{ "ursId": "URS-003", "title": "Audit Log Tracking of All User Actions", "timestamp": "2026-09-29T02:31:01.549Z", "durationMs": 52008, "config": { "inboxUrl": "http://localhost:42273", "dbHost": "localhost", "dbPort": 35767, "dbName": "cc_repinbox_dev" }, "setup": { "status": "pass" }, "scenarios": [ { "name": "Step 1: Rep login", "status": "pass", "description": "Step 1: Rep login", "screenshots": [ "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/screenshots/step-01-rep-logged-in.png" ], "explanation": "The sales representative (Blair Bennett) authenticates using valid credentials. On successful login the client-side logEvent() helper writes a user_log row with action=user:login to the audit_events table. This is verified in the DB validation phase to confirm that every login event is captured regardless of user role.", "expectedAuditActions": [ "user_log:user:login" ], "startedAt": "2026-09-29T02:31:10.056Z", "finishedAt": "2026-09-29T02:31:10.056Z", "videoPath": "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/videos/step-01-rep-login.webm" }, { "name": "Step 2: Create order", "status": "pass", "description": "Step 2: Create order", "screenshots": [ "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/screenshots/step-02-order-step2-account-selected.png", "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/screenshots/step-02-order-step3-products.png", "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/screenshots/step-02-order-step4-review.png", "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/screenshots/step-02-order-submitted.png" ], "explanation": "The rep navigates through the four-step order request wizard and submits a consignment order. The createOrderRequest service function calls logDecision with action=order_request_created and performed=true immediately after the INSERT, writing a synchronous audit row that proves the creation event. A separate decision:auto_approve_order row is written later by a delayed Restate handler once the ORDER_REQUEST_SUBMISSION_DELAY_MS grace window expires, and is therefore out of scope for this test's observation window.", "expectedAuditActions": [ "decision:order_request_created" ], "startedAt": "2026-09-29T02:31:23.323Z", "finishedAt": "2026-09-29T02:31:30.735Z", "videoPath": "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/videos/step-02-create-order.webm" }, { "name": "Step 3: Edit order item", "status": "pass", "description": "Step 3: Edit order item", "screenshots": [ "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/screenshots/step-03-order-detail.png", "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/screenshots/step-03-edit-dialog-open.png", "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/screenshots/step-03-after-edit.png" ], "explanation": "The rep opens the newly created order and edits a line item quantity during the submission grace period. The editOrderRequestItem service function calls logDecision with action=update_order_request_item and performed=true, writing a synchronous audit row immediately. This confirms that data-modification events within an order are captured inline at the point of change.", "expectedAuditActions": [ "decision:update_order_request_item" ], "startedAt": "2026-09-29T02:31:41.005Z", "finishedAt": "2026-09-29T02:31:48.293Z", "videoPath": "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/videos/step-03-edit-order.webm" }, { "name": "Step 4: Admin login", "status": "pass", "description": "Step 4: Admin login", "screenshots": [ "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/screenshots/step-04-admin-logged-in.png" ], "explanation": "The administrator (Dan Distributor) authenticates using valid credentials. The login event writes a user_log row with action=user:login to audit_events, identically to the rep's login in Step 1. This confirms that audit logging of authentication events is role-agnostic and applies uniformly to every authenticated user in the system.", "expectedAuditActions": [ "user_log:user:login" ], "startedAt": "2026-09-29T02:31:53.288Z", "finishedAt": "2026-09-29T02:31:53.288Z", "videoPath": "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z/videos/step-04-admin-login.webm" } ], "dbValidations": [ { "name": "audit_events table has the expected schema", "query": "SELECT column_name\n FROM information_schema.columns\n WHERE table_schema = 'public' AND table_name = 'audit_events'", "status": "pass", "rows": [ { "column_name": "id" }, { "column_name": "organization_id" }, { "column_name": "user_id" }, { "column_name": "contact_id" }, { "column_name": "event_type" }, { "column_name": "action" }, { "column_name": "object_id" }, { "column_name": "secondary_object_id" }, { "column_name": "payload" }, { "column_name": "route" }, { "column_name": "trace_id" }, { "column_name": "created_at" }, { "column_name": "url" } ], "assertion": "Table public.audit_events should expose at least: id, organization_id, user_id, event_type, action, object_id, payload, created_at" }, { "name": "rep login was audited (Blair)", "query": "SELECT id, action, event_type, user_id, organization_id, payload, created_at\n FROM audit_events\n WHERE created_at >= $1\n AND user_id = $2\n AND event_type = 'user_log'\n AND action = 'user:login'\n ORDER BY created_at ASC", "status": "pass", "rows": [ { "id": "01a0eb00-69b3-729a-a779-23ec57bdf6d8", "action": "user:login", "event_type": "user_log", "user_id": "17b8c9d0-e1f2-3456-1234-567890123456", "organization_id": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "payload": { "email": "blair.bennett@corvetasurgical.com" }, "created_at": "2026-09-29T02:31:08.000Z" }, { "id": "01a0eb00-83f3-7ccb-928f-65a5aa35f0fb", "action": "user:login", "event_type": "user_log", "user_id": "17b8c9d0-e1f2-3456-1234-567890123456", "organization_id": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "payload": { "email": "blair.bennett@corvetasurgical.com" }, "created_at": "2026-09-29T02:31:14.717Z" }, { "id": "01a0eb00-d320-7a17-8c1a-a82794cfda2f", "action": "user:login", "event_type": "user_log", "user_id": "17b8c9d0-e1f2-3456-1234-567890123456", "organization_id": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "payload": { "email": "blair.bennett@corvetasurgical.com" }, "created_at": "2026-09-29T02:31:34.981Z" } ], "assertion": "Blair logging in should produce at least one user_log row with action=user:login." }, { "name": "admin login was audited (Dan)", "query": "SELECT id, action, event_type, user_id, organization_id, payload, created_at\n FROM audit_events\n WHERE created_at >= $1\n AND user_id = $2\n AND event_type = 'user_log'\n AND action = 'user:login'\n ORDER BY created_at ASC", "status": "pass", "rows": [ { "id": "01a0eb01-14a9-7f7b-85f1-629d59a9ba4e", "action": "user:login", "event_type": "user_log", "user_id": "c3d4e5f6-a7b8-9012-cdef-123456789012", "organization_id": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "payload": { "email": "dan.distributor@corvetasurgical.com" }, "created_at": "2026-09-29T02:31:51.728Z" } ], "assertion": "Dan logging in should produce at least one user_log row with action=user:login." }, { "name": "order_request_created decision was audited for Blair", "query": "SELECT id, action, event_type, user_id, object_id, payload, created_at\n FROM audit_events\n WHERE created_at >= $1\n AND user_id = $2\n AND event_type = 'decision'\n AND action = 'order_request_created'\n ORDER BY created_at DESC", "status": "pass", "rows": [ { "id": "01a0eb00-bca1-7007-9519-f3e6f3e4a1eb", "action": "order_request_created", "event_type": "decision", "user_id": "17b8c9d0-e1f2-3456-1234-567890123456", "object_id": "01a0eb00-bc9e-7990-a771-926470fc82c9", "payload": { "reason": "Order request OR-1 created (importSource=manual)", "priority": "normal", "itemCount": 1, "orderType": "dropship", "performed": true, "entityType": "order_request", "importSource": "manual", "requestNumber": "OR-1", "selfFulfilled": false, "resolvedLocationId": "6ea3b4c5-d6e7-8901-6789-012345678901", "resolvedSalesAccountId": "fea7b8c9-d0e1-2345-0123-456789012345", "fulfillingOrganizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "requestingOrganizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901" }, "created_at": "2026-09-29T02:31:29.126Z" } ], "assertion": "Creating an order request