336a5890a8
Soft-delete cascade was the missing half of archive: stamping workspaces.archived_at alone left objects visible to anyone with a direct id. The cascade runs in one transaction so the partial state isn't reachable, and restore inverts it for any archived row in the workspace — provenance-blind on purpose until we have a use case that needs to distinguish per-workspace from per-object archives. audit_log keeps the keyset index on (workspace_id, created_at) and the actor_user_id FK with onDelete set null. recordAudit() refuses to write a null actor without a metadata.system_actor label so the audit view always has something to render. workspaces and invites mutations call recordAudit on success; objects-router instrumentation and the markdown importer's system-actor flow are filed as P2 follow-ups because each needs a thoughtful "what's audit-worthy?" pass, not mechanical wiring. Settings → Audit log lives at /<slug>/settings/audit, owner-gated, keyset-paginated. ACTION_LABELS is small on purpose; new actions fall back to their raw key so missing a label degrades gracefully. Co-authored-by: Cursor <cursoragent@cursor.com>
73 lines
2.5 KiB
TypeScript
73 lines
2.5 KiB
TypeScript
import { TRPCError } from "@trpc/server";
|
|
import { z } from "zod";
|
|
import { and, desc, eq, lt } from "drizzle-orm";
|
|
|
|
import { auditLog, users } from "@tasks/database/schema";
|
|
import { router, workspaceProcedure } from "@/server/trpc";
|
|
|
|
const DEFAULT_LIMIT = 50;
|
|
const MAX_LIMIT = 200;
|
|
|
|
/**
|
|
* Audit log read API. Owner-only; this is a debugging / support surface,
|
|
* not a feature stream. Kept narrow on purpose — pagination is keyset on
|
|
* `(created_at, id)` so we can scale rows without LIMIT/OFFSET pain.
|
|
*/
|
|
export const auditRouter = router({
|
|
list: workspaceProcedure
|
|
.input(
|
|
z.object({
|
|
limit: z.number().int().min(1).max(MAX_LIMIT).optional(),
|
|
// Keyset cursor: a row's `createdAt` ISO string. Rows older than this
|
|
// are returned next. We use createdAt-only (no id tiebreaker) because
|
|
// the index is `(workspace_id, created_at)`. In the rare event of
|
|
// identical timestamps the user can refresh; we're not building a
|
|
// realtime feed here.
|
|
cursorCreatedAt: z.string().datetime().optional(),
|
|
}),
|
|
)
|
|
.query(async ({ ctx, input }) => {
|
|
if (ctx.workspace.role !== "owner") {
|
|
throw new TRPCError({
|
|
code: "FORBIDDEN",
|
|
message: "Only the workspace owner can view the audit log.",
|
|
});
|
|
}
|
|
|
|
const limit = input.limit ?? DEFAULT_LIMIT;
|
|
const cursorDate = input.cursorCreatedAt ? new Date(input.cursorCreatedAt) : null;
|
|
|
|
const rows = await ctx.db
|
|
.select({
|
|
id: auditLog.id,
|
|
action: auditLog.action,
|
|
targetType: auditLog.targetType,
|
|
targetId: auditLog.targetId,
|
|
metadata: auditLog.metadata,
|
|
createdAt: auditLog.createdAt,
|
|
actorUserId: auditLog.actorUserId,
|
|
actorName: users.name,
|
|
actorEmail: users.email,
|
|
})
|
|
.from(auditLog)
|
|
.leftJoin(users, eq(auditLog.actorUserId, users.id))
|
|
.where(
|
|
cursorDate
|
|
? and(
|
|
eq(auditLog.workspaceId, ctx.workspace.id),
|
|
lt(auditLog.createdAt, cursorDate),
|
|
)
|
|
: eq(auditLog.workspaceId, ctx.workspace.id),
|
|
)
|
|
.orderBy(desc(auditLog.createdAt))
|
|
.limit(limit + 1);
|
|
|
|
const hasMore = rows.length > limit;
|
|
const page = hasMore ? rows.slice(0, limit) : rows;
|
|
const nextCursor = hasMore ? page[page.length - 1]!.createdAt.toISOString() : null;
|
|
|
|
return { rows: page, nextCursor };
|
|
}),
|
|
});
|
|
|
|
export type AuditRouter = typeof auditRouter;
|