URS-003 · Audit Log Tracking of All User Actions

Title: Audit Log Tracking of All User Actions Date: 2026-09-29T02:31:01.549Z Duration: 52.0s Overall Status: ✅ PASS

User Requirement

The system shall record user actions related to data creation and modification.

Source: User_Requirement_Specifications_Vantis_DeviceFlow.xlsx — the run below proves the system meets this requirement.

Environment

• Inbox URL: http://localhost:42273
• Database: localhost:35767/cc_repinbox_dev

Setup

Status: ✅ PASS

Test Steps

Each step below corresponds to one Playwright test that ran sequentially. Screenshots and video recordings provide visual evidence of the UI behaviour.

1. Step 1: Rep login — ✅ PASS

What this step proves:

The sales representative (Blair Bennett) authenticates using valid credentials. On successful login the client-side logEvent() helper writes a user_log row with action=user:login to the audit_events table. This is verified in the DB validation phase to confirm that every login event is captured regardless of user role.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

Time	Type	Action	User	Org	Performed
2026-09-29 02:31:08Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-09-29 02:31:14Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-09-29 02:31:34Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-09-29 02:31:51Z	user_log	user:login	dan.distributor@corvetasurgical.com	Corveta Surgical Group	—

Screenshots:

Video recording:

---

2. Step 2: Create order — ✅ PASS

What this step proves:

The rep navigates through the four-step order request wizard and submits a consignment order. The createOrderRequest service function calls logDecision with action=order_request_created and performed=true immediately after the INSERT, writing a synchronous audit row that proves the creation event. A separate decision:auto_approve_order row is written later by a delayed Restate handler once the ORDER_REQUEST_SUBMISSION_DELAY_MS grace window expires, and is therefore out of scope for this test’s observation window.

Audit events generated by this step:

(Evidence scoped to step execution window: 2026-09-29T02:31:23.323Z → 2026-09-29T02:31:30.735Z)

Time	Type	Action	User	Org	Performed
2026-09-29 02:31:29Z	checklist	checklists.create	blair.bennett@corvetasurgical.com	Vantis	—
2026-09-29 02:31:29Z	decision	representatives.gate_rep_action	blair.bennett@corvetasurgical.com	Vantis	no
2026-09-29 02:31:29Z	decision	order_request_created	blair.bennett@corvetasurgical.com	Vantis	yes

Screenshots:

Video recording:

---

3. Step 3: Edit order item — ✅ PASS

What this step proves:

The rep opens the newly created order and edits a line item quantity during the submission grace period. The editOrderRequestItem service function calls logDecision with action=update_order_request_item and performed=true, writing a synchronous audit row immediately. This confirms that data-modification events within an order are captured inline at the point of change.

Audit events generated by this step:

(Evidence scoped to step execution window: 2026-09-29T02:31:41.005Z → 2026-09-29T02:31:48.293Z)

Time	Type	Action	User	Org	Performed
2026-09-29 02:31:44Z	decision	basicErp.deriveSalesOrder	blair.bennett@corvetasurgical.com	Vantis	no
2026-09-29 02:31:44Z	decision	reevaluate_order_request_issues	blair.bennett@corvetasurgical.com	Vantis	no
2026-09-29 02:31:44Z	decision	update_order_request_item	blair.bennett@corvetasurgical.com	Vantis	yes

Screenshots:

Video recording:

---

4. Step 4: Admin login — ✅ PASS

What this step proves:

The administrator (Dan Distributor) authenticates using valid credentials. The login event writes a user_log row with action=user:login to audit_events, identically to the rep’s login in Step 1. This confirms that audit logging of authentication events is role-agnostic and applies uniformly to every authenticated user in the system.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

Time	Type	Action	User	Org	Performed
2026-09-29 02:31:08Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-09-29 02:31:14Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-09-29 02:31:34Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-09-29 02:31:51Z	user_log	user:login	dan.distributor@corvetasurgical.com	Corveta Surgical Group	—

Screenshots:

Video recording:

---

Database Validations

The following SQL queries ran against the application database after the Playwright scenarios completed. Each query asserts a specific condition that proves the feature under test persisted its data correctly.

audit_events table has the expected schema — ✅ PASS

Assertion: Table public.audit_events should expose at least: id, organization_id, user_id, event_type, action, object_id, payload, created_at

SELECT column_name
                 FROM information_schema.columns
                 WHERE table_schema = 'public' AND table_name = 'audit_events'

column_name
id
organization_id
user_id
contact_id
event_type
action
object_id
secondary_object_id
payload
route
trace_id
created_at
url

rep login was audited (Blair) — ✅ PASS

Assertion: Blair logging in should produce at least one user_log row with action=user:login.

