Add comprehensive ISAC audit logging

src/routes/admin/talents/+page.server.ts

@@ -5,6 +5,7 @@ import { fail } from '@sveltejs/kit';
 import { randomUUID } from 'node:crypto';
 import type { Actions, PageServerLoad } from './$types';
 import { getPagination } from '$lib/server/pagination';
+import { auditRecord, recordIsacAudit } from '$lib/server/audit';
 
 type SharedEffect = { statId: string; valueI: number; valueII: number };
 
@@ -107,7 +108,7 @@ const renderDescription = (
 
 export const actions: Actions = {
 	saveTrigger: async ({ request, cookies }) => {
-		await requirePermission(await getSessionUser(cookies), 'data.manage');
+		const operator = await requirePermission(await getSessionUser(cookies), 'data.manage');
 		const form = await request.formData();
 		const id = String(form.get('id') ?? ''), name = String(form.get('name') ?? '').trim(), description = String(form.get('description') ?? '').trim(), uptime = form.get('supportsUptime') === 'on';
 		const min = uptime ? Number(form.get('minUptime')) : null, max = uptime ? Number(form.get('maxUptime')) : null;
@@ -115,13 +116,15 @@ export const actions: Actions = {
 		if (uptime && (!Number.isFinite(min) || !Number.isFinite(max) || Number(min) < 0 || Number(max) > 100 || Number(min) > Number(max))) return fail(400, { triggerError: 'Uptime must be a valid 0–100% range.' });
 		const db = await getDatabase();
 		if (await (await db.prepare('SELECT id FROM talent_triggers WHERE name=? COLLATE NOCASE AND id<>?')).get(name, id || 'new')) return fail(409, { triggerError: 'That trigger already exists.' });
-		const now = new Date().toISOString();
+		const now = new Date().toISOString(), triggerId = id || randomUUID();
+		const before = id ? await auditRecord('talent_triggers', id) : null;
 		if (id) await (await db.prepare('UPDATE talent_triggers SET name=?,description=?,supports_uptime=?,min_uptime=?,max_uptime=?,updated_at=? WHERE id=?')).run(name, description, uptime ? 1 : 0, min, max, now, id);
-		else await (await db.prepare('INSERT INTO talent_triggers(id,name,description,supports_uptime,min_uptime,max_uptime,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?)')).run(randomUUID(), name, description, uptime ? 1 : 0, min, max, now, now);
+		else await (await db.prepare('INSERT INTO talent_triggers(id,name,description,supports_uptime,min_uptime,max_uptime,created_at,updated_at) VALUES(?,?,?,?,?,?,?,?)')).run(triggerId, name, description, uptime ? 1 : 0, min, max, now, now);
+		await recordIsacAudit({ actorId: operator.id, category: 'game_data', action: id ? 'talent_trigger.updated' : 'talent_trigger.created', entityId: triggerId, before, after: await auditRecord('talent_triggers', triggerId) });
 		return { triggerSaved: true, triggerMode: id ? 'edit' : 'add', resultToken: randomUUID() };
 	},
 	saveTalent: async ({ request, cookies }) => {
-		await requirePermission(await getSessionUser(cookies), 'data.manage');
+		const operator = await requirePermission(await getSessionUser(cookies), 'data.manage');
 		const form = await request.formData();
 		const id = String(form.get('id') ?? ''), name = String(form.get('name') ?? '').trim(), category = String(form.get('category') ?? '');
 		const descriptionTemplate = String(form.get('descriptionTemplate') ?? '').trim();
@@ -141,6 +144,7 @@ export const actions: Actions = {
 		if (statRows.length !== sharedEffects.length) return fail(400, { talentError: 'One or more selected attributes are unavailable.' });
 		const units = new Map(statRows.map((stat) => [String(stat.id), stat.unit]));
 		const talentId = id || randomUUID(), now = new Date().toISOString();
+		const before = id ? { record: await auditRecord('talents', id), template: await (await db.prepare('SELECT template FROM talent_description_templates WHERE talent_id=?')).get(id), tiers: await (await db.prepare('SELECT tier,description FROM talent_tiers WHERE talent_id=? ORDER BY tier')).all(id) } : null;
 		if (id) await (await db.prepare('UPDATE talents SET name=?,category=?,updated_at=? WHERE id=?')).run(name, storedCategory, now, id);
 		else await (await db.prepare('INSERT INTO talents(id,name,category,created_at,updated_at) VALUES(?,?,?,?,?)')).run(talentId, name, storedCategory, now, now);
 		if (storedCategory === 'Weapon') {
@@ -171,6 +175,7 @@ export const actions: Actions = {
 			for (const triggerId of triggerIds) await (await db.prepare('INSERT INTO talent_tier_triggers(talent_tier_id,trigger_id) VALUES(?,?)')).run(tierId, triggerId);
 			for (const effect of sharedEffects) await (await db.prepare('INSERT INTO talent_tier_effects(id,talent_tier_id,stat_attribute_id,value,created_at) VALUES(?,?,?,?,?)')).run(randomUUID(), tierId, effect.statId, tier === 'I' ? effect.valueI : effect.valueII, now);
 		}
+		await recordIsacAudit({ actorId: operator.id, category: 'game_data', action: id ? 'talent.updated' : 'talent.created', entityId: talentId, before, after: { record: await auditRecord('talents', talentId), category, descriptionTemplate, triggerIds, effects: sharedEffects } });
 		return { talentSaved: true, talentMode: id ? 'edit' : 'add', resultToken: randomUUID() };
 	}
 };