职责清晰，易于维护
- 缺点：可能有重复依赖（但 pnpm 会去重）
-
-**备选：按功能分组**
- 将依赖按功能分组（如 "aws-deps", "aliyun-deps"）
- 优点：更细粒度控制
- 缺点：增加复杂度
-
-### 2. 安装触发时机
-**选择：首次使用时触发**
- 在插件的 `execute()` 或 `getClient()` 方法中触发安装
- 优点：真正的按需加载
- 缺点：首次使用有延迟
-
-**备选：启动时预检查**
- 启动时扫描启用的插件，预安装依赖
- 优点：避免运行时延迟
- 缺点：可能安装不需要的依赖
-
-### 3. 依赖路径解析
-**选择：使用绝对路径 + `file://` 协议**
-```typescript
-const modulePath = path.resolve(__dirname, '../../optional-deps/node_modules', packageName);
-return await import(`file://${modulePath}/index.js`);
-```
-
-**原因：**
- Node.js ESM 要求明确的 URL 格式
- 避免模块解析冲突
-
-### 4. 并发控制
-**选择：文件锁 + 内存锁双重保护**
- 使用 `proper-lockfile` 锁定 `optional-deps/` 目录
- 内存中使用 `Map` 记录正在安装的依赖
- 避免多个插件同时触发安装
-
-### 5. 错误处理
-**策略：**
- 安装失败时记录日志，抛出明确的错误信息
- 提供手动安装命令提示：`请运行: cd optional-deps && pnpm install`
- 支持降级：某些非核心依赖安装失败时，插件可以部分功能可用
-
-## 验证方案
-
-### 单元测试
-1. 测试 `DependencyManager.isInstalled()` 正确检测依赖状态
-2. 测试 `DependencyManager.installDependencies()` 成功安装依赖
-3. 测试并发安装时的锁机制
-4. 测试从 `optional-deps/node_modules` 加载模块
-
-### 集成测试
-1. 清空 `optional-deps/node_modules`
-2. 启动服务，验证不触发安装
-3. 调用 AWS 插件，验证触发安装并成功加载
-4. 再次调用，验证不重复安装
-5. 验证主 `node_modules` 体积减少
-
-### 性能测试
-1. 测量首次安装依赖的耗时
-2. 测量后续加载的耗时（应该与正常 import 相近）
-3. 对比改造前后的 `node_modules` 大小
-
-## 风险与挑战
-
-### 1. 首次使用延迟
-**风险：** 用户首次使用插件时需要等待依赖安装（可能几十秒）
-**缓解：**
- 在 UI 上显示安装进度
- 提供预安装命令：`pnpm run install-optional-deps`
- 文档说明首次使用会有延迟
-
-### 2. 离线环境
-**风险：** 离线环境无法下载依赖
-**缓解：**
- 提供完整安装包（包含所有可选依赖）
- 支持手动复制 `node_modules`
-
-### 3. 版本冲突
-**风险：** 可选依赖与主依赖版本冲突
-**缓解：**
- 使用 `--ignore-workspace` 隔离安装
- 定期同步主依赖版本
-
-### 4. TypeScript 类型
-**风险：** 动态导入的类型推断
-**缓解：**
- 保留 `@types/*` 在主 `devDependencies`
- 使用泛型和类型断言
-
-## 预期收益
-
-1. **空间节省：** 主 `node_modules` 体积减少 60-70%（估算）
-2. **安装速度：** 初始 `pnpm install` 速度提升 3-5 倍
-3. **用户体验：** 不使用的插件不占用空间，按需加载
-4. **维护性：** 依赖分组清晰，易于管理
-
-## 后续优化
-
-1. **依赖预热：** 在后台预安装常用插件依赖
-2. **依赖缓存：** 支持从 CDN 或本地缓存安装
-3. **依赖更新：** 提供命令批量更新可选依赖
-4. **插件市场：** 支持从远程下载插件及其依赖配置
-
-## 附录：依赖分类清单
-
-### 可选依赖（迁移到 optional-deps/package.json）
-
-**AWS 相关（plugin-aws, plugin-aws-cn）：**
-```json
-{
-  "@aws-sdk/client-acm": "^3.964.0",
-  "@aws-sdk/client-cloudfront": "^3.964.0",
-  "@aws-sdk/client-iam": "^3.964.0",
-  "@aws-sdk/client-route-53": "^3.964.0",
-  "@aws-sdk/client-s3": "^3.964.0",
-  "@aws-sdk/client-sts": "^3.990.0"
-}
-```
-
-**阿里云相关（plugin-aliyun, plugin-lib/aliyun）：**
-```json
-{
-  "@alicloud/fc20230330": "^4.1.7",
-  "@alicloud/openapi-client": "^0.4.12",
-  "@alicloud/openapi-util": "^0.3.2",
-  "@alicloud/pop-core": "^1.7.10",
-  "@alicloud/sts-sdk": "^1.0.2",
-  "@alicloud/tea-typescript": "^1.8.0",
-  "@alicloud/tea-util": "^1.4.10",
-  "ali-oss": "^6.21.0"
-}
-```
-
-**腾讯云相关（plugin-tencent, plugin-lib/tencent）：**
-```json
-{
-  "tencentcloud-sdk-nodejs": "^4.1.112",
-  "cos-nodejs-sdk-v5": "^2.14.6"
-}
-```
-
-**华为云相关（plugin-huawei）：**
-```json
-{
-  "@huaweicloud/huaweicloud-sdk-cdn": "3.1.185",
-  "@huaweicloud/huaweicloud-sdk-core": "3.1.185",
-  "@huaweicloud/huaweicloud-sdk-elb": "3.1.185",
-  "@huaweicloud/huaweicloud-sdk-iam": "3.1.185",
-  "esdk-obs-nodejs": "^3.25.6"
-}
-```
-
-**Azure 相关（plugin-azure）：**
-```json
-{
-  "@azure/arm-dns": "^5.1.0",
-  "@azure/identity": "^4.13.1"
-}
-```
-
-**Google Cloud 相关（plugin-google, plugin-cert/google）：**
-```json
-{
-  "@google-cloud/dns": "^5.3.1",
-  "@google-cloud/publicca": "^1.3.0"
-}
-```
-
-**火山引擎相关（plugin-volcengine）：**
-```json
-{
-  "@volcengine/openapi": "^1.28.1",
-  "@volcengine/tos-sdk": "^2.9.1"
-}
-```
-
-**SSH/网络相关（plugin-host, plugin-lib/ssh）：**
-```json
-{
-  "ssh2": "^1.17.0",
-  "socks": "^2.8.3",
-  "socks-proxy-agent": "^8.0.4",
-  "basic-ftp": "^5.0.5"
-}
-```
-
-**其他存储/传输（plugin-qiniu, plugin-lib/qiniu）：**
-```json
-{
-  "qiniu": "^7.12.0"
-}
-```
-
-**邮件通知（plugin-notification/email）：**
-```json
-{
-  "nodemailer": "^6.9.16"
-}
-```
-
-### 主依赖（保留在主 package.json）
-
-**框架核心：**
- `@midwayjs/*` 系列
- `@koa/cors`
- `typeorm`, `better-sqlite3`, `mysql2`, `pg`
-
-**项目内部包：**
- `@certd/*` 系列
-
-**通用工具：**
- `axios`, `lodash-es`, `dayjs`, `js-yaml`
- `crypto-js`, `jsonwebtoken`, `bcryptjs`
- `reflect-metadata`, `uuid`, `nanoid`
- 等等
-
-## 总结
-
-本方案通过引入独立的可选依赖管理机制，实现了插件依赖的按需下载和加载。核心思路是：
-
-1. **隔离管理：** 在 `optional-deps/` 目录下维护独立的 `package.json` 和 `node_modules`
-2. **动态安装：** 通过 `DependencyManager` 在首次使用时触发 `pnpm install`
-3. **路径加载：** 使用绝对路径从独立目录加载依赖模块
-4. **最小改动：** 通过辅助函数 `importOptionalDep` 简化插件代码改造
-
-该方案可以显著减少主 `node_modules` 体积，提升初始安装速度，同时保持现有架构的兼容性和可维护性。
@@ -400,6 +400,7 @@ export class OAuthDemoAccess extends BaseAccess {
 4. **错误处理**：API 调用失败时应抛出明确的错误信息。
 5. **测试方法**：实现 `onTestRequest` 方法，以便用户可以测试授权是否正常。
 6. **统一接口调用**：封装统一的 API 请求方法，避免重复编写错误处理逻辑。
+7. **旧版数据兼容**： 新增注解的插件参数，必须要考虑旧版数据兼容，比如新增一个deployType参数，有两种值：`default`和`custom`，需要在使用时判空，走旧版逻辑。

 ## 开发技巧

@@ -454,3 +454,4 @@ new TencentDnsProvider();
 3. **记录结构**：定义适合对应云平台的记录数据结构，至少包含 id 字段用于删除记录。
 4. **日志输出**：使用 `this.logger` 输出日志，而不是 `console`，参数文本化，不要传对象，否则会输出`[object Object]}`。
 5. **错误处理**：API 调用失败时应抛出明确的错误信息。
+6. **旧版数据兼容**： 新增插件参数，必须要考虑旧版数据兼容，比如新增一个deployType参数，有两种值：`default`和`custom`，需要在使用时判空，走旧版逻辑。
@@ -281,12 +281,12 @@ export class DemoTest extends AbstractTaskPlugin {
      return {
        value: item.siteName,
        label: item.siteName,
-        domain: item.siteName,
+        domain: item.siteName, //这里必须要包含domain 否则后面分组时候全部分配到未匹配中
      };
    });
    //将站点域名名称根据证书域名进行匹配分组，分成匹配的和不匹配的两组选项，返回给前端，供用户选择
    return {
-      list: optionsUtils.buildGroupOptions(options, this.certDomains),
+      list: optionsUtils.buildGroupOptions(options, this.certDomains), //分组后的列表
      total: siteRes.length,
    };
  }
@@ -641,6 +641,7 @@ new AliyunOSSDeploy();
 4. **日志输出**：使用 `this.logger` 输出日志，而不是 `console`，参数文本化，不要传对象，否则会输出`[object Object]}`。
 5. **错误处理**：执行过程中的错误应被捕获并记录。
 6. **授权获取**：使用 `this.getAccess(accessId)` 获取授权信息。
+7. **旧版数据兼容**： 新增@TaskInput注解的插件参数，必须要考虑旧版数据兼容，比如新增一个deployType参数，有两种值：`default`和`custom`，需要在使用时判空，走旧版逻辑。

 ## 部署逻辑注意事项

@@ -210,3 +210,22 @@ Certd 是可私有化部署的 SSL/TLS 证书自动化管理平台，提供 Web
 - 后端业务数据、接口、实体、权限、迁移：改 `packages/ui/certd-server/src/modules` 与 `src/controller`。
 - 表单、列表、插件配置 UI：改 `packages/ui/certd-client/src/views/certd` 及对应 `src/api`。

+## 注意事项
+
+### 旧版数据兼容
+
+- 新增插件参数时，必须要考虑旧版数据兼容，比如新增一个deployType参数，有两种值：`default`和`custom`，需要在使用时判空，走旧版逻辑。
+
+## 前端路由与国际化
+
+- 路由 `meta.title` 是 **i18n 国际化 key**，必须在 `src/locales/langs/zh-CN/` 和 `src/locales/langs/en-US/` 对应的模块文件中添加翻译。
+- 示例：路由 `title: "certd.auditLog"` 需要在中英 locales 文件中有对应 key（`"certd.auditLog": "操作日志"` / `"certd.auditLog": "Audit Log"`）。
+- 菜单通过路由自动生成，需设置 `meta.isMenu: true` 才会出现在左侧菜单。
+- Plus 版功能菜单需设置 `meta.show: () => { const settingStore = useSettingStore(); return settingStore.isPlus; }`。
+
+## 审计日志
+
+- 审计日志是 Plus 版功能，非 Plus 版不会写入。
+- Controller 继承 `BaseController`，通过 `this.auditLog({ content: "xxx" })` 记录日志。
+- `getAuditType()` 返回类型常量，中间件自动从 ctx.path 判定 scope（`/api/sys/` → system，其他 → user）。
+- 操作日志有系统级（scope=system）和用户级（scope=user）区分。
@@ -3,6 +3,34 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+### Bug Fixes
+
+* **volcengine-alb:** 修复火山引擎ALB 默认证书部署类型会部署到扩展证书的问题 ([0a068a2](https://github.com/certd/certd/commit/0a068a274673e9768954e9f7367c267d44f3b530))
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+### Bug Fixes
+
+* 修复火山视频点播源站选择不到自定义源站的bug ([0071bcb](https://github.com/certd/certd/commit/0071bcb0e4dd108c86d7ca01820a9f6e6960e440))
+* 修复企业模式下弹出邮箱绑定提醒的问题 ([8d9dad9](https://github.com/certd/certd/commit/8d9dad9c82f6f2fd3ab3040068946a33f37145b1))
+* 修复AsiaIsp CDN证书重复情况下部署失败的问题 ([c3d6db3](https://github.com/certd/certd/commit/c3d6db3f1ef2f1c897b7989521fe8809dffaded1))
+* 修复cname用阿里云校验时报找不到runtimeDepsService的错误 ([072edd7](https://github.com/certd/certd/commit/072edd7affee424ab3411f4d41d338f084d7cac6))
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+### Bug Fixes
+
+* 修复多域名无法使用passkey登录的bug ([d176f9c](https://github.com/certd/certd/commit/d176f9cc0ebd051a614bfac74d1616d1945fc9a3))
+* 修复企业模式下登录报projectId不能为空的问题 ([a65366b](https://github.com/certd/certd/commit/a65366bbe1aadea8baaffbdadab58a5b631d9417))
+* **login:** 修复输入法 composing 状态下回车触发提交的问题 ([b74db81](https://github.com/certd/certd/commit/b74db81304bbe68476bbec5ea4307a2264060e92))
+
+### Performance Improvements
+
+* **certd-server:** 使用 jks-go转换jks证书，大幅精简镜像大小 ([c78898e](https://github.com/certd/certd/commit/c78898e4c10dd1701467d2e42e3f72bd8f2a352f))
+* **pipeline:** 将默认历史保留条数从30调整为100 ([d3e4677](https://github.com/certd/certd/commit/d3e4677ea4fac8e7533749d7f4187e410489e536))
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 ### Bug Fixes
@@ -3,6 +3,62 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+### Bug Fixes
+
+* **volcengine-alb:** 修复火山引擎ALB 默认证书部署类型会部署到扩展证书的问题 ([0a068a2](https://github.com/certd/certd/commit/0a068a274673e9768954e9f7367c267d44f3b530))
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+### Bug Fixes
+
+* 修复火山视频点播源站选择不到自定义源站的bug ([0071bcb](https://github.com/certd/certd/commit/0071bcb0e4dd108c86d7ca01820a9f6e6960e440))
+* 修复企业模式下弹出邮箱绑定提醒的问题 ([8d9dad9](https://github.com/certd/certd/commit/8d9dad9c82f6f2fd3ab3040068946a33f37145b1))
+* 修复AsiaIsp CDN证书重复情况下部署失败的问题 ([c3d6db3](https://github.com/certd/certd/commit/c3d6db3f1ef2f1c897b7989521fe8809dffaded1))
+* 修复cname用阿里云校验时报找不到runtimeDepsService的错误 ([072edd7](https://github.com/certd/certd/commit/072edd7affee424ab3411f4d41d338f084d7cac6))
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+### Bug Fixes
+
+* 修复多域名无法使用passkey登录的bug ([d176f9c](https://github.com/certd/certd/commit/d176f9cc0ebd051a614bfac74d1616d1945fc9a3))
+* 修复企业模式下登录报projectId不能为空的问题 ([a65366b](https://github.com/certd/certd/commit/a65366bbe1aadea8baaffbdadab58a5b631d9417))
+* **login:** 修复输入法 composing 状态下回车触发提交的问题 ([b74db81](https://github.com/certd/certd/commit/b74db81304bbe68476bbec5ea4307a2264060e92))
+
+### Performance Improvements
+
+* **certd-server:** 使用 jks-go转换jks证书，大幅精简镜像大小 ([c78898e](https://github.com/certd/certd/commit/c78898e4c10dd1701467d2e42e3f72bd8f2a352f))
+* **pipeline:** 将默认历史保留条数从30调整为100 ([d3e4677](https://github.com/certd/certd/commit/d3e4677ea4fac8e7533749d7f4187e410489e536))
+
+# [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)
+
+### Bug Fixes
+
+* 修复jdk证书格式的问题 ([260f5ae](https://github.com/certd/certd/commit/260f5ae777b83493b0c578fe30fd00ec0c873226))
+* 修复telegram - 符号转义问题 ([d5882f1](https://github.com/certd/certd/commit/d5882f16bedb09baf09ace92049b02872620f5dc))
+* **aliyun:** 修复阿里云CDN/DCDN根据证书自动匹配不到证书的bug ([1ae185d](https://github.com/certd/certd/commit/1ae185d0bc356f4678bc38ca0582ce3396f82ebe))
+
+### Features
+
+* 通过插件配置懒加载依赖，动态加载第三方依赖包，精简安装镜像大小 ([01568ca](https://github.com/certd/certd/commit/01568ca1489069046b5a89ebdd4ced2f7f6ddf93))
+
+### Performance Improvements
+
+*  阿里云ESA证书部署支持SaaS模式 ([82276b5](https://github.com/certd/certd/commit/82276b53a8474a18a3d0237050907c994fc748f0))
+* 【破坏性更新】 证书压缩包不再生成文件存储，而是实时打包下载，证书申请插件不再输出certZip ([7cff1a9](https://github.com/certd/certd/commit/7cff1a98424120585205889874b3ef4956a30583))
+* 火山引擎点播插件支持部署到自定义源站域名 ([095791c](https://github.com/certd/certd/commit/095791cdc2b7c1f4b913b634643afec5e30fe9b0))
+* 基础镜像改成node:22-trixie-slim，对网络兼容性更好 ([c66a2bd](https://github.com/certd/certd/commit/c66a2bd77ab6dbb3e3fe2c00562b66287a9429ea))
+* 新增橙域网络(asia-isp) CDN证书部署插件 ([b48831e](https://github.com/certd/certd/commit/b48831e60b0059bef7ef9a34ab61c9dd2f684641))
+* 优化阿里云API网关增加翻页查询 ([ed58ae3](https://github.com/certd/certd/commit/ed58ae3c5339e4a0238a92acfe7ea6d2f566ea28))
+* 优化用户体验，首次访问时弹出邮箱账号绑定用以初始化账号 ([608cc2a](https://github.com/certd/certd/commit/608cc2a81ff0b4872c9fe11ed9c9c0b4b90a12a3))
+* 优化ACME账号字段的选择提示 ([bfd3cac](https://github.com/certd/certd/commit/bfd3cacc687fc5cbc3cb2ca3cadbc140de300dc2))
+* 支持全自动匹配部署宝塔网站证书 ([4dff48e](https://github.com/certd/certd/commit/4dff48e807c32a7623ec9206cf39c88e88f89f6a))
+* **cert-plugin:** 调整更新天数自动减半逻辑，仅7天ip证书生效，其他情况下不减半 ([56e5524](https://github.com/certd/certd/commit/56e5524a0f4af3645d70bc3b3ec750b45ba8de10))
+* dns默认ipv4first ([194463b](https://github.com/certd/certd/commit/194463bea9e797315aa7a724f4b2930701570419))
+* **passkey:** passkey支持多域名rpid ([79f6586](https://github.com/certd/certd/commit/79f65868ca0f5162bbc2f935ce89abc28011d816))
+* **plugin:** 在线插件编辑支持配置第三方依赖和插件依赖 ([635f069](https://github.com/certd/certd/commit/635f069012d4193cfb7cb051c96e28eec1247ca2))
+
 ## [1.41.4](https://github.com/certd/certd/compare/v1.41.3...v1.41.4) (2026-06-14)

 ### Bug Fixes
@@ -9,5 +9,5 @@
    }
  },
  "npmClient": "pnpm",
-  "version": "1.42.0"
+  "version": "1.42.3"
 }
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/publishlab/node-acme-client/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/acme-client
+
+## [1.42.2](https://github.com/publishlab/node-acme-client/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/acme-client
+
+## [1.42.1](https://github.com/publishlab/node-acme-client/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/acme-client
+
 # [1.42.0](https://github.com/publishlab/node-acme-client/compare/v1.41.4...v1.42.0) (2026-07-05)

