38 lines
1.7 KiB
SQL
38 lines
1.7 KiB
SQL
-- ==========================================
|
|
-- Migration 017: Audit Log
|
|
-- ==========================================
|
|
-- Immutable append-only log of all mutating actions.
|
|
-- Required for enterprise compliance (SOC2, FedRAMP, HIPAA).
|
|
-- ==========================================
|
|
|
|
-- Drop stale table if left from a prior partial run
|
|
DROP TABLE IF EXISTS audit_log CASCADE;
|
|
|
|
CREATE TABLE audit_log (
|
|
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
|
|
actor_id UUID REFERENCES users(id) ON DELETE SET NULL,
|
|
action VARCHAR(100) NOT NULL, -- e.g. 'user.create', 'team.add_member'
|
|
resource_type VARCHAR(50) NOT NULL, -- e.g. 'user', 'team', 'preset', 'channel'
|
|
resource_id VARCHAR(255), -- UUID or identifier of affected resource
|
|
metadata JSONB DEFAULT '{}'::jsonb, -- action-specific details
|
|
ip_address VARCHAR(45), -- IPv4 or IPv6
|
|
user_agent TEXT DEFAULT '',
|
|
created_at TIMESTAMPTZ DEFAULT NOW()
|
|
);
|
|
|
|
-- Time-range queries (admin viewer, compliance exports)
|
|
CREATE INDEX idx_audit_log_created ON audit_log(created_at DESC);
|
|
|
|
-- Filter by actor
|
|
CREATE INDEX idx_audit_log_actor ON audit_log(actor_id) WHERE actor_id IS NOT NULL;
|
|
|
|
-- Filter by resource
|
|
CREATE INDEX idx_audit_log_resource ON audit_log(resource_type, resource_id);
|
|
|
|
-- Filter by action
|
|
CREATE INDEX idx_audit_log_action ON audit_log(action);
|
|
|
|
COMMENT ON TABLE audit_log IS 'Immutable audit trail of all mutating operations';
|
|
COMMENT ON COLUMN audit_log.action IS 'Dotted action name: resource.verb (e.g. user.create, team.add_member)';
|
|
COMMENT ON COLUMN audit_log.metadata IS 'Action-specific context: old/new values, affected fields, etc.';
|