SELECT id, action, event_type, user_id, organization_id, payload, created_at
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = $2
                   AND event_type = 'user_log'
                   AND action = 'user:login'
                 ORDER BY created_at ASC

id	action	event_type	user_id	organization_id	payload	created_at
01a0eb00-69b3-729a-a779-23ec57bdf6d8	user:login	user_log	17b8c9d0-e1f2-3456-1234-567890123456	b2c3d4e5-f6a7-8901-bcde-f12345678901	{"email":"blair.bennett@corvetasurgical.com"}	2026-09-29T02:31:08.000Z
01a0eb00-83f3-7ccb-928f-65a5aa35f0fb	user:login	user_log	17b8c9d0-e1f2-3456-1234-567890123456	b2c3d4e5-f6a7-8901-bcde-f12345678901	{"email":"blair.bennett@corvetasurgical.com"}	2026-09-29T02:31:14.717Z
01a0eb00-d320-7a17-8c1a-a82794cfda2f	user:login	user_log	17b8c9d0-e1f2-3456-1234-567890123456	b2c3d4e5-f6a7-8901-bcde-f12345678901	{"email":"blair.bennett@corvetasurgical.com"}	2026-09-29T02:31:34.981Z

admin login was audited (Dan) — ✅ PASS

Assertion: Dan logging in should produce at least one user_log row with action=user:login.

SELECT id, action, event_type, user_id, organization_id, payload, created_at
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = $2
                   AND event_type = 'user_log'
                   AND action = 'user:login'
                 ORDER BY created_at ASC

id	action	event_type	user_id	organization_id	payload	created_at
01a0eb01-14a9-7f7b-85f1-629d59a9ba4e	user:login	user_log	c3d4e5f6-a7b8-9012-cdef-123456789012	b2c3d4e5-f6a7-8901-bcde-f12345678901	{"email":"dan.distributor@corvetasurgical.com"}	2026-09-29T02:31:51.728Z

order_request_created decision was audited for Blair — ✅ PASS

Assertion: Creating an order request should produce a decision audit_events row with action=order_request_created for the acting user.

SELECT id, action, event_type, user_id, object_id, payload, created_at
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = $2
                   AND event_type = 'decision'
                   AND action = 'order_request_created'
                 ORDER BY created_at DESC

id	action	event_type	user_id	object_id	payload	created_at
01a0eb00-bca1-7007-9519-f3e6f3e4a1eb	order_request_created	decision	17b8c9d0-e1f2-3456-1234-567890123456	01a0eb00-bc9e-7990-a771-926470fc82c9	{"reason":"Order request OR-1 created (importSource=manual)","priority":"normal","itemCount":1,"orderType":"dropship","performed":true,"entityType":"order_request","importSource":"manual","requestNumber":"OR-1","selfFulfilled":false,"resolvedLocationId":"6ea3b4c5-d6e7-8901-6789-012345678901","resolvedSalesAccountId":"fea7b8c9-d0e1-2345-0123-456789012345","fulfillingOrganizationId":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","requestingOrganizationId":"b2c3d4e5-f6a7-8901-bcde-f12345678901"}	2026-09-29T02:31:29.126Z

update_order_request_item decision was audited for Blair — ✅ PASS

Assertion: Editing an order item should produce a decision audit_events row with action=update_order_request_item for the acting user.

SELECT id, action, event_type, user_id, object_id, payload, created_at
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = $2
                   AND event_type = 'decision'
                   AND action = 'update_order_request_item'
                 ORDER BY created_at DESC

id	action	event_type	user_id	object_id	payload	created_at
01a0eb00-f892-7062-b8cb-7bd607390df9	update_order_request_item	decision	17b8c9d0-e1f2-3456-1234-567890123456	01a0eb00-bc9e-7990-a771-926470fc82c9	{"reason":"Item quantity or notes updated during the submission grace period","performed":true,"entityType":"order_request"}	2026-09-29T02:31:44.431Z

audit rows for Blair have required fields populated — ✅ PASS

Assertion: Every audit_events row for Blair during the run should have non-null event_type and organization_id. (created_at is NOT NULL by schema constraint.)