 ### Performance Improvements
@@ -1,518 +0,0 @@
-## Classes
-
-<dl>
-<dt><a href="#AcmeClient">AcmeClient</a></dt>
-<dd><p>AcmeClient</p>
-</dd>
-</dl>
-
-## Objects
-
-<dl>
-<dt><a href="#Client">Client</a> : <code>object</code></dt>
-<dd><p>ACME client</p>
-</dd>
-</dl>
-
-<a name="AcmeClient"></a>
-
-## AcmeClient
-AcmeClient
-
-**Kind**: global class  
-
-* [AcmeClient](#AcmeClient)
-    * [new AcmeClient(opts)](#new_AcmeClient_new)
-    * [.getTermsOfServiceUrl()](#AcmeClient+getTermsOfServiceUrl) ⇒ <code>Promise.&lt;(string\|null)&gt;</code>
-    * [.getAccountUrl()](#AcmeClient+getAccountUrl) ⇒ <code>string</code>
-    * [.createAccount([data])](#AcmeClient+createAccount) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.updateAccount([data])](#AcmeClient+updateAccount) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.updateAccountKey(newAccountKey, [data])](#AcmeClient+updateAccountKey) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.createOrder(data)](#AcmeClient+createOrder) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.getOrder(order)](#AcmeClient+getOrder) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.finalizeOrder(order, csr)](#AcmeClient+finalizeOrder) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.getAuthorizations(order)](#AcmeClient+getAuthorizations) ⇒ <code>Promise.&lt;Array.&lt;object&gt;&gt;</code>
-    * [.deactivateAuthorization(authz)](#AcmeClient+deactivateAuthorization) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.getChallengeKeyAuthorization(challenge)](#AcmeClient+getChallengeKeyAuthorization) ⇒ <code>Promise.&lt;string&gt;</code>
-    * [.verifyChallenge(authz, challenge)](#AcmeClient+verifyChallenge) ⇒ <code>Promise</code>
-    * [.completeChallenge(challenge)](#AcmeClient+completeChallenge) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.waitForValidStatus(item)](#AcmeClient+waitForValidStatus) ⇒ <code>Promise.&lt;object&gt;</code>
-    * [.getCertificate(order, [preferredChain])](#AcmeClient+getCertificate) ⇒ <code>Promise.&lt;string&gt;</code>
-    * [.revokeCertificate(cert, [data])](#AcmeClient+revokeCertificate) ⇒ <code>Promise</code>
-    * [.auto(opts)](#AcmeClient+auto) ⇒ <code>Promise.&lt;string&gt;</code>
-
-<a name="new_AcmeClient_new"></a>
-
-### new AcmeClient(opts)
-
-| Param | Type | Description |
-| --- | --- | --- |
-| opts | <code>object</code> |  |
-| opts.directoryUrl | <code>string</code> | ACME directory URL |
-| opts.accountKey | <code>buffer</code> \| <code>string</code> | PEM encoded account private key |
-| [opts.accountUrl] | <code>string</code> | Account URL, default: `null` |
-| [opts.externalAccountBinding] | <code>object</code> |  |
-| [opts.externalAccountBinding.kid] | <code>string</code> | External account binding KID |
-| [opts.externalAccountBinding.hmacKey] | <code>string</code> | External account binding HMAC key |
-| [opts.backoffAttempts] | <code>number</code> | Maximum number of backoff attempts, default: `10` |
-| [opts.backoffMin] | <code>number</code> | Minimum backoff attempt delay in milliseconds, default: `5000` |
-| [opts.backoffMax] | <code>number</code> | Maximum backoff attempt delay in milliseconds, default: `30000` |
-
-**Example**  
-Create ACME client instance
-```js
-const client = new acme.Client({
-    directoryUrl: acme.directory.letsencrypt.staging,
-    accountKey: 'Private key goes here',
-});
-```
-**Example**  
-Create ACME client instance
-```js
-const client = new acme.Client({
-    directoryUrl: acme.directory.letsencrypt.staging,
-    accountKey: 'Private key goes here',
-    accountUrl: 'Optional account URL goes here',
-    backoffAttempts: 10,
-    backoffMin: 5000,
-    backoffMax: 30000,
-});
-```
-**Example**  
-Create ACME client with external account binding
-```js
-const client = new acme.Client({
-    directoryUrl: 'https://acme-provider.example.com/directory-url',
-    accountKey: 'Private key goes here',
-    externalAccountBinding: {
-        kid: 'YOUR-EAB-KID',
-        hmacKey: 'YOUR-EAB-HMAC-KEY',
-    },
-});
-```
-<a name="AcmeClient+getTermsOfServiceUrl"></a>
-
-### acmeClient.getTermsOfServiceUrl() ⇒ <code>Promise.&lt;(string\|null)&gt;</code>
-Get Terms of Service URL if available
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;(string\|null)&gt;</code> - ToS URL  
-**Example**  
-Get Terms of Service URL
-```js
-const termsOfService = client.getTermsOfServiceUrl();
-
-if (!termsOfService) {
-    // CA did not provide Terms of Service
-}
-```
-<a name="AcmeClient+getAccountUrl"></a>
-
-### acmeClient.getAccountUrl() ⇒ <code>string</code>
-Get current account URL
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>string</code> - Account URL  
-**Throws**:
-
- <code>Error</code> No account URL found
-
-**Example**  
-Get current account URL
-```js
-try {
-    const accountUrl = client.getAccountUrl();
-}
-catch (e) {
-    // No account URL exists, need to create account first
-}
-```
-<a name="AcmeClient+createAccount"></a>
-
-### acmeClient.createAccount([data]) ⇒ <code>Promise.&lt;object&gt;</code>
-Create a new account
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.3
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Account  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [data] | <code>object</code> | Request data |
-
-**Example**  
-Create a new account
-```js
-const account = await client.createAccount({
-    termsOfServiceAgreed: true,
-});
-```
-**Example**  
-Create a new account with contact info
-```js
-const account = await client.createAccount({
-    termsOfServiceAgreed: true,
-    contact: ['mailto:test@example.com'],
-});
-```
-<a name="AcmeClient+updateAccount"></a>
-
-### acmeClient.updateAccount([data]) ⇒ <code>Promise.&lt;object&gt;</code>
-Update existing account
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.3.2
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Account  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| [data] | <code>object</code> | Request data |
-
-**Example**  
-Update existing account
-```js
-const account = await client.updateAccount({
-    contact: ['mailto:foo@example.com'],
-});
-```
-<a name="AcmeClient+updateAccountKey"></a>
-
-### acmeClient.updateAccountKey(newAccountKey, [data]) ⇒ <code>Promise.&lt;object&gt;</code>
-Update account private key
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.3.5
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Account  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| newAccountKey | <code>buffer</code> \| <code>string</code> | New PEM encoded private key |
-| [data] | <code>object</code> | Additional request data |
-
-**Example**  
-Update account private key
-```js
-const newAccountKey = 'New private key goes here';
-const result = await client.updateAccountKey(newAccountKey);
-```
-<a name="AcmeClient+createOrder"></a>
-
-### acmeClient.createOrder(data) ⇒ <code>Promise.&lt;object&gt;</code>
-Create a new order
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.4
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Order  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| data | <code>object</code> | Request data |
-
-**Example**  
-Create a new order
-```js
-const order = await client.createOrder({
-    identifiers: [
-        { type: 'dns', value: 'example.com' },
-        { type: 'dns', value: 'test.example.com' },
-    ],
-});
-```
-<a name="AcmeClient+getOrder"></a>
-
-### acmeClient.getOrder(order) ⇒ <code>Promise.&lt;object&gt;</code>
-Refresh order object from CA
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.4
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Order  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| order | <code>object</code> | Order object |
-
-**Example**  
-```js
-const order = { ... }; // Previously created order object
-const result = await client.getOrder(order);
-```
-<a name="AcmeClient+finalizeOrder"></a>
-
-### acmeClient.finalizeOrder(order, csr) ⇒ <code>Promise.&lt;object&gt;</code>
-Finalize order
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.4
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Order  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| order | <code>object</code> | Order object |
-| csr | <code>buffer</code> \| <code>string</code> | PEM encoded Certificate Signing Request |
-
-**Example**  
-Finalize order
-```js
-const order = { ... }; // Previously created order object
-const csr = { ... }; // Previously created Certificate Signing Request
-const result = await client.finalizeOrder(order, csr);
-```
-<a name="AcmeClient+getAuthorizations"></a>
-
-### acmeClient.getAuthorizations(order) ⇒ <code>Promise.&lt;Array.&lt;object&gt;&gt;</code>
-Get identifier authorizations from order
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.5
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;Array.&lt;object&gt;&gt;</code> - Authorizations  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| order | <code>object</code> | Order |
-
-**Example**  
-Get identifier authorizations
-```js
-const order = { ... }; // Previously created order object
-const authorizations = await client.getAuthorizations(order);
-
-authorizations.forEach((authz) => {
-    const { challenges } = authz;
-});
-```
-<a name="AcmeClient+deactivateAuthorization"></a>
-
-### acmeClient.deactivateAuthorization(authz) ⇒ <code>Promise.&lt;object&gt;</code>
-Deactivate identifier authorization
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.5.2
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Authorization  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| authz | <code>object</code> | Identifier authorization |
-
-**Example**  
-Deactivate identifier authorization
-```js
-const authz = { ... }; // Identifier authorization resolved from previously created order
-const result = await client.deactivateAuthorization(authz);
-```
-<a name="AcmeClient+getChallengeKeyAuthorization"></a>
-
-### acmeClient.getChallengeKeyAuthorization(challenge) ⇒ <code>Promise.&lt;string&gt;</code>
-Get key authorization for ACME challenge
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-8.1
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;string&gt;</code> - Key authorization  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| challenge | <code>object</code> | Challenge object returned by API |
-
-**Example**  
-Get challenge key authorization
-```js
-const challenge = { ... }; // Challenge from previously resolved identifier authorization
-const key = await client.getChallengeKeyAuthorization(challenge);
-
-// Write key somewhere to satisfy challenge
-```
-<a name="AcmeClient+verifyChallenge"></a>
-
-### acmeClient.verifyChallenge(authz, challenge) ⇒ <code>Promise</code>
-Verify that ACME challenge is satisfied
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| authz | <code>object</code> | Identifier authorization |
-| challenge | <code>object</code> | Authorization challenge |
-
-**Example**  
-Verify satisfied ACME challenge
-```js
-const authz = { ... }; // Identifier authorization
-const challenge = { ... }; // Satisfied challenge
-await client.verifyChallenge(authz, challenge);
-```
-<a name="AcmeClient+completeChallenge"></a>
-
-### acmeClient.completeChallenge(challenge) ⇒ <code>Promise.&lt;object&gt;</code>
-Notify CA that challenge has been completed
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.5.1
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Challenge  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| challenge | <code>object</code> | Challenge object returned by API |
-
-**Example**  
-Notify CA that challenge has been completed
-```js
-const challenge = { ... }; // Satisfied challenge
-const result = await client.completeChallenge(challenge);
-```
-<a name="AcmeClient+waitForValidStatus"></a>
-
-### acmeClient.waitForValidStatus(item) ⇒ <code>Promise.&lt;object&gt;</code>
-Wait for ACME provider to verify status on a order, authorization or challenge
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.5.1
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;object&gt;</code> - Valid order, authorization or challenge  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| item | <code>object</code> | An order, authorization or challenge object |
-
-**Example**  
-Wait for valid challenge status
-```js
-const challenge = { ... };
-await client.waitForValidStatus(challenge);
-```
-**Example**  
-Wait for valid authorization status
-```js
-const authz = { ... };
-await client.waitForValidStatus(authz);
-```
-**Example**  
-Wait for valid order status
-```js
-const order = { ... };
-await client.waitForValidStatus(order);
-```
-<a name="AcmeClient+getCertificate"></a>
-
-### acmeClient.getCertificate(order, [preferredChain]) ⇒ <code>Promise.&lt;string&gt;</code>
-Get certificate from ACME order
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.4.2
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;string&gt;</code> - Certificate  
-
-| Param | Type | Default | Description |
-| --- | --- | --- | --- |
-| order | <code>object</code> |  | Order object |
-| [preferredChain] | <code>string</code> | <code>null</code> | Indicate which certificate chain is preferred if a CA offers multiple, by exact issuer common name, default: `null` |
-
-**Example**  
-Get certificate
-```js
-const order = { ... }; // Previously created order
-const certificate = await client.getCertificate(order);
-```
-**Example**  
-Get certificate with preferred chain
-```js
-const order = { ... }; // Previously created order
-const certificate = await client.getCertificate(order, 'DST Root CA X3');
-```
-<a name="AcmeClient+revokeCertificate"></a>
-
-### acmeClient.revokeCertificate(cert, [data]) ⇒ <code>Promise</code>
-Revoke certificate
-
-https://datatracker.ietf.org/doc/html/rfc8555#section-7.6
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| cert | <code>buffer</code> \| <code>string</code> | PEM encoded certificate |
-| [data] | <code>object</code> | Additional request data |
-
-**Example**  
-Revoke certificate
-```js
-const certificate = { ... }; // Previously created certificate
-const result = await client.revokeCertificate(certificate);
-```
-**Example**  
-Revoke certificate with reason
-```js
-const certificate = { ... }; // Previously created certificate
-const result = await client.revokeCertificate(certificate, {
-    reason: 4,
-});
-```
-<a name="AcmeClient+auto"></a>
-
-### acmeClient.auto(opts) ⇒ <code>Promise.&lt;string&gt;</code>
-Auto mode
-
-**Kind**: instance method of [<code>AcmeClient</code>](#AcmeClient)  
-**Returns**: <code>Promise.&lt;string&gt;</code> - Certificate  
-
-| Param | Type | Description |
-| --- | --- | --- |
-| opts | <code>object</code> |  |
-| opts.csr | <code>buffer</code> \| <code>string</code> | Certificate Signing Request |
-| opts.challengeCreateFn | <code>function</code> | Function returning Promise triggered before completing ACME challenge |
-| opts.challengeRemoveFn | <code>function</code> | Function returning Promise triggered after completing ACME challenge |
-| [opts.email] | <code>string</code> | Account email address |
-| [opts.termsOfServiceAgreed] | <code>boolean</code> | Agree to Terms of Service, default: `false` |
-| [opts.skipChallengeVerification] | <code>boolean</code> | Skip internal challenge verification before notifying ACME provider, default: `false` |
-| [opts.challengePriority] | <code>Array.&lt;string&gt;</code> | Array defining challenge type priority, default: `['http-01', 'dns-01']` |
-| [opts.preferredChain] | <code>string</code> | Indicate which certificate chain is preferred if a CA offers multiple, by exact issuer common name, default: `null` |
-
-**Example**  
-Order a certificate using auto mode
-```js
-const [certificateKey, certificateRequest] = await acme.crypto.createCsr({
-    altNames: ['test.example.com'],
-});
-
-const certificate = await client.auto({
-    csr: certificateRequest,
-    email: 'test@example.com',
-    termsOfServiceAgreed: true,
-    challengeCreateFn: async (authz, challenge, keyAuthorization) => {
-        // Satisfy challenge here
-    },
-    challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
-        // Clean up challenge here
-    },
-});
-```
-**Example**  
-Order a certificate using auto mode with preferred chain
-```js
-const [certificateKey, certificateRequest] = await acme.crypto.createCsr({
-    altNames: ['test.example.com'],
-});
-
-const certificate = await client.auto({
-    csr: certificateRequest,
-    email: 'test@example.com',
-    termsOfServiceAgreed: true,
-    preferredChain: 'DST Root CA X3',
-    challengeCreateFn: async () => {},
-    challengeRemoveFn: async () => {},
-});
-```
-<a name="Client"></a>
-
-## Client : <code>object</code>
-ACME client
-
-**Kind**: global namespace  
@@ -3,7 +3,7 @@
    "description": "Simple and unopinionated ACME client",
    "private": false,
    "author": "nmorsman",
-    "version": "1.42.0",
+    "version": "1.42.3",
    "type": "module",
    "module": "./dist/index.js",
    "main": "./dist/index.js",
@@ -18,7 +18,7 @@
        "types"
    ],
    "dependencies": {
-        "@certd/basic": "^1.42.0",
+        "@certd/basic": "^1.42.3",
        "@peculiar/x509": "^1.11.0",
        "asn1js": "^3.0.5",
        "axios": "^1.9.0",
@@ -50,10 +50,9 @@
    "scripts": {
        "before-build": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true});fs.rmSync('tsconfig.tsbuildinfo',{force:true});\"",
        "build": "npm run before-build && tsc -p tsconfig.build.json --skipLibCheck",
-        "build-docs": "jsdoc2md dist/client.js > docs/client.md && jsdoc2md dist/crypto/index.js > docs/crypto.md && jsdoc2md dist/crypto/forge.js > docs/forge.md",
        "lint": "eslint \"src/**/*.ts\" \"types/**/*.ts\"",
        "lint-types": "tsd --files \"types/index.test-d.ts\"",
-        "prepublishOnly": "npm run build && npm run build-docs",
+        "prepublishOnly": "npm run build",
        "test": "mocha -t 60000 \"test/setup.js\" \"test/**/*.spec.js\"",
        "before-test:unit": "node -e \"const fs=require('fs');fs.rmSync('dist-test',{recursive:true,force:true});fs.rmSync('tsconfig.test.tsbuildinfo',{force:true});\"",
        "test:unit": "cross-env NODE_ENV=unittest npm run before-test:unit && cross-env NODE_ENV=unittest tsc -p tsconfig.test.json --skipLibCheck && cross-env NODE_ENV=unittest mocha -t 60000 \"dist-test/**/*.test.js\"",
@@ -76,5 +75,5 @@
    "bugs": {
        "url": "https://github.com/publishlab/node-acme-client/issues"
    },
-    "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+    "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/basic
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/basic
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/basic
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 **Note:** Version bump only for package @certd/basic
@@ -1 +1 @@
-19:21
+23:45
@@ -1,7 +1,7 @@
 {
  "name": "@certd/basic",
  "private": false,
-  "version": "1.42.0",
+  "version": "1.42.3",
  "type": "module",
  "main": "./dist/index.js",
  "module": "./dist/index.js",
@@ -54,5 +54,5 @@
    "tslib": "^2.8.1",
    "typescript": "^5.4.2"
  },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/pipeline
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/pipeline
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/pipeline
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 ### Features
@@ -1,7 +1,7 @@
 {
  "name": "@certd/pipeline",
  "private": false,
-  "version": "1.42.0",
+  "version": "1.42.3",
  "type": "module",
  "main": "./dist/index.js",
  "module": "./dist/index.js",
@@ -21,8 +21,8 @@
    "lint": "eslint --fix"
  },
  "dependencies": {
-    "@certd/basic": "^1.42.0",
-    "@certd/plus-core": "^1.42.0",
+    "@certd/basic": "^1.42.3",
+    "@certd/plus-core": "^1.42.3",
    "dayjs": "^1.11.7",
    "lodash-es": "^4.17.21",
    "reflect-metadata": "^0.2.2"
@@ -51,5 +51,5 @@
    "tslib": "^2.8.1",
    "typescript": "^5.4.2"
  },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/lib-huawei
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/lib-huawei
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/lib-huawei
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 **Note:** Version bump only for package @certd/lib-huawei
@@ -1,7 +1,7 @@
 {
  "name": "@certd/lib-huawei",
  "private": false,
-  "version": "1.42.0",
+  "version": "1.42.3",
  "main": "./dist/bundle.js",
  "module": "./dist/bundle.js",
  "types": "./dist/d/index.d.ts",
@@ -30,5 +30,5 @@
    "prettier": "3.3.3",
    "tslib": "^2.8.1"
  },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/lib-iframe
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/lib-iframe
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/lib-iframe
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 **Note:** Version bump only for package @certd/lib-iframe
@@ -1,7 +1,7 @@
 {
  "name": "@certd/lib-iframe",
  "private": false,
-  "version": "1.42.0",
+  "version": "1.42.3",
  "type": "module",
  "main": "./dist/index.js",
  "module": "./dist/index.js",
@@ -37,5 +37,5 @@
    "tslib": "^2.8.1",
    "typescript": "^5.4.2"
  },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/jdcloud
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/jdcloud
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/jdcloud
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 **Note:** Version bump only for package @certd/jdcloud
@@ -1,6 +1,6 @@
 {
  "name": "@certd/jdcloud",
-  "version": "1.42.0",
+  "version": "1.42.3",
  "description": "jdcloud openApi sdk",
  "main": "./dist/bundle.js",
  "module": "./dist/bundle.js",
@@ -62,5 +62,5 @@
      "fetch"
    ]
  },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/lib-k8s
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/lib-k8s
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/lib-k8s
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 **Note:** Version bump only for package @certd/lib-k8s
@@ -1,7 +1,7 @@
 {
  "name": "@certd/lib-k8s",
  "private": false,
-  "version": "1.42.0",
+  "version": "1.42.3",
  "type": "module",
  "main": "./dist/index.js",
  "module": "./dist/index.js",
@@ -21,7 +21,7 @@
    "lint": "eslint --fix"
  },
  "dependencies": {
-    "@certd/basic": "^1.42.0",
+    "@certd/basic": "^1.42.3",
    "@kubernetes/client-node": "0.21.0"
  },
  "devDependencies": {
@@ -38,5 +38,5 @@
    "tslib": "^2.8.1",
    "typescript": "^5.4.2"
  },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/lib-server
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/lib-server
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/lib-server
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 ### Features
@@ -1,6 +1,6 @@
 {
  "name": "@certd/lib-server",
-  "version": "1.42.0",
+  "version": "1.42.3",
  "description": "midway with flyway, sql upgrade way ",
  "private": false,
  "type": "module",
@@ -29,11 +29,11 @@
  ],
  "license": "AGPL",
  "dependencies": {
-    "@certd/acme-client": "^1.42.0",
-    "@certd/basic": "^1.42.0",
-    "@certd/pipeline": "^1.42.0",
-    "@certd/plugin-lib": "^1.42.0",
-    "@certd/plus-core": "^1.42.0",
+    "@certd/acme-client": "^1.42.3",
+    "@certd/basic": "^1.42.3",
+    "@certd/pipeline": "^1.42.3",
+    "@certd/plugin-lib": "^1.42.3",
+    "@certd/plus-core": "^1.42.3",
    "@midwayjs/cache": "3.14.0",
    "@midwayjs/core": "3.20.11",
    "@midwayjs/i18n": "3.20.13",
@@ -69,5 +69,5 @@
    "typeorm": "^0.3.20",
    "typescript": "^5.4.2"
  },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -0,0 +1,35 @@
+/// <reference types="mocha" />
+
+import assert from "node:assert/strict";
+import { AuditLogContext } from "./audit.js";
+
+// AuditLog decorator and getAuditLogOptions are removed since auditLog()
+// now signals audit intent directly via ctx.auditLog.enabled
+
+describe("AuditLogContext type", () => {
+  it("supports enabled flag", () => {
+    const ctx: AuditLogContext = {
+      type: "pipeline",
+      action: "删除流水线",
+      append: ["ID:5"],
+      content: "删除了流水线(ID:5)",
+      projectId: 3,
+      projectName: "默认项目",
+      enabled: true,
+    };
+
+    assert.equal(ctx.enabled, true);
+    assert.equal(ctx.type, "pipeline");
+    assert.equal(ctx.content, "删除了流水线(ID:5)");
+    assert.equal(ctx.projectId, 3);
+  });
+
+  it("works with minimal fields", () => {
+    const ctx: AuditLogContext = {
+      enabled: true,
+      append: ["提交2条"],
+    };
+
+    assert.equal(ctx.enabled, true);
+  });
+});
@@ -0,0 +1,21 @@
+export type AuditLogOptions = {
+  type?: string;
+  action?: string;
+  content?: string;
+  template?: string;
+  disabled?: boolean;
+};
+
+export type AuditLogContext = {
+  type?: string;
+  action?: string;
+  append?: string | string[];
+  content?: string;
+  projectId?: number;
+  projectName?: string;
+  enabled?: boolean;
+  allowAnonymous?: boolean;
+  scope?: string;
+  userId?: number;
+  username?: string;
+};
@@ -3,6 +3,7 @@ import type { IMidwayContainer } from "@midwayjs/core";
 import * as koa from "@midwayjs/koa";
 import { Constants } from "./constants.js";
 import { isEnterprise } from "./mode.js";
+import type { AuditLogContext } from "./audit.js";

 export abstract class BaseController {
  @Inject()
@@ -127,4 +128,43 @@ export abstract class BaseController {
    }
    return { projectId, userId };
  }
+
+  getAuditType(): string {
+    return "unknown";
+  }
+
+  auditLog(bean: { type?: string; action?: string; content?: string; append?: string | string[]; projectId?: number; userId?: number; username?: string } = {}) {
+    const auditLog = this.ensureAuditLogContext();
+    auditLog.enabled = true;
+    if (bean.userId != null) {
+      auditLog.userId = bean.userId;
+    }
+    if (bean.username != null) {
+      auditLog.username = bean.username;
+    }
+    if (bean.type != null) {
+      auditLog.type = bean.type;
+    }
+    if (bean.action != null) {
+      auditLog.action = bean.action;
+    }
+    if (bean.projectId != null) {
+      auditLog.projectId = bean.projectId;
+    }
+    if (bean.content) {
+      auditLog.content = bean.content;
+    }
+    if (bean.append) {
+      const items = Array.isArray(bean.append) ? bean.append : [bean.append];
+      const old = Array.isArray(auditLog.append) ? auditLog.append : auditLog.append ? [auditLog.append] : [];
+      auditLog.append = [...old, ...items].filter(item => item && String(item).trim());
+    }
+  }
+
+  private ensureAuditLogContext(): AuditLogContext {
+    if (!this.ctx.auditLog) {
+      this.ctx.auditLog = {};
+    }
+    return this.ctx.auditLog;
+  }
 }
@@ -279,7 +279,7 @@ export abstract class BaseService<T> {
      return item != null && item != "";
    });
  }
-  async batchDelete(ids: number[], userId: number, projectId?: number) {
+  async batchDelete(ids: number[], userId: number, projectId?: number): Promise<number> {
    ids = this.filterIds(ids);
    if (userId != null) {
      const userProjectQuery = this.buildUserProjectQuery(userId, projectId);
@@ -295,6 +295,7 @@ export abstract class BaseService<T> {
    }

    await this.delete(ids);
+    return ids.length;
  }

  async findOne(options: FindOneOptions<T>) {
@@ -1,21 +1,21 @@
 export const Constants = {
-  dataDir: './data',
+  dataDir: "./data",
  role: {
    defaultUser: 3,
  },
  per: {
    //无需登录
-    guest: '_guest_',
+    guest: "_guest_",
    //无需登录
-    anonymous: '_guest_',
+    anonymous: "_guest_",
    //无需登录，有 token 时解析当前用户
-    guestOptionalAuth: '_guestOptionalAuth_',
+    guestOptionalAuth: "_guestOptionalAuth_",
    //仅需要登录
-    authOnly: '_authOnly_',
+    authOnly: "_authOnly_",
    //仅需要登录
-    loginOnly: '_authOnly_',
+    loginOnly: "_authOnly_",

