feat : add audit logs

app/api/admin/media/[id]/complete/route.ts

@@ -4,6 +4,7 @@ import * as z from "zod";
 
 import { requireAdmin } from "@/lib/auth/server";
 import { completePendingMedia } from "@/lib/media/repository";
+import { auditActor } from "@/lib/audit-log";
 
 export async function POST(
   request: Request,
@@ -17,7 +18,9 @@ export async function POST(
     if (!z.string().uuid().safeParse(id).success) {
       return Response.json({ error: "invalid-id" }, { status: 400 });
     }
-    const result = await withUploadSlot(() => completePendingMedia(id));
+    const result = await withUploadSlot(() =>
+      completePendingMedia(id, auditActor(admin.user)),
+    );
     if (result.status === "ready") {
       return Response.json({
         media: {

app/api/admin/media/[id]/route.ts

@@ -4,6 +4,7 @@ import * as z from "zod";
 
 import { requireAdmin } from "@/lib/auth/server";
 import { discardUnreferencedMedia } from "@/lib/media/repository";
+import { auditActor } from "@/lib/audit-log";
 
 export async function DELETE(
   request: Request,
@@ -17,7 +18,7 @@ export async function DELETE(
     if (!z.string().uuid().safeParse(id).success) {
       return Response.json({ error: "invalid-id" }, { status: 400 });
     }
-    const deleted = await discardUnreferencedMedia(id);
+    const deleted = await discardUnreferencedMedia(id, auditActor(admin.user));
     return deleted
       ? new Response(null, { status: 204 })
       : Response.json({ error: "media-is-referenced-or-missing" }, { status: 409 });

app/api/admin/media/route.ts

@@ -1,8 +1,9 @@
 import { requireAdmin } from "@/lib/auth/server";
 import { uploadPublicMedia } from "@/lib/media/repository";
 import { MAX_MEDIA_BYTES, mediaUploadSchema } from "@/lib/media/validation";
-import { boundedBody, errorResponse, HttpError, requireSameOrigin, securityLog, withUploadSlot } from "@/lib/security/http";
+import { boundedBody, errorResponse, HttpError, requireSameOrigin, withUploadSlot } from "@/lib/security/http";
 import { limitRequest } from "@/lib/security/rate-limit";
+import { auditActor } from "@/lib/audit-log";
 
 export async function POST(request: Request) {
   try {
@@ -26,8 +27,7 @@ export async function POST(request: Request) {
       if (!mediaUploadSchema.safeParse({ fileName: file.name, mimeType: file.type, byteSize: file.size }).success) {
         throw new HttpError(415, "invalid-image");
       }
-      const result = await uploadPublicMedia(file, admin.user.id);
-      securityLog("media-uploaded", { actorId: admin.user.id, targetId: result.id });
+      const result = await uploadPublicMedia(file, auditActor(admin.user));
       return Response.json(result, { status: 201, headers: { "Cache-Control": "no-store" } });
     });
   } catch (cause) {