feat(management): admin actions and session history #192

New issue

Closed

opened 2026-10-03 13:14:17 +00:00 by yuris · 0 comments

yuris commented 2026-10-03 13:14:17 +00:00

Owner

Copy link

Problem

Store owners/admins have no visibility into administrative operations (such as inventory stock adjustments, user creation/edits, password resets, and order modifications) and cannot inspect or revoke active user login sessions across devices.

Acceptance Criteria

1. Schema & Database:
   • Define actionLogs (action_logs) in apps/management/lib/db/schema.ts tracking userId, userName, userRole, action, entityType, entityId, description, metadata (jsonb), ipAddress, and createdAt.
   • Map existing Better Auth sessions (session) in apps/management/lib/db/schema.ts referencing users.id.
   • Add database migration file for action_logs in apps/management/drizzle/.
2. Audit & Session Backend:
   • Implement logAction(txOrDb, entry) in apps/management/lib/audit/service.ts.
   • Instrument key mutation paths to log actions:
     • Stock adjustments (adjustStockAction in apps/management/lib/inventory/actions.ts)
     • User management (createUserAction, updateUserAction, resetPasswordAction in apps/management/lib/users/actions.ts)
     • Order updates (updateOrderAction in apps/management/lib/orders/actions.ts)
   • Implement server actions in apps/management/lib/audit/actions.ts:
     • getActionLogs(filter) guarded by requireAdmin().
     • getSessions() guarded by requireAdmin(), identifying current session and parsing userAgent for device/browser.
     • revokeSessionAction(sessionId) guarded by requireAdmin() (disallowing self-revocation).
     • revokeAllOtherSessionsAction() guarded by requireAdmin().
3. Admin UI:
   • Page at /settings/audit guarded by requireAdmin() (non-admins redirected to /).
   • Tab 1: "Riwayat Aksi" with search, entity filter, table showing timestamp, actor, action, target entity, description, and metadata sheet viewer.
   • Tab 2: "Sesi Pengguna" displaying active sessions, device info, IP, last active time, and revoke session buttons.
   • Add navigation link to "Audit & Sesi" in desktop settings dropup and mobile drawer for admins in dashboard-nav.tsx.
4. Verification:
   • Unit tests covering logAction, getActionLogs, getSessions, and revokeSessionAction with admin checks in apps/management/lib/audit/actions.test.ts.
   • pnpm --filter garage test passes.
   • pnpm --filter garage typecheck passes.
   • .forgejo/scripts/biome-gate.sh passes.

## Problem Store owners/admins have no visibility into administrative operations (such as inventory stock adjustments, user creation/edits, password resets, and order modifications) and cannot inspect or revoke active user login sessions across devices. ## Acceptance Criteria 1. **Schema & Database:** - Define `actionLogs` (`action_logs`) in `apps/management/lib/db/schema.ts` tracking `userId`, `userName`, `userRole`, `action`, `entityType`, `entityId`, `description`, `metadata` (jsonb), `ipAddress`, and `createdAt`. - Map existing Better Auth `sessions` (`session`) in `apps/management/lib/db/schema.ts` referencing `users.id`. - Add database migration file for `action_logs` in `apps/management/drizzle/`. 2. **Audit & Session Backend:** - Implement `logAction(txOrDb, entry)` in `apps/management/lib/audit/service.ts`. - Instrument key mutation paths to log actions: - Stock adjustments (`adjustStockAction` in `apps/management/lib/inventory/actions.ts`) - User management (`createUserAction`, `updateUserAction`, `resetPasswordAction` in `apps/management/lib/users/actions.ts`) - Order updates (`updateOrderAction` in `apps/management/lib/orders/actions.ts`) - Implement server actions in `apps/management/lib/audit/actions.ts`: - `getActionLogs(filter)` guarded by `requireAdmin()`. - `getSessions()` guarded by `requireAdmin()`, identifying current session and parsing userAgent for device/browser. - `revokeSessionAction(sessionId)` guarded by `requireAdmin()` (disallowing self-revocation). - `revokeAllOtherSessionsAction()` guarded by `requireAdmin()`. 3. **Admin UI:** - Page at `/settings/audit` guarded by `requireAdmin()` (non-admins redirected to `/`). - Tab 1: "Riwayat Aksi" with search, entity filter, table showing timestamp, actor, action, target entity, description, and metadata sheet viewer. - Tab 2: "Sesi Pengguna" displaying active sessions, device info, IP, last active time, and revoke session buttons. - Add navigation link to "Audit & Sesi" in desktop settings dropup and mobile drawer for admins in `dashboard-nav.tsx`. 4. **Verification:** - Unit tests covering `logAction`, `getActionLogs`, `getSessions`, and `revokeSessionAction` with admin checks in `apps/management/lib/audit/actions.test.ts`. - `pnpm --filter garage test` passes. - `pnpm --filter garage typecheck` passes. - `.forgejo/scripts/biome-gate.sh` passes.

yuris referenced this issue from a pull request that will close it, 2026-10-03 13:29:35 +00:00

feat(management): admin actions and session history #193

yuris closed this issue 2026-10-03 13:49:40 +00:00

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

feat/remove-supplier-category-and-terms

fix/suppliers-table-single-line

feat/phase-5-batch-price-update

feat/phase-4-supplier-catalog-pricing

feat/phase-3-supplier-directory

feat/phase-2-admin-auth-nav

feat/phase-1-supplier-schema

ci/166-prune-container-images

store/services-order

No results found.

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

yuris/garage#192

No description provided.