# audit-log/

Centralized audit logging system for tracking all user and system actions.

## Files

| File | What | When to read |
| ---- | ---- | ------------ |
| `README.md` | Architecture and API documentation | Understanding audit log system |

## Subdirectories

| Directory | What | When to read |
| --------- | ---- | ------------ |
| `api/` | HTTP endpoints for log viewing/export | API route changes |
| `domain/` | Business logic, types, service | Core audit logging logic |
| `data/` | Repository, database queries | Database operations |
| `jobs/` | Scheduled cleanup job | Retention policy |
| `migrations/` | Database schema | Schema changes |
| `__tests__/` | Integration tests | Adding or modifying tests |

## Key Files

| File | What | When to read |
| ---- | ---- | ------------ |
| `audit-log.instance.ts` | Singleton service instance | Cross-feature logging |
| `domain/audit-log.types.ts` | Types, categories, severities | Type definitions |
| `domain/audit-log.service.ts` | Core logging operations | Creating/searching logs |
| `data/audit-log.repository.ts` | Database queries | Data access patterns |
| `jobs/cleanup.job.ts` | 90-day retention cleanup | Retention enforcement |

## Usage

Import the singleton for cross-feature logging:

```typescript
import { auditLogService } from '../../audit-log';

// Log with convenience methods
await auditLogService.info('vehicle', userId, 'Vehicle created', 'vehicle', vehicleId);
await auditLogService.warning('auth', userId, 'Password reset requested');
await auditLogService.error('system', null, 'Backup failed', 'backup', backupId);
```

## Categories

- `auth`: Login, logout, password changes
- `vehicle`: Vehicle CRUD operations
- `user`: User management actions
- `system`: Backups, imports/exports
- `admin`: Admin-specific actions

## Retention

Logs older than 90 days are automatically deleted by a daily cleanup job (3 AM).
