URS-003 · Audit Log Tracking of All User Actions

Title: Audit Log Tracking of All User Actions Date: 2026-08-03T23:01:56.698Z Duration: 53.8s Overall Status: ✅ PASS

User Requirement

The system shall record user actions related to data creation and modification.

Source: User_Requirement_Specifications_Vantis_DeviceFlow.xlsx — the run below proves the system meets this requirement.

Environment

• Inbox URL: http://localhost:44295
• Database: localhost:42015/cc_repinbox_dev

Setup

Status: ✅ PASS

Test Steps

Each step below corresponds to one Playwright test that ran sequentially. Screenshots and video recordings provide visual evidence of the UI behaviour.

1. Step 1: Rep login — ✅ PASS

What this step proves:

The sales representative (Blair Bennett) authenticates using valid credentials. On successful login the client-side logEvent() helper writes a user_log row with action=user:login to the audit_events table. This is verified in the DB validation phase to confirm that every login event is captured regardless of user role.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

Time	Type	Action	User	Org	Performed
2026-08-03 23:02:03Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-08-03 23:02:11Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-08-03 23:02:31Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-08-03 23:02:48Z	user_log	user:login	dan.distributor@corvetasurgical.com	Corveta Surgical Group	—

Screenshots:

Video recording:

---

2. Step 2: Create order — ✅ PASS

What this step proves:

The rep navigates through the four-step order request wizard and submits a consignment order. The createOrderRequest service function calls logDecision with action=order_request_created and performed=true immediately after the INSERT, writing a synchronous audit row that proves the creation event. A separate decision:auto_approve_order row is written later by a delayed Restate handler once the ORDER_REQUEST_SUBMISSION_DELAY_MS grace window expires, and is therefore out of scope for this test’s observation window.

Audit events generated by this step:

(Evidence scoped to step execution window: 2026-08-03T23:02:19.400Z → 2026-08-03T23:02:26.791Z)

Time	Type	Action	User	Org	Performed
2026-08-03 23:02:25Z	checklist	checklists.create	blair.bennett@corvetasurgical.com	Vantis	—
2026-08-03 23:02:25Z	decision	order_request_created	blair.bennett@corvetasurgical.com	Vantis	yes

Screenshots:

Video recording:

---

3. Step 3: Edit order item — ✅ PASS

What this step proves:

The rep opens the newly created order and edits a line item quantity during the submission grace period. The editOrderRequestItem service function calls logDecision with action=update_order_request_item and performed=true, writing a synchronous audit row immediately. This confirms that data-modification events within an order are captured inline at the point of change.

Audit events generated by this step:

(Evidence scoped to step execution window: 2026-08-03T23:02:36.637Z → 2026-08-03T23:02:44.277Z)

Time	Type	Action	User	Org	Performed
2026-08-03 23:02:40Z	decision	update_order_request_item	blair.bennett@corvetasurgical.com	Vantis	yes
2026-08-03 23:02:40Z	decision	reevaluate_order_request_issues	blair.bennett@corvetasurgical.com	Vantis	no

Screenshots:

Video recording:

---

4. Step 4: Admin login — ✅ PASS

What this step proves:

The administrator (Dan Distributor) authenticates using valid credentials. The login event writes a user_log row with action=user:login to audit_events, identically to the rep’s login in Step 1. This confirms that audit logging of authentication events is role-agnostic and applies uniformly to every authenticated user in the system.

Audit events generated by this step:

(Evidence matched by declared name — step timing not available or no events fell in window)

Time	Type	Action	User	Org	Performed
2026-08-03 23:02:03Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-08-03 23:02:11Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-08-03 23:02:31Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—
2026-08-03 23:02:48Z	user_log	user:login	dan.distributor@corvetasurgical.com	Corveta Surgical Group	—

Screenshots:

Video recording:

---

Database Validations

The following SQL queries ran against the application database after the Playwright scenarios completed. Each query asserts a specific condition that proves the feature under test persisted its data correctly.

audit_events table has the expected schema — ✅ PASS

Assertion: Table public.audit_events should expose at least: id, organization_id, user_id, event_type, action, object_id, payload, created_at

SELECT column_name
                 FROM information_schema.columns
                 WHERE table_schema = 'public' AND table_name = 'audit_events'

column_name
id
organization_id
user_id
contact_id
event_type
action
object_id
secondary_object_id
payload
route
trace_id
created_at
url

rep login was audited (Blair) — ✅ PASS

Assertion: Blair logging in should produce at least one user_log row with action=user:login.

