The audit log records important product actions so admins can answer "who did what, when, and to which resource?" It is useful for B2B products, support debugging, compliance reviews, and account security screens.
Key files
| File | Purpose |
|---|---|
src/lib/activity-log.ts | Write and query audit records |
src/app/api/audit-log/route.ts | User-facing audit log API |
src/app/[locale]/admin/activity/ | Admin activity view |
activity_log table | Stored audit events |
Writing events
Use logActivity from server actions, route handlers, or background jobs:
import { logActivity } from '@/lib/activity-log';
await logActivity({
userId,
action: 'subscription.updated',
resourceType: 'subscription',
resourceId: subscriptionId,
metadata: { plan: 'pro' },
});
Keep event names stable. They become filters, support references, and sometimes customer-facing audit records.
Query helpers
| Helper | Purpose |
|---|---|
getRecentLogs() | Latest events across the app |
getUserLogs(userId) | Events for one user |
getResourceLogs(type, id) | Events for one resource |
getOrgLogs(orgId) | Events for one organization |
Feature flag
Disable public/admin audit surfaces with:
ENABLE_AUDIT_LOG="false"
When disabled, matching routes return 404 through src/proxy.ts.