should produce a decision audit_events row with action=order_request_created for the acting user." }, { "name": "update_order_request_item decision was audited for Blair", "query": "SELECT id, action, event_type, user_id, object_id, payload, created_at\n FROM audit_events\n WHERE created_at >= $1\n AND user_id = $2\n AND event_type = 'decision'\n AND action = 'update_order_request_item'\n ORDER BY created_at DESC", "status": "pass", "rows": [ { "id": "01a0eb00-f892-7062-b8cb-7bd607390df9", "action": "update_order_request_item", "event_type": "decision", "user_id": "17b8c9d0-e1f2-3456-1234-567890123456", "object_id": "01a0eb00-bc9e-7990-a771-926470fc82c9", "payload": { "reason": "Item quantity or notes updated during the submission grace period", "performed": true, "entityType": "order_request" }, "created_at": "2026-09-29T02:31:44.431Z" } ], "assertion": "Editing an order item should produce a decision audit_events row with action=update_order_request_item for the acting user." }, { "name": "audit rows for Blair have required fields populated", "query": "SELECT id,\n (event_type IS NULL) AS missing_event_type,\n (organization_id IS NULL) AS missing_org\n FROM audit_events\n WHERE created_at >= $1\n AND user_id = $2\n AND (\n event_type IS NULL OR\n organization_id IS NULL\n )", "status": "pass", "rows": [], "assertion": "Every audit_events row for Blair during the run should have non-null event_type and organization_id. (`created_at` is NOT NULL by schema constraint.)" }, { "name": "no audit rows leaked to other organizations (test actors only)", "query": "SELECT id, organization_id, user_id, event_type, action, created_at\n FROM audit_events\n WHERE created_at >= $1\n AND user_id = ANY($2::uuid[])\n AND organization_id <> ALL($3::uuid[])", "status": "pass", "rows": [], "assertion": "Audit rows written during the run by the test actors (Blair, Dan, Rana) must belong to one of the demo organizations (Vantis or Corveta)." } ], "overallStatus": "pass", "outputDir": "/home/runner/_work/code/code/validation_test_results/urs-003-audit-log-tracking/2026-09-29T02-31-01-549Z", "auditStartTime": "2026-09-29T02:30:59.718Z", "auditEventEvidence": [ { "createdAt": "2026-09-29T02:31:08.000Z", "eventType": "user_log", "action": "user:login", "userEmail": "blair.bennett@corvetasurgical.com", "userId": "17b8c9d0-e1f2-3456-1234-567890123456", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "blair.bennett@corvetasurgical.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-09-29T02:31:14.717Z", "eventType": "user_log", "action": "user:login", "userEmail": "blair.bennett@corvetasurgical.com", "userId": "17b8c9d0-e1f2-3456-1234-567890123456", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "blair.bennett@corvetasurgical.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-09-29T02:31:29.126Z", "eventType": "checklist", "action": "checklists.create", "userEmail": "blair.bennett@corvetasurgical.com", "userId": "17b8c9d0-e1f2-3456-1234-567890123456", "organizationName": "Vantis", "organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "objectId": "01a0eb00-bcb4-70ea-83c6-4248ed10d533", "secondaryObjectId": null, "payload": { "title": "Order OR-1", "source": { "type": "order_request", "orderRequestId": "01a0eb00-bc9e-7990-a771-926470fc82c9" } }, "route": null, "traceId": null }, { "createdAt": "2026-09-29T02:31:29.126Z", "eventType": "decision", "action": "representatives.gate_rep_action", "userEmail": "blair.bennett@corvetasurgical.com", "userId": "17b8c9d0-e1f2-3456-1234-567890123456", "organizationName": "Vantis", "organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "objectId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "secondaryObjectId": null, "payload": { "reason": "no_blocking_relationship", "orderType": "dropship", "performed": false, "entityType": "organization", "gatedAction": "order_request", "isOwnTrunkDestination": false, "requestingOrganizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901" }, "route": null, "traceId": null }, { "createdAt": "2026-09-29T02:31:29.126Z", "eventType": "decision", "action": "order_request_created", "userEmail": "blair.bennett@corvetasurgical.com", "userId": "17b8c9d0-e1f2-3456-1234-567890123456", "organizationName": "Vantis", "organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "objectId": "01a0eb00-bc9e-7990-a771-926470fc82c9", "secondaryObjectId": null, "payload": { "reason": "Order request OR-1 created (importSource=manual)", "priority": "normal", "itemCount": 1, "orderType": "dropship", "performed": true, "entityType": "order_request", "importSource": "manual", "requestNumber": "OR-1", "selfFulfilled": false, "resolvedLocationId": "6ea3b4c5-d6e7-8901-6789-012345678901", "resolvedSalesAccountId": "fea7b8c9-d0e1-2345-0123-456789012345", "fulfillingOrganizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "requestingOrganizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901" }, "route": null, "traceId": null }, { "createdAt": "2026-09-29T02:31:34.981Z", "eventType": "user_log", "action": "user:login", "userEmail": "blair.bennett@corvetasurgical.com", "userId": "17b8c9d0-e1f2-3456-1234-567890123456", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "blair.bennett@corvetasurgical.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" }, { "createdAt": "2026-09-29T02:31:44.431Z", "eventType": "decision", "action": "basicErp.deriveSalesOrder", "userEmail": "blair.bennett@corvetasurgical.com", "userId": "17b8c9d0-e1f2-3456-1234-567890123456", "organizationName": "Vantis", "organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "objectId": "01a0eb00-bc9e-7990-a771-926470fc82c9", "secondaryObjectId": null, "payload": { "reason": "flag_disabled", "performed": false, "entityType": "order_request" }, "route": null, "traceId": null }, { "createdAt": "2026-09-29T02:31:44.431Z", "eventType": "decision", "action": "reevaluate_order_request_issues", "userEmail": "blair.bennett@corvetasurgical.com", "userId": "17b8c9d0-e1f2-3456-1234-567890123456", "organizationName": "Vantis", "organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "objectId": "01a0eb00-bc9e-7990-a771-926470fc82c9", "secondaryObjectId": null, "payload": { "reason": "Order request issues were unchanged after an edit", "performed": false, "entityType": "order_request" }, "route": null, "traceId": null }, { "createdAt": "2026-09-29T02:31:44.431Z", "eventType": "decision", "action": "update_order_request_item", "userEmail": "blair.bennett@corvetasurgical.com", "userId": "17b8c9d0-e1f2-3456-1234-567890123456", "organizationName": "Vantis", "organizationId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "objectId": "01a0eb00-bc9e-7990-a771-926470fc82c9", "secondaryObjectId": null, "payload": { "reason": "Item quantity or notes updated during the submission grace period", "performed": true, "entityType": "order_request" }, "route": null, "traceId": null }, { "createdAt": "2026-09-29T02:31:51.728Z", "eventType": "user_log", "action": "user:login", "userEmail": "dan.distributor@corvetasurgical.com", "userId": "c3d4e5f6-a7b8-9012-cdef-123456789012", "organizationName": "Corveta Surgical Group", "organizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "objectId": null, "secondaryObjectId": null, "payload": { "email": "dan.distributor@corvetasurgical.com" }, "route": "/login", "traceId": "00000000000000000000000000000000" } ], "auditQuery": "SELECT\n ae.created_at,\n ae.event_type,\n ae.action,\n ae.user_id,\n u.email AS user_email,\n ae.organization_id,\n o.name AS organization_name,\n ae.object_id,\n ae.secondary_object_id,\n ae.payload,\n ae.route,\n ae.trace_id\n FROM audit_events ae\n LEFT JOIN users u ON u.id = ae.user_id\n LEFT JOIN organizations o ON o.id = ae.organization_id\n WHERE ae.created_at >= $1\n AND ae.organization_id = ANY($2::uuid[])\n ORDER BY ae.created_at ASC", "auditAssertions": [ { "stepName": "Step 1: Rep login", "expectedAction": "user_log:user:login", "found": true }, { "stepName": "Step 2: Create order", "expectedAction": "decision:order_request_created", "found": true }, { "stepName": "Step 3: Edit order item", "expectedAction": "decision:update_order_request_item", "found": true }, { "stepName": "Step 4: Admin login", "expectedAction": "user_log:user:login", "found": true } ], "emailAssertions": [] }