sys-audit-log.object.ts

// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.

import { ObjectSchema, Field } from '@objectstack/spec/data';
import { SystemObjectName } from '@objectstack/spec/system';
import {
  SysMigration,
  SysMigrationJournal,
  SysPlatformSetting,
  SysPlatformSettingAudit,
  SysSecret,
  SysSetting,
  SysSettingAudit,
} from '@objectstack/platform-objects/system';
import { SIGN_IN_STAMP_EVENT } from '../sign-in-stamp.js';

/**
 * The platform objects whose rows the default `recent` view leaves out: the
 * rows one act writes beside the row that records it. Measured on a fresh
 * showcase boot:
 *
 *  - a settings write records `config_change`, and ALSO writes the stored
 *    setting (`sys_setting`, the global rung's `sys_platform_setting`, a
 *    secret's ciphertext in `sys_secret`) and the settings trail's own entry
 *    (`sys_setting_audit` / `sys_platform_setting_audit`), each mirrored here;
 *  - the first sign-in through the console mints the token-signing key
 *    (`sys_jwks`) under the signing-in person's id, beside its `login` row;
 *  - a boot writes the data-migration ledger (`sys_migration`,
 *    `sys_migration_journal`).
 *
 * The two settings stores are listed apart, in
 * {@link AUDIT_LOG_SETTINGS_STORE_OBJECTS}: the `config_change` row itself
 * names one of them as its object, so the view leaves out their other rows and
 * keeps that one.
 *
 * The sign-in stamp on `sys_user` is the third such row, and it is left out by
 * its mark instead (`sign-in-stamp.ts`): `sys_user` itself stays in, because an
 * administrator's edit of a user is an act.
 *
 * Read from the definitions and the protocol's name constants. Deliberately not
 * a name prefix and not the identity domain: `sys_*` also names objects whose
 * writes are acts (a member's role, a sharing rule, a user's ban).
 * `sys-audit-log-default-view.integration.test.ts` holds the view to it on a
 * real engine and driver.
 */
export const AUDIT_LOG_DEFAULT_VIEW_EXCLUDED_OBJECTS: readonly string[] = Object.freeze([
  SysSecret.name,
  SysSettingAudit.name,
  SysPlatformSettingAudit.name,
  SystemObjectName.JWKS,
  SysMigration.name,
  SysMigrationJournal.name,
]);

/**
 * The settings stores a `config_change` row names as its object
 * (`config-change-audit.ts` in service-settings): `sys_setting` for a tenant or
 * user value, `sys_platform_setting` for a global one. The default view keeps
 * the `config_change` row and leaves out the store's own mirrored write.
 */
export const AUDIT_LOG_SETTINGS_STORE_OBJECTS: readonly string[] = Object.freeze([
  SysSetting.name,
  SysPlatformSetting.name,
]);

/**
 * sys_audit_log — System Audit Log Object
 *
 * Immutable audit trail for all significant platform events.
 * Records who did what, when, and the before/after state.
 *
 * Every field is `readonly: true` — audit logs are written only by
 * internal system hooks, never via UI forms. API exposes only `get` + `list`.
 *
 * @namespace sys
 */
export const SysAuditLog = ObjectSchema.create({
  name: 'sys_audit_log',
  label: 'Audit Log',
  pluralLabel: 'Audit Logs',
  icon: 'scroll-text',
  isSystem: true,
  managedBy: 'append-only',
  // [ADR-0131 D7] Deployment-level ledger: NO injected organization column.
  // Some rows are about actions no organization owns (`config_change` on the
  // settings global rung, `platform_admin_standing_change` at boot,
  // plugin-auth's run-level `import`), so the tenancy anchor cannot be this
  // object's. The organization a row is ABOUT is the plain attribution field
  // `tenant_id` below, which the tenant-field resolver does not claim: Layer 0
  // is inert here, and the read scope is object permission plus the platform
  // row policy `sys_audit_log_org` in plugin-security's default sets.
  systemFields: { tenant: false },
  // ADR-0057: compliance ledger — retain hot 90d, then archive-then-delete.
  // The LifecycleService NEVER hot-deletes rows with `archive` declared until
  // the archive copy succeeded; deployments without an 'archive' datasource
  // simply retain everything (today's behavior).
  lifecycle: {
    class: 'audit',
    retention: { maxAge: '90d' },
    archive: { after: '90d', to: 'archive', keep: '7y' },
  },
  description: 'Immutable audit trail for platform events',
  displayNameField: 'action',
  nameField: 'action', // [ADR-0079] canonical primary-title pointer (mirrors deprecated displayNameField)
  // [#24611] No `titleFormat`. It read `{action} · {object_name}`, but the
  // declared `action` pointer is required and outranks the template on every
  // title reader, so the template never titled a row; it only kept the target's
  // API name in the object's title declaration.
  //
  // Neither half of the `record_id` / `object_name` pointer pair is listed. The
  // record page's strip draws a listed field as its stored text, so the type
  // half read as an API name and the id half as a raw id; a field the strip
  // draws is also hidden from the Details tab, which is where `record_id`
  // draws as the pointer card headed by the target object's label
  // (`sys-audit-log-pointer-pair.test.ts`).
  highlightFields: ['created_at', 'action', 'user_id'],