-    open: '_open_',
+    open: "_open_",
  },
  res: {
    serverError(message: string) {
@@ -26,102 +26,102 @@ export const Constants = {
    },
    error: {
      code: 1,
-      message: 'Internal server error',
+      message: "Internal server error",
    },
    success: {
      code: 0,
-      message: 'success',
+      message: "success",
    },
    validation: {
      code: 10,
-      message: '参数错误',
+      message: "参数错误",
    },
    needvip: {
      code: 88,
-      message: '需要VIP',
+      message: "需要VIP",
    },
    needsuite: {
      code: 89,
-      message: '需要购买或升级套餐',
+      message: "需要购买或升级套餐",
    },
    loginError: {
      code: 2,
-      message: '登录失败',
+      message: "登录失败",
    },
    codeError: {
      code: 3,
-      message: '验证码错误',
+      message: "验证码错误",
    },
    auth: {
      code: 401,
-      message: '您还未登录或token已过期',
+      message: "您还未登录或token已过期",
    },
    permission: {
      code: 402,
-      message: '您没有权限',
+      message: "您没有权限",
    },
    param: {
      code: 400,
-      message: '参数错误',
+      message: "参数错误",
    },
    notFound: {
      code: 404,
-      message: '页面/文件/资源不存在',
+      message: "页面/文件/资源不存在",
    },

    preview: {
      code: 10001,
-      message: '对不起，预览环境不允许修改此数据',
+      message: "对不起，预览环境不允许修改此数据",
    },
-    siteOff:{
+    siteOff: {
      code: 10010,
-      message: '站点已关闭',
+      message: "站点已关闭",
    },
-    need2fa:{
+    need2fa: {
      code: 10020,
-      message: '需要2FA认证',
+      message: "需要2FA认证",
    },
    openKeyError: {
      code: 20000,
-      message: 'ApiToken错误',
+      message: "ApiToken错误",
    },
    openKeySignError: {
      code: 20001,
-      message: 'ApiToken签名错误',
+      message: "ApiToken签名错误",
    },
    openKeyExpiresError: {
      code: 20002,
-      message: 'ApiToken时间戳错误',
+      message: "ApiToken时间戳错误",
    },
    openKeySignTypeError: {
      code: 20003,
-      message: 'ApiToken签名类型不支持',
+      message: "ApiToken签名类型不支持",
    },
    openParamError: {
      code: 20010,
-      message: '请求参数错误',
+      message: "请求参数错误",
    },
    openCertNotFound: {
      code: 20011,
-      message: '证书不存在',
+      message: "证书不存在",
    },
    openCertNotReady: {
      code: 20012,
-      message: '证书还未生成',
+      message: "证书还未生成",
    },
    openCertApplying: {
      code: 20013,
-      message: '证书正在申请中，请稍后重新获取',
+      message: "证书正在申请中，请稍后重新获取",
    },
-    openDomainNoVerifier:{
+    openDomainNoVerifier: {
      code: 20014,
-      message: '域名校验方式未配置',
+      message: "域名校验方式未配置",
    },
    openEmailNotFound: {
      code: 20021,
-      message: '用户邮箱还未配置',
+      message: "用户邮箱还未配置",
    },
  },
  systemUserId: 0, // 系统级别userid固定为0
-  enterpriseUserId:  -1 // 企业模式用户id固定为-1
+  enterpriseUserId: -1, // 企业模式用户id固定为-1
 };
@@ -1,11 +1,11 @@
-import { ALL, Body, Post, Query } from '@midwayjs/core';
-import { BaseController } from './base-controller.js';
+import { ALL, Body, Post, Query } from "@midwayjs/core";
+import { BaseController } from "./base-controller.js";

 export abstract class CrudController<T> extends BaseController {
  // eslint-disable-next-line @typescript-eslint/no-unused-vars
  abstract getService<T>();

-  @Post('/page')
+  @Post("/page")
  async page(@Body(ALL) body: any) {
    const pageRet = await this.getService().page({
      query: body.query ?? {},
@@ -16,7 +16,7 @@ export abstract class CrudController<T> extends BaseController {
    return this.ok(pageRet);
  }

-  @Post('/list')
+  @Post("/list")
  async list(@Body(ALL) body: any) {
    const listRet = await this.getService().list({
      query: body.query ?? {},
@@ -25,33 +25,33 @@ export abstract class CrudController<T> extends BaseController {
    return this.ok(listRet);
  }

-  @Post('/add')
+  @Post("/add")
  async add(@Body(ALL) bean: any) {
    delete bean.id;
    const id = await this.getService().add(bean);
    return this.ok(id);
  }

-  @Post('/info')
-  async info(@Query('id') id: number) {
+  @Post("/info")
+  async info(@Query("id") id: number) {
    const bean = await this.getService().info(id);
    return this.ok(bean);
  }

-  @Post('/update')
+  @Post("/update")
  async update(@Body(ALL) bean: any) {
    await this.getService().update(bean);
    return this.ok(null);
  }

-  @Post('/delete')
-  async delete(@Query('id') id: number) {
+  @Post("/delete")
+  async delete(@Query("id") id: number) {
    await this.getService().delete([id]);
    return this.ok(null);
  }

-  @Post('/deleteByIds')
-  async deleteByIds(@Body('ids') ids: number[]) {
+  @Post("/deleteByIds")
+  async deleteByIds(@Body("ids") ids: number[]) {
    await this.getService().delete(ids);
    return this.ok(null);
  }
@@ -1,12 +1,14 @@
-import { Constants } from '../constants.js';
-import { BaseException } from './base-exception.js';
+import { Constants } from "../constants.js";
+import { BaseException } from "./base-exception.js";
 /**
 * 通用异常
 */
 export class LoginErrorException extends BaseException {
  leftCount: number;
-  constructor(message, leftCount: number) {
-    super('LoginErrorException', Constants.res.loginError.code, message ? message : Constants.res.loginError.message);
+  userId?: number;
+  constructor(message, leftCount: number, userId?: number) {
+    super("LoginErrorException", Constants.res.loginError.code, message ? message : Constants.res.loginError.message);
    this.leftCount = leftCount;
+    this.userId = userId;
  }
 }
@@ -1,8 +1,9 @@
-export * from './base-controller.js';
-export * from './constants.js';
-export * from './crud-controller.js';
-export * from './enum-item.js';
-export * from './exception/index.js';
-export * from './result.js';
-export * from './base-service.js';
-export * from "./mode.js"
+export * from "./base-controller.js";
+export * from "./constants.js";
+export * from "./crud-controller.js";
+export * from "./enum-item.js";
+export * from "./exception/index.js";
+export * from "./result.js";
+export * from "./base-service.js";
+export * from "./audit.js";
+export * from "./mode.js";
@@ -1,12 +1,12 @@
-let adminMode = "saas"
+let adminMode = "saas";

-export function setAdminMode(mode:string = "saas"){
-  adminMode = mode
+export function setAdminMode(mode: string = "saas") {
+  adminMode = mode;
 }
-export function getAdminMode(){
-  return adminMode
+export function getAdminMode() {
+  return adminMode;
 }

-export function isEnterprise(){
-  return adminMode === "enterprise"
-}
+export function isEnterprise() {
+  return adminMode === "enterprise";
+}
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/midway-flyway-js
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/midway-flyway-js
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/midway-flyway-js
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 **Note:** Version bump only for package @certd/midway-flyway-js
@@ -1,6 +1,6 @@
 {
  "name": "@certd/midway-flyway-js",
-  "version": "1.42.0",
+  "version": "1.42.3",
  "description": "midway with flyway, sql upgrade way ",
  "private": false,
  "type": "module",
@@ -52,5 +52,5 @@
    "typeorm": "^0.3.20",
    "typescript": "^5.4.2"
  },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/plugin-cert
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/plugin-cert
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+**Note:** Version bump only for package @certd/plugin-cert
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 **Note:** Version bump only for package @certd/plugin-cert
@@ -1,7 +1,7 @@
 {
  "name": "@certd/plugin-cert",
  "private": false,
-  "version": "1.42.0",
+  "version": "1.42.3",
  "type": "module",
  "main": "./dist/index.js",
  "types": "./dist/index.d.ts",
@@ -20,7 +20,7 @@
    "lint": "eslint --fix"
  },
  "dependencies": {
-    "@certd/plugin-lib": "^1.42.0"
+    "@certd/plugin-lib": "^1.42.3"
  },
  "devDependencies": {
    "@types/chai": "^4.3.12",
@@ -38,5 +38,5 @@
    "tslib": "^2.8.1",
    "typescript": "^5.4.2"
  },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/plugin-lib
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+**Note:** Version bump only for package @certd/plugin-lib
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+### Performance Improvements
+
+* **certd-server:** 使用 jks-go转换jks证书，大幅精简镜像大小 ([c78898e](https://github.com/certd/certd/commit/c78898e4c10dd1701467d2e42e3f72bd8f2a352f))
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 ### Bug Fixes
@@ -1,7 +1,7 @@
 {
  "name": "@certd/plugin-lib",
  "private": false,
-  "version": "1.42.0",
+  "version": "1.42.3",
  "type": "module",
  "main": "./dist/index.js",
  "types": "./dist/index.d.ts",
@@ -17,9 +17,9 @@
    "lint": "eslint --fix"
  },
  "dependencies": {
-    "@certd/acme-client": "^1.42.0",
-    "@certd/basic": "^1.42.0",
-    "@certd/pipeline": "^1.42.0",
+    "@certd/acme-client": "^1.42.3",
+    "@certd/basic": "^1.42.3",
+    "@certd/pipeline": "^1.42.3",
    "dayjs": "^1.11.7",
    "jszip": "^3.10.1",
    "lodash-es": "^4.17.21",
@@ -45,5 +45,5 @@
    "tslib": "^2.8.1",
    "typescript": "^5.4.2"
  },
-  "gitHead": "bc731e4fb119787930e816a7d57c808b1b5cd66a"
+  "gitHead": "a6ef6996c3a68ce0c2a4577a0934ed74a53f0515"
 }
@@ -1,4 +1,4 @@
-import { ILogger, sp } from "@certd/basic";
+import { ILogger, sp, http } from "@certd/basic";
 import type { CertInfo } from "./cert-reader.js";
 import { CertReader, CertReaderHandleContext } from "./cert-reader.js";
 import path from "path";
@@ -52,6 +52,81 @@ export class CertConverter {
    });
  }

+  async getJksGoPath(): Promise<string> {
+    const osType = process.platform === "win32" ? "windows" : "linux";
+    const jksGoDir = path.resolve("./tools/jks-go");
+    const JKS_GO_VERSION = process.env.JKS_GO_VERSION || "1.0.0";
+
+    const versionFile = path.join(jksGoDir, "version");
+    const finalPath = path.join(jksGoDir, osType === "windows" ? "jks-go.exe" : "jks-go");
+
+    let needDownload = false;
+    if (!fs.existsSync(finalPath)) {
+      needDownload = true;
+    } else if (!fs.existsSync(versionFile)) {
+      needDownload = true;
+    } else {
+      const currentVersion = fs.readFileSync(versionFile, "utf-8").trim();
+      if (currentVersion !== JKS_GO_VERSION) {
+        this.logger.info(`jks-go版本不匹配,当前版本:${currentVersion},期望版本:${JKS_GO_VERSION},准备重新下载`);
+        needDownload = true;
+      }
+    }
+
+    if (!needDownload) {
+      return finalPath;
+    }
+
+    if (!fs.existsSync(jksGoDir)) {
+      fs.mkdirSync(jksGoDir, { recursive: true });
+    }
+
+    const arch = process.arch;
+    let platformArch = "amd64";
+    if (arch === "arm64") {
+      platformArch = "arm64";
+    } else if (arch === "arm") {
+      platformArch = "arm_armv7";
+    }
+
+    let jksGoFileName = `jks-go_${osType}_${platformArch}`;
+    if (osType === "windows") {
+      jksGoFileName += ".exe";
+    }
+
+    const jksGoFilePath = path.join(jksGoDir, jksGoFileName);
+    this.logger.info(`jks-go文件不存在或版本不匹配,准备下载:${jksGoFileName}`);
+    const downloadUrl = `https://atomgit.com/certd/jks-go/releases/download/v${JKS_GO_VERSION}/${jksGoFileName}`;
+    // https://atomgit.com/certd/jks-go/releases/download/v1.0.2/jks-go_linux_amd64
+    const response = await http.request({
+      url: downloadUrl,
+      method: "GET",
+      responseType: "arraybuffer",
+      logRes: false,
+      logParams: false,
+      logData: false,
+    });
+
+    const buffer = Buffer.from(response);
+    fs.writeFileSync(jksGoFilePath, buffer);
+    this.logger.info("下载jks-go成功");
+
+    if (fs.existsSync(finalPath)) {
+      fs.unlinkSync(finalPath);
+    }
+    fs.copyFileSync(jksGoFilePath, finalPath);
+    if (osType === "linux") {
+      await sp.spawn({
+        cmd: `chmod +x ${finalPath}`,
+      });
+    }
+
+    fs.writeFileSync(versionFile, JKS_GO_VERSION, "utf-8");
+    this.logger.info(`jks-go版本已更新为:${JKS_GO_VERSION}`);
+
+    return finalPath;
+  }
+
  private async convertPfx(opts: CertReaderHandleContext, pfxPassword: string, pfxArgs: string) {
    const { tmpCrtPath, tmpKeyPath } = opts;

@@ -118,22 +193,22 @@ export class CertConverter {
    const jksPassword = pfxPassword || "123456";
    try {
      const randomStr = Math.floor(Math.random() * 1000000) + "";
+      const { tmpOnePath } = opts;

-      const p12Path = path.join(os.tmpdir(), "/certd/tmp/", randomStr + `_cert.p12`);
-      const { tmpCrtPath, tmpKeyPath } = opts;
-      let passwordArg = "-passout pass:";
-      if (jksPassword) {
-        passwordArg = `-password pass:${jksPassword}`;
-      }
-      await this.exec(`openssl pkcs12 -export -in ${tmpCrtPath} -inkey ${tmpKeyPath} -out ${p12Path} -name certd ${passwordArg}`);
-
-      const jksPath = path.join(os.tmpdir(), "/certd/tmp/", randomStr + `_cert.jks`);
-      const dir = path.dirname(jksPath);
+      const bundlePath = path.join(os.tmpdir(), "/certd/tmp/", randomStr + `_bundle.pem`);
+      const dir = path.dirname(bundlePath);
      if (!fs.existsSync(dir)) {
        fs.mkdirSync(dir, { recursive: true });
      }
-      await this.exec(`keytool -importkeystore -srckeystore ${p12Path} -srcstoretype PKCS12 -srcstorepass "${jksPassword}" -destkeystore ${jksPath} -deststoretype JKS -deststorepass "${jksPassword}" `);
-      fs.unlinkSync(p12Path);
+
+      const crtContent = fs.readFileSync(tmpOnePath);
+      fs.writeFileSync(bundlePath, crtContent);
+
+      const jksPath = path.join(os.tmpdir(), "/certd/tmp/", randomStr + `_cert.jks`);
+
+      const jksGoPath = await this.getJksGoPath();
+      await this.exec(`${jksGoPath} -importkeystore -srckeystore ${bundlePath} -srcstoretype PEM -destkeystore ${jksPath} -deststorepass "${jksPassword}"`);
+      fs.unlinkSync(bundlePath);

      const fileBuffer = fs.readFileSync(jksPath);
      const certBase64 = fileBuffer.toString("base64");
@@ -18,11 +18,14 @@ COPY . /workspace/
 RUN npm install -g pnpm@10.33.4

 RUN cp /workspace/certd-client/dist/* /workspace/certd-server/public/ -rf
-RUN cd /workspace/certd-server && pnpm install --production && npm run build-on-docker
-
+RUN cd /workspace/certd-server && pnpm install && npm run build-on-docker
+RUN rm -rf /workspace/certd-server/node_modules

 ARG base_type=alpine

+# ------------------------------------------------------------------
+# 构建生产环境镜像
+# ------------------------------------------------------------------
 FROM base-${TARGETARCH}${TARGETVARIANT:+-}${TARGETVARIANT}-${base_type}
 EXPOSE 7001
 EXPOSE 7002
@@ -35,21 +38,16 @@ RUN if [ -f /etc/debian_version ]; then \
        apt-get update \
        && apt-get install -y --no-install-recommends \
            ca-certificates \
-            gnupg \
            wget \
            openssl \
            netcat-openbsd \
            iputils-ping \
            dnsutils \
            iproute2 \
-        && wget -O - https://packages.adoptium.net/artifactory/api/gpg/key/public | gpg --dearmor | tee /usr/share/keyrings/adoptium.gpg > /dev/null \
-        && echo "deb [signed-by=/usr/share/keyrings/adoptium.gpg] https://packages.adoptium.net/artifactory/deb bookworm main" | tee /etc/apt/sources.list.d/adoptium.list \
-        && apt-get update \
-        && apt-get install -y --no-install-recommends temurin-8-jre \
        && apt-get clean \
        && rm -rf /var/lib/apt/lists/*; \
    elif [ -f /etc/alpine-release ]; then \
-        apk add --no-cache openssl openjdk8-jre; \
+        apk add --no-cache openssl wget ca-certificates; \
    else \
        echo "Unsupported base image"; exit 1; \
    fi
@@ -60,6 +58,9 @@ ENV TERM=xterm
 ENV LEGO_VERSION=4.30.1
 ENV LEGO_DOWNLOAD_DIR=/app/tools/lego

+ENV JKS_GO_VERSION=1.0.3
+ENV JKS_GO_DOWNLOAD_DIR=/app/tools/jks-go
+
 ENV ALIYUN_CLIENT_CONNECT_TIMEOUT=10000
 ENV ALIYUN_CLIENT_READ_TIMEOUT=20000

@@ -76,6 +77,26 @@ RUN ARCH=$(uname -m) && \
        echo "Unsupported architecture: $ARCH"; \
    fi

+RUN mkdir -p $JKS_GO_DOWNLOAD_DIR
+
+# 根据架构下载jks-go
+RUN ARCH=$(uname -m) && \
+    if [ "$ARCH" = "x86_64" ]; then \
+        wget -O $JKS_GO_DOWNLOAD_DIR/jks-go_linux_amd64 https://github.com/certd/jks-go/releases/download/v${JKS_GO_VERSION}/jks-go_linux_amd64 && \
+        chmod +x $JKS_GO_DOWNLOAD_DIR/jks-go_linux_amd64 && \
+        ln -s $JKS_GO_DOWNLOAD_DIR/jks-go_linux_amd64 /usr/local/bin/jks-go; \
+    elif [ "$ARCH" = "aarch64" ]; then \
+        wget -O $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm64 https://github.com/certd/jks-go/releases/download/v${JKS_GO_VERSION}/jks-go_linux_arm64 && \
+        chmod +x $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm64 && \
+        ln -s $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm64 /usr/local/bin/jks-go; \
+    elif [ "$ARCH" = "armv7l" ]; then \
+        wget -O $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm_armv7 https://github.com/certd/jks-go/releases/download/v${JKS_GO_VERSION}/jks-go_linux_arm_armv7 && \
+        chmod +x $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm_armv7 && \
+        ln -s $JKS_GO_DOWNLOAD_DIR/jks-go_linux_arm_armv7 /usr/local/bin/jks-go; \
+    else \
+        echo "Unsupported architecture: $ARCH"; \
+    fi
+
 ENV TZ=Asia/Shanghai
 ENV NODE_ENV=production
 ENV MIDWAY_SERVER_ENV=production
@@ -84,5 +105,6 @@ RUN npm install -g pnpm@10.33.4


 COPY --from=builder /workspace/certd-server/ /app/
+RUN pnpm install --production
 COPY ./patch/ssh2/*.js /app/node_modules/.pnpm/node_modules/ssh2/lib/protocol/
 CMD ["node", "--optimize-for-size", "./bootstrap.js"]
@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+**Note:** Version bump only for package @certd/ui-client
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+### Bug Fixes
+
+* 修复企业模式下弹出邮箱绑定提醒的问题 ([8d9dad9](https://github.com/certd/certd/commit/8d9dad9c82f6f2fd3ab3040068946a33f37145b1))
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+### Bug Fixes
+
+* **login:** 修复输入法 composing 状态下回车触发提交的问题 ([b74db81](https://github.com/certd/certd/commit/b74db81304bbe68476bbec5ea4307a2264060e92))
+
+### Performance Improvements
+
+* **pipeline:** 将默认历史保留条数从30调整为100 ([d3e4677](https://github.com/certd/certd/commit/d3e4677ea4fac8e7533749d7f4187e410489e536))
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 ### Performance Improvements
@@ -1,6 +1,6 @@
 {
  "name": "@certd/ui-client",
-  "version": "1.42.0",
+  "version": "1.42.3",
  "private": true,
  "scripts": {
    "dev": "vite --open",
@@ -105,8 +105,8 @@
    "zod-defaults": "^0.1.3"
  },
  "devDependencies": {
-    "@certd/lib-iframe": "^1.42.0",
-    "@certd/pipeline": "^1.42.0",
+    "@certd/lib-iframe": "^1.42.3",
+    "@certd/pipeline": "^1.42.3",
    "@rollup/plugin-commonjs": "^25.0.7",
    "@rollup/plugin-node-resolve": "^15.2.3",
    "@types/chai": "^4.3.12",
@@ -18,6 +18,7 @@ export default {
  openKey: "Open API Key",
  notification: "Notification Settings",
  siteMonitorSetting: "Site Monitor Settings",
+  auditLog: "Audit Log",
  userSecurity: "Security Settings",
  userProfile: "Account Info",
  userGrant: "Grant Delegation",
@@ -67,6 +68,7 @@ export default {
    projectJoin: "Join Project",
    currentProject: "Current Project",
    projectMemberManager: "Project Member",
+    auditLog: "Audit Log",
    domainMonitorSetting: "Domain Monitor Settings",
  },
 };
@@ -18,6 +18,7 @@ export default {
  openKey: "开放接口密钥",
  notification: "通知设置",
  siteMonitorSetting: "站点监控设置",
+  auditLog: "操作日志",
  userSecurity: "认证安全设置",
  userProfile: "账号信息",
  userGrant: "授权委托",
@@ -67,6 +68,7 @@ export default {
    projectJoin: "加入项目",
    currentProject: "当前项目",
    projectMemberManager: "项目成员管理",
+    auditLog: "审计日志",
    domainMonitorSetting: "域名监控设置",
    jobHistory: "监控执行记录",
  },
@@ -287,6 +287,22 @@ export const certdResources = [
              isMenu: true,
            },
          },
+          {
+            title: "certd.auditLog",
+            name: "AuditLog",
+            path: "/certd/audit",
+            component: "/certd/audit/index.vue",
+            meta: {
+              icon: "ion:document-text-outline",
+              auth: true,
+              keepAlive: true,
+              isMenu: true,
+              show: () => {
+                const settingStore = useSettingStore();
+                return settingStore.isPlus;
+              },
+            },
+          },
          {
            title: "certd.userSecurity",
            name: "UserSecurity",
@@ -410,6 +410,22 @@ export const sysResources = [
          },
        ],
      },
+      {
+        title: "certd.sysResources.auditLog",
+        name: "SysAuditLog",
+        path: "/sys/audit",
+        component: "/sys/audit/index.vue",
+        meta: {
+          icon: "ion:document-text-outline",
+          keepAlive: true,
+          auth: true,
+          isMenu: true,
+          show: () => {
+            const settingStore = useSettingStore();
+            return settingStore.isPlus;
+          },
+        },
+      },
      {
        title: "certd.sysResources.netTest",
        name: "NetTest",
@@ -73,6 +73,14 @@ async function handleSubmit() {
  }
 }