SELECT id, action, event_type, user_id, organization_id, payload, created_at
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = $2
                   AND event_type = 'user_log'
                   AND action = 'user:login'
                 ORDER BY created_at ASC

id	action	event_type	user_id	organization_id	payload	created_at
019fc9dc-e127-757f-94cb-8373c3b85f99	user:login	user_log	17b8c9d0-e1f2-3456-1234-567890123456	b2c3d4e5-f6a7-8901-bcde-f12345678901	{"email":"blair.bennett@corvetasurgical.com"}	2026-08-03T23:02:03.964Z
019fc9dc-fe2c-75b3-9975-246ac193c141	user:login	user_log	17b8c9d0-e1f2-3456-1234-567890123456	b2c3d4e5-f6a7-8901-bcde-f12345678901	{"email":"blair.bennett@corvetasurgical.com"}	2026-08-03T23:02:11.288Z
019fc9dd-4b64-73de-8a0e-0e4b6beaff98	user:login	user_log	17b8c9d0-e1f2-3456-1234-567890123456	b2c3d4e5-f6a7-8901-bcde-f12345678901	{"email":"blair.bennett@corvetasurgical.com"}	2026-08-03T23:02:31.030Z

admin login was audited (Dan) — ✅ PASS

Assertion: Dan logging in should produce at least one user_log row with action=user:login.

SELECT id, action, event_type, user_id, organization_id, payload, created_at
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = $2
                   AND event_type = 'user_log'
                   AND action = 'user:login'
                 ORDER BY created_at ASC

id	action	event_type	user_id	organization_id	payload	created_at
019fc9dd-8f6f-7229-9ef3-47731c198cbe	user:login	user_log	c3d4e5f6-a7b8-9012-cdef-123456789012	b2c3d4e5-f6a7-8901-bcde-f12345678901	{"email":"dan.distributor@corvetasurgical.com"}	2026-08-03T23:02:48.464Z

order_request_created decision was audited for Blair — ✅ PASS

Assertion: Creating an order request should produce a decision audit_events row with action=order_request_created for the acting user.

SELECT id, action, event_type, user_id, object_id, payload, created_at
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = $2
                   AND event_type = 'decision'
                   AND action = 'order_request_created'
                 ORDER BY created_at DESC

id	action	event_type	user_id	object_id	payload	created_at
019fc9dd-3468-7830-b8f9-8bbd3f0fb05d	order_request_created	decision	17b8c9d0-e1f2-3456-1234-567890123456	019fc9dd-3464-75e0-be4e-951d2b8f2e19	{"reason":"Order request OR-1 created (importSource=manual)","priority":"normal","itemCount":1,"orderType":"dropship","performed":true,"entityType":"order_request","importSource":"manual","requestNumber":"OR-1","selfFulfilled":false,"resolvedLocationId":"6ea3b4c5-d6e7-8901-6789-012345678901","resolvedSalesAccountId":"fea7b8c9-d0e1-2345-0123-456789012345","fulfillingOrganizationId":"a1b2c3d4-e5f6-7890-abcd-ef1234567890","requestingOrganizationId":"b2c3d4e5-f6a7-8901-bcde-f12345678901"}	2026-08-03T23:02:25.063Z

update_order_request_item decision was audited for Blair — ✅ PASS

Assertion: Editing an order item should produce a decision audit_events row with action=update_order_request_item for the acting user.