  // A list names the target with the pointer's id half, `record_id`: the
  // console draws it as the target record and fetches the type half
  // `object_name` for that cell without a column (objectui#13036). A list
  // view never shows the type half, which would draw the stored API name as
  // text (`sys-audit-log-pointer-pair.test.ts`).
  //
  // `recent` is the FIRST declared view, so it is the list Setup's 审计日志
  // opens with no view named. It keeps every act and leaves out the rows an act
  // writes beside it (`AUDIT_LOG_DEFAULT_VIEW_EXCLUDED_OBJECTS`, the settings
  // stores' rows other than `config_change`, and the sign-in stamp by its
  // `metadata.event`). `metadata` is not a value-bearing column
  // (`parent-field-query-guard.ts` names only `old_value` / `new_value`), so
  // every reader may run the filter; the `or` keeps the rows with no metadata,
  // which a bare `not_contains` would drop. Nothing changes in what is written:
  // `all_events` lists every row.
  listViews: {
    recent: {
      type: 'grid',
      name: 'recent',
      label: 'Recent',
      data: { provider: 'object', object: 'sys_audit_log' },
      columns: ['created_at', 'action', 'record_id', 'user_id'],
      filter: [
        { field: 'object_name', operator: 'not_in', value: [...AUDIT_LOG_DEFAULT_VIEW_EXCLUDED_OBJECTS] },
        {
          or: [
            { field: 'object_name', operator: 'not_in', value: [...AUDIT_LOG_SETTINGS_STORE_OBJECTS] },
            { field: 'action', operator: 'equals', value: 'config_change' },
          ],
        },
        {
          or: [
            { field: 'metadata', operator: 'is_null' },
            { field: 'metadata', operator: 'not_contains', value: SIGN_IN_STAMP_EVENT },
          ],
        },
      ],
      sort: [{ field: 'created_at', order: 'desc' }],
      pagination: { pageSize: 50 },
      emptyState: { title: 'No audit events', message: 'Activity will appear here as users interact with the platform.' },
    },
    writes_only: {
      type: 'grid',
      name: 'writes_only',
      label: 'Writes',
      data: { provider: 'object', object: 'sys_audit_log' },
      columns: ['created_at', 'action', 'record_id', 'user_id'],
      // `restore` removed (#8315): the value is retired from the enum, so the
      // filter would have matched nothing for the rest of time. The three that
      // remain are exactly what `actionFor()` in `audit-writers.ts` can emit.
      filter: [{ field: 'action', operator: 'in', value: ['create', 'update', 'delete'] }],
      sort: [{ field: 'created_at', order: 'desc' }],
      pagination: { pageSize: 50 },
    },
    auth_events: {
      type: 'grid',
      name: 'auth_events',
      label: 'Auth',
      data: { provider: 'object', object: 'sys_audit_log' },
      columns: ['created_at', 'action', 'user_id'],
      // `permission_change` removed (#8147): the value is retired from the enum,
      // so the filter would have matched nothing for the rest of time. Permission
      // object writes are already on the ledger as ordinary create/update rows.
      //
      // `login_failed` and `account_locked` joined WITH their writer (the
      // auth-event sink's account events, called from plugin-auth's password
      // sign-in outcome): a refused sign-in and an account entering the
      // ADR-0069 D2 lockout are auth events, and this preset is where an
      // administrator looks for them.
      filter: [
        { field: 'action', operator: 'in', value: ['login', 'logout', 'login_failed', 'account_locked'] },
      ],
      sort: [{ field: 'created_at', order: 'desc' }],
      pagination: { pageSize: 50 },
    },
    // [#8992] The `read` action's shipped surface. A ledger value with no view
    // is half of the empty-widget defect the 2026-08-12 ruling named; this card