+function handleKeydownEnter(e: KeyboardEvent) {
+  if (e.isComposing) {
+    return;
+  }
+  e.preventDefault();
+  handleSubmit();
+}
+
 function handleGo(path: string) {
  router.push(path);
 }
@@ -89,7 +97,7 @@ defineExpose({
 </script>

 <template>
-  <div @keydown.enter.prevent="handleSubmit">
+  <div @keydown.enter="handleKeydownEnter">
    <slot name="title">
      <Title>
        <slot name="title">
@@ -0,0 +1,28 @@
+import { request } from "/src/api/service";
+
+const apiPrefix = "/pi/audit";
+
+export function createAuditApi() {
+  return {
+    async GetList(query: any) {
+      return await request({
+        url: apiPrefix + "/page",
+        method: "post",
+        data: query,
+      });
+    },
+    async DelObj(id: number) {
+      return await request({
+        url: apiPrefix + "/delete",
+        method: "post",
+        params: { id },
+      });
+    },
+    async GetDict() {
+      return await request({
+        url: apiPrefix + "/dict",
+        method: "post",
+      });
+    },
+  };
+}
@@ -0,0 +1,113 @@
+import { CreateCrudOptionsProps, CreateCrudOptionsRet, DelReq, UserPageQuery, UserPageRes, dict } from "@fast-crud/fast-crud";
+import { useI18n } from "/src/locales";
+import { useDicts } from "../dicts";
+
+const typeDict = dict({
+  url: "/pi/audit/dict",
+  getData: async () => {
+    const { createAuditApi } = await import("./api");
+    const api = createAuditApi();
+    const res = await api.GetDict();
+    return res.types || [];
+  },
+});
+
+const actionDict = dict({
+  url: "/pi/audit/dict",
+  getData: async () => {
+    const { createAuditApi } = await import("./api");
+    const api = createAuditApi();
+    const res = await api.GetDict();
+    return res.actions || [];
+  },
+});
+
+export default function ({ crudExpose, context }: CreateCrudOptionsProps): CreateCrudOptionsRet {
+  const { t } = useI18n();
+  const { myProjectDict } = useDicts();
+  const api = context.api;
+
+  const pageRequest = async (query: UserPageQuery): Promise<UserPageRes> => {
+    return await api.GetList(query);
+  };
+  const delRequest = async (req: DelReq) => {
+    return await api.DelObj(req.row.id);
+  };
+
+  return {
+    crudOptions: {
+      request: { pageRequest, delRequest },
+      actionbar: {
+        buttons: {
+          add: { show: false },
+        },
+      },
+      rowHandle: {
+        width: 120,
+        fixed: "right",
+        buttons: {
+          view: { show: false },
+          edit: { show: false },
+          remove: { show: true },
+          copy: { show: false },
+        },
+      },
+      columns: {
+        id: {
+          title: "ID",
+          type: "number",
+          column: { width: 80 },
+          form: { show: false },
+        },
+        createTime: {
+          title: "操作时间",
+          type: "datetime",
+          search: {
+            show: true,
+            component: {
+              name: "a-range-picker",
+            },
+          },
+          column: { width: 170, sorter: true },
+          form: { show: false },
+        },
+        type: {
+          title: "操作类型",
+          type: "dict-select",
+          dict: typeDict,
+          search: { show: true },
+          column: { width: 120 },
+          form: { show: false },
+        },
+        action: {
+          title: "操作动作",
+          type: "text",
+          search: { show: true },
+          column: { width: 200, tooltip: true },
+          form: { show: false },
+        },
+        content: {
+          title: "备注",
+          type: "text",
+          search: { show: true },
+          column: { width: 700, tooltip: true },
+          form: { show: false },
+        },
+        ipAddress: {
+          title: "IP地址",
+          type: "text",
+          column: { width: 140 },
+          form: { show: false },
+        },
+        projectId: {
+          title: t("certd.fields.projectName"),
+          type: "dict-select",
+          dict: myProjectDict,
+          form: {
+            show: false,
+          },
+        },
+      },
+    },
+  };
+}
@@ -0,0 +1,24 @@
+<template>
+  <fs-page>
+    <template #header>
+      <div class="title">
+        操作日志
+        <span class="sub">查看您的操作记录</span>
+      </div>
+    </template>
+    <fs-crud ref="crudRef" v-bind="crudBinding" />
+  </fs-page>
+</template>
+
+<script lang="ts" setup>
+import { useFs } from "@fast-crud/fast-crud";
+import createCrudOptions from "./crud";
+import { createAuditApi } from "./api";
+import { useMounted } from "/@/use/use-mounted";
+
+defineOptions({ name: "AuditLog" });
+
+const api = createAuditApi();
+const { crudBinding, crudRef, crudExpose } = useFs({ createCrudOptions, context: { api } });
+useMounted(() => crudExpose.doRefresh());
+</script>
@@ -207,7 +207,7 @@ export function useCertUpload() {
              const { id } = await api.Save({
                title: pipeline.title,
                content: JSON.stringify(pipeline),
-                keepHistoryCount: 30,
+                keepHistoryCount: 100,
                type: "cert_upload",
                groupId: form.groupId,
              });
@@ -605,7 +605,7 @@ export function useCertPipelineCreator({ formWrapperRef }: { formWrapperRef: Ref
      const { id } = await api.Save({
        title: pipeline.title,
        content: JSON.stringify(pipeline),
-        keepHistoryCount: 30,
+        keepHistoryCount: 100,
        type: "cert",
        groupId,
        addToMonitorEnabled: form.addToMonitorEnabled,
@@ -160,7 +160,7 @@ export async function createPipelineByTemplate(opts: { templateId: number; title
  return await templateApi.CreatePipelineByTemplate({
    title,
    content: JSON.stringify(pipeline),
-    keepHistoryCount: keepHistoryCount ?? 30,
+    keepHistoryCount: keepHistoryCount ?? 100,
    groupId,
    templateId,
  });
@@ -15,11 +15,14 @@ import { Modal, notification } from "ant-design-vue";
 import { useI18n } from "/src/locales";
 import { request } from "/@/api/service";
 import { useFormDialog } from "/@/use/use-dialog";
+import { useSettingStore } from "/@/store/settings/index.jsx";

 const { t } = useI18n();
 const { openFormDialog } = useFormDialog();

 const userStore = useUserStore();
+const settingStore = useSettingStore();
+
 const changePasswordButtonRef = ref();
 const emailFormWrapperRef = ref<any>();

@@ -34,6 +37,9 @@ const validateEmailConfirm = async (_rule: any, value: string) => {
 };

 async function checkAndSetupAccount() {
+  if (settingStore.isEnterprise) {
+    return;
+  }
  try {
    const userInfo = userStore.getUserInfo as any;
    if (!userInfo.needInitAccount) {
@@ -0,0 +1,35 @@
+import { request } from "/src/api/service";
+
+const apiPrefix = "/sys/audit";
+
+export function createSysAuditApi() {
+  return {
+    async GetList(query: any) {
+      return await request({
+        url: apiPrefix + "/page",
+        method: "post",
+        data: query,
+      });
+    },
+    async DelObj(id: number) {
+      return await request({
+        url: apiPrefix + "/delete",
+        method: "post",
+        params: { id },
+      });
+    },
+    async Clean(retentionDays: number) {
+      return await request({
+        url: apiPrefix + "/clean",
+        method: "post",
+        data: { retentionDays },
+      });
+    },
+    async GetDict() {
+      return await request({
+        url: apiPrefix + "/dict",
+        method: "post",
+      });
+    },
+  };
+}
@@ -0,0 +1,167 @@
+import { CreateCrudOptionsProps, CreateCrudOptionsRet, DelReq, UserPageQuery, UserPageRes, dict } from "@fast-crud/fast-crud";
+import { Modal } from "ant-design-vue";
+import { useI18n } from "/src/locales";
+import { useDicts } from "/@/views/certd/dicts";
+
+const typeDict = dict({
+  url: "/sys/audit/dict",
+  getData: async () => {
+    const { createSysAuditApi } = await import("./api");
+    const api = createSysAuditApi();
+    const res = await api.GetDict();
+    return res.types || [];
+  },
+});
+
+const actionDict = dict({
+  url: "/sys/audit/dict",
+  getData: async () => {
+    const { createSysAuditApi } = await import("./api");
+    const api = createSysAuditApi();
+    const res = await api.GetDict();
+    return res.actions || [];
+  },
+});
+
+export default function ({ crudExpose, context }: CreateCrudOptionsProps): CreateCrudOptionsRet {
+  const { t } = useI18n();
+  const { myProjectDict } = useDicts();
+  const api = context.api;
+
+  const pageRequest = async (query: UserPageQuery): Promise<UserPageRes> => {
+    return await api.GetList(query);
+  };
+  const delRequest = async (req: DelReq) => {
+    return await api.DelObj(req.row.id);
+  };
+
+  const cleanExpired = async () => {
+    Modal.confirm({
+      title: "确认清理",
+      content: "确定要清理90天前的审计日志吗？此操作不可撤销。",
+      okText: "确认清理",
+      okType: "danger",
+      cancelText: "取消",
+      async onOk() {
+        await api.Clean(90);
+        crudExpose.doRefresh();
+      },
+    });
+  };
+
+  return {
+    crudOptions: {
+      request: { pageRequest, delRequest },
+      tabs: {
+        name: "scope",
+        show: true,
+        dict: {
+          data: [
+            { value: "system", label: "系统级", color: "red" },
+            { value: "user", label: "用户级", color: "blue" },
+          ],
+        },
+      },
+      actionbar: {
+        buttons: {
+          add: { show: false },
+          clean: {
+            text: "清理过期日志(90天)",
+            type: "primary",
+            danger: true,
+            click: cleanExpired,
+          },
+        },
+      },
+      rowHandle: {
+        width: 120,
+        fixed: "right",
+        buttons: {
+          view: { show: false },
+          edit: { show: false },
+          remove: { show: true },
+          copy: { show: false },
+        },
+      },
+      search: {
+        initialForm: { scope: "system" },
+      },
+      columns: {
+        id: {
+          title: "ID",
+          type: "number",
+          column: { width: 80 },
+          form: { show: false },
+        },
+        createTime: {
+          title: "操作时间",
+          type: "datetime",
+          search: {
+            show: true,
+            component: {
+              name: "a-range-picker",
+            },
+          },
+          column: { width: 170, sorter: true },
+          form: { show: false },
+        },
+        username: {
+          title: "操作人",
+          type: "text",
+          search: { show: true },
+          column: { width: 120 },
+          form: { show: false },
+        },
+        type: {
+          title: "类型",
+          type: "dict-select",
+          dict: typeDict,
+          search: { show: true },
+          column: { width: 120 },
+          form: { show: false },
+        },
+        action: {
+          title: "操作",
+          type: "text",
+          search: { show: true },
+          column: { width: 200, tooltip: true },
+          form: { show: false },
+        },
+        content: {
+          title: "备注",
+          type: "text",
+          search: { show: true },
+          column: { width: 500, tooltip: true },
+          form: { show: false },
+        },
+        ipAddress: {
+          title: "IP地址",
+          type: "text",
+          column: { width: 140 },
+          form: { show: false },
+        },
+        projectId: {
+          title: t("certd.fields.projectName"),
+          type: "dict-select",
+          dict: myProjectDict,
+          form: {
+            show: false,
+          },
+        },
+        scope: {
+          title: "范围",
+          type: "dict-select",
+          dict: dict({
+            data: [
+              { value: "system", label: "系统级", color: "blue" },
+              { value: "user", label: "用户级", color: "green" },
+            ],
+          }),
+          search: { show: true },
+          column: { width: 100 },
+          form: { show: false },
+        },
+      },
+    },
+  };
+}
@@ -0,0 +1,24 @@
+<template>
+  <fs-page>
+    <template #header>
+      <div class="title">
+        操作日志
+        <span class="sub">查看所有用户的操作记录</span>
+      </div>
+    </template>
+    <fs-crud ref="crudRef" v-bind="crudBinding" />
+  </fs-page>
+</template>
+
+<script lang="ts" setup>
+import { useFs } from "@fast-crud/fast-crud";
+import createCrudOptions from "./crud";
+import { createSysAuditApi } from "./api";
+import { useMounted } from "/@/use/use-mounted";
+
+defineOptions({ name: "SysAuditLog" });
+
+const api = createSysAuditApi();
+const { crudBinding, crudRef, crudExpose } = useFs({ createCrudOptions, context: { api } });
+useMounted(() => crudExpose.doRefresh());
+</script>
@@ -1,2 +1,3 @@
 LEGO_VERSION=4.30.1
+JKS_GO_VERSION=1.0.3
 certd_plugin_loadmode=dev
@@ -20,6 +20,7 @@ run/

 .env.pgpl.yaml
 tools/lego/*
+tools/jks-go
 !tools/lego/readme.md
 test.mjs
 isolate-*.log
@@ -3,6 +3,33 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.

+## [1.42.3](https://github.com/certd/certd/compare/v1.42.2...v1.42.3) (2026-07-08)
+
+### Bug Fixes
+
+* **volcengine-alb:** 修复火山引擎ALB 默认证书部署类型会部署到扩展证书的问题 ([0a068a2](https://github.com/certd/certd/commit/0a068a274673e9768954e9f7367c267d44f3b530))
+
+## [1.42.2](https://github.com/certd/certd/compare/v1.42.1...v1.42.2) (2026-07-07)
+
+### Bug Fixes
+
+* 修复火山视频点播源站选择不到自定义源站的bug ([0071bcb](https://github.com/certd/certd/commit/0071bcb0e4dd108c86d7ca01820a9f6e6960e440))
+* 修复企业模式下弹出邮箱绑定提醒的问题 ([8d9dad9](https://github.com/certd/certd/commit/8d9dad9c82f6f2fd3ab3040068946a33f37145b1))
+* 修复AsiaIsp CDN证书重复情况下部署失败的问题 ([c3d6db3](https://github.com/certd/certd/commit/c3d6db3f1ef2f1c897b7989521fe8809dffaded1))
+* 修复cname用阿里云校验时报找不到runtimeDepsService的错误 ([072edd7](https://github.com/certd/certd/commit/072edd7affee424ab3411f4d41d338f084d7cac6))
+
+## [1.42.1](https://github.com/certd/certd/compare/v1.42.0...v1.42.1) (2026-07-06)
+
+### Bug Fixes
+
+* 修复多域名无法使用passkey登录的bug ([d176f9c](https://github.com/certd/certd/commit/d176f9cc0ebd051a614bfac74d1616d1945fc9a3))
+* 修复企业模式下登录报projectId不能为空的问题 ([a65366b](https://github.com/certd/certd/commit/a65366bbe1aadea8baaffbdadab58a5b631d9417))
+
+### Performance Improvements
+
+* **certd-server:** 使用 jks-go转换jks证书，大幅精简镜像大小 ([c78898e](https://github.com/certd/certd/commit/c78898e4c10dd1701467d2e42e3f72bd8f2a352f))
+* **pipeline:** 将默认历史保留条数从30调整为100 ([d3e4677](https://github.com/certd/certd/commit/d3e4677ea4fac8e7533749d7f4187e410489e536))
+
 # [1.42.0](https://github.com/certd/certd/compare/v1.41.4...v1.42.0) (2026-07-05)

 ### Bug Fixes
@@ -0,0 +1,2 @@
+ALTER TABLE `cd_audit_log` ADD COLUMN `scope` varchar(32) NOT NULL DEFAULT 'user';
+CREATE INDEX `index_audit_log_scope` ON `cd_audit_log` (`scope`);
@@ -0,0 +1,2 @@
+ALTER TABLE "cd_audit_log" ADD COLUMN "scope" varchar(32) NOT NULL DEFAULT ('user');
+CREATE INDEX "index_audit_log_scope" ON "cd_audit_log" ("scope");
@@ -0,0 +1,2 @@
+ALTER TABLE "cd_audit_log" ADD COLUMN "scope" varchar(32) NOT NULL DEFAULT ('user');
+CREATE INDEX "index_audit_log_scope" ON "cd_audit_log" ("scope");
@@ -102,6 +102,7 @@ input:
  sourceStationType:
    title: 源站类型
    helper: 选择源站类型
+    value: 1
    component:
      name: a-select
      vModel: value
@@ -110,7 +111,6 @@ input:
          label: 点播源站
        - value: 2
          label: 自定义源站
-      value: 1
      helper: 注意：封面加速域名不支持自定义源站
    required: false
    order: 0
@@ -1,6 +1,6 @@
 {
  "name": "@certd/ui-server",
-  "version": "1.42.0",
+  "version": "1.42.3",
  "description": "fast-server base midway",
  "private": true,
  "type": "module",
@@ -41,20 +41,20 @@
    "lint1": "eslint --fix"
  },
  "dependencies": {
-    "@certd/acme-client": "^1.42.0",
-    "@certd/basic": "^1.42.0",
-    "@certd/commercial-core": "^1.42.0",
+    "@certd/acme-client": "^1.42.3",
+    "@certd/basic": "^1.42.3",
+    "@certd/commercial-core": "^1.42.3",
    "@certd/cv4pve-api-javascript": "^8.4.2",
-    "@certd/jdcloud": "^1.42.0",
-    "@certd/lib-huawei": "^1.42.0",
-    "@certd/lib-k8s": "^1.42.0",
-    "@certd/lib-server": "^1.42.0",
-    "@certd/midway-flyway-js": "^1.42.0",
-    "@certd/pipeline": "^1.42.0",
-    "@certd/plugin-cert": "^1.42.0",
-    "@certd/plugin-lib": "^1.42.0",
-    "@certd/plugin-plus": "^1.42.0",
-    "@certd/plus-core": "^1.42.0",
+    "@certd/jdcloud": "^1.42.3",
+    "@certd/lib-huawei": "^1.42.3",
+    "@certd/lib-k8s": "^1.42.3",
+    "@certd/lib-server": "^1.42.3",
+    "@certd/midway-flyway-js": "^1.42.3",
+    "@certd/pipeline": "^1.42.3",
+    "@certd/plugin-cert": "^1.42.3",
+    "@certd/plugin-lib": "^1.42.3",
+    "@certd/plugin-plus": "^1.42.3",
+    "@certd/plus-core": "^1.42.3",
    "@koa/cors": "^5.0.0",
    "@midwayjs/bootstrap": "3.20.11",
    "@midwayjs/cache": "3.14.0",
@@ -92,7 +92,6 @@
    "log4js": "^6.9.1",
    "lru-cache": "^11.0.1",
    "mitt": "^3.0.1",
-    "mwtsc": "^1.15.1",
    "mysql2": "^3.14.0",
    "nanoid": "^5.0.7",
    "node-forge": "^1.3.1",
@@ -133,6 +132,7 @@
    "esmock": "^2.7.5",
    "mocha": "^10.6.0",
    "mwts": "^1.3.0",
+    "mwtsc": "^1.15.1",
    "prettier": "3.3.3",
    "rimraf": "^5.0.5",
    "ts-node": "^10.9.2",
@@ -12,6 +12,7 @@ import cors from "@koa/cors";
 import { GlobalExceptionMiddleware } from "./middleware/global-exception.js";
 import { PreviewMiddleware } from "./middleware/preview.js";
 import { AuthorityMiddleware } from "./middleware/authority.js";
+import { AuditLogMiddleware } from "./middleware/audit-log.js";
 import { logger } from "@certd/basic";
 import { ResetPasswdMiddleware } from "./middleware/reset-passwd/middleware.js";
 import DefaultConfig from "./config/config.default.js";
@@ -113,6 +114,7 @@ export class MainConfiguration {
      PreviewMiddleware,
      //授权处理
      AuthorityMiddleware,
+      AuditLogMiddleware,

      //resetPasswd,重置密码模式下不提供服务
      ResetPasswdMiddleware,
@@ -132,5 +134,6 @@ export class MainConfiguration {
      logger.info(text);
    });
    logger.info("当前环境：", this.app.getEnv()); // prod
+    
  }
 }
@@ -1,8 +1,9 @@
-import { ALL, Body, Controller, Inject, Post, Provide } from "@midwayjs/core";
+import { ALL, Body, Controller, Inject, Post, Provide } from "@midwayjs/core";
 import { BaseController, CommonException, Constants, SysSettingsService } from "@certd/lib-server";
 import { CodeService } from "../../../modules/basic/service/code-service.js";
 import { UserService } from "../../../modules/sys/authority/service/user-service.js";
 import { LoginService } from "../../../modules/login/service/login-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -19,7 +20,11 @@ export class ForgotPasswordController extends BaseController {
  @Inject()
  sysSettingsService: SysSettingsService;

