@anteros/core 0.0.40 → 0.0.42

package/tests/audit-operations.test.ts

@@ -0,0 +1,184 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { createApp } from "../server/hono";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { useRest } from "../database/rest";
+import { AUDIT_COLLECTION } from "../database/audit";
+
+const TENANT = "ops-test";
+const DB = "mongodb://localhost:27017/_AUDIT_OPS_TEST";
+const SLUG = "orders";
+const SERVICE = "billing";
+
+let internalRest: InstanceType<typeof useRest>;
+let server: any;
+let url = "";
+
+/** Latest audited entry for an action, written *after* `since` (fire-and-forget logging) */
+async function lastActivity(action: string, since?: Date) {
+    for (let i = 0; i < 40; i++) {
+        const found: any = await internalRest.db.collection(AUDIT_COLLECTION).findOne(
+            { "operation.action": action, ...(since ? { ts: { $gte: since } } : {}) },
+            { sort: { ts: -1 } },
+        );
+        if (found) return found;
+        await Bun.sleep(25);
+    }
+    return null;
+}
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000 },
+        tenants: [{ id: TENANT, dir: "src", database: { uri: DB } }],
+    });
+    await syncTenants();
+
+    (cfg as any).collections = [{
+        _tenant_: TENANT,
+        slug: SLUG,
+        fields: [{ name: "ref", type: "string" }],
+        api: { access: { "*": true } },
+    }];
+    (cfg as any).services = [{
+        _tenant_: TENANT,
+        name: SERVICE,
+        enabled: true,
+        actions: {
+            charge: async ({ data }: any) => ({ charged: data?.amount }),
+            boom: async () => { throw new Error("service-kaboom") },
+        },
+        api: { access: { "*": true } },
+    }];
+
+    internalRest = new useRest({ internal: true, tenant_id: TENANT });
+
+    await internalRest.insertMany(SLUG, [{ ref: "A-1" }, { ref: "A-2" }]);
+
+    const app = createApp();
+    server = Bun.serve({ port: 0, fetch: app.fetch });
+    url = server.url.href.replace(/\/$/, "");
+});
+
+afterAll(async () => {
+    try { await internalRest.db.collection(SLUG).drop(); } catch (_) {}
+    try { await internalRest.db.collection(AUDIT_COLLECTION).drop(); } catch (_) {}
+    try { server.stop(true); } catch {}
+});
+
+describe("audit — streams", () => {
+    it("audits `findStream` with its parameters and no result", async () => {
+        const since = new Date();
+        const docs: any[] = [];
+        for await (const doc of internalRest.findStream(SLUG, { $match: { ref: "A-1" } }, { batchSize: 10 })) {
+            docs.push(doc);
+        }
+        expect(docs.length).toBe(1); // the consumer really got the documents
+
+        const logged = await lastActivity("findStream", since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.input.params).toEqual({ $match: { ref: "A-1" } });
+        expect(logged.operation.input.options).toEqual({ batchSize: 10 });
+        expect(logged.operation.result).toBeNull();
+        expect(logged.operation.status).toBe("success");
+        expect(typeof logged.operation.duration).toBe("number");
+    });
+
+    it("audits `aggregateStream` with its pipeline and no result", async () => {
+        const since = new Date();
+        const pipeline = [{ $match: { ref