Audit Logging

1// prisma/schema.prisma
2
3model AuditLog {
4  id          String   @id @default(cuid())
5  createdAt   DateTime @default(now())
6
7  // Event details
8  action      String   // e.g., "user.login", "payment.created"
9  category    String   // e.g., "auth", "billing", "admin"
10  severity    String   @default("info") // info, warning, error, critical
11
12  // Actor information
13  userId      String?
14  user        User?    @relation(fields: [userId], references: [id])
15  actorType   String   @default("user") // user, system, api
16
17  // Context
18  ipAddress   String?
19  userAgent   String?
20
21  // Event data
22  targetType  String?  // e.g., "user", "organization", "payment"
23  targetId    String?
24  metadata    Json?    // Additional event-specific data
25
26  // Result
27  status      String   @default("success") // success, failure
28  errorMessage String?
29
30  @@index([userId])
31  @@index([action])
32  @@index([category])
33  @@index([createdAt])
34}

1// src/lib/audit.ts
2
3import { prisma } from "@/lib/db";
4import { NextRequest } from "next/server";
5
6export type AuditAction =
7  | "user.login"
8  | "user.logout"
9  | "user.register"
10  | "user.password_reset"
11  | "user.email verified"
12  | "user.updated"
13  | "user.deleted"
14  | "payment.created"
15  | "payment.failed"
16  | "subscription.created"
17  | "subscription.cancelled"
18  | "api key.created"
19  | "api key.revoked"
20  | "organization.created"
21  | "organization.member_added"
22  | "organization.member_removed"
23  | "admin.user_impersonated"
24  | "admin.settings_changed";
25
26export type AuditCategory = "auth" | "billing" | "admin" | "organization" | "api";
27export type AuditSeverity = "info" | "warning" | "error" | "critical";
28
29interface AuditLogInput {
30  action: AuditAction;
31  category: AuditCategory;
32  severity?: AuditSeverity;
33  userId?: string;
34  actorType?: "user" | "system" | "api";
35  targetType?: string;
36  targetId?: string;
37  metadata?: Record<string, unknown>;
38  status?: "success" | "failure";
39  errorMessage?: string;
40  request?: NextRequest;
41}
42
43export async function createAuditLog(input: AuditLogInput) {
44  const {
45    action,
46    category,
47    severity = "info",
48    userId,
49    actorType = "user",
50    targetType,
51    targetId,
52    metadata,
53    status = "success",
54    errorMessage,
55    request,
56  } = input;
57
58  // Extract request context
59  let ipAddress: string | undefined;
60  let userAgent: string | undefined;
61
62  if (request) {
63    ipAddress = request.ip ??
64      request.headers.get("x-forwarded-for")?.split(",")[0] ??
65      undefined;
66    userAgent = request.headers.get("user-agent") ?? undefined;
67  }
68
69  return prisma.auditLog.create({
70    data: {
71      action,
72      category,
73      severity,
74      userId,
75      actorType,
76      ipAddress,
77      userAgent,
78      targetType,
79      targetId,
80      metadata,
81      status,
82      errorMessage,
83    },
84  });
85}

1// Login event
2// src/app/api/auth/login/route.ts
3
4import { createAuditLog } from "@/lib/audit";
5
6export async function POST(request: NextRequest) {
7  const body = await request.json();
8
9  try {
10    const user = await authenticateUser(body.email, body.password);
11
12    await createAuditLog({
13      action: "user.login",
14      category: "auth",
15      userId: user.id,
16      metadata: { email: body.email },
17      request,
18    });
19
20    return NextResponse.json({ success: true });
21  } catch (_) {
22    await createAuditLog({
23      action: "user.login",
24      category: "auth",
25      severity: "warning",
26      status: "failure",
27      metadata: { email: body.email },
28      errorMessage: error instanceof Error ? error.message : "Unknown error",
29      request,
30    });
31
32    return NextResponse.json(
33      { error: "Invalid credentials" },
34      { status: 401 }
35    );
36  }
37}
38
39// Payment event
40// src/app/api/stripe/webhook/route.ts
41
42await createAuditLog({
43  action: "payment.created",
44  category: "billing",
45  userId: payment.userId,
46  targetType: "payment",
47  targetId: payment.id,
48  metadata: {
49    amount: payment.amount,
50    currency: payment.currency,
51    stripePaymentId: payment.stripeId,
52  },
53});
54
55// Admin action
56await createAuditLog({
57  action: "admin.user_impersonated",
58  category: "admin",
59  severity: "warning",
60  userId: adminUser.id,
61  targetType: "user",
62  targetId: impersonatedUser.id,
63  metadata: {
64    reason: "Customer support request",
65  },
66  request,
67});

