feat: audit source operations

lib/audit.ts

@@ -0,0 +1,4 @@
+import { db } from "@/lib/db";
+export function audit(actorUserId: number | null, action: string, targetType: string, targetId?: string | number, metadata: unknown = {}) {
+  db.prepare("INSERT INTO audit_events(actor_user_id,action,target_type,target_id,metadata_json) VALUES(?,?,?,?,?)").run(actorUserId, action, targetType, targetId == null ? null : String(targetId), JSON.stringify(metadata));
+}

lib/db.ts

@@ -94,6 +94,11 @@ CREATE TABLE IF NOT EXISTS source_invites (
   used_at TEXT, created_by INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
   created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
 );
+CREATE TABLE IF NOT EXISTS audit_events (
+  id INTEGER PRIMARY KEY, actor_user_id INTEGER REFERENCES users(id) ON DELETE SET NULL,
+  action TEXT NOT NULL, target_type TEXT NOT NULL, target_id TEXT, metadata_json TEXT,
+  created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
+);
 CREATE TABLE IF NOT EXISTS tag_aliases (
   alias TEXT PRIMARY KEY COLLATE NOCASE, canonical TEXT NOT NULL COLLATE NOCASE,
   created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
@@ -145,6 +150,7 @@ applyColumnMigration(34, "posts", "last_seen_sync_run", "ALTER TABLE posts ADD C
 db.prepare("INSERT OR IGNORE INTO schema_migrations(version) VALUES(35)").run();
 db.prepare("UPDATE source_members SET role='editor' WHERE role='member'").run();
 db.prepare("INSERT OR IGNORE INTO schema_migrations(version) VALUES(36)").run();
+db.prepare("INSERT OR IGNORE INTO schema_migrations(version) VALUES(37)").run();
 
 const admin = process.env.ADMIN_USERNAME;
 const adminPassword = process.env.ADMIN_PASSWORD;