feat: add organization audit logging

[izadoesdev]

Summary

• add organization-scoped audit events, durable replay, authenticated reads, and coverage for API-key and website mutations
• make privileged mutations transactional with their mandatory ledger entries, including Better Auth organization hooks
• accept origin IPs only from an explicitly configured, proxy-verified header
• refine Insight evidence, resume behavior, and dashboard voice/tracking presentation

Validation

• bun run check-types
• bun run test
• focused audit IP and API-key tests

---

Summary by cubic

Adds organization-level audit logging with a durable outbox and transactional writes across auth, API keys, and websites. Introduces audit log APIs and tightens client IP capture to trusted proxy headers.

• New Features

  • Tenant-scoped audit ledger (audit_events) with durable outbox and API replay loop.
  • RPC: audit-logs.list and audit-logs.getById (requires audit_log:read; granted to admin/owner).
  • Unified audit vocabulary in @databuddy/shared (auditActions, outcomes, sources).
  • Transactional audit for API keys and websites:
    • API keys: create, update, revoke, rotate, delete.
    • Websites: create, update, visibility, settings, delete, transfer (both orgs logged).
  • Better Auth org hooks emit audit events (org create/update/delete, member role/add/remove, invitations).
  • Dashboard auth route wraps requests with audit context and a single Better Auth transaction.
  • Trusted client IPs read only from a verified header via getTrustedClientIp.
  • Website service writes moved into explicit DB transactions; caches invalidate after commit.

• Migration

  • Run DB migrations.
  • Deploy behind a trusted proxy and set:
    • IP_HEADER_VERIFIED=true
    • TRUSTED_IP_HEADER (defaults to cf-connecting-ip; set to your edge header if different).
  • Restart API workers to start the audit outbox replay loop.

^{Written for commit 717d6cf. Summary will update on new commits.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dashboard	Ready	Preview	Jul 30, 2026 9:07pm
databuddy-status	Ready	Preview	Jul 30, 2026 9:07pm
documentation	Ready	Preview	Jul 30, 2026 9:07pm

[unkey-deploy]

The latest updates on your projects. Learn more about Unkey Deploy

Name	Status	Preview	Inspect	Updated (UTC)
links (preview)	Ready	Visit Preview	Inspect	Jul 30, 2026 9:06pm

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 5b23ffb7-95f7-458b-9566-2a234a39f88c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dosubot]

📄 Knowledge review

Dosu skipped reviewing this PR because your organization has used its 200 included credits for the month. Your usage will reset on 2026-08-01. To have Dosu review this PR before then, ask your organization admin to upgrade to a pro account.

---

[greptile-apps]

Greptile Summary

Adds an organization-scoped audit ledger and transactional audit coverage across privileged mutations.

• Introduces audit event and outbox schemas, typed audit vocabulary, replay processing, and authenticated audit-log queries.
• Records Better Auth organization operations plus API-key and website mutations alongside their database transactions.
• Adds proxy-verified client-IP handling and refactors website cache invalidation around transactional writes.
• Refines Insight action parsing, tracking-warning visibility, and voice-dialog messaging.

Confidence Score: 4/5

The PR appears safe to merge, with one non-blocking voice-dialog messaging regression for unsupported browsers.

The audit ledger, authorization, transaction, replay, and tenant-scoping changes do not expose a concrete blocking failure, but the voice dialog now misrepresents unsupported voice input as ready to use.

Files Needing Attention: apps/dashboard/components/agent/agent-voice-dialog.tsx

Important Files Changed

Filename	Overview
packages/services/src/audit.ts	Implements audit payload construction, transactional insertion, idempotent outbox replay, cursor pagination, and tenant-scoped reads.
packages/auth/src/auth.ts	Adds transaction-bound organization audit hooks and records default organization provisioning.
packages/rpc/src/routers/audit-logs.ts	Adds permission-gated, tenant-scoped list and detail procedures for audit events.
packages/rpc/src/routers/apikeys.ts	Makes API-key mutations atomic with their corresponding audit records.
packages/rpc/src/routers/websites.ts	Makes website mutations atomic with audit records and moves cache invalidation after commit.
packages/db/src/drizzle/schema/audit.ts	Defines durable audit ledger and outbox tables with tenant-pagination indexes.
apps/dashboard/app/api/auth/[...all]/route.ts	Wraps organization mutation endpoints with request audit context and a Better Auth transaction.
apps/dashboard/components/agent/agent-voice-dialog.tsx	Simplifies status messaging but now gives unsupported browsers an unusable instruction.

Sequence Diagram

sequenceDiagram
  participant Client
  participant API as Auth/RPC Handler
  participant TX as Database Transaction
  participant Audit as Audit Ledger
  participant Cache
  Client->>API: Privileged organization/resource mutation
  API->>API: Authenticate and authorize
  API->>TX: Begin transaction
  TX->>TX: Apply mutation
  TX->>Audit: Append organization-scoped event
  Audit-->>TX: Event persisted
  TX-->>API: Commit mutation and event
  API->>Cache: Invalidate affected caches
  API-->>Client: Return result

Loading

Comments Outside Diff (1)

1. apps/dashboard/components/agent/agent-voice-dialog.tsx, line 209 (link)

   Restore unsupported-browser guidance

   When voice input is unsupported and no separate error exists, the dialog still tells the user to start speaking, leaving them without an explanation for why voice capture does not work.

_{Reviews (1): Last reviewed commit: "fix(audit): make privileged writes atomi..." | Re-trigger Greptile}