Add comprehensive ISAC audit logging

src/routes/admin/weapons/+page.server.ts

@@ -5,6 +5,7 @@ import { fail } from '@sveltejs/kit';
 import { randomUUID } from 'node:crypto';
 import type { Actions, PageServerLoad } from './$types';
 import { getPagination } from '$lib/server/pagination';
+import { auditRecord, recordIsacAudit } from '$lib/server/audit';
 
 const categories = ['Shotgun', 'Rifle', 'MMR', 'AR', 'LMG', 'SMG'];
 const damageTypes = ['Blast', 'Pierce', 'Shredding'];
@@ -75,7 +76,7 @@ function readRange(form: FormData, tier: number, range: (typeof rangeNames)[numb
 
 export const actions: Actions = {
 	save: async ({ request, cookies }) => {
-		await requirePermission(await getSessionUser(cookies), 'data.manage');
+		const operator = await requirePermission(await getSessionUser(cookies), 'data.manage');
 		const form = await request.formData();
 		const id = String(form.get('id') ?? '');
 		const name = String(form.get('name') ?? '').normalize('NFKC').trim();
@@ -178,6 +179,13 @@ export const actions: Actions = {
 
 		const weaponId = id || randomUUID();
 		const now = new Date().toISOString();
+		const before = id ? {
+			record: await auditRecord('weapons', id),
+			tiers: await (await database.prepare('SELECT * FROM weapon_tier_ranges WHERE weapon_id=? ORDER BY tier')).all(id),
+			talents: await (await database.prepare('SELECT * FROM weapon_talent_options WHERE weapon_id=? ORDER BY talent_slot')).all(id),
+			augmentEffects: await (await database.prepare('SELECT * FROM weapon_augmentation_effects WHERE weapon_id=? ORDER BY sort_order')).all(id),
+			baseBonuses: await (await database.prepare('SELECT * FROM weapon_base_attribute_bonuses WHERE weapon_id=? ORDER BY sort_order')).all(id)
+		} : null;
 		if (id) {
 			const exists = await (await database.prepare('SELECT id FROM weapons WHERE id=?')).get(id);
 			if (!exists) return fail(404, { weaponError: 'Weapon not found.' });
@@ -209,12 +217,15 @@ export const actions: Actions = {
 			await (await database.prepare('INSERT INTO weapon_base_attribute_bonuses(id,weapon_id,stat_attribute_id,value,sort_order) VALUES(?,?,?,?,?)'))
 				.run(randomUUID(), weaponId, effect.statId, effect.value, effect.order);
 		}
+		await recordIsacAudit({ actorId: operator.id, category: 'game_data', action: id ? 'weapon.updated' : 'weapon.created', entityId: weaponId, before, after: { record: await auditRecord('weapons', weaponId), tiers, talent1Ids, talent2Ids, augmentEffects, baseBonuses } });
 		return { weaponSaved: true, weaponMode: id ? 'edit' : 'add', resultToken: randomUUID() };
 	},
 	archive: async ({ request, cookies }) => {
-		await requirePermission(await getSessionUser(cookies), 'data.manage');
+		const operator = await requirePermission(await getSessionUser(cookies), 'data.manage');
 		const id = String((await request.formData()).get('id') ?? '');
+		const before = await auditRecord('weapons', id);
 		await (await (await getDatabase()).prepare('UPDATE weapons SET active=0,updated_at=? WHERE id=?')).run(new Date().toISOString(), id);
+		await recordIsacAudit({ actorId: operator.id, category: 'game_data', action: 'weapon.archived', entityId: id, before, after: await auditRecord('weapons', id) });
 		return { weaponArchived: true };
 	}
 };