SELECT id, action, event_type, user_id, object_id, payload, created_at
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = $2
                   AND event_type = 'decision'
                   AND action = 'update_order_request_item'
                 ORDER BY created_at DESC

id	action	event_type	user_id	object_id	payload	created_at
019fc9dd-6fbc-7c57-a549-714768d12ec5	update_order_request_item	decision	17b8c9d0-e1f2-3456-1234-567890123456	019fc9dd-3464-75e0-be4e-951d2b8f2e19	{"reason":"Item quantity or notes updated during the submission grace period","performed":true,"entityType":"order_request"}	2026-08-03T23:02:40.213Z

audit rows for Blair have required fields populated — ✅ PASS

Assertion: Every audit_events row for Blair during the run should have non-null event_type and organization_id. (created_at is NOT NULL by schema constraint.)

SELECT id,
                        (event_type IS NULL)        AS missing_event_type,
                        (organization_id IS NULL)   AS missing_org
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = $2
                   AND (
                     event_type IS NULL OR
                     organization_id IS NULL
                   )

No rows returned

no audit rows leaked to other organizations (test actors only) — ✅ PASS

Assertion: Audit rows written during the run by the test actors (Blair, Dan, Rana) must belong to one of the demo organizations (Vantis or Corveta).

SELECT id, organization_id, user_id, event_type, action, created_at
                 FROM audit_events
                 WHERE created_at >= $1
                   AND user_id = ANY($2::uuid[])
                   AND organization_id <> ALL($3::uuid[])

No rows returned

Audit & Email Assertion Ledger

Per-declaration outcome of every expectedAuditActions and expectedEmailTemplates entry written into the orchestrator. Missing evidence here is a real test failure, not a soft warning.

Audit Action Assertions

Each row asserts that a declared expectedAuditActions entry produced a matching row in audit_events. A ❌ flips overall status to FAIL — the declaration is real proof, not just an annotation.

Step	Expected Audit Action	Found
Step 1: Rep login	user_log:user:login	✅
Step 2: Create order	decision:order_request_created	✅
Step 3: Edit order item	decision:update_order_request_item	✅
Step 4: Admin login	user_log:user:login	✅

Audit Log Events

Every row written to audit_events while this test was running (scoped to the demo organizations). Provides compliance evidence that user actions are traced end-to-end (URS-003).

Capture window start: 2026-08-03T23:01:54.936Z

SELECT
    ae.created_at,
    ae.event_type,
    ae.action,
    ae.user_id,
    u.email AS user_email,
    ae.organization_id,
    o.name AS organization_name,
    ae.object_id,
    ae.secondary_object_id,
    ae.payload,
    ae.route,
    ae.trace_id
  FROM audit_events ae
  LEFT JOIN users u ON u.id = ae.user_id
  LEFT JOIN organizations o ON o.id = ae.organization_id
  WHERE ae.created_at >= $1
    AND ae.organization_id = ANY($2::uuid[])
  ORDER BY ae.created_at ASC

8 event(s) captured:

Time	Type	Action	User	Org	Object ID	Performed	Reason
2026-08-03 23:02:03Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—	—
2026-08-03 23:02:11Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—	—
2026-08-03 23:02:25Z	checklist	checklists.create	blair.bennett@corvetasurgical.com	Vantis	019fc9dd-3483-73be-96c2-3f5a909d07e9	—
2026-08-03 23:02:25Z	decision	order_request_created	blair.bennett@corvetasurgical.com	Vantis	019fc9dd-3464-75e0-be4e-951d2b8f2e19	yes	Order request OR-1 created (importSource=manual)
2026-08-03 23:02:31Z	user_log	user:login	blair.bennett@corvetasurgical.com	Corveta Surgical Group	—	—
2026-08-03 23:02:40Z	decision	update_order_request_item	blair.bennett@corvetasurgical.com	Vantis	019fc9dd-3464-75e0-be4e-951d2b8f2e19	yes	Item quantity or notes updated during the submission grace period
2026-08-03 23:02:40Z	decision	reevaluate_order_request_issues	blair.bennett@corvetasurgical.com	Vantis	019fc9dd-3464-75e0-be4e-951d2b8f2e19	no	Order request issues were unchanged after an edit
2026-08-03 23:02:48Z	user_log	user:login	dan.distributor@corvetasurgical.com	Corveta Surgical Group	—	—

Downloads

• audit-events.json
• report.md
• result.json
• screenshots-index.json
• step-timings.json

Feedback