brackt/app/models/audit-log.ts

88 lines
2.6 KiB
TypeScript
Raw Normal View History

Add audit logging for commissioner actions (#293) Closes #144 * feat: add commissioner audit log for league transparency (issue #144) Adds a complete audit log system so league members can verify that settings, draft order, picks, and time banks have not been quietly changed without their awareness. Changes: - database/schema.ts: new `audit_action` enum + `commissioner_audit_log` table (seasonId, leagueId, actorClerkId, actorDisplayName, action, affectedTeamIds[], details jsonb, createdAt) - drizzle/0075: generated migration for the new table - app/models/audit-log.ts: createAuditLogEntry, getAuditLogForSeason (paginated), logCommissionerAction (resolves display name automatically) - app/lib/audit-log-display.ts: shared formatAuditDetail() helper used by both the league home widget and the full audit log page - app/routes/leagues/$leagueId.audit-log.tsx: new read-only route at /leagues/:id/audit-log, accessible to all league members, with action-type filter and pagination - app/routes.ts: registers the new route - League home page ($leagueId.server.ts / $leagueId.tsx): "Recent Activity" summary card showing the last 5 entries with "View all" link - Settings page ($leagueId.settings.tsx): "View Full Audit Log" link card; audit log calls added for league/draft settings changes, draft order set/randomized, and draft reset - API routes: audit log calls added to draft.start, draft.pause, draft.resume, draft.rollback, draft.adjust-time-bank, draft.force-autopick, draft.force-manual-pick, draft.replace-pick - Tests: 11 new unit tests for the audit-log model; mocks added to 3 existing route test files to account for the new logCommissionerAction call https://claude.ai/code/session_01NdiwK2fbtKhAD3XuD58fTm * fix: validate action filter URL param against known enum values The action filter on the audit log route was cast directly from the URL search param to AuditAction without validation. An invalid value would be passed into the Drizzle inArray() call, potentially throwing a PostgreSQL enum type error. Now validates against the actual enum values before using the filter. https://claude.ai/code/session_01NdiwK2fbtKhAD3XuD58fTm * Fix lint errors: use !== instead of != and toSorted instead of sort https://claude.ai/code/session_01NdiwK2fbtKhAD3XuD58fTm --------- Co-authored-by: Claude <noreply@anthropic.com>
2026-04-13 18:45:39 -04:00
import { eq, desc, and, inArray, sql } from "drizzle-orm";
import { database } from "~/database/context";
import * as schema from "~/database/schema";
import { findUserByClerkId, getUserDisplayName } from "~/models/user";
export type AuditLogEntry = typeof schema.commissionerAuditLog.$inferSelect;
export type NewAuditLogEntry = typeof schema.commissionerAuditLog.$inferInsert;
export type AuditAction = typeof schema.auditActionEnum.enumValues[number];
export interface AuditLogPage {
entries: AuditLogEntry[];
total: number;
hasMore: boolean;
}
export async function createAuditLogEntry(
data: NewAuditLogEntry
): Promise<AuditLogEntry> {
const db = database();
const [entry] = await db
.insert(schema.commissionerAuditLog)
.values(data)
.returning();
return entry;
}
export async function getAuditLogForSeason(
seasonId: string,
options?: { limit?: number; offset?: number; actions?: AuditAction[] }
): Promise<AuditLogPage> {
const db = database();
const limit = options?.limit ?? 50;
const offset = options?.offset ?? 0;
const whereClause =
options?.actions && options.actions.length > 0
? and(
eq(schema.commissionerAuditLog.seasonId, seasonId),
inArray(schema.commissionerAuditLog.action, options.actions)
)
: eq(schema.commissionerAuditLog.seasonId, seasonId);
const [entries, countRows] = await Promise.all([
db
.select()
.from(schema.commissionerAuditLog)
.where(whereClause)
.orderBy(desc(schema.commissionerAuditLog.createdAt))
.limit(limit)
.offset(offset),
db
.select({ count: sql<number>`count(*)::int` })
.from(schema.commissionerAuditLog)
.where(whereClause),
]);
const total = countRows[0]?.count ?? 0;
return { entries, total, hasMore: offset + entries.length < total };
}
/**
* Convenience wrapper that resolves the actor display name from the users table
* and writes a single audit log record. Call this after the main action succeeds.
*/
export async function logCommissionerAction(params: {
seasonId: string;
leagueId: string;
actorClerkId: string;
action: AuditAction;
affectedTeamIds?: string[];
details?: Record<string, unknown>;
}): Promise<void> {
const user = await findUserByClerkId(params.actorClerkId);
const actorDisplayName = user
? (getUserDisplayName(user) ?? params.actorClerkId)
: params.actorClerkId;
await createAuditLogEntry({
seasonId: params.seasonId,
leagueId: params.leagueId,
actorClerkId: params.actorClerkId,
actorDisplayName,
action: params.action,
affectedTeamIds: params.affectedTeamIds ?? [],
details: params.details ?? {},
});
}