Audit Log

Read-only event viewer at /dashboard/audit-log. Shows the current user their own user_events rows written by logUserEvent. It is a per-user self-view, not an admin tool , but on this fork's shared Postgres, that's an application-level restriction (an explicit user_id filter on every query), not a structural one. This is different from the base template, where events lived in each user's own SQLite file and there was no cross-user query to run even by accident , here, a forgotten .where(eq(userEvents.userId, userId)) would be a real cross-tenant leak, not a structural impossibility. See architecture/postgres-port.md for the general tenant-isolation tradeoff this fork accepted.

How events get there

Every authenticated mutation should call logUserEvent after a successful write:

import { logUserEvent } from '@/lib/db/user-events';

// Inside withUserTransaction, after the write:
await logUserEvent(tx, userId, 'item.created', { id });

logUserEvent appends a row to the shared userEvents table, scoped by user_id. The audit-log feature reads these rows back, filtered to the same user.

Scope: logUserEvent only applies to mutations going through withUserTransaction. Shared-DB mutations (billing, credits, admin operations) are not covered , this is intentional, not a gap (see CLAUDE.md's Server Functions rule).

Access

Any authenticated user can open the page; getAuditLogFn calls requireUser() and then listAuditEvents(db, user.id), which filters the shared userEvents table by that user's id , so each user only ever sees their own events, sorted newest first, with event type, timestamp, and payload. There is no compensating enforcement (e.g. a CI lint rule) yet that catches a missing user_id filter on a query like this , it's a documented TODO in CLAUDE.md's Postgres Port Status section, not something already built. An admin wanting another user's events would need direct DB access; no cross-user UI exists by design.

Files:

src/features/audit-log/server/audit-log.queries.ts -- fetches the current user's events (requireUser, filtered by user.id)
src/features/audit-log/components/ -- event table UI
Route: src/routes/_app.dashboard.audit-log.index.tsx

Per-user rate limiting integration

checkUserRateLimit counts userEvents rows (filtered by user_id) to enforce per-user rate limits. Writing to userEvents via logUserEvent is what feeds that count. Both must happen inside withUserTransaction, using the same transaction handle. See Rate limiting.