-  @Post("/forgotPassword", { description: Constants.per.guest })
+  getAuditType(): string {
+    return AuditType.login;
+  }
+
+  @Post("/forgotPassword", { description: Constants.per.guest, summary: "找回密码" })
  public async forgotPassword(
    @Body(ALL)
    body: any
@@ -28,15 +33,13 @@ export class ForgotPasswordController extends BaseController {
    if (!sysSettings.selfServicePasswordRetrievalEnabled) {
      throw new CommonException("暂未开启自助找回");
    }
-    // 找回密码的验证码允许错误次数
-    const maxErrorCount = 5;

    if (body.type === "email") {
      this.codeService.checkEmailCode({
        verificationType: "forgotPassword",
        email: body.input,
        validateCode: body.validateCode,
-        maxErrorCount: maxErrorCount,
+        maxErrorCount: 5,
        throwError: true,
      });
    } else if (body.type === "mobile") {
@@ -45,14 +48,15 @@ export class ForgotPasswordController extends BaseController {
        mobile: body.input,
        phoneCode: body.phoneCode,
        smsCode: body.validateCode,
-        maxErrorCount: maxErrorCount,
+        maxErrorCount: 5,
        throwError: true,
      });
    } else {
      throw new CommonException("暂不支持的找回类型,请联系管理员找回");
    }
-    const username = await this.userService.forgotPassword(body);
+    const {id,username} = await this.userService.forgotPassword(body);
    username && this.loginService.clearCacheOnSuccess(username);
+    this.auditLog({ userId: id, content: "用户请求找回密码" });
    return this.ok();
  }
 }
@@ -1,10 +1,11 @@
-import { ALL, Body, Controller, Inject, Post, Provide, RequestIP } from "@midwayjs/core";
+import { ALL, Body, Controller, Inject, Post, Provide, RequestIP } from "@midwayjs/core";
 import { LoginService } from "../../../modules/login/service/login-service.js";
 import { AddonService, BaseController, Constants, SysPublicSettings, SysSettingsService } from "@certd/lib-server";
 import { CodeService } from "../../../modules/basic/service/code-service.js";
 import { checkComm } from "@certd/plus-core";
 import { CaptchaService } from "../../../modules/basic/service/captcha-service.js";
 import { PasskeyService } from "../../../modules/login/service/passkey-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -27,7 +28,11 @@ export class LoginController extends BaseController {
  @Inject()
  passkeyService: PasskeyService;

-  @Post("/login", { description: Constants.per.guest })
+  getAuditType(): string {
+    return AuditType.login;
+  }
+
+  @Post("/login", { description: Constants.per.guest, summary: "用户名密码登录" })
  public async login(
    @Body(ALL)
    body: any,
@@ -38,16 +43,22 @@ export class LoginController extends BaseController {
    if (settings.captchaEnabled === true) {
      await this.captchaService.doValidate({ form: body.captcha, must: false, captchaAddonId: settings.captchaAddonId, req: { remoteIp } });
    }
-    const token = await this.loginService.loginByPassword(body);
-    this.writeTokenCookie(token);
-    return this.ok(token);
+    try {
+      const token = await this.loginService.loginByPassword(body);
+      this.writeTokenCookie(token);
+      this.auditLog({ userId: token.userId, username: body.username, content: `用户「${body.username}」登录成功` });
+      return this.ok(token);
+    } catch (err:any) {
+      this.auditLog({userId:err.userId, username: body.username, content: `用户「${body.username}」登录失败` });
+      throw err;
+    }
  }

  private writeTokenCookie(token: { expire: any; token: any }) {
    // this.loginService.writeTokenCookie(this.ctx,token);
  }

-  @Post("/loginBySms", { description: Constants.per.guest })
+  @Post("/loginBySms", { description: Constants.per.guest, summary: "短信验证码登录" })
  public async loginBySms(
    @Body(ALL)
    body: any
@@ -58,31 +69,42 @@ export class LoginController extends BaseController {
    }
    checkComm();

-    const token = await this.loginService.loginBySmsCode({
-      phoneCode: body.phoneCode,
-      mobile: body.mobile,
-      smsCode: body.smsCode,
-      randomStr: body.randomStr,
-      inviteCode: body.inviteCode,
-    });
+    try {
+      const token = await this.loginService.loginBySmsCode({
+        phoneCode: body.phoneCode,
+        mobile: body.mobile,
+        smsCode: body.smsCode,
+        randomStr: body.randomStr,
+        inviteCode: body.inviteCode,
+      });

-    this.writeTokenCookie(token);
-
-    return this.ok(token);
+      this.writeTokenCookie(token);
+      this.auditLog({ userId: token.userId, username: body.mobile, content: `用户「${body.mobile}」短信登录成功` });
+      return this.ok(token);
+    } catch (err) {
+      this.auditLog({ userId: err.userId, username: body.mobile, content: `用户「${body.mobile}」短信登录失败` });
+      throw err;
+    }
  }

-  @Post("/loginByTwoFactor", { description: Constants.per.guest })
+  @Post("/loginByTwoFactor", { description: Constants.per.guest, summary: "两步验证登录" })
  public async loginByTwoFactor(
    @Body(ALL)
    body: any
  ) {
-    const token = await this.loginService.loginByTwoFactor({
-      loginId: body.loginId,
-      verifyCode: body.verifyCode,
-    });
+    try {
+      const token = await this.loginService.loginByTwoFactor({
+        loginId: body.loginId,
+        verifyCode: body.verifyCode,
+      });

-    this.writeTokenCookie(token);
-    return this.ok(token);
+      this.writeTokenCookie(token);
+      this.auditLog({ userId: token.userId, username: body.loginId, content: `用户「${body.loginId}」两步验证登录成功` });
+      return this.ok(token);
+    } catch (err) {
+      this.auditLog({ userId: err.userId, username: body.loginId, content: `用户「${body.loginId}」两步验证登录失败` });
+      throw err;
+    }
  }

  @Post("/passkey/generateAuthentication", { description: Constants.per.guest })
@@ -92,24 +114,30 @@ export class LoginController extends BaseController {
    return this.ok(options);
  }

-  @Post("/loginByPasskey", { description: Constants.per.guest })
+  @Post("/loginByPasskey", { description: Constants.per.guest, summary: "Passkey登录" })
  public async loginByPasskey(
    @Body(ALL)
    body: any
  ) {
-    const credential = body.credential;
-    const challenge = body.challenge;
+    try {
+      const credential = body.credential;
+      const challenge = body.challenge;

-    const token = await this.loginService.loginByPasskey(
-      {
-        credential,
-        challenge,
-      },
-      this.ctx
-    );
+      const token = await this.loginService.loginByPasskey(
+        {
+          credential,
+          challenge,
+        },
+        this.ctx
+      );

-    // this.writeTokenCookie(token);
-    return this.ok(token);
+      this.writeTokenCookie(token);
+      this.auditLog({ userId: token.userId, content: "用户Passkey登录成功" });
+      return this.ok(token);
+    } catch (err) {
+      this.auditLog({ userId: err.userId, content: "用户Passkey登录失败" });
+      throw err;
+    }
  }

  @Post("/logout", { description: Constants.per.authOnly })
@@ -1,4 +1,4 @@
-import { logger, simpleNanoId, utils } from "@certd/basic";
+import { logger, simpleNanoId, utils } from "@certd/basic";
 import { addonRegistry, AddonService, BaseController, Constants, SysInstallInfo, SysSettingsService } from "@certd/lib-server";
 import { checkPlus } from "@certd/plus-core";
 import { ALL, Body, Controller, Get, Inject, Param, Post, Provide, Query } from "@midwayjs/core";
@@ -8,6 +8,7 @@ import { LoginService } from "../../../modules/login/service/login-service.js";
 import { OauthBoundService } from "../../../modules/login/service/oauth-bound-service.js";
 import { AddonGetterService } from "../../../modules/pipeline/service/addon-getter-service.js";
 import { UserEntity } from "../../../modules/sys/authority/entity/user.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";
 import { IOauthProvider } from "../../../plugins/plugin-oauth/api.js";

 type OauthProviderSetting = {
@@ -48,6 +49,10 @@ export class ConnectController extends BaseController {
  @Inject()
  addonService: AddonService;

+  getAuditType(): string {
+    return AuditType.login;
+  }
+
  private async getOauthProvider(type: string) {
    const publicSettings = await this.sysSettingsService.getPublicSettings();
    if (!publicSettings?.oauthEnabled) {
@@ -68,12 +73,11 @@ export class ConnectController extends BaseController {
    };
  }

-  @Post("/login", { description: Constants.per.guest })
+  @Post("/login", { description: Constants.per.guest, summary: "第三方登录" })
  public async login(@Body(ALL) body: { type: string; subtype?: string; forType?: string; from?: string }) {
    const oauthProvider = await this.getOauthProvider(body.type);
    const installInfo = await this.sysSettingsService.getSetting<SysInstallInfo>(SysInstallInfo);
    const bindUrl = installInfo?.bindUrl || "";
-    //构造登录url
    const redirectUrl = `${bindUrl}api/oauth/callback/${body.type}`;

    const stateObj = {
@@ -95,8 +99,6 @@ export class ConnectController extends BaseController {
    });
    this.ctx.cookies.set("oauth_ticket", ticket, {
      httpOnly: true,
-      // secure: true,
-      // sameSite: "strict",
    });
    return this.ok({ loginUrl, ticket });
  }
@@ -153,7 +155,7 @@ export class ConnectController extends BaseController {
    }
  }

-  @Post("/getLogoutUrl", { description: Constants.per.guest })
+  @Post("/getLogoutUrl", { description: Constants.per.guest, summary: "第三方登出" })
  public async logout(@Body(ALL) body: any) {
    checkPlus();
    const oauthProvider = await this.getOauthProvider(body.type);
@@ -195,7 +197,7 @@ export class ConnectController extends BaseController {
    // this.loginService.writeTokenCookie(this.ctx,token);
  }

-  @Post("/autoRegister", { description: Constants.per.guest })
+  @Post("/autoRegister", { description: Constants.per.guest, summary: "第三方自动注册" })
  public async autoRegister(@Body(ALL) body: { validationCode: string; type: string; inviteCode?: string }) {
    const validationValue = this.codeService.getValidationValue(body.validationCode);
    if (!validationValue) {
@@ -219,12 +221,12 @@ export class ConnectController extends BaseController {

    const loginRes = await this.loginService.generateToken(newUser);
    this.writeTokenCookie(loginRes);
+    this.auditLog({ userId: newUser.id, content: `第三方账号自动注册,类型: ${body.type}` });
    return this.ok(loginRes);
  }

-  @Post("/bind", { description: Constants.per.loginOnly })
+  @Post("/bind", { description: Constants.per.loginOnly, summary: "绑定第三方账号" })
  public async bind(@Body(ALL) body: any) {
-    //需要已登录
    const userId = this.getUserId();
    const validationValue = this.codeService.getValidationValue(body.validationCode);
    if (!validationValue) {
@@ -238,17 +240,18 @@ export class ConnectController extends BaseController {
      type,
      openId,
    });
+    this.auditLog({ userId, content: `第三方账号绑定,类型: ${body.type}` });
    return this.ok(1);
  }

-  @Post("/unbind", { description: Constants.per.loginOnly })
+  @Post("/unbind", { description: Constants.per.loginOnly, summary: "解绑第三方账号" })
  public async unbind(@Body(ALL) body: any) {
-    //需要已登录
    const userId = this.getUserId();
    await this.oauthBoundService.unbind({
      userId,
      type: body.type,
    });
+    this.auditLog({ userId, content: `第三方账号解绑,类型: ${body.type}` });
    return this.ok(1);
  }

@@ -1,9 +1,10 @@
-import { ALL, Body, Controller, Inject, Post, Provide, RequestIP } from "@midwayjs/core";
+import { ALL, Body, Controller, Inject, Post, Provide, RequestIP } from "@midwayjs/core";
 import { BaseController, Constants, SysSettingsService } from "@certd/lib-server";
 import { RegisterType } from "../../../modules/sys/authority/service/user-service.js";
 import { CodeService } from "../../../modules/basic/service/code-service.js";
 import { checkComm, checkPlus } from "@certd/plus-core";
 import { LoginService } from "../../../modules/login/service/login-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 export type RegisterReq = {
  type: RegisterType;
@@ -31,7 +32,11 @@ export class RegisterController extends BaseController {
  @Inject()
  sysSettingsService: SysSettingsService;

-  @Post("/register", { description: Constants.per.guest })
+  getAuditType(): string {
+    return AuditType.login;
+  }
+
+  @Post("/register", { description: Constants.per.guest, summary: "用户注册" })
  public async register(
    @Body(ALL)
    body: RegisterReq,
@@ -60,6 +65,7 @@ export class RegisterController extends BaseController {
        password: body.password,
      } as any;
      const newUser = await this.loginService.register(body.type, registerUser, body.inviteCode);
+      this.auditLog({ userId: newUser.id, username: body.username, content: `用户「${body.username}」注册成功` });
      return this.ok(newUser);
    } else if (body.type === "mobile") {
      if (sysPublicSettings.mobileRegisterEnabled === false) {
@@ -80,6 +86,7 @@ export class RegisterController extends BaseController {
        password: body.password,
      } as any;
      const newUser = await this.loginService.register(body.type, registerUser, body.inviteCode);
+      this.auditLog({ userId: newUser.id, username: body.mobile, content: `用户「${body.mobile}」注册成功` });
      return this.ok(newUser);
    } else if (body.type === "email") {
      if (sysPublicSettings.emailRegisterEnabled === false) {
@@ -97,6 +104,7 @@ export class RegisterController extends BaseController {
        password: body.password,
      } as any;
      const newUser = await this.loginService.register(body.type, registerUser, body.inviteCode);
+      this.auditLog({ userId: newUser.id, username: body.email, content: `用户「${body.email}」注册成功` });
      return this.ok(newUser);
    }
  }
@@ -1,5 +1,6 @@
 import { ALL, Body, Controller, Inject, Post, Provide } from "@midwayjs/core";
 import { BaseController, PlusService, SysInstallInfo, SysSettingsService } from "@certd/lib-server";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 export type PreBindUserReq = {
  userId: number;
@@ -18,17 +19,21 @@ export class BasicController extends BaseController {
  @Inject()
  sysSettingsService: SysSettingsService;

-  @Post("/preBindUser", { description: "sys:settings:edit" })
+  getAuditType(): string {
+    return AuditType.account;
+  }
+
+  @Post("/preBindUser", { description: "sys:settings:edit", summary: "预绑定用户" })
  public async preBindUser(@Body(ALL) body: PreBindUserReq) {
-    // 设置缓存内容
    if (body.userId == null || body.userId <= 0) {
      throw new Error("用户ID不能为空");
    }
    await this.plusService.userPreBind(body.userId);
+    await this.auditLog({ content: `预绑定了用户(ID:${body.userId})` });
    return this.ok({});
  }

-  @Post("/bindUser", { description: "sys:settings:edit" })
+  @Post("/bindUser", { description: "sys:settings:edit", summary: "绑定用户" })
  public async bindUser(@Body(ALL) body: BindUserReq) {
    if (body.userId == null || body.userId <= 0) {
      throw new Error("用户ID不能为空");
@@ -36,20 +41,23 @@ export class BasicController extends BaseController {
    const installInfo: SysInstallInfo = await this.sysSettingsService.getSetting(SysInstallInfo);
    installInfo.bindUserId = body.userId;
    await this.sysSettingsService.saveSetting(installInfo);
+    await this.auditLog({ content: `绑定了用户(ID:${body.userId})` });
    return this.ok({});
  }

-  @Post("/unbindUser", { description: "sys:settings:edit" })
+  @Post("/unbindUser", { description: "sys:settings:edit", summary: "解绑用户" })
  public async unbindUser() {
    const installInfo: SysInstallInfo = await this.sysSettingsService.getSetting(SysInstallInfo);
    installInfo.bindUserId = null;
    await this.sysSettingsService.saveSetting(installInfo);
+    await this.auditLog({ content: "解绑了用户" });
    return this.ok({});
  }

-  @Post("/updateLicense", { description: "sys:settings:edit" })
+  @Post("/updateLicense", { description: "sys:settings:edit", summary: "更新许可证" })
  public async updateLicense(@Body(ALL) body: { license: string }) {
    await this.plusService.updateLicense(body.license);
+    await this.auditLog({ content: "更新了许可证" });
    return this.ok(true);
  }
 }
@@ -0,0 +1,42 @@
+import { BaseController, Constants } from "@certd/lib-server";
+import { ALL, Body, Controller, Inject, Post, Provide, Query } from "@midwayjs/core";
+import { ApiTags } from "@midwayjs/swagger";
+import { AuditService } from "../../../modules/sys/enterprise/service/audit-service.js";
+import { buildAuditTypeDict, buildAuditActionDict } from "../../../modules/sys/enterprise/service/audit-constants.js";
+
+@Provide()
+@ApiTags(["audit"])
+@Controller("/api/sys/audit")
+export class SysAuditLogController extends BaseController {
+  @Inject()
+  auditService: AuditService;
+
+  @Post("/page", { description: Constants.per.authOnly, summary: "分页查询审计日志" })
+  async page(@Body(ALL) body: any) {
+    if (body.query?.scope) {
+      delete body.query.userId;
+    }
+    const pageRet = await this.auditService.page(body);
+    return this.ok(pageRet);
+  }
+
+  @Post("/delete", { description: Constants.per.authOnly, summary: "删除审计日志" })
+  async delete(@Query("id") id: number) {
+    await this.auditService.delete([id]);
+    return this.ok({});
+  }
+
+  @Post("/clean", { description: Constants.per.authOnly, summary: "清理过期审计日志" })
+  async clean(@Body("retentionDays") retentionDays: number) {
+    const count = await this.auditService.cleanExpired(retentionDays || 90);
+    return this.ok({ deletedCount: count });
+  }
+
+  @Post("/dict", { description: Constants.per.authOnly, summary: "获取审计类型和动作字典" })
+  async getDict() {
+    return this.ok({
+      types: buildAuditTypeDict(),
+      actions: buildAuditActionDict(),
+    });
+  }
+}
@@ -1,6 +1,7 @@
 import { ALL, Body, Controller, Inject, Post, Provide, Query } from "@midwayjs/core";
 import { CrudController } from "@certd/lib-server";
 import { PermissionService } from "../../../modules/sys/authority/service/permission-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 * 权限资源
@@ -14,8 +15,11 @@ export class PermissionController extends CrudController<PermissionService> {
  getService() {
    return this.service;
  }
+  getAuditType(): string {
+    return AuditType.permission;
+  }

-  @Post("/page", { description: "sys:auth:per:view" })
+  @Post("/page", { description: "sys:auth:per:view", summary: "查询权限分页列表" })
  async page(
    @Body(ALL)
    body
@@ -23,30 +27,42 @@ export class PermissionController extends CrudController<PermissionService> {
    return await super.page(body);
  }

-  @Post("/add", { description: "sys:auth:per:add" })
+  @Post("/add", { description: "sys:auth:per:add", summary: "添加权限" })
  async add(
    @Body(ALL)
    bean
  ) {
-    return await super.add(bean);
+    const res = await super.add(bean);
+    await this.auditLog({
+      content: `新增了权限「${bean.name}」(ID:${res.data})`,
+    });
+    return res;
  }

-  @Post("/update", { description: "sys:auth:per:edit" })
+  @Post("/update", { description: "sys:auth:per:edit", summary: "更新权限" })
  async update(
    @Body(ALL)
    bean
  ) {
-    return await super.update(bean);
+    const res = await super.update(bean);
+    await this.auditLog({
+      content: `修改了权限「${bean.name}」(ID:${bean.id})`,
+    });
+    return res;
  }
-  @Post("/delete", { description: "sys:auth:per:remove" })
+  @Post("/delete", { description: "sys:auth:per:remove", summary: "删除权限" })
  async delete(
    @Query("id")
    id: number
  ) {
-    return await super.delete(id);
+    const res = await super.delete(id);
+    await this.auditLog({
+      content: `删除了权限(ID:${id})`,
+    });
+    return res;
  }

-  @Post("/tree", { description: "sys:auth:per:view" })
+  @Post("/tree", { description: "sys:auth:per:view", summary: "查询权限树" })
  async tree() {
    const tree = await this.service.tree({});
    return this.ok(tree);
@@ -1,6 +1,7 @@
 import { ALL, Body, Controller, Inject, Post, Provide, Query } from "@midwayjs/core";
 import { CrudController } from "@certd/lib-server";
 import { RoleService } from "../../../modules/sys/authority/service/role-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 * 系统用户
@@ -15,6 +16,10 @@ export class RoleController extends CrudController<RoleService> {
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.role;
+  }
+
  @Post("/page", { description: "sys:auth:role:view" })
  async page(
    @Body(ALL)
@@ -29,22 +34,30 @@ export class RoleController extends CrudController<RoleService> {
    return this.ok(ret);
  }

-  @Post("/add", { description: "sys:auth:role:add" })
+  @Post("/add", { description: "sys:auth:role:add", summary: "新增角色" })
  async add(
    @Body(ALL)
    bean
  ) {
-    return await super.add(bean);
+    const res = await super.add(bean);
+    await this.auditLog({
+      content: `新增了角色「${bean.name}」(ID:${res.data})`,
+    });
+    return res;
  }

-  @Post("/update", { description: "sys:auth:role:edit" })
+  @Post("/update", { description: "sys:auth:role:edit", summary: "修改角色" })
  async update(
    @Body(ALL)
    bean
  ) {
-    return await super.update(bean);
+    const res = await super.update(bean);
+    await this.auditLog({
+      content: `修改了角色「${bean.name}」(ID:${bean.id})`,
+    });
+    return res;
  }
-  @Post("/delete", { description: "sys:auth:role:remove" })
+  @Post("/delete", { description: "sys:auth:role:remove", summary: "删除角色" })
  async delete(
    @Query("id")
    id: number
@@ -52,7 +65,11 @@ export class RoleController extends CrudController<RoleService> {
    if (id === 1) {
      throw new Error("不能删除默认的管理员角色");
    }
-    return await super.delete(id);
+    const res = await super.delete(id);
+    await this.auditLog({
+      content: `删除了角色(ID:${id})`,
+    });
+    return res;
  }

  @Post("/getPermissionTree", { description: "sys:auth:role:view" })
@@ -78,9 +95,10 @@ export class RoleController extends CrudController<RoleService> {
   * @param roleId
   * @param permissionIds
   */
-  @Post("/authz", { description: "sys:auth:role:edit" })
+  @Post("/authz", { description: "sys:auth:role:edit", summary: "角色授权" })
  async authz(@Body("roleId") roleId, @Body("permissionIds") permissionIds) {
    await this.service.authz(roleId, permissionIds);
+    await this.auditLog({ content: `为角色(ID:${roleId})进行了授权` });
    return this.ok(null);
  }
 }
@@ -6,6 +6,7 @@ import { PermissionService } from "../../../modules/sys/authority/service/permis
 import { Constants } from "@certd/lib-server";
 import { In } from "typeorm";
 import { LoginService } from "../../../modules/login/service/login-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 * 系统用户
@@ -24,6 +25,10 @@ export class UserController extends CrudController<UserService> {
  @Inject()
  loginService: LoginService;

+  getAuditType(): string {
+    return AuditType.user;
+  }
+
  getService() {
    return this.service;
  }
@@ -92,23 +97,31 @@ export class UserController extends CrudController<UserService> {
    return ret;
  }

-  @Post("/add", { description: "sys:auth:user:add" })
+  @Post("/add", { description: "sys:auth:user:add", summary: "新增用户" })
  async add(
    @Body(ALL)
    bean
  ) {
-    return await super.add(bean);
+    const res = await super.add(bean);
+    await this.auditLog({
+      content: `新增了用户「${bean.username}」(ID:${res.data})`,
+    });
+    return res;
  }

-  @Post("/update", { description: "sys:auth:user:edit" })
+  @Post("/update", { description: "sys:auth:user:edit", summary: "修改用户" })
  async update(
    @Body(ALL)
    bean
  ) {
-    return await super.update(bean);
+    const res = await super.update(bean);
+    await this.auditLog({
+      content: `修改了用户「${bean.username}」(ID:${bean.id})`,
+    });
+    return res;
  }

