Changeset 0.8.2 (#45)

server/database/migrations/017_audit_log.sql

@@ -0,0 +1,37 @@
+-- ==========================================
+-- Migration 017: Audit Log
+-- ==========================================
+-- Immutable append-only log of all mutating actions.
+-- Required for enterprise compliance (SOC2, FedRAMP, HIPAA).
+-- ==========================================
+
+-- Drop stale table if left from a prior partial run
+DROP TABLE IF EXISTS audit_log CASCADE;
+
+CREATE TABLE audit_log (
+    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    actor_id        UUID REFERENCES users(id) ON DELETE SET NULL,
+    action          VARCHAR(100) NOT NULL,       -- e.g. 'user.create', 'team.add_member'
+    resource_type   VARCHAR(50) NOT NULL,        -- e.g. 'user', 'team', 'preset', 'channel'
+    resource_id     VARCHAR(255),                -- UUID or identifier of affected resource
+    metadata        JSONB DEFAULT '{}'::jsonb,   -- action-specific details
+    ip_address      VARCHAR(45),                 -- IPv4 or IPv6
+    user_agent      TEXT DEFAULT '',
+    created_at      TIMESTAMPTZ DEFAULT NOW()
+);
+
+-- Time-range queries (admin viewer, compliance exports)
+CREATE INDEX idx_audit_log_created ON audit_log(created_at DESC);
+
+-- Filter by actor
+CREATE INDEX idx_audit_log_actor ON audit_log(actor_id) WHERE actor_id IS NOT NULL;
+
+-- Filter by resource
+CREATE INDEX idx_audit_log_resource ON audit_log(resource_type, resource_id);
+
+-- Filter by action
+CREATE INDEX idx_audit_log_action ON audit_log(action);
+
+COMMENT ON TABLE audit_log IS 'Immutable audit trail of all mutating operations';
+COMMENT ON COLUMN audit_log.action IS 'Dotted action name: resource.verb (e.g. user.create, team.add_member)';
+COMMENT ON COLUMN audit_log.metadata IS 'Action-specific context: old/new values, affected fields, etc.';