AuditLog model + audit service

[PierreBrisorgueil]

Phase 5 — Logging & Monitoring (2/3)

What

New modules/audit/ module:

• AuditLog Mongoose model (action, userId, orgId, targetType, targetId, ip, userAgent, metadata)
• TTL index on createdAt — configurable via config.audit.ttlDays (default 90)
• audit.service.js — audit.log({ action, req, targetType, targetId, metadata })
• Instrument sensitive controllers: auth (login, signup, password change), billing (subscribe, cancel), invitations (create, accept)
• GET /api/audit route — admin-only, paginated, filterable by action/userId/orgId
• Zod validation schema

Config

audit: { ttlDays: 90, enabled: true }

Collection

auditlogs (Mongoose auto-pluralize)

Acceptance

• AuditLog entries created on auth/billing/invitation actions
• TTL index auto-purges after configured days
• Admin can query audit logs via API
• No-op when audit.enabled: false