craftvia/src/server/audit.ts

import { prisma } from "./db";

/**
 * Audit trail (SPEC §5 AuditLog, §10): every writing action creates an entry.
 * Uses the raw client on purpose — audit writes must never be silently
 * filtered, and tenantId is passed explicitly by the caller.
 */
export async function writeAuditLog(entry: {
  tenantId: string;
  actorId?: string;
  action: "create" | "update" | "delete" | "login" | "logout" | "export" | "import" | "denied";
  scope?: "tenant" | "platform";
  entity: string;
  entityId?: string;
  before?: unknown;
  after?: unknown;
}) {
  await prisma.auditLog.create({
    data: {
      tenantId: entry.tenantId,
      scope: entry.scope ?? "tenant",
      actorId: entry.actorId,
      action: entry.action,
      entity: entry.entity,
      entityId: entry.entityId,
      before: entry.before as object | undefined,
      after: entry.after as object | undefined,
    },
  });
}

/**
 * Audit-Eintrag der Plattform-Ebene (kein Mandantenbezug, scope="platform").
 * Für Superadmin-Anmeldungen und -Aktionen (Phase-1-Härtung Paket 2).
 */
export async function writePlatformAudit(entry: {
  actorId?: string;
  action: "create" | "update" | "delete" | "login" | "logout" | "export" | "import" | "denied";
  entity: string;
  entityId?: string;
  before?: unknown;
  after?: unknown;
}) {
  await prisma.auditLog.create({
    data: {
      tenantId: null,
      scope: "platform",
      actorId: entry.actorId,
      action: entry.action,
      entity: entry.entity,
      entityId: entry.entityId,
      before: entry.before as object | undefined,
      after: entry.after as object | undefined,
    },
  });
}