Original task: Show admins a history of sensitive actions. Forced group
deletions already write to the new `audit_logs` table; admins now have
a UI to browse and filter those entries.
API
- New OpenAPI endpoint GET /admin/audit-logs (admin-only) with optional
filters: action (exact), from / to (YYYY-MM-DD, inclusive), limit
(1-200, default 50), offset (default 0).
- New schemas: AuditLogActor, AuditLogEntry, AuditLogList. List
response includes paginated `entries`, `totalCount`, `nextOffset`,
and a distinct `actions` list to power the filter dropdown.
- New `audit` tag added to the spec; ran orval codegen so
api-client-react / api-zod expose useListAuditLogs et al.
- Implemented `artifacts/api-server/src/routes/audit.ts` and registered
it in routes/index.ts. Validates date format / order, joins users for
actor info, and orders newest-first.
UI (artifacts/tx-os/src/pages/admin.tsx)
- New "Audit log" entry under the User Management nav group (icon:
ScrollText). Section deep-link works via #section=audit-log.
- New AuditLogPanel + AuditLogRow components: action chip + target,
formatted timestamp, actor avatar/name, expandable JSON metadata.
- Filters bar: action dropdown (populated from API's distinct
actions), from/to date inputs, Apply / Reset, plus a "Load more"
control that increases the page size (caps at 200, the API limit).
Read-only by design.
- Added en/ar locale strings for nav.auditLog and the audit subtree.
Verification
- Typecheck: pnpm -w run typecheck (clean).
- API smoke tested via curl: 401 unauthenticated, validation errors
for bad / inverted dates, returns the seeded `group.force_delete`
entry once produced.
- End-to-end browser test (testing skill): logged in as admin,
navigated to /admin#section=audit-log, verified the row, expanded
metadata, exercised filters (empty state + reset).
No deviations from the task description.
Replit-Task-Id: 5b5bf9b1-6937-43c3-85c9-81f0c19a5e49
riyadhafraa
1ca5d5ae4b