Add comprehensive ISAC audit logging

src/lib/components/KpiFilters.svelte

@@ -2,12 +2,12 @@
 	import { page } from '$app/state';
 
 	type Item = { value: string; label: string; count: string | number; description: string };
-	let { items, active = '', className = '' }: { items: Item[]; active?: string; className?: string } = $props();
+	let { items, active = '', className = '', parameter = 'filter' }: { items: Item[]; active?: string; className?: string; parameter?: string } = $props();
 
 	function href(value: string) {
 		const params = new URLSearchParams(page.url.searchParams);
-		if (value) params.set('filter', value);
-		else params.delete('filter');
+		if (value) params.set(parameter, value);
+		else params.delete(parameter);
 		params.delete('page');
 		const query = params.toString();
 		return `${page.url.pathname}${query ? `?${query}` : ''}`;

src/lib/server/audit.ts

@@ -0,0 +1,35 @@
+import { getDatabase } from '$lib/server/database';
+import { randomUUID } from 'node:crypto';
+
+type AuditValue = Record<string, unknown> | unknown[] | null;
+
+export async function recordIsacAudit(input: {
+	actorId: string;
+	category: string;
+	action: string;
+	entityId: string;
+	before?: AuditValue;
+	after?: AuditValue;
+}) {
+	const database = await getDatabase();
+	await (await database.prepare(`INSERT INTO audit_log
+		(id,actor_id,entity_type,entity_id,action,before_json,after_json,created_at)
+		VALUES(?,?,?,?,?,?,?,?)`)).run(
+		randomUUID(),
+		input.actorId,
+		input.category,
+		input.entityId,
+		input.action,
+		input.before === undefined ? null : JSON.stringify(input.before),
+		input.after === undefined ? null : JSON.stringify(input.after),
+		new Date().toISOString()
+	);
+}
+
+export async function auditRecord(table: string, id: string): Promise<Record<string, unknown> | null> {
+	if (!['stat_attributes', 'talents', 'talent_triggers', 'brand_sets', 'gear', 'weapons', 'roles'].includes(table)) {
+		throw new Error('Unsupported audit table');
+	}
+	const database = await getDatabase();
+	return await (await database.prepare(`SELECT * FROM ${table} WHERE id=?`)).get(id) ?? null;
+}

src/lib/server/auth/account-deletion.ts

@@ -47,7 +47,7 @@ export async function softDeleteAccount(
 	)).run(
 		randomUUID(),
 		deletedBy,
-		'user',
+		'user_access',
 		userId,
 		'account.soft_deleted',
 		purgeSecurityData ? JSON.stringify({ purgedAtOwnerRequest: true }) : JSON.stringify({ username: user.username, displayName: user.display_name }),