Audit Logging Protocol

1. Principles

• No Invisible Actions: Every state-changing API call (POST, PUT, DELETE) must produce a log entry.
• Traceability: Logs must include

  userId

  ,

  action

  ,

  resourceId

  , and

  metadata

  .

2. Implementation Standards

• Backend (API):
  • Use the project's standard Logger service (e.g.,

    src/services/logger.ts

    or similar).
  • Example:

    await Logger.info({
      event: 'POST_CREATED',
      userId: user.id,
      metadata: { postId: newPost.id },
    });
    

• Database (Supabase):
  • Ensure tables have

    created_at

    ,

    updated_at

    , and

    created_by

    columns.
  • Check if specific Audit Table inserts are required (e.g.

    audit_logs

    table).

3. Verification Checklist

• Does the new API endpoint call

  Logger

  ?
• Are logs visible in Supabase/Dashboards?
• Is the log level appropriate (Info vs Error)?
• Does the log contain enough context to debug issues later?