-  @Post("/delete", { description: "sys:auth:user:remove" })
+  @Post("/delete", { description: "sys:auth:user:remove", summary: "删除用户" })
  async delete(
    @Query("id")
    id: number
@@ -119,19 +132,24 @@ export class UserController extends CrudController<UserService> {
    if (id === 3) {
      throw new Error("不能删除默认的普通用户角色");
    }
-    return await super.delete(id);
+    const res = await super.delete(id);
+    await this.auditLog({
+      content: `删除了用户(ID:${id})`,
+    });
+    return res;
  }

  /**
   * 解除登录锁定
   */
-  @Post("/unlockBlock", { description: "sys:auth:user:edit" })
+  @Post("/unlockBlock", { description: "sys:auth:user:edit", summary: "解锁登录锁定" })
  public async unlockBlock(@Body("id") id: number) {
    const info = await this.service.info(id, ["password"]);
    this.loginService.clearCacheOnSuccess(info.username);
    if (info.mobile) {
      this.loginService.clearCacheOnSuccess(info.mobile);
    }
+    await this.auditLog({ content: `解锁了用户登录锁定(ID:${id})` });
    return this.ok(info);
  }

@@ -2,6 +2,7 @@ import { ALL, Body, Controller, Inject, Post, Provide, Query } from "@midwayjs/c
 import { CrudController } from "@certd/lib-server";
 import { merge } from "lodash-es";
 import { CnameProviderService } from "../../../modules/cname/service/cname-provider-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 * 授权
@@ -16,6 +17,10 @@ export class CnameRecordController extends CrudController<CnameProviderService>
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.cname;
+  }
+
  @Post("/page", { description: "sys:settings:view" })
  async page(@Body(ALL) body: any) {
    body.query = body.query ?? {};
@@ -27,7 +32,7 @@ export class CnameRecordController extends CrudController<CnameProviderService>
    return super.list(body);
  }

-  @Post("/add", { description: "sys:settings:edit" })
+  @Post("/add", { description: "sys:settings:edit", summary: "添加CNAME服务" })
  async add(@Body(ALL) bean: any) {
    const def: any = {
      isDefault: false,
@@ -35,13 +40,17 @@ export class CnameRecordController extends CrudController<CnameProviderService>
    };
    merge(bean, def);
    bean.userId = this.getUserId();
-    return super.add(bean);
+    const res = await super.add(bean);
+    await this.auditLog({ content: `添加了CNAME服务(ID:${res.data})` });
+    return res;
  }

-  @Post("/update", { description: "sys:settings:edit" })
+  @Post("/update", { description: "sys:settings:edit", summary: "更新CNAME服务" })
  async update(@Body(ALL) bean: any) {
    bean.userId = this.getUserId();
-    return super.update(bean);
+    const res = await super.update(bean);
+    await this.auditLog({ content: `更新了CNAME服务(ID:${bean.id})` });
+    return res;
  }

  @Post("/info", { description: "sys:settings:view" })
@@ -49,26 +58,31 @@ export class CnameRecordController extends CrudController<CnameProviderService>
    return super.info(id);
  }

-  @Post("/delete", { description: "sys:settings:edit" })
+  @Post("/delete", { description: "sys:settings:edit", summary: "删除CNAME服务" })
  async delete(@Query("id") id: number) {
-    return super.delete(id);
+    const res = await super.delete(id);
+    await this.auditLog({ content: `删除了CNAME服务(ID:${id})` });
+    return res;
  }

-  @Post("/deleteByIds", { description: "sys:settings:edit" })
+  @Post("/deleteByIds", { description: "sys:settings:edit", summary: "批量删除CNAME服务" })
  async deleteByIds(@Body("ids") ids: number[]) {
    const res = await this.service.delete(ids);
+    await this.auditLog({ content: `批量删除了${ids.length}条CNAME服务` });
    return this.ok(res);
  }

-  @Post("/setDefault", { description: "sys:settings:edit" })
+  @Post("/setDefault", { description: "sys:settings:edit", summary: "设置默认CNAME服务" })
  async setDefault(@Body("id") id: number) {
    await this.service.setDefault(id);
+    await this.auditLog({ content: `设置了默认CNAME服务(ID:${id})` });
    return this.ok();
  }

-  @Post("/setDisabled", { description: "sys:settings:edit" })
+  @Post("/setDisabled", { description: "sys:settings:edit", summary: "禁用/启用CNAME服务" })
  async setDisabled(@Body("id") id: number, @Body("disabled") disabled: boolean) {
    await this.service.setDisabled(id, disabled);
+    await this.auditLog({ content: `${disabled ? "禁用" : "启用"}了CNAME服务(ID:${id})` });
    return this.ok();
  }
 }
@@ -3,6 +3,7 @@ import { ALL, Body, Controller, Inject, Post, Provide, Query } from "@midwayjs/c
 import { ProjectService } from "../../../modules/sys/enterprise/service/project-service.js";
 import { ProjectEntity } from "../../../modules/sys/enterprise/entity/project.js";
 import { merge } from "lodash-es";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -15,22 +16,26 @@ export class SysProjectController extends CrudController<ProjectEntity> {
  @Inject()
  sysSettingsService: SysSettingsService;

+  getAuditType(): string {
+    return AuditType.project;
+  }
+
  getService<T>() {
    return this.service;
  }

-  @Post("/page", { description: "sys:settings:view" })
+  @Post("/page", { description: "sys:settings:view", summary: "查询项目分页列表" })
  async page(@Body(ALL) body: any) {
    body.query = body.query ?? {};
    return await super.page(body);
  }

-  @Post("/list", { description: "sys:settings:view" })
+  @Post("/list", { description: "sys:settings:view", summary: "查询项目列表" })
  async list(@Body(ALL) body: any) {
    return super.list(body);
  }

-  @Post("/add", { description: "sys:settings:edit" })
+  @Post("/add", { description: "sys:settings:edit", summary: "添加项目" })
  async add(@Body(ALL) bean: any) {
    const def: any = {
      isDefault: false,
@@ -38,37 +43,57 @@ export class SysProjectController extends CrudController<ProjectEntity> {
    };
    merge(bean, def);
    bean.userId = this.getUserId();
-    return super.add({
+    const res = await super.add({
      ...bean,
      userId: -1, //企业用户id固定为-1
      adminId: bean.userId,
    });
+    await this.auditLog({
+      content: `新增了项目「${bean.name}」(ID:${res.data})`,
+    });
+    return res;
  }

-  @Post("/update", { description: "sys:settings:edit" })
+  @Post("/update", { description: "sys:settings:edit", summary: "更新项目" })
  async update(@Body(ALL) bean: any) {
    bean.userId = this.getUserId();
-    return super.update(bean);
+    const res = await super.update(bean);
+    await this.auditLog({
+      content: `修改了项目「${bean.name}」(ID:${bean.id})`,
+    });
+    return res;
  }

-  @Post("/info", { description: "sys:settings:view" })
+  @Post("/info", { description: "sys:settings:view", summary: "查询项目详情" })
  async info(@Query("id") id: number) {
    return super.info(id);
  }

-  @Post("/delete", { description: "sys:settings:edit" })
+  @Post("/delete", { description: "sys:settings:edit", summary: "删除项目" })
  async delete(@Query("id") id: number) {
-    return super.delete(id);
+    const res = await super.delete(id);
+    await this.auditLog({
+      content: `删除了项目(ID:${id})`,
+    });
+    return res;
  }

-  @Post("/deleteByIds", { description: "sys:settings:edit" })
+  @Post("/deleteByIds", { description: "sys:settings:edit", summary: "批量删除项目" })
  async deleteByIds(@Body("ids") ids: number[]) {
    const res = await this.service.delete(ids);
+    await this.auditLog({
+      content: `批量删除了${ids.length}个项目`,
+    });
    return this.ok(res);
  }
-  @Post("/setDisabled", { description: "sys:settings:edit" })
+  @Post("/setDisabled", { description: "sys:settings:edit", summary: "禁用/启用项目" })
  async setDisabled(@Body("id") id: number, @Body("disabled") disabled: boolean) {
    await this.service.setDisabled(id, disabled);
+    const project = await this.service.info(id);
+    const actionText = disabled ? "禁用了" : "启用了";
+    await this.auditLog({
+      content: `${actionText}项目「${project.name}」(ID:${id})`,
+    });
    return this.ok();
  }
 }
@@ -4,6 +4,7 @@ import { ProjectMemberEntity } from "../../../modules/sys/enterprise/entity/proj
 import { ProjectMemberService } from "../../../modules/sys/enterprise/service/project-member-service.js";
 import { merge } from "lodash-es";
 import { ProjectService } from "../../../modules/sys/enterprise/service/project-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -15,7 +16,6 @@ export class SysProjectMemberController extends CrudController<ProjectMemberEnti

  @Inject()
  sysSettingsService: SysSettingsService;
-
  @Inject()
  projectService: ProjectService;

@@ -23,18 +23,22 @@ export class SysProjectMemberController extends CrudController<ProjectMemberEnti
    return this.service;
  }

-  @Post("/page", { description: "sys:settings:view" })
+  getAuditType(): string {
+    return AuditType.enterprise;
+  }
+
+  @Post("/page", { description: "sys:settings:view", summary: "查询项目成员分页列表" })
  async page(@Body(ALL) body: any) {
    body.query = body.query ?? {};
    return await super.page(body);
  }

-  @Post("/list", { description: "sys:settings:view" })
+  @Post("/list", { description: "sys:settings:view", summary: "查询项目成员列表" })
  async list(@Body(ALL) body: any) {
    return super.list(body);
  }

-  @Post("/add", { description: "sys:settings:edit" })
+  @Post("/add", { description: "sys:settings:edit", summary: "添加项目成员" })
  async add(@Body(ALL) bean: any) {
    const def: any = {
      isDefault: false,
@@ -47,10 +51,12 @@ export class SysProjectMemberController extends CrudController<ProjectMemberEnti
      projectId: bean.projectId,
    });

-    return super.add(bean);
+    const res = await super.add(bean);
+    await this.auditLog({ content: `添加了项目成员(ID:${res.data})` });
+    return res;
  }

-  @Post("/update", { description: "sys:settings:edit" })
+  @Post("/update", { description: "sys:settings:edit", summary: "更新项目成员" })
  async update(@Body(ALL) bean: any) {
    if (!bean.id) {
      throw new Error("id is required");
@@ -65,10 +71,11 @@ export class SysProjectMemberController extends CrudController<ProjectMemberEnti
      permission: bean.permission,
      status: bean.status,
    });
+    await this.auditLog({ content: `更新了项目成员(ID:${bean.id})` });
    return this.ok(res);
  }

-  @Post("/info", { description: "sys:settings:view" })
+  @Post("/info", { description: "sys:settings:view", summary: "查询项目成员详情" })
  async info(@Query("id") id: number) {
    if (!id) {
      throw new Error("id is required");
@@ -81,7 +88,7 @@ export class SysProjectMemberController extends CrudController<ProjectMemberEnti
    return super.info(id);
  }

-  @Post("/delete", { description: "sys:settings:edit" })
+  @Post("/delete", { description: "sys:settings:edit", summary: "删除项目成员" })
  async delete(@Query("id") id: number) {
    if (!id) {
      throw new Error("id is required");
@@ -91,10 +98,12 @@ export class SysProjectMemberController extends CrudController<ProjectMemberEnti
      userId: this.getUserId(),
      projectId: projectId,
    });
-    return super.delete(id);
+    const res = await super.delete(id);
+    await this.auditLog({ content: `删除了项目成员(ID:${id})` });
+    return res;
  }

-  @Post("/deleteByIds", { description: "sys:settings:edit" })
+  @Post("/deleteByIds", { description: "sys:settings:edit", summary: "批量删除项目成员" })
  async deleteByIds(@Body("ids") ids: number[]) {
    for (const id of ids) {
      if (!id) {
@@ -108,6 +117,7 @@ export class SysProjectMemberController extends CrudController<ProjectMemberEnti
      await this.service.delete(id as any);
    }

+    await this.auditLog({ content: `批量删除了${ids.length}个项目成员` });
    return this.ok({});
  }
 }
@@ -2,6 +2,7 @@ import { ALL, Body, Controller, Inject, Post, Provide, Query } from "@midwayjs/c
 import { CrudController } from "@certd/lib-server";
 import { SiteInfoService } from "../../../modules/monitor/service/site-info-service.js";
 import { ApiTags } from "@midwayjs/swagger";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

@Provide()
@Controller("/api/sys/monitor/site")
@@ -14,6 +15,10 @@ export class SysSiteInfoController extends CrudController<SiteInfoService> {
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.monitor;
+  }
+
  @Post("/page", { description: "sys:settings:view", summary: "管理员查询站点监控分页列表" })
  async page(@Body(ALL) body: any) {
    body.query = body.query ?? {};
@@ -44,12 +49,16 @@ export class SysSiteInfoController extends CrudController<SiteInfoService> {

  @Post("/delete", { description: "sys:settings:edit", summary: "管理员删除站点监控" })
  async delete(@Query("id") id: number) {
-    return await super.delete(id);
+    await super.delete(id);
+    await this.auditLog({ content: `管理员删除了站点监控(ID:${id})` });
+    return this.ok();
  }

  @Post("/batchDelete", { description: "sys:settings:edit", summary: "管理员批量删除站点监控" })
  async batchDelete(@Body("ids") ids: number[]) {
+    const count = ids.length;
    await this.service.delete(ids);
+    await this.auditLog({ content: `管理员批量删除了${count}条站点监控` });
    return this.ok();
  }
 }
@@ -3,6 +3,7 @@ import { CrudController } from "@certd/lib-server";
 import { ApiTags } from "@midwayjs/swagger";
 import { PipelineService } from "../../../modules/pipeline/service/pipeline-service.js";
 import { checkPlus } from "@certd/plus-core";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

@Provide()
@Controller("/api/sys/pipeline")
@@ -15,6 +16,10 @@ export class SysPipelineController extends CrudController<PipelineService> {
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.pipeline;
+  }
+
  @Post("/page", { description: "sys:settings:view", summary: "管理员查询用户流水线分页列表" })
  async page(@Body(ALL) body: any) {
    body.query = body.query ?? {};
@@ -41,13 +46,16 @@ export class SysPipelineController extends CrudController<PipelineService> {
  @Post("/delete", { description: "sys:settings:edit", summary: "管理员删除用户流水线" })
  async delete(@Query("id") id: number) {
    await this.service.delete(id);
+    await this.auditLog({ content: `管理员删除了用户流水线(ID:${id})` });
    return this.ok();
  }

  @Post("/batchDelete", { description: "sys:settings:edit", summary: "管理员批量删除用户流水线" })
  async batchDelete(@Body("ids") ids: number[]) {
    checkPlus();
+    const count = ids.length;
    await this.service.batchDelete(ids);
+    await this.auditLog({ content: `管理员批量删除了${count}条用户流水线` });
    return this.ok();
  }
 }
@@ -3,6 +3,7 @@ import { merge } from "lodash-es";
 import { CrudController } from "@certd/lib-server";
 import { PluginImportReq, PluginService } from "../../../modules/plugin/service/plugin-service.js";
 import { CommPluginConfig, PluginConfig, PluginConfigService } from "../../../modules/plugin/service/plugin-config-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";
 /**
 * 插件
 */
@@ -19,6 +20,10 @@ export class PluginController extends CrudController<PluginService> {
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.plugin;
+  }
+
  @Post("/page", { description: "sys:settings:view" })
  async page(@Body(ALL) body: any) {
    body.query = body.query ?? {};
@@ -30,19 +35,22 @@ export class PluginController extends CrudController<PluginService> {
    return super.list(body);
  }

-  @Post("/add", { description: "sys:settings:edit" })
+  @Post("/add", { description: "sys:settings:edit", summary: "添加插件" })
  async add(@Body(ALL) bean: any) {
    const def: any = {
      isDefault: false,
      disabled: false,
    };
    merge(bean, def);
-    return super.add(bean);
+    const res = await super.add(bean);
+    await this.auditLog({ content: `新增了插件「${bean.name}」(ID:${res.data}, 类型:${bean.type})` });
+    return res;
  }

-  @Post("/update", { description: "sys:settings:edit" })
+  @Post("/update", { description: "sys:settings:edit", summary: "更新插件" })
  async update(@Body(ALL) bean: any) {
    const res = await super.update(bean);
+    await this.auditLog({ content: `修改了插件「${bean.name}」(ID:${bean.id})` });
    return res;
  }

@@ -51,21 +59,25 @@ export class PluginController extends CrudController<PluginService> {
    return super.info(id);
  }

-  @Post("/delete", { description: "sys:settings:edit" })
+  @Post("/delete", { description: "sys:settings:edit", summary: "删除插件" })
  async delete(@Query("id") id: number) {
    const res = await this.service.deleteByIds([id]);
+    await this.auditLog({ content: `删除了插件(ID:${id})` });
    return this.ok(res);
  }

-  @Post("/deleteByIds", { description: "sys:settings:edit" })
+  @Post("/deleteByIds", { description: "sys:settings:edit", summary: "批量删除插件" })
  async deleteByIds(@Body("ids") ids: number[]) {
    const res = await this.service.deleteByIds(ids);
+    await this.auditLog({ content: `批量删除了${ids.length}条插件` });
    return this.ok(res);
  }

-  @Post("/setDisabled", { description: "sys:settings:edit" })
+  @Post("/setDisabled", { description: "sys:settings:edit", summary: "禁用/启用插件" })
  async setDisabled(@Body(ALL) body: { id: number; name: string; type: string; disabled: boolean }) {
    await this.service.setDisabled(body);
+    const { id, disabled } = body;
+    await this.auditLog({ content: `${disabled ? "禁用" : "启用"}了插件(ID:${id})` });
    return this.ok();
  }
  @Post("/getCommPluginConfigs", { description: "sys:settings:view" })
@@ -74,9 +86,10 @@ export class PluginController extends CrudController<PluginService> {
    return this.ok(res);
  }

-  @Post("/saveCommPluginConfigs", { description: "sys:settings:edit" })
+  @Post("/saveCommPluginConfigs", { description: "sys:settings:edit", summary: "保存公共插件配置" })
  async saveCommPluginConfigs(@Body(ALL) body: CommPluginConfig) {
    const res = await this.pluginConfigService.saveCommPluginConfig(body);
+    await this.auditLog({ content: "保存了公共插件配置" });
    return this.ok(res);
  }
  @Post("/getPluginByName", { description: "sys:settings:view" })
@@ -88,19 +101,21 @@ export class PluginController extends CrudController<PluginService> {
    return this.ok(res);
  }

-  @Post("/saveSetting", { description: "sys:settings:edit" })
+  @Post("/saveSetting", { description: "sys:settings:edit", summary: "保存插件设置" })
  async saveSetting(@Body(ALL) body: PluginConfig) {
    const res = await this.pluginConfigService.savePluginConfig(body);
+    await this.auditLog({ content: "保存了插件设置" });
    return this.ok(res);
  }

-  @Post("/import", { description: "sys:settings:edit" })
+  @Post("/import", { description: "sys:settings:edit", summary: "导入插件" })
  async import(@Body(ALL) body: PluginImportReq) {
    const res = await this.service.importPlugin(body);
+    await this.auditLog({ content: "导入了插件配置" });
    return this.ok(res);
  }

-  @Post("/export", { description: "sys:settings:edit" })
+  @Post("/export", { description: "sys:settings:edit", summary: "导出插件" })
  async export(@Body("id") id: number) {
    const res = await this.service.exportPlugin(id);
    return this.ok(res);
@@ -2,6 +2,7 @@ import { ALL, Body, Controller, Inject, Post, Provide } from "@midwayjs/core";
 import { BaseController, SysSafeSetting } from "@certd/lib-server";
 import { cloneDeep } from "lodash-es";
 import { SafeService } from "../../../modules/sys/settings/safe-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -11,6 +12,10 @@ export class SysSettingsController extends BaseController {
  @Inject()
  safeService: SafeService;

+  getAuditType(): string {
+    return AuditType.settings;
+  }
+
  @Post("/get", { description: "sys:settings:view" })
  async safeGet() {
    const res = await this.safeService.getSafeSetting();
@@ -22,15 +27,19 @@ export class SysSettingsController extends BaseController {
  @Post("/save", { description: "sys:settings:edit" })
  async safeSave(@Body(ALL) body: any) {
    await this.safeService.saveSafeSetting(body);
+    await this.auditLog({
+      content: "修改了安全设置",
+    });
    return this.ok({});
  }

  /**
   * 立即隐藏
   */
-  @Post("/hidden", { description: "sys:settings:edit" })
+  @Post("/hidden", { description: "sys:settings:edit", summary: "立刻隐藏系统" })
  async hiddenImmediate() {
    await this.safeService.hiddenImmediately();
+    await this.auditLog({ content: "立刻隐藏了系统" });
    return this.ok({});
  }
 }
@@ -8,6 +8,7 @@ import { http, logger, utils } from "@certd/basic";
 import { CodeService } from "../../../modules/basic/service/code-service.js";
 import { SmsServiceFactory } from "../../../modules/basic/sms/factory.js";
 import { RuntimeDepsService } from "../../../modules/runtime-deps/runtime-deps-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -31,58 +32,71 @@ export class SysSettingsController extends CrudController<SysSettingsService> {
    return this.service;
  }

-  @Post("/page", { description: "sys:settings:view" })
+  getAuditType(): string {
+    return AuditType.settings;
+  }
+
+  @Post("/page", { description: "sys:settings:view", summary: "查询系统设置分页列表" })
  async page(@Body(ALL) body) {
    return super.page(body);
  }

-  @Post("/list", { description: "sys:settings:view" })
+  @Post("/list", { description: "sys:settings:view", summary: "查询系统设置列表" })
  async list(@Body(ALL) body) {
    return super.list(body);
  }

-  @Post("/add", { description: "sys:settings:edit" })
+  @Post("/add", { description: "sys:settings:edit", summary: "添加系统设置" })
  async add(@Body(ALL) bean) {
-    return super.add(bean);
+    const res = await super.add(bean);
+    await this.auditLog({ content: "添加了系统设置" });
+    return res;
  }

-  @Post("/update", { description: "sys:settings:edit" })
+  @Post("/update", { description: "sys:settings:edit", summary: "更新系统设置" })
  async update(@Body(ALL) bean) {
    await this.service.checkUserId(bean.id, this.getUserId());
-    return super.update(bean);
+    const res = await super.update(bean);
+    await this.auditLog({ content: "更新了系统设置" });
+    return res;
  }
-  @Post("/info", { description: "sys:settings:view" })
+  @Post("/info", { description: "sys:settings:view", summary: "查询系统设置详情" })
  async info(@Query("id") id: number) {
    await this.service.checkUserId(id, this.getUserId());
    return super.info(id);
  }

-  @Post("/delete", { description: "sys:settings:edit" })
+  @Post("/delete", { description: "sys:settings:edit", summary: "删除系统设置" })
  async delete(@Query("id") id: number) {
    await this.service.checkUserId(id, this.getUserId());
-    return super.delete(id);
+    const res = await super.delete(id);
+    await this.auditLog({ content: "删除了系统设置" });
+    return res;
  }

-  @Post("/save", { description: "sys:settings:edit" })
+  @Post("/save", { description: "sys:settings:edit", summary: "保存系统设置" })
  async save(@Body(ALL) bean: SysSettingsEntity) {
    await this.service.save(bean);
+    await this.auditLog({
+      content: "修改了系统设置",
+    });
    return this.ok({});
  }