    // adds the action and the screen that answers its question in one stroke.
    // `record_views` is the "who viewed this record" query as a list: actor
    // first, because that is the column an auditor scans.
    //
    // [#9539, maintainer ruling 2026-08-18 + triage auto-adjudication
    // 2026-08-19, both Option 1] `ip_address` was dropped from this column
    // list: `buildRow` in `read-audit.ts` never stamps it (client-fingerprint
    // fields are populated on auth events only — see the README), so on every
    // `read` row this column could ever show, it was structurally empty. On a
    // compliance screen a blank cell reads as "captured, and none" rather than
    // "not captured" — 审计面宁窄勿谎, the same principle #7675/#8147/#8315
    // applied to enum values, one layer down on a column. Replaced with
    // `actor`, which the read writer DOES stamp on every row and which is the
    // one column that attributes a service principal (`svc:<name>`) rather
    // than just falling back to a null `user_id`. Pinned by
    // `sys-audit-log-record-views-columns.test.ts`: this view's columns must
    // stay a subset of the read writer's actually-stamped key set.
    record_views: {
      type: 'grid',
      name: 'record_views',
      label: 'Record Views',
      data: { provider: 'object', object: 'sys_audit_log' },
      columns: ['created_at', 'user_id', 'record_id', 'actor'],
      filter: [{ field: 'action', operator: 'in', value: ['read'] }],
      sort: [{ field: 'created_at', order: 'desc' }],
      pagination: { pageSize: 50 },
      emptyState: {
        title: 'No record views recorded',
        message:
          'Record-view auditing is opt-in per object. Rows appear here once an object is added to the audit '
          + "plugin's readAudit.objects list and someone opens one of its records.",
      },
    },
    config_changes: {
      type: 'grid',
      name: 'config_changes',
      label: 'Config',
      data: { provider: 'object', object: 'sys_audit_log' },
      // [#24611] No Object column: it drew one of three stored API names
      // (`sys_setting`, `sys_platform_setting` for a global-scope change,
      // `sys_user` for an import) as text. A `config_change` row names the
      // settings row it changed as its `record_id` (service-settings'
      // `config-change-audit.ts`), so the row's page draws that pair as the
      // setting's card and lists the ledger's other rows about the same
      // setting, the mirror's row with the value among them
      // (`sys-audit-log.page.ts`). An `import` row, and a `config_change` row
      // written before its writer recorded the id, carry no `record_id`.
      // Which setting changed is also in `metadata`, and the row's page shows
      // the `tenant_id` a global change leaves empty.
      columns: ['created_at', 'action', 'user_id'],
      // `export` removed (#8147) — retired from the enum, nothing ever wrote it.
      // `import` KEPT deliberately: `plugin-auth`'s admin user-import writes a
      // real run-level row (`admin-import-users.ts`, `action: 'import'` with
      // `record_id: null`), pinned by the W4 case in
      // `packages/qa/dogfood/test/admin-identity-audit-trail.dogfood.test.ts`.
      // This view is the only shipped surface that lists those rows.
      filter: [{ field: 'action', operator: 'in', value: ['config_change', 'import'] }],
      sort: [{ field: 'created_at', order: 'desc' }],
      pagination: { pageSize: 50 },
    },
    all_events: {
      type: 'grid',
      name: 'all_events',
      label: 'All',
      data: { provider: 'object', object: 'sys_audit_log' },
      columns: ['created_at', 'action', 'record_id', 'user_id'],
      sort: [{ field: 'created_at', order: 'desc' }],
      pagination: { pageSize: 100 },
    },
  },

