Problem Statement
AuditService.log() accepts action: string with no enumeration. Callers use ad-hoc strings with embedded dynamic data (email addresses), making it impossible to query efficiently.
Why It Matters
Audit logs are only useful if they're queryable. Embedding variable data in the action field prevents filtering, aggregation, and alerting on specific event types.
Technical Context
api/src/audit/audit.service.ts: log(userId, action, ip) — free-form action stringapi/src/auth/auth.service.ts: callers use compound strings with embedded data
Acceptance Criteria
Files Affected: api/src/audit/audit.service.ts, api/src/auth/auth.service.ts, database/migrations/
Difficulty: Medium | Effort: 1–2 days
Problem Statement
AuditService.log()acceptsaction: stringwith no enumeration. Callers use ad-hoc strings with embedded dynamic data (email addresses), making it impossible to query efficiently.Why It Matters
Audit logs are only useful if they're queryable. Embedding variable data in the action field prevents filtering, aggregation, and alerting on specific event types.
Technical Context
api/src/audit/audit.service.ts:log(userId, action, ip)— free-form action stringapi/src/auth/auth.service.ts: callers use compound strings with embedded dataAcceptance Criteria
AuditActionenum (e.g.AUTH_LOGIN_SUCCESS,AUTH_LOGIN_FAILURE, etc.)audit_logsschema updated to add ametadata JSONBcolumn for variable dataAuditService.log()signature updated tolog(userId, action: AuditAction, metadata: Record<string, unknown>, ip)audit_logs(action)in a new migrationFiles Affected:
api/src/audit/audit.service.ts,api/src/auth/auth.service.ts,database/migrations/Difficulty: Medium | Effort: 1–2 days