-  @Post("/get", { description: "sys:settings:view" })
+  @Post("/get", { description: "sys:settings:view", summary: "查询系统设置" })
  async get(@Query("key") key: string) {
    const entity = await this.service.getByKey(key);
    return this.ok(entity);
  }

  // savePublicSettings
-  @Post("/getEmailSettings", { description: "sys:settings:view" })
+  @Post("/getEmailSettings", { description: "sys:settings:view", summary: "查询邮件服务器设置" })
  async getEmailSettings(@Body(ALL) body) {
    const conf = await getEmailSettings(this.service, this.userSettingsService);
    return this.ok(conf);
  }

-  @Post("/getEmailTemplates", { description: "sys:settings:view" })
+  @Post("/getEmailTemplates", { description: "sys:settings:view", summary: "查询邮件模板列表" })
  async getEmailTemplates(@Body(ALL) body) {
    const conf = await getEmailSettings(this.service, this.userSettingsService);
    const templates = conf.templates || {};
@@ -101,15 +115,16 @@ export class SysSettingsController extends CrudController<SysSettingsService> {
    return this.ok(proviers);
  }

-  @Post("/saveEmailSettings", { description: "sys:settings:edit" })
+  @Post("/saveEmailSettings", { description: "sys:settings:edit", summary: "保存邮件服务器设置" })
  async saveEmailSettings(@Body(ALL) body) {
    const conf = await getEmailSettings(this.service, this.userSettingsService);
    merge(conf, body);
    await this.service.saveSetting(conf);
+    await this.auditLog({ content: "保存了邮件服务器设置" });
    return this.ok(conf);
  }

-  @Post("/getSysSettings", { description: "sys:settings:view" })
+  @Post("/getSysSettings", { description: "sys:settings:view", summary: "查询系统配置" })
  async getSysSettings() {
    const publicSettings = await this.service.getPublicSettings();
    let privateSettings = await this.service.getPrivateSettings();
@@ -118,7 +133,7 @@ export class SysSettingsController extends CrudController<SysSettingsService> {
  }

  // savePublicSettings
-  @Post("/saveSysSettings", { description: "sys:settings:edit" })
+  @Post("/saveSysSettings", { description: "sys:settings:edit", summary: "保存系统设置" })
  async saveSysSettings(@Body(ALL) body: { public: SysPublicSettings; private: SysPrivateSettings }) {
    const publicSettings = await this.service.getPublicSettings();
    const privateSettings = await this.service.getPrivateSettings();
@@ -126,16 +141,18 @@ export class SysSettingsController extends CrudController<SysSettingsService> {
    merge(privateSettings, body.private);
    await this.service.savePublicSettings(publicSettings);
    await this.service.savePrivateSettings(privateSettings);
+    await this.auditLog({ content: "保存了系统设置" });
    return this.ok({});
  }

-  @Post("/stopOtherUserTimer", { description: "sys:settings:edit" })
+  @Post("/stopOtherUserTimer", { description: "sys:settings:edit", summary: "停止其他用户定时任务" })
  async stopOtherUserTimer(@Body(ALL) body) {
    await this.pipelineService.stopOtherUserPipeline(1);
+    await this.auditLog({ content: "停止了其他用户定时任务" });
    return this.ok({});
  }

-  @Post("/testProxy", { description: "sys:settings:edit" })
+  @Post("/testProxy", { description: "sys:settings:edit", summary: "测试代理" })
  async testProxy(@Body(ALL) body) {
    const google = "https://www.google.com/";
    const baidu = "https://www.baidu.com/";
@@ -173,19 +190,19 @@ export class SysSettingsController extends CrudController<SysSettingsService> {
    });
  }

-  @Post("/testSms", { description: "sys:settings:edit" })
+  @Post("/testSms", { description: "sys:settings:edit", summary: "测试短信" })
  async testSms(@Body(ALL) body) {
    await this.codeService.sendSmsCode(body.phoneCode, body.mobile);
    return this.ok({});
  }

-  @Post("/getSmsTypeDefine", { description: "sys:settings:view" })
+  @Post("/getSmsTypeDefine", { description: "sys:settings:view", summary: "查询短信类型定义" })
  async getSmsTypeDefine(@Body("type") type: string) {
    const define = await SmsServiceFactory.getDefine(type);
    return this.ok(define);
  }

-  @Post("/safe/get", { description: "sys:settings:view" })
+  @Post("/safe/get", { description: "sys:settings:view", summary: "查询安全设置" })
  async safeGet() {
    const res = await this.service.getSetting<SysSafeSetting>(SysSafeSetting);
    const clone: SysSafeSetting = cloneDeep(res);
@@ -193,7 +210,7 @@ export class SysSettingsController extends CrudController<SysSettingsService> {
    return this.ok(clone);
  }

-  @Post("/safe/save", { description: "sys:settings:edit" })
+  @Post("/safe/save", { description: "sys:settings:edit", summary: "保存安全设置" })
  async safeSave(@Body(ALL) body: any) {
    if (body.hidden.openPassword) {
      body.hidden.openPassword = utils.hash.md5(body.hidden.openPassword);
@@ -205,24 +222,26 @@ export class SysSettingsController extends CrudController<SysSettingsService> {
      throw new Error("首次设置需要填写解锁密码");
    }
    await this.service.saveSetting(blankSetting);
+    await this.auditLog({ content: "保存了安全设置" });
    return this.ok({});
  }

-  @Post("/captchaTest", { description: "sys:settings:edit" })
+  @Post("/captchaTest", { description: "sys:settings:edit", summary: "测试验证码" })
  async captchaTest(@Body(ALL) body: any, @RequestIP() remoteIp: string) {
    await this.codeService.checkCaptcha(body, { remoteIp });
    return this.ok({});
  }

-  @Post("/oauth/providers", { description: "sys:settings:view" })
+  @Post("/oauth/providers", { description: "sys:settings:view", summary: "查询OAuth提供商列表" })
  async oauthProviders() {
    const list = await addonRegistry.getDefineList("oauth");
    return this.ok(list);
  }

-  @Post("/clearRuntimeDeps", { description: "sys:settings:edit" })
+  @Post("/clearRuntimeDeps", { description: "sys:settings:edit", summary: "清除运行时依赖" })
  async clearRuntimeDeps() {
    await this.runtimeDepsService.clearRuntimeDeps();
+    await this.auditLog({ content: "清除了运行时依赖" });
    return this.ok(true);
  }
 }
@@ -5,6 +5,7 @@ import { checkPlus } from "@certd/plus-core";
 import { http, logger, utils } from "@certd/basic";
 import { TaskServiceBuilder } from "../../../modules/pipeline/service/getter/task-service-getter.js";
 import { ApiTags } from "@midwayjs/swagger";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 * Addon
@@ -24,6 +25,10 @@ export class AddonController extends CrudController<AddonService> {
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.addon;
+  }
+
  @Post("/page", { description: Constants.per.authOnly, summary: "查询Addon分页列表" })
  async page(@Body(ALL) body) {
    const { projectId, userId } = await this.getProjectUserIdRead();
@@ -68,7 +73,9 @@ export class AddonController extends CrudController<AddonService> {
    if (define.needPlus) {
      checkPlus();
    }
-    return super.add(bean);
+    const res = await super.add(bean);
+    this.auditLog({ content: `新增了Addon「${bean.name}」(ID:${res.data}, 类型:${bean.type})` });
+    return res;
  }

  @Post("/update", { description: Constants.per.authOnly, summary: "更新Addon" })
@@ -91,7 +98,9 @@ export class AddonController extends CrudController<AddonService> {
    }
    delete bean.userId;
    delete bean.projectId;
-    return super.update(bean);
+    const res = await super.update(bean);
+    this.auditLog({ content: `修改了Addon「${bean.name}」(ID:${bean.id})` });
+    return res;
  }

  @Post("/info", { description: Constants.per.authOnly, summary: "查询Addon详情" })
@@ -103,7 +112,9 @@ export class AddonController extends CrudController<AddonService> {
  @Post("/delete", { description: Constants.per.authOnly, summary: "删除Addon" })
  async delete(@Query("id") id: number) {
    await this.checkOwner(this.getService(), id, "write");
-    return super.delete(id);
+    const res = await super.delete(id);
+    this.auditLog({ content: `删除了Addon(ID:${id})` });
+    return res;
  }

  @Post("/define", { description: Constants.per.authOnly, summary: "查询Addon插件定义" })
@@ -158,6 +169,7 @@ export class AddonController extends CrudController<AddonService> {
  async setDefault(@Query("addonType") addonType: string, @Query("id") id: number) {
    const { projectId, userId } = await this.checkOwner(this.getService(), id, "write", true);
    const res = await this.service.setDefault(id, userId, addonType, projectId);
+    this.auditLog({ content: `设置了默认Addon(ID:${id})` });
    return this.ok(res);
  }

@@ -0,0 +1,41 @@
+import { BaseController, Constants } from "@certd/lib-server";
+import { ALL, Body, Controller, Inject, Post, Provide } from "@midwayjs/core";
+import { ApiTags } from "@midwayjs/swagger";
+import { AuditService } from "../../../modules/sys/enterprise/service/audit-service.js";
+import { buildAuditTypeDict, buildAuditActionDict } from "../../../modules/sys/enterprise/service/audit-constants.js";
+
+@Provide()
+@ApiTags(["audit"])
+@Controller("/api/pi/audit")
+export class AuditLogController extends BaseController {
+  @Inject()
+  auditService: AuditService;
+
+  @Post("/page", { description: Constants.per.authOnly, summary: "分页查询当前用户操作日志" })
+  async page(@Body(ALL) body: any) {
+    const { projectId, userId } = await this.getProjectUserIdRead();
+    const query: any  = { }
+    if (projectId) {
+      //如果是项目级别，排除userId参数，因为日志这里userId不是-1 ，而是实际的用户
+      query.projectId = projectId;
+    }else{
+      query.userId = userId;
+    }
+    body.query = {
+      ...body.query || {},
+      ...query,
+      scope: "user"
+    }
+
+    const pageRet = await this.auditService.page(body);
+    return this.ok(pageRet);
+  }
+
+  @Post("/dict", { description: Constants.per.authOnly, summary: "获取审计类型和动作字典" })
+  async getDict() {
+    return this.ok({
+      types: buildAuditTypeDict(),
+      actions: buildAuditActionDict(),
+    });
+  }
+}
@@ -3,6 +3,7 @@ import { Constants, CrudController } from "@certd/lib-server";
 import { AuthService } from "../../../modules/sys/authority/service/auth-service.js";
 import { GroupService } from "../../../modules/basic/service/group-service.js";
 import { ApiTags } from "@midwayjs/swagger";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 * 通知
@@ -20,6 +21,10 @@ export class GroupController extends CrudController<GroupService> {
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.pipelineGroup;
+  }
+
  @Post("/page", { description: Constants.per.authOnly, summary: "查询分组分页列表" })
  async page(@Body(ALL) body: any) {
    const { projectId, userId } = await this.getProjectUserIdRead();
@@ -52,7 +57,9 @@ export class GroupController extends CrudController<GroupService> {
    const { projectId, userId } = await this.getProjectUserIdRead();
    bean.projectId = projectId;
    bean.userId = userId;
-    return await super.add(bean);
+    const res = await super.add(bean);
+    this.auditLog({ content: `新增了分组「${bean.name}」(ID:${res.data})` });
+    return res;
  }

  @Post("/update", { description: Constants.per.authOnly, summary: "更新分组" })
@@ -60,7 +67,9 @@ export class GroupController extends CrudController<GroupService> {
    await this.checkOwner(this.getService(), bean.id, "write");
    delete bean.userId;
    delete bean.projectId;
-    return await super.update(bean);
+    const res = await super.update(bean);
+    this.auditLog({ content: `修改了分组「${bean.name}」(ID:${bean.id})` });
+    return res;
  }
  @Post("/info", { description: Constants.per.authOnly, summary: "查询分组详情" })
  async info(@Query("id") id: number) {
@@ -71,7 +80,9 @@ export class GroupController extends CrudController<GroupService> {
  @Post("/delete", { description: Constants.per.authOnly, summary: "删除分组" })
  async delete(@Query("id") id: number) {
    await this.checkOwner(this.getService(), id, "write");
-    return await super.delete(id);
+    const res = await super.delete(id);
+    this.auditLog({ content: `删除了分组(ID:${id})` });
+    return res;
  }

  @Post("/all", { description: Constants.per.authOnly, summary: "查询所有分组" })
@@ -2,6 +2,7 @@ import { ALL, Body, Controller, Inject, Post, Provide, Query } from "@midwayjs/c
 import { Constants, CrudController } from "@certd/lib-server";
 import { ApiTags } from "@midwayjs/swagger";
 import { CertApplyTemplateService } from "../../../modules/cert/service/cert-apply-template-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

@Provide()
@Controller("/api/cert/apply-template")
@@ -14,6 +15,10 @@ export class CertApplyTemplateController extends CrudController<CertApplyTemplat
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.certTemplate;
+  }
+
  private removeContent(data: any) {
    const records = Array.isArray(data) ? data : data?.records;
    if (!records) {
@@ -53,7 +58,9 @@ export class CertApplyTemplateController extends CrudController<CertApplyTemplat
    const { projectId, userId } = await this.getProjectUserIdWrite();
    bean.projectId = projectId;
    bean.userId = userId;
-    return super.add(bean);
+    const res = await super.add(bean);
+    this.auditLog({ content: `新增了证书参数模版(ID:${res.data})` });
+    return res;
  }

  @Post("/update", { description: Constants.per.authOnly, summary: "更新证书申请参数模版" })
@@ -61,7 +68,9 @@ export class CertApplyTemplateController extends CrudController<CertApplyTemplat
    await this.checkOwner(this.getService(), bean.id, "write");
    delete bean.userId;
    delete bean.projectId;
-    return super.update(bean);
+    const res = await super.update(bean);
+    this.auditLog({ content: `修改了证书参数模版(ID:${bean.id})` });
+    return res;
  }

  @Post("/info", { description: Constants.per.authOnly, summary: "查询证书申请参数模版详情" })
@@ -73,13 +82,17 @@ export class CertApplyTemplateController extends CrudController<CertApplyTemplat
  @Post("/delete", { description: Constants.per.authOnly, summary: "删除证书申请参数模版" })
  async delete(@Query("id") id: number) {
    await this.checkOwner(this.getService(), id, "write");
-    return super.delete(id);
+    const res = await super.delete(id);
+    this.auditLog({ content: `删除了证书参数模版(ID:${id})` });
+    return res;
  }

  @Post("/setDefault", { description: Constants.per.authOnly, summary: "设置默认证书申请参数模版" })
  async setDefault(@Body("id") id: number) {
    const { projectId, userId } = await this.getProjectUserIdWrite();
-    return this.ok(await this.service.setDefault(id, userId, projectId));
+    const defaultId = await this.service.setDefault(id, userId, projectId);
+    this.auditLog({ content: `设置了默认证书参数模版(ID:${id})` });
+    return this.ok(defaultId);
  }

  @Post("/default", { description: Constants.per.authOnly, summary: "查询默认证书申请参数模版" })
@@ -2,6 +2,7 @@ import { ALL, Body, Controller, Inject, Post, Provide, Query } from "@midwayjs/c
 import { Constants, CrudController } from "@certd/lib-server";
 import { ApiTags } from "@midwayjs/swagger";
 import { DnsPersistRecordService } from "../../../modules/cert/service/dns-persist-record-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

@Provide()
@Controller("/api/cert/dns-persist")
@@ -14,6 +15,10 @@ export class DnsPersistRecordController extends CrudController<DnsPersistRecordS
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.dnsPersist;
+  }
+
  @Post("/page", { description: Constants.per.authOnly, summary: "查询DNS持久验证记录分页列表" })
  async page(@Body(ALL) body: any) {
    const { projectId, userId } = await this.getProjectUserIdRead();
@@ -28,7 +33,9 @@ export class DnsPersistRecordController extends CrudController<DnsPersistRecordS
    const { projectId, userId } = await this.getProjectUserIdWrite();
    bean.projectId = projectId;
    bean.userId = userId;
-    return super.add(bean);
+     const res = await this.getService().add(bean);
+    this.auditLog({ content: `新增了DNS持久验证记录(ID:${res.id})` });
+    return this.ok(res);
  }

  @Post("/update", { description: Constants.per.authOnly, summary: "更新DNS持久验证记录" })
@@ -36,7 +43,9 @@ export class DnsPersistRecordController extends CrudController<DnsPersistRecordS
    await this.checkOwner(this.getService(), bean.id, "write");
    delete bean.userId;
    delete bean.projectId;
-    return super.update(bean);
+    const res = await super.update(bean);
+    this.auditLog({ content: `修改了DNS持久验证记录(ID:${bean.id})` });
+    return res;
  }

  @Post("/info", { description: Constants.per.authOnly, summary: "查询DNS持久验证记录详情" })
@@ -49,6 +58,7 @@ export class DnsPersistRecordController extends CrudController<DnsPersistRecordS
  async delete(@Query("id") id: number) {
    await this.checkOwner(this.getService(), id, "write");
    await this.service.delete(id as any);
+    this.auditLog({ content: `删除了DNS持久验证记录(ID:${id})` });
    return this.ok({
      message: this.service.lastDeleteMessage,
    });
@@ -80,12 +90,16 @@ export class DnsPersistRecordController extends CrudController<DnsPersistRecordS
  @Post("/triggerVerify", { description: Constants.per.authOnly, summary: "后台验证DNS持久验证记录" })
  async triggerVerify(@Body(ALL) body: { id: number }) {
    await this.checkOwner(this.getService(), body.id, "write");
-    return this.ok(await this.service.triggerVerify(body.id));
+    const res = await this.service.triggerVerify(body.id);
+    this.auditLog({ content: `触发了DNS持久验证(ID:${body.id})` });
+    return this.ok(res);
  }

  @Post("/createTxt", { description: Constants.per.authOnly, summary: "一键创建DNS持久验证TXT记录" })
  async createTxt(@Body(ALL) body: { id: number; dnsProviderType?: string; dnsProviderAccess?: number }) {
    await this.checkOwner(this.getService(), body.id, "write");
-    return this.ok(await this.service.createDnsTxt(body));
+    const res = await this.service.createDnsTxt(body);
+    this.auditLog({ content: `一键创建了DNS持久验证TXT记录(ID:${body.id})` });
+    return this.ok(res);
  }
 }
@@ -4,6 +4,7 @@ import { DomainService } from "../../../modules/cert/service/domain-service.js";
 import { checkPlus } from "@certd/plus-core";
 import { ApiTags } from "@midwayjs/swagger";
 import { parseDomainByPsl } from "@certd/plugin-lib";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 * 授权
@@ -19,6 +20,10 @@ export class DomainController extends CrudController<DomainService> {
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.domain;
+  }
+
  @Post("/page", { description: Constants.per.authOnly, summary: "查询域名分页列表" })
  async page(@Body(ALL) body: any) {
    const { projectId, userId } = await this.getProjectUserIdRead();
@@ -58,7 +63,9 @@ export class DomainController extends CrudController<DomainService> {
    const { projectId, userId } = await this.getProjectUserIdRead();
    bean.projectId = projectId;
    bean.userId = userId;
-    return super.add(bean);
+    const res = await super.add(bean);
+    this.auditLog({ content: `新增了域名「${bean.domain}」` });
+    return res;
  }

  @Post("/update", { description: Constants.per.authOnly, summary: "更新域名" })
@@ -66,7 +73,9 @@ export class DomainController extends CrudController<DomainService> {
    await this.checkOwner(this.getService(), bean.id, "write");
    delete bean.userId;
    delete bean.projectId;
-    return super.update(bean);
+    const res = await super.update(bean);
+    this.auditLog({ content: `修改了域名「${bean.domain}」` });
+    return res;
  }

  @Post("/info", { description: Constants.per.authOnly, summary: "查询域名详情" })
@@ -78,13 +87,16 @@ export class DomainController extends CrudController<DomainService> {
  @Post("/delete", { description: Constants.per.authOnly, summary: "删除域名" })
  async delete(@Query("id") id: number) {
    await this.checkOwner(this.getService(), id, "write");
-    return super.delete(id);
+    const res = await super.delete(id);
+    this.auditLog({ content: `删除了域名(ID:${id})` });
+    return res;
  }

  @Post("/deleteByIds", { description: Constants.per.authOnly, summary: "批量删除域名" })
  async deleteByIds(@Body(ALL) body: any) {
    const { projectId, userId } = await this.getProjectUserIdRead();
    await this.service.batchDelete(body.ids, userId, projectId);
+    this.auditLog({ content: `批量删除了${body.ids.length}条域名` });
    return this.ok();
  }

@@ -99,6 +111,7 @@ export class DomainController extends CrudController<DomainService> {
      projectId: projectId,
    };
    await this.service.startDomainImportTask(req);
+    this.auditLog({ content: "开始了域名导入任务" });
    return this.ok();
  }

@@ -123,6 +136,7 @@ export class DomainController extends CrudController<DomainService> {
      key,
    };
    await this.service.deleteDomainImportTask(req);
+    this.auditLog({ content: "删除了域名导入任务" });
    return this.ok();
  }

@@ -139,6 +153,7 @@ export class DomainController extends CrudController<DomainService> {
      key,
    };
    const item = await this.service.saveDomainImportTask(req);
+    this.auditLog({ content: "保存了域名导入任务" });
    return this.ok(item);
  }

@@ -149,6 +164,7 @@ export class DomainController extends CrudController<DomainService> {
      userId: userId,
      projectId: projectId,
    });
+    this.auditLog({ content: "开始了同步域名过期时间任务" });
    return this.ok();
  }
  @Post("/sync/expiration/status", { description: Constants.per.authOnly, summary: "查询同步域名过期时间任务状态" })
@@ -169,6 +185,7 @@ export class DomainController extends CrudController<DomainService> {
      projectId: projectId,
      setting: { ...body },
    });
+    this.auditLog({ content: "保存了域名监控设置" });
    return this.ok();
  }

@@ -2,6 +2,7 @@ import { ALL, Body, Controller, Inject, Post, Provide, Query } from "@midwayjs/c
 import { Constants, CrudController } from "@certd/lib-server";
 import { CnameRecordService } from "../../../modules/cname/service/cname-record-service.js";
 import { ApiTags } from "@midwayjs/swagger";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 * 授权
@@ -17,6 +18,10 @@ export class CnameRecordController extends CrudController<CnameRecordService> {
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.cname;
+  }
+
  @Post("/page", { description: Constants.per.authOnly, summary: "查询CNAME记录分页列表" })
  async page(@Body(ALL) body: any) {
    const { userId, projectId } = await this.getProjectUserIdRead();
@@ -56,7 +61,9 @@ export class CnameRecordController extends CrudController<CnameRecordService> {
    const { userId, projectId } = await this.getProjectUserIdWrite();
    bean.userId = userId;
    bean.projectId = projectId;
-    return super.add(bean);
+    const res = await super.add(bean);
+    this.auditLog({ content: `新增了CNAME记录「${bean.domain}」` });
+    return res;
  }