  // [ADR-0095 D1, 2026-10-18 note; ADR-0131 D7] This object's default row scope: the one
  // policy plugin-security's shipped permission sets spread for it today
  // (`auditLedgerRowScope` in `default-permission-sets.ts`), moved here verbatim. Layer
  // 0 is inert on the ledger (`systemFields: { tenant: false }` above), so Layer 1
  // silence means this scope, not no filter. The security plugin's row-policy collection
  // applies it when no set the caller holds carries a row policy for the object and
  // operation; the shipped sets still carry it, so their holders read as before. An
  // `extend` contribution cannot set or loosen it (refused at registration).
  defaultRowScope: {
    name: 'sys_audit_log_org',
    operation: 'select',
    using: 'tenant_id == current_user.organization_id',
  },

  fields: {
    // ── Event ────────────────────────────────────────────────────
    created_at: Field.datetime({
      label: 'Timestamp',
      required: true,
      defaultValue: 'NOW()',
      readonly: true,
      group: 'Event',
    }),

    // ADR-0087 retirement (#8147, ruling 2026-08-12): `export` and
    // `permission_change` left this enum. Neither had a writer anywhere in the
    // repo — the only two `sys_audit_log` writers are `audit-writers.ts` (whose
    // `actionFor` emits create/update/delete and nothing else) and
    // `plugin-auth`'s admin user-import. A declared action nothing ever writes
    // is an empty widget and a filter that can never match: 审计面宁窄勿谎.
    // Permission-object writes are already on the ledger as create/update rows.
    //
    // ADR-0087 retirement (#8315, the same ruling carried by triage): `restore`
    // left this enum for the same reason and by the same measurement. It was
    // never a near-miss — `actionFor()` in `audit-writers.ts` returns
    // `'create' | 'update' | 'delete' | null`, so the record-level writer
    // STRUCTURALLY cannot produce it, and no other writer in the repo emits it
    // either. ⚠ This is not a product stance against undelete: soft
    // delete/restore is an unbuilt capability parked on #1883 (`pm:on-hold`)
    // and #3146 (`status:parked`). If it lands, this value returns WITH its
    // writer — the emission point, its tests, and the view that surfaces it —
    // never as a bare enum row again.
    //
    // ⚠ `import` was named in the same ruling but is NOT retired: it has a live,
    // deliberate writer (`plugin-auth/src/admin-import-users.ts`, run-level row
    // with `record_id: null`) pinned by dogfood case W4. Retiring it would make
    // this enum deny a value the platform writes on every admin import run —
    // and silently, because every field here is `readonly: true` and
    // `validateRecord` skips readonly fields, so nothing would ever go red.
    // See #8147 for the escalation.
    // [#8992, maintainer ruling 2026-08-16] `read` joins the enum WRITER-FIRST,
    // which is the only way a value is allowed back onto this surface (the
    // docblock in `sys-audit-log-retired-actions.test.ts` states the rule and
    // the pin enforces it). Its writer is `read-audit.ts`'s `afterFind` hook,
    // its shipped surface is the `record_views` list view above, and both
    // landed in the same PR as this line. Scope is the ruling's MVP:
    // record-detail views on per-object opt-in, batched off the request path —
    // so a deployment that opts nothing in never writes one, and the value is
    // narrow rather than absent (审计面宁窄勿谎).
    // [#18412, maintainer ruling 2026-09-18 — director batch #153 item 2]
    // `platform_admin_standing_change` joins the enum WRITER-FIRST, the only
    // way a value is allowed onto this surface. Its writer is
    // `plugin-security/src/bootstrap-platform-admin.ts`
    // (`recordPlatformAdminStandingChange`, row shape in
