Audit: admin-gated web endpoint for the audit log

[CaYatur]

What & why

Item #7 (part of #1): expose the audit log over the web panel. Because entries carry player IPs — personal data — the endpoint is owner-only, a stricter gate than any per-server scope.

How

• GET /api/audit (admin-panel listener, owner-only): mirrors the desktop audit:query. All of from, to, sources, actions, serverId, actor, ip, text, ok, limit, offset ride the query string; returns the same AuditPage (entries newest-first, total, bySource). Non-owner → 403, no token → 401.
• Panel: an owner-only "Audit" tab (hidden client-side when role !== 'owner', but the server gate is the real boundary), with a text search + source + outcome filter and a compact table. Panel strings stay English, matching the rest of the non-i18n admin panel.

Privacy

Owner-only by design; the client-side tab hiding is cosmetic, the user.role === 'owner' server check is the enforcement. IPs never reach a lesser role.

Verification

• typecheck (node + web) ✓ · build ✓
• MSMS_SMOKE_WEB: owner GET 200 newest-first + sources/text/ok filters, non-owner token 403, no token 401 — all green by exit code.

Verification gap (disclosed)

The panel loadAudit JS consumer is inspection-only — the admin panel is served as a static HTML string with no headless DOM harness, so panel JS isn't exercised by a smoke (same as the rest of the panel). The endpoint it calls is fully covered.

Closes #7.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[CaYatur]

Code review

Overview

Exposes the global audit log over the admin-panel listener as owner-only GET /api/audit, mirroring the desktop audit:query, plus an owner-only "Audit" tab in the panel. Correct instinct to make this owner-only rather than a per-server scope — the entries carry player IPs, and per-server scopes don't cleanly bound a cross-server, IP-bearing log.

Correctness / security

• Enforcement is server-side. The tab is hidden client-side for non-owners, but the real gate is user.role === 'owner' on the route; the WEB smoke proves a non-owner token gets 403 and no token 401. Client hiding is correctly treated as cosmetic.
• Not on the public listener. The route lives in the authenticated admin handler, after session resolution — handlePublic (separate port) has no /api/audit. IPs can't leak to the public site.
• Read-only, no injection surface; rendered cells go through esc().

Findings

1. (fixed in 8416eaa) Loose ok parse — the old okRaw == null ? undefined : okRaw === 'true' mapped a present-but-empty or garbage ?ok= to false, silently filtering to failures only. Now only the literal true/false filter; anything else is ignored. WEB smoke still green.
2. (low, disclosed) Panel consumer inspection-only — loadAudit isn't exercised by a smoke because the admin panel is a served static-HTML string with no headless DOM harness (same as the rest of the panel). The endpoint it calls is fully covered.

Conventions

• Follows the existing global-admin-route pattern (/api/site), the panel api() helper, and the section/tab structure. Panel stays English, matching the non-i18n admin panel (public site i18n is separate and untouched).

Verification

typecheck (node + web) ✓ · build ✓ · MSMS_SMOKE_WEB — owner 200 newest-first + sources/text/ok filters, non-owner 403, no token 401 ✓ — green by exit code, re-run after the fix.

Verdict: ready to merge. One real nit found + fixed; no blockers.