  @Post("/update", { description: Constants.per.authOnly, summary: "更新CNAME记录" })
@@ -64,7 +71,9 @@ export class CnameRecordController extends CrudController<CnameRecordService> {
    await this.checkOwner(this.getService(), bean.id, "write");
    delete bean.userId;
    delete bean.projectId;
-    return super.update(bean);
+    const res = await super.update(bean);
+    this.auditLog({ content: `修改了CNAME记录(ID:${bean.id})` });
+    return res;
  }

  @Post("/info", { description: Constants.per.authOnly, summary: "查询CNAME记录详情" })
@@ -76,13 +85,16 @@ export class CnameRecordController extends CrudController<CnameRecordService> {
  @Post("/delete", { description: Constants.per.authOnly, summary: "删除CNAME记录" })
  async delete(@Query("id") id: number) {
    await this.checkOwner(this.getService(), id, "write");
-    return super.delete(id);
+    const res = await super.delete(id);
+    this.auditLog({ content: `删除了CNAME记录(ID:${id})` });
+    return res;
  }

  @Post("/deleteByIds", { description: Constants.per.authOnly, summary: "批量删除CNAME记录" })
  async deleteByIds(@Body(ALL) body: any) {
    const { userId, projectId } = await this.getProjectUserIdWrite();
    await this.service.batchDelete(body.ids, userId, projectId);
+    this.auditLog({ content: `批量删除了${body.ids.length}条CNAME记录` });
    return this.ok();
  }
  @Post("/getByDomain", { description: Constants.per.authOnly, summary: "根据域名获取CNAME记录" })
@@ -103,6 +115,7 @@ export class CnameRecordController extends CrudController<CnameRecordService> {
  async resetStatus(@Body(ALL) body: { id: number }) {
    await this.checkOwner(this.getService(), body.id, "read");
    const res = await this.service.resetStatus(body.id);
+    this.auditLog({ content: `重置了CNAME记录状态(ID:${body.id})` });
    return this.ok(res);
  }
  @Post("/import", { description: Constants.per.authOnly, summary: "导入CNAME记录" })
@@ -114,6 +127,7 @@ export class CnameRecordController extends CrudController<CnameRecordService> {
      domainList: body.domainList,
      cnameProviderId: body.cnameProviderId,
    });
+    this.auditLog({ append: `提交${res.count}条` });
    return this.ok(res);
  }
 }
@@ -4,6 +4,7 @@ import { AuthService } from "../../../modules/sys/authority/service/auth-service
 import { ProjectService } from "../../../modules/sys/enterprise/service/project-service.js";
 import { ProjectMemberService } from "../../../modules/sys/enterprise/service/project-member-service.js";
 import { ApiTags } from "@midwayjs/swagger";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -24,6 +25,10 @@ export class UserProjectController extends BaseController {
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.enterprise;
+  }
+
  /**
   * @param body
   * @returns
@@ -63,6 +68,7 @@ export class UserProjectController extends BaseController {
  async applyJoin(@Body(ALL) body: any) {
    const userId = this.getUserId();
    const res = await this.service.applyJoin({ userId, projectId: body.projectId });
+    this.auditLog({ content: "申请了加入项目" });
    return this.ok(res);
  }

@@ -84,6 +90,7 @@ export class UserProjectController extends BaseController {
      status,
      permission,
    });
+    this.auditLog({ content: "更新了项目成员" });
    return this.ok(res);
  }

@@ -92,6 +99,7 @@ export class UserProjectController extends BaseController {
    const { projectId } = await this.getProjectUserIdAdmin();
    const { status, permission, userId } = body;
    const res = await this.service.approveJoin({ userId, projectId: projectId, status, permission });
+    this.auditLog({ content: "审批了加入项目申请" });
    return this.ok(res);
  }

@@ -100,8 +108,9 @@ export class UserProjectController extends BaseController {
    const { projectId } = await this.getProjectUserIdAdmin();
    await this.projectMemberService.deleteWhere({
      projectId,
-      userId: this.getUserId(),
+      userId: body.userId,
    });
+    this.auditLog({ content: "删除了项目成员" });
    return this.ok();
  }

@@ -113,6 +122,7 @@ export class UserProjectController extends BaseController {
      projectId,
      userId,
    });
+    this.auditLog({ content: "离开了项目" });
    return this.ok();
  }
 }
@@ -5,6 +5,7 @@ import { ProjectMemberService } from "../../../modules/sys/enterprise/service/pr
 import { merge } from "lodash-es";
 import { ProjectService } from "../../../modules/sys/enterprise/service/project-service.js";
 import { ApiTags } from "@midwayjs/swagger";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";
 /**
 */
@Provide()
@@ -24,6 +25,10 @@ export class ProjectMemberController extends CrudController<ProjectMemberEntity>
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.enterprise;
+  }
+
  @Post("/page", { description: Constants.per.authOnly, summary: "查询项目成员分页列表" })
  async page(@Body(ALL) body: any) {
    const { projectId } = await this.getProjectUserIdRead();
@@ -53,7 +58,9 @@ export class ProjectMemberController extends CrudController<ProjectMemberEntity>
      projectId: bean.projectId,
    });

-    return super.add(bean);
+    const res = await super.add(bean);
+    this.auditLog({ content: `新增了项目成员(ID:${res.data})` });
+    return res;
  }

  @Post("/update", { description: Constants.per.authOnly, summary: "更新项目成员" })
@@ -71,7 +78,7 @@ export class ProjectMemberController extends CrudController<ProjectMemberEntity>
      permission: bean.permission,
      status: bean.status,
    });
-
+    this.auditLog({ content: `修改了项目成员(ID:${bean.id})` });
    return this.ok(res);
  }

@@ -98,7 +105,9 @@ export class ProjectMemberController extends CrudController<ProjectMemberEntity>
      userId: this.getUserId(),
      projectId: projectId,
    });
-    return super.delete(id);
+    const res = await super.delete(id);
+    this.auditLog({ content: `删除了项目成员(ID:${id})` });
+    return res;
  }

  @Post("/deleteByIds", { description: Constants.per.authOnly, summary: "批量删除项目成员" })
@@ -115,6 +124,7 @@ export class ProjectMemberController extends CrudController<ProjectMemberEntity>
      await this.service.delete(id as any);
    }

+    this.auditLog({ content: `批量删除了${ids.length}条项目成员` });
    return this.ok({});
  }
 }
@@ -2,6 +2,7 @@ import { BaseController, Constants } from "@certd/lib-server";
 import { Controller, Inject, Post, Provide } from "@midwayjs/core";
 import { TransferService } from "../../../modules/sys/enterprise/service/transfer-service.js";
 import { ApiTags } from "@midwayjs/swagger";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -16,6 +17,10 @@ export class TransferController extends BaseController {
    return this.service;
  }

+  getAuditType(): string {
+    return AuditType.enterprise;
+  }
+
  /**
   * 我自己的资源
   * @param body
@@ -38,6 +43,7 @@ export class TransferController extends BaseController {
    const { projectId } = await this.getProjectUserIdRead();
    const userId = this.getUserId();
    await this.service.transferAll(userId, projectId);
+    this.auditLog({ content: "迁移了项目资源" });
    return this.ok();
  }
 }
@@ -3,6 +3,7 @@ import { BaseController } from "@certd/lib-server";
 import { Constants } from "@certd/lib-server";
 import { EmailService } from "../../../modules/basic/service/email-service.js";
 import { ApiTags } from "@midwayjs/swagger";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -13,10 +14,15 @@ export class EmailController extends BaseController {
  @Inject()
  emailService: EmailService;

+  getAuditType(): string {
+    return AuditType.mine;
+  }
+
  @Post("/test", { description: Constants.per.authOnly, summary: "测试邮件发送" })
  public async test(@Body("receiver") receiver) {
    const userId = super.getUserId();
    await this.emailService.test(userId, receiver);
+    this.auditLog({ content: "测试了邮件发送" });
    return this.ok({});
  }

@@ -31,6 +37,7 @@ export class EmailController extends BaseController {
  public async add(@Body("email") email) {
    const userId = super.getUserId();
    await this.emailService.add(userId, email);
+    this.auditLog({ content: "添加了邮件" });
    return this.ok({});
  }

@@ -38,6 +45,7 @@ export class EmailController extends BaseController {
  public async delete(@Body("email") email) {
    const userId = super.getUserId();
    await this.emailService.delete(userId, email);
+    this.auditLog({ content: "删除了邮件" });
    return this.ok({});
  }
 }
@@ -1,4 +1,4 @@
-import { AccessGetter, AccessService, BaseController, Constants, SysSettingsService } from "@certd/lib-server";
+import { AccessGetter, AccessService, BaseController, Constants, isEnterprise, SysSettingsService } from "@certd/lib-server";
 import { ALL, Body, Controller, Inject, Post, Provide } from "@midwayjs/core";
 import { PasskeyService } from "../../../modules/login/service/passkey-service.js";
 import { RoleService } from "../../../modules/sys/authority/service/role-service.js";
@@ -9,6 +9,7 @@ import { http, logger, utils } from "@certd/basic";
 import { ApiTags } from "@midwayjs/swagger";
 import { CodeService } from "../../../modules/basic/service/code-service.js";
 import { EmailService } from "../../../modules/basic/service/email-service.js";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -40,6 +41,10 @@ export class MineController extends BaseController {
  @Inject()
  emailService: EmailService;

+  getAuditType(): string {
+    return AuditType.mine;
+  }
+
  @Post("/info", { description: Constants.per.authOnly, summary: "查询用户信息" })
  public async info() {
    const userId = this.getUserId();
@@ -54,15 +59,16 @@ export class MineController extends BaseController {
    delete user.password;
    //@ts-ignore
    user.needInitPassword = needInitPassword;
-
-    const { projectId } = await this.getProjectUserIdRead();
-    const userProjectQuery = this.accessService.buildUserProjectQuery(userId, projectId);
-    const existingAccess = await this.accessService.findOne({
-      where: { type: "acmeAccount", subtype: "letsencrypt", ...userProjectQuery },
-    });
-    if (!existingAccess) {
-      //@ts-ignore
-      user.needInitAccount = true;
+    //@ts-ignore
+    user.needInitAccount = false;
+    if (!isEnterprise()) {
+      const existingAccess = await this.accessService.findOne({
+        where: { type: "acmeAccount", subtype: "letsencrypt", userId },
+      });
+      if (!existingAccess) {
+        //@ts-ignore
+        user.needInitAccount = true;
+      }
    }

    return this.ok(user);
@@ -72,6 +78,7 @@ export class MineController extends BaseController {
  public async changePassword(@Body(ALL) body: any) {
    const userId = this.getUserId();
    await this.userService.changePassword(userId, body);
+    this.auditLog({ content: "修改了密码" });
    return this.ok({});
  }

@@ -79,6 +86,7 @@ export class MineController extends BaseController {
  public async initPassword(@Body(ALL) body: any) {
    const userId = this.getUserId();
    await this.userService.initPassword(userId, body);
+    this.auditLog({ content: "初始化了密码" });
    return this.ok({});
  }

@@ -90,6 +98,7 @@ export class MineController extends BaseController {
      avatar: body.avatar,
      nickName: body.nickName,
    });
+    this.auditLog({ content: "更新了个人资料" });
    return this.ok({});
  }

@@ -128,6 +137,7 @@ export class MineController extends BaseController {
      phoneCode: body.phoneCode,
      mobile: body.mobile,
    });
+    this.auditLog({ content: "修改了手机号" });
    return this.ok({});
  }

@@ -144,13 +154,13 @@ export class MineController extends BaseController {
    await this.userService.updateEmail(userId, {
      email: body.email,
    });
+    this.auditLog({ content: "修改了邮箱" });
    return this.ok({});
  }

  @Post("/accountInit", { description: Constants.per.authOnly, summary: "初始化Let's Encrypt ACME账号和邮件通知" })
  public async accountInit(@Body("email") email?: string) {
-    const { projectId, userId } = await this.getProjectUserIdWrite();
-
+    const userId = this.getUserId();
    let userEmail = email;
    let user: any = null;
    if (!userEmail) {
@@ -172,10 +182,10 @@ export class MineController extends BaseController {

    await this.emailService.add(userId, userEmail);

-    await this.notificationService.getOrCreateDefault(userEmail, userId, projectId);
+    await this.notificationService.getOrCreateDefault(userEmail, userId);

    const getAccessById = this.accessService.getById.bind(this.accessService);
-    const accessGetter = new AccessGetter(userId, projectId, getAccessById);
+    const accessGetter = new AccessGetter(userId, undefined, getAccessById);
    const accessContext = {
      http,
      logger,
@@ -190,7 +200,7 @@ export class MineController extends BaseController {
      type: "acmeAccount",
      name: "Let's Encrypt",
      userId,
-      projectId,
+      projectId: undefined,
      setting: JSON.stringify({
        caType: "letsencrypt",
        email: userEmail,
@@ -198,6 +208,7 @@ export class MineController extends BaseController {
      }),
    });

+    this.auditLog({ content: "初始化了Let's Encrypt ACME账号和邮件通知" });
    return this.ok({ success: true });
  }
 }
@@ -3,6 +3,7 @@ import { PasskeyService } from "../../../modules/login/service/passkey-service.j
 import { BaseController, Constants } from "@certd/lib-server";
 import { UserService } from "../../../modules/sys/authority/service/user-service.js";
 import { ApiTags } from "@midwayjs/swagger";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

@Provide()
@Controller("/api/mine/passkey")
@@ -14,6 +15,10 @@ export class MinePasskeyController extends BaseController {
  @Inject()
  userService: UserService;

+  getAuditType(): string {
+    return AuditType.mine;
+  }
+
  @Post("/generateRegistration", { description: Constants.per.authOnly, summary: "生成Passkey注册选项" })
  public async generateRegistration(
    @Body(ALL)
@@ -46,7 +51,7 @@ export class MinePasskeyController extends BaseController {
    const deviceName = body.deviceName;

    const result = await this.passkeyService.registerPasskey(userId, response, challenge, deviceName, this.ctx);
-
+    this.auditLog({ content: "验证注册了Passkey" });
    return this.ok(result);
  }

@@ -62,6 +67,7 @@ export class MinePasskeyController extends BaseController {

    const result = await this.passkeyService.registerPasskey(userId, response, challenge, deviceName, this.ctx);

+    this.auditLog({ content: "注册了Passkey" });
    return this.ok(result);
  }

@@ -90,6 +96,7 @@ export class MinePasskeyController extends BaseController {
    }

    await this.passkeyService.delete([passkey.id]);
+    this.auditLog({ content: "解绑了Passkey" });
    return this.ok({});
  }
 }
@@ -6,6 +6,7 @@ import { merge } from "lodash-es";
 import { TwoFactorService } from "../../../modules/mine/service/two-factor-service.js";
 import { isPlus } from "@certd/plus-core";
 import { ApiTags } from "@midwayjs/swagger";
+import { AuditType } from "../../../modules/sys/enterprise/service/audit-constants.js";

 /**
 */
@@ -19,6 +20,10 @@ export class UserTwoFactorSettingController extends BaseController {
  @Inject()
  twoFactorService: TwoFactorService;

+  getAuditType(): string {
+    return AuditType.mine;
+  }
+
  @Post("/get", { description: Constants.per.authOnly, summary: "获取双因子认证设置" })
  async get() {
    const userId = this.getUserId();
@@ -42,6 +47,7 @@ export class UserTwoFactorSettingController extends BaseController {
    }

    await this.service.saveSetting(userId, null, setting);
+    this.auditLog({ content: "保存了双因子认证设置" });
    return this.ok({});
  }

@@ -62,6 +68,7 @@ export class UserTwoFactorSettingController extends BaseController {
      userId,
      verifyCode: bean.verifyCode,
    });
+    this.auditLog({ content: "保存了验证器设置" });
    return this.ok();
  }

@@ -69,6 +76,7 @@ export class UserTwoFactorSettingController extends BaseController {
  async authenticatorOff() {
    const userId = this.getUserId();
    await this.twoFactorService.offAuthenticator(userId);
+    this.auditLog({ content: "关闭了验证器" });
    return this.ok();
  }
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
xiaojunnuo	f2855d6dac	feat: 支持审计日志，操作日志	2026-07-12 02:29:54 +08:00
xiaojunnuo	4250d0e266	chore: audit log first	2026-07-10 19:24:42 +08:00
xiaojunnuo	edda1b57f3	chore: 火山vod 上传后等待3秒	2026-07-09 19:09:08 +08:00
xiaojunnuo	5a7766992d	chore: 修复update domain传参问题	2026-07-09 16:42:48 +08:00
xiaojunnuo	02dabe11db	fix: 修复火山引擎查不到自定义源站域名的问题	2026-07-09 16:39:08 +08:00
xiaojunnuo	58024128d8	Merge branch 'v2-dev' of https://github.com/certd/certd into v2-dev	2026-07-09 14:47:33 +08:00
xiaojunnuo	e44bf9d773	fix: 修复火山引擎自定义源站域名查询不到的问题	2026-07-09 14:47:05 +08:00
xiaojunnuo	1114223bda	build: release	2026-07-09 00:00:53 +08:00
xiaojunnuo	55022e5fa6	build: publish	2026-07-08 23:48:41 +08:00
xiaojunnuo	ae732fb298	build: trigger build image	2026-07-08 23:48:29 +08:00
xiaojunnuo	a6ef6996c3	v1.42.3	2026-07-08 23:47:40 +08:00
xiaojunnuo	97cf5e127b	build: prepare to build	2026-07-08 23:45:42 +08:00
xiaojunnuo	690df7373c	chore: 旧版数据兼容性的ai 提示	2026-07-08 12:04:07 +08:00
xiaojunnuo	9cc01e5da1	Merge branch 'v2-dev' of https://github.com/certd/certd into v2-dev	2026-07-08 11:51:35 +08:00
xiaojunnuo	0a068a2746	fix(volcengine-alb): 修复火山引擎ALB 默认证书部署类型会部署到扩展证书的问题	2026-07-08 11:51:26 +08:00
xiaojunnuo	85a239ff8c	build: release	2026-07-07 21:20:19 +08:00
xiaojunnuo	a545a28dfb	Merge branch 'v2' of https://github.com/certd/certd into v2	2026-07-07 21:18:51 +08:00
xiaojunnuo	ac876a980c	build: release	2026-07-07 21:15:16 +08:00
xiaojunnuo	4b555e8a56	build: publish	2026-07-07 20:04:20 +08:00
xiaojunnuo	1a8d14dc44	build: trigger build image	2026-07-07 20:04:08 +08:00
xiaojunnuo	83263a72d2	v1.42.2	2026-07-07 19:59:41 +08:00
xiaojunnuo	76f3ba8691	build: prepare to build	2026-07-07 19:56:46 +08:00
xiaojunnuo	072edd7aff	fix: 修复cname用阿里云校验时报找不到runtimeDepsService的错误	2026-07-07 19:51:23 +08:00
猫爪子	c0be4d702c	fix(certd-server): 修复 AWS 中国区 CloudFront 证书部署问题 (#764 ) @yw-mao - 修复证书链拆分，保留 END CERTIFICATE 结尾标记，避免 MalformedCertificate - 更新 CloudFront 时构造干净的 IAM ViewerCertificate，强制 sni-only，解决 InvalidViewerCertificate 及中国区不支持 vip 的报错 - 部署完成后清理被替换掉的旧 IAM 证书，避免续期堆积 - IAM/CloudFront 权限不足时抛出可读中文提示，便于运维排查 Co-authored-by: Cursor <cursoragent@cursor.com>	2026-07-07 16:20:07 +08:00
xiaojunnuo	c3d6db3f1e	fix: 修复AsiaIsp CDN证书重复情况下部署失败的问题	2026-07-07 14:15:09 +08:00
xiaojunnuo	e05ec53eb5	chore: 1	2026-07-07 10:21:01 +08:00
xiaojunnuo	8d9dad9c82	fix: 修复企业模式下弹出邮箱绑定提醒的问题	2026-07-07 09:43:10 +08:00
xiaojunnuo	0071bcb0e4	fix: 修复火山视频点播源站选择不到自定义源站的bug	2026-07-07 09:42:41 +08:00
xiaojunnuo	dbdc1ccd1b	build: release	2026-07-07 00:35:25 +08:00
xiaojunnuo	2a606fdb1d	build: publish	2026-07-07 00:22:06 +08:00
xiaojunnuo	3b86f30bcf	build: trigger build image	2026-07-07 00:21:54 +08:00
xiaojunnuo	7808d028e9	v1.42.1	2026-07-07 00:20:58 +08:00
xiaojunnuo	04bcf73b8b	build: prepare to build	2026-07-07 00:18:40 +08:00
xiaojunnuo	1f8179d519	build: prepare to build	2026-07-07 00:14:50 +08:00
xiaojunnuo	3ffd8946f8	Merge branch 'v2-dev' of https://github.com/certd/certd into v2-dev	2026-07-07 00:12:46 +08:00
xiaojunnuo	c78898e4c1	perf(certd-server): 使用 jks-go转换jks证书，大幅精简镜像大小	2026-07-07 00:12:37 +08:00
xiaojunnuo	d3e4677ea4	perf(pipeline): 将默认历史保留条数从30调整为100 统一修改所有新建流水线场景下的默认keepHistoryCount配置，提升历史记录留存数量	2026-07-06 19:56:54 +08:00
xiaojunnuo	d176f9cc0e	fix: 修复多域名无法使用passkey登录的bug	2026-07-06 14:34:05 +08:00
xiaojunnuo	a65366bbe1	fix: 修复企业模式下登录报projectId不能为空的问题	2026-07-06 13:52:56 +08:00
xiaojunnuo	20cfe74b17	build: release	2026-07-05 21:41:50 +08:00
xiaojunnuo	b74db81304	fix(login): 修复输入法 composing 状态下回车触发提交的问题优化登录页面的回车提交逻辑，避免中文输入法输入过程中按回车误触发表单提交	2026-07-05 21:37:09 +08:00
xiaojunnuo	a8adbda04a	refactor(runtime-deps): 调整依赖相关类为单例并修复相关逻辑 1. 将NpmRegistryResolver和RuntimeDepsService从请求作用域改为单例作用域 2. 为RuntimeDepsService的安装缓存添加node_modules存在性校验 3. 优化锁文件删除逻辑，处理Windows下文件句柄未立即释放的问题 4. 跳过并修复了清理运行时依赖目录的测试用例	2026-07-05 20:30:00 +08:00
xiaojunnuo	3e80d30ca6	chore: 调整dockerfile	2026-07-05 19:51:08 +08:00
xiaojunnuo	2eb54d50a5	chore(certd-server): adjust dependency installation and docker build steps 调整了依赖包的安装位置，将cross-env和mwtsc移到devDependencies，同时修改Dockerfile中的安装命令：先安装完整依赖构建，再清理非生产依赖，并在最终镜像中仅安装生产依赖	2026-07-05 19:45:49 +08:00
xiaojunnuo	6995308c17	build(certd-server): 调整cross-env依赖的安装位置将cross-env从devDependencies移动到dependencies中，统一管理运行时依赖	2026-07-05 19:36:41 +08:00
xiaojunnuo	0738d120ae	build: publish	2026-07-05 19:31:22 +08:00
xiaojunnuo	bad6879589	build: trigger build image	2026-07-05 19:31:10 +08:00
@@ -1 +1 @@
 :21
 :45