    // `platform-admin-standing-audit.ts`), which records WHO holds
    // platform-administrator standing and from when — the property lost when
    // standing moved from a stored grant row to config-derived, request-time
    // resolution (#11663, ADR-0131). One entry per CHANGE of standing plus a
    // first-boot baseline, so a frequently restarted rig writes nothing.
    //
    // Its shipped surfaces are the unfiltered `recent` and `all_events` views
    // above: the rows are visible on both, so this value is not the empty
    // widget the 2026-08-12 ruling named (审计面宁窄勿谎). ⛔ It is deliberately
    // NOT added to the `config_changes` filter — that view's label and columns
    // answer 「which setting changed」, and standing is not a `sys_setting`.
    //
    // ⛔ Dotless `snake_case`, per Prime Directive #3 and every incumbent value
    // here; the ruling's illustrative `platform_admin_standing.changed` carried
    // a dot and was written 「e.g.」.
    //
    // `login_failed` and `account_locked` join the enum WRITER-FIRST. Their
    // writer is `auth-event-audit.ts` (`createAuthEventAuditSink`, the account
    // event class), called by plugin-auth from the password sign-in outcome
    // (`auth-session-audit.ts`): one `login_failed` row per refused sign-in
    // that names an existing account, and one `account_locked` row each time
    // the ADR-0069 D2 lockout is stamped. Each row names the account
    // (`user_id`, and `sys_user` + its id as the target), the outcome (the
    // action, plus the refusal's machine code in `metadata`), the time and the
    // client fingerprint; never the attempted credential. Their shipped
    // surface is the `auth_events` list view above.
    //
    // [#27908, maintainer ruling 6513869839 on #27681, parameter 3]
    // `action_invocation` joins the enum WRITER-FIRST. Its writer is
    // `action-invocation-audit.ts` (`createActionInvocationAuditWriter`, on the
    // `audit` slot), called by both action doors in `@objectstack/runtime` —
    // REST `POST /actions/:object/:action` and the `/mcp` bridge's
    // `run_action` / `resume_run` — on every branch (script, api, flow,
    // declarative update): one row per invocation that reached its branch,
    // naming the door in `metadata.surface` (`rest` / `mcp`), so an
    // administrator tells an agent's call from a click without a second log.
    // Its shipped surfaces are the unfiltered `recent` and `all_events` views
    // above, as for `platform_admin_standing_change`. No new column: the
    // surface rides `metadata` beside `performed_by` / `on_behalf_of`.
    //
    // Each option carries a label (#27855): the list, the detail and the System
    // Overview "Audit Events by Action" chart (whose dimension resolves through
    // these options) read it, where the bare-array shorthand made the label the
    // stored code, `config_change`. The stored values are unchanged.
    action: Field.select(
      {
        options: [
          { label: 'Create', value: 'create' },
          { label: 'Read', value: 'read' },
          { label: 'Update', value: 'update' },
          { label: 'Delete', value: 'delete' },
          { label: 'Login', value: 'login' },
          { label: 'Logout', value: 'logout' },
          { label: 'Login Failed', value: 'login_failed' },
          { label: 'Account Locked', value: 'account_locked' },
          { label: 'Config Change', value: 'config_change' },
          { label: 'Import', value: 'import' },
          { label: 'Platform Admin Standing Change', value: 'platform_admin_standing_change' },
          { label: 'Action Invocation', value: 'action_invocation' },
        ],
        label: 'Action',
        required: true,
        readonly: true,
        searchable: true,
        description: 'Action type (snake_case)',
        group: 'Event',
      },
    ),

