v_2.3

lib/audit.js

@@ -0,0 +1,28 @@
+'use strict';
+const { db } = require('../db');
+
+const insert = db.prepare(
+  `INSERT INTO logs (actor, actor_id, action, page, detail, ip)
+   VALUES (@actor, @actor_id, @action, @page, @detail, @ip)`
+);
+
+/**
+ * Record an auditable action.
+ * @param {object} req  Express request (for user + ip). Can be null for system events.
+ * @param {string} action  Short machine code, e.g. FILE_UPLOAD
+ * @param {string} page  Human page name
+ * @param {string} detail  Free-text description
+ */
+function log(req, action, page, detail) {
+  const user = req && req.session && req.session.user;
+  insert.run({
+    actor: user ? user.username : 'system',
+    actor_id: user ? user.id : null,
+    action,
+    page: page || null,
+    detail: detail || null,
+    ip: req ? (req.headers['x-forwarded-for'] || req.socket.remoteAddress || null) : null,
+  });
+}
+
+module.exports = { log };