SELECT id,
                        (event_type IS NULL)        AS missing_event_type,
                        (organization_id IS NULL)   AS missing_org
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = $2
                   AND (
                     event_type IS NULL OR
                     organization_id IS NULL
                   )

No rows returned

no audit rows leaked to other organizations (test actors only) — ✅ PASS

Assertion: Audit rows written during the run by the test actors (Blair, Dan, Rana) must belong to one of the demo organizations (Vantis or Corveta).

SELECT id, organization_id, user_id, event_type, action, created_at
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = ANY($2::uuid[])
                   AND organization_id <> ALL($3::uuid[])

No rows returned

Audit & Email Assertion Ledger

Per-declaration outcome of every expectedAuditActions and expectedEmailTemplates entry written into the orchestrator. Missing evidence here is a real test failure, not a soft warning.

Audit Action Assertions

Each row asserts that a declared expectedAuditActions entry produced a matching row in audit_events. A ❌ flips overall status to FAIL — the declaration is real proof, not just an annotation.

Step	Expected Audit Action	Found
Step 1: Rep login	user_log:user:login	✅
Step 2: Create order	decision:order_request_created	✅
Step 3: Edit order item	decision:update_order_request_item	✅
Step 4: Admin login	user_log:user:login	✅

Audit Log Events

Every row written to audit_events while this test was running (scoped to the demo organizations). Provides compliance evidence that user actions are traced end-to-end (URS-003).

Capture window start: 2026-09-29T02:30:59.718Z

SELECT
    ae.created_at,
    ae.event_type,
    ae.action,
    ae.user_id,
    u.email AS user_email,
    ae.organization_id,
    o.name AS organization_name,
    ae.object_id,
    ae.secondary_object_id,
    ae.payload,
    ae.route,
    ae.trace_id
  FROM audit_events ae
  LEFT JOIN users u ON u.id = ae.user_id
  LEFT JOIN organizations o ON o.id = ae.organization_id
  WHERE ae.created_at >= $1
    AND ae.organization_id = ANY($2::uuid[])
  ORDER BY ae.created_at ASC

10 event(s) captured:

Time	Type	Action	User	Org	Object ID	Performed	Reason
2026-09-29 02:31:08Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—	—
2026-09-29 02:31:14Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—	—
2026-09-29 02:31:29Z	checklist	checklists.create	blair.bennett@corvetasurgical.com	Vantis	01a0eb00-bcb4-70ea-83c6-4248ed10d533	—
2026-09-29 02:31:29Z	decision	representatives.gate_rep_action	blair.bennett@corvetasurgical.com	Vantis	a1b2c3d4-e5f6-7890-abcd-ef1234567890	no	no_blocking_relationship
2026-09-29 02:31:29Z	decision	order_request_created	blair.bennett@corvetasurgical.com	Vantis	01a0eb00-bc9e-7990-a771-926470fc82c9	yes	Order request OR-1 created (importSource=manual)
2026-09-29 02:31:34Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—	—
2026-09-29 02:31:44Z	decision	basicErp.deriveSalesOrder	blair.bennett@corvetasurgical.com	Vantis	01a0eb00-bc9e-7990-a771-926470fc82c9	no	flag_disabled
2026-09-29 02:31:44Z	decision	reevaluate_order_request_issues	blair.bennett@corvetasurgical.com	Vantis	01a0eb00-bc9e-7990-a771-926470fc82c9	no	Order request issues were unchanged after an edit
2026-09-29 02:31:44Z	decision	update_order_request_item	blair.bennett@corvetasurgical.com	Vantis	01a0eb00-bc9e-7990-a771-926470fc82c9	yes	Item quantity or notes updated during the submission grace period
2026-09-29 02:31:51Z	user_log	user:login	dan.distributor@corvetasurgical.com	Corveta Surgical Group	—	—

Downloads

• audit-events.json
• report.md
• result.json
• screenshots-index.json
• step-timings.json

Feedback