    user_id: Field.lookup('sys_user', {
      label: 'User',
      required: false,
      readonly: true,
      searchable: true,
      description: 'User who performed the action (null for non-user / service actions — see actor)',
      group: 'Event',
    }),

    // First-class principal label, independent of the sys_user lookup. Records
    // WHO acted even when there is no real user row: a user id, a service-token
    // principal (`svc:<name>`), or null/'system'. `user_id` stays a strict
    // sys_user lookup (a service principal can't be stuffed there), so this is
    // the field that makes service-token writes attributable (ADR-0014 D2).
    actor: Field.text({
      label: 'Actor',
      required: false,
      readonly: true,
      searchable: true,
      maxLength: 255,
      description: 'Principal that performed the action: a user id, svc:<name>, or null',
      group: 'Event',
    }),

    // ── Target record ────────────────────────────────────────────
    object_name: Field.text({
      label: 'Object',
      required: false,
      readonly: true,
      searchable: true,
      maxLength: 255,
      description: 'Target object (e.g. sys_user, project_task)',
      group: 'Target',
    }),

    // [commit f64668d3c, route A] The bound is derived by referenced-column transitivity
    // from the id this column holds, never guessed: `driver-sql` creates every
    // table's primary key as `table.string('id').primary()` — knex's
    // `varchar(255)`, which the driver spells out as
    // `DEFAULT_STRING_VARCHAR_CHARS = 255` and names in its own error text as
    // "built-in `id` (a varchar(255))". The writers enumerated below all stamp
    // a real record id of a stored row, so none of them can produce a value
    // wider than the column that id lives in. 255 is also <= the 768-character
    // utf8mb4 key ceiling, so the `(object_name, record_id)` index below is
    // expressible on MySQL — which is the whole point: unbounded, this column
    // was emitted TEXT, MySQL refused the index with
    // `ER_BLOB_KEY_WITHOUT_LENGTH`, and the object landed registered-but-broken
    // with the lookup its own `record_views` list view depends on absent.
    record_id: Field.text({
      label: 'Record',
      required: false,
      readonly: true,
      searchable: true,
      maxLength: 255,
      description: 'ID of the affected record',
      // [#11386] The id half of this object's ActivityPointer pair (ADR-0052
      // §5), adopting the #11339 carrier. VERIFIED for THIS object rather than
      // assumed from the shape: every writer of the pair stamps an object
      // MACHINE NAME beside a real record id of that object —
      // `audit-writers.ts` (`object_name: ctx.object`, `record_id: recordId`),
      // `read-audit.ts` (`event.objectName` / `event.recordId`),
      // `auth-event-audit.ts` (the session object + `event.sessionId` for a
      // session event, `sys_user` + the account's id for an account event) and
      // plugin-auth's admin user endpoints (`'sys_user'` + the affected user
      // id). The pair is also the object's own query key: the
      // `{object_name, record_id}` index and the `record_views` list view
      // answer "who touched THIS record", which only matches on the target's
      // real id.
      //
      // Consequence of declaring, accepted deliberately: a seeded ledger row
      // whose pointer names a record that cannot be resolved is now refused
      // loudly instead of stored verbatim — the verbatim row was one that
      // matched no pair query and rendered on no drill-down. A demo row ABOUT
      // A DELETED RECORD (an `action: 'delete'` row, whose target must NOT
      // exist) stays authorable through the landed escape hatch: an
      // internal-id-shaped value passes through untouched.
      //
      // ⚠️ ORDERING, and why this object differs from its three siblings
      // (commit 1cba33f16): this id half is OPTIONAL, so a seed that names a target
      // loaded later is genuinely order-independent — pass 1 inserts without
      // the column and pass 2 back-fills it through the internal id captured at
      // insert time, measured end-to-end against the real engine in
      // `packages/objectql/src/engine-seed-required-deferral.test.ts`. ⛔ Do not
      // carry that property over to `sys_approval_request`, `sys_record_share`
      // or `sys_share_link`: their id half is `required: true`, deferring
      // DELETES the column from the pass-1 insert, and required-validation
      // rejects the row before pass 2 can help. Those three must seed the
      // target dataset first; this one need not. Making this column `required`
      // would therefore also make its seeds order-dependent.
      referenceVia: 'object_name',
      group: 'Target',
    }),

    // ── Change payload ───────────────────────────────────────────
    old_value: Field.textarea({
      label: 'Old Value',
      required: false,
      readonly: true,
      description: 'JSON-serialized previous state',
      group: 'Changes',
    }),

    new_value: Field.textarea({
      label: 'New Value',
      required: false,
      readonly: true,
      description: 'JSON-serialized new state',
      group: 'Changes',
    }),

    // ── Client fingerprint ───────────────────────────────────────
    ip_address: Field.text({
      label: 'IP Address',
      required: false,
      readonly: true,
      maxLength: 45,
      group: 'Client',
    }),

    user_agent: Field.textarea({
      label: 'User Agent',
      required: false,
      readonly: true,
      group: 'Client',
    }),

    // ── Context ──────────────────────────────────────────────────
    // [ADR-0131 D7] The attribution field, never the tenancy anchor: every
    // writer stamps the organization the row is about here, and NULL means a
    // deployment-level action. Organization readers are scoped on it by the
    // `sys_audit_log_org` row policy; per-tenant retention partitions on it.
    tenant_id: Field.lookup('sys_organization', {
      label: 'Tenant',
      required: false,
      readonly: true,
      description: 'Organization this event is about; empty for a deployment-level action',
      group: 'Context',
    }),

    metadata: Field.textarea({
      label: 'Metadata',
      required: false,
      readonly: true,
      description: 'JSON-serialized additional context',
      group: 'Context',
    }),

    // ── System ───────────────────────────────────────────────────
    id: Field.text({
      label: 'Audit Log ID',
      required: true,
      readonly: true,
      group: 'System',
    }),
  },

  indexes: [
    { fields: ['created_at'] },
    { fields: ['user_id'] },
    { fields: ['object_name', 'record_id'] },
    { fields: ['action'] },
    { fields: ['tenant_id'] },
  ],

  enable: {
    trackHistory: false, // Audit logs are themselves the audit trail
    searchable: true,
    apiEnabled: true,
    apiMethods: ['get', 'list'], // Read-only — creation happens via internal system hooks only
    clone: false,
  },
});