1// src/app/api/admin/audit-logs/route.ts
2
3import { NextRequest, NextResponse } from "next/server";
4import { auth } from "@/lib/auth";
5import { prisma } from "@/lib/db";
6
7export async function GET(request: NextRequest) {
8  const session = await auth();
9
10  // Admin only
11  if (session?.user?.role !== "admin") {
12    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
13  }
14
15  const searchParams = request.nextUrl.searchParams;
16
17  const page = parseInt(searchParams.get("page") || "1");
18  const limit = parseInt(searchParams.get("limit") || "50");
19  const userId = searchParams.get("userId");
20  const action = searchParams.get("action");
21  const category = searchParams.get("category");
22  const severity = searchParams.get("severity");
23  const from = searchParams.get("from");
24  const to = searchParams.get("to");
25
26  const where: any = {};
27
28  if (userId) where.userId = userId;
29  if (action) where.action = action;
30  if (category) where.category = category;
31  if (severity) where.severity = severity;
32
33  if (from || to) {
34    where.createdAt = {};
35    if (from) where.createdAt.gte = new Date(from);
36    if (to) where.createdAt.lte = new Date(to);
37  }
38
39  const [logs, total] = await Promise.all([
40    prisma.auditLog.findMany({
41      where,
42      orderBy: { createdAt: "desc" },
43      skip: (page - 1) * limit,
44      take: limit,
45      include: {
46        user: {
47          select: { id: true, name: true, email: true },
48        },
49      },
50    }),
51    prisma.auditLog.count({ where }),
52  ]);
53
54  return NextResponse.json({
55    logs,
56    pagination: {
57      page,
58      limit,
59      total,
60      pages: Math.ceil(total / limit),
61    },
62  });
63}

1// scripts/cleanup-audit-logs.ts
2
3import { prisma } from "@/lib/db";
4
5const RETENTION_DAYS = {
6  info: 30,      // Keep info logs for 30 days
7  warning: 90,   // Keep warning logs for 90 days
8  error: 180,    // Keep error logs for 180 days
9  critical: 365, // Keep critical logs for 1 year
10};
11
12async function cleanupAuditLogs() {
13  const now = new Date();
14
15  for (const [severity, days] of Object.entries(RETENTION_DAYS)) {
16    const cutoffDate = new Date(now.getTime() - days * 24 * 60 * 60 * 1000);
17
18    const result = await prisma.auditLog.deleteMany({
19      where: {
20        severity,
21        createdAt: { lt: cutoffDate },
22      },
23    });
24
25    console.log(`Deleted ${result.count} ${severity} logs older than ${days} days`);
26  }
27}
28
29cleanupAuditLogs()
30  .catch(console.error)
31  .finally(() => prisma.$disconnect());
32
33// Run as cron job:
34// 0 0 * * * npx ts-node scripts/cleanup-audit-logs.ts

1// src/lib/audit.ts
2
3import { sendEmail } from "@/lib/email";
4
5const ALERT_ACTIONS = [
6  "user.password_reset",
7  "admin.user_impersonated",
8  "api key.created",
9];
10
11export async function createAuditLog(input: AuditLogInput) {
12  const log = await prisma.auditLog.create({ /* ... */ });
13
14  // Send alerts for critical actions
15  if (
16    input.severity === "critical" ||
17    ALERT_ACTIONS.includes(input.action)
18  ) {
19    await sendSecurityAlert(log);
20  }
21
22  return log;
23}
24
25async function sendSecurityAlert(log: AuditLog) {
26  const adminEmails = process.env.SECURITY_ALERT_EMAILS?.split(",") || [];
27
28  for (const email of adminEmails) {
29    await sendEmail({
30      to: email,
31      subject: `Security Alert: ${log.action}`,
32      text: `
33        Action: ${log.action}
34        Category: ${log.category}
35        Severity: ${log.severity}
36        User ID: ${log.userId || "N/A"}
37        IP: ${log.ipAddress || "N/A"}
38        Time: ${log.createdAt.toISOString()}
39
40        Metadata: ${JSON.stringify(log.metadata, null, 2)}
41      `,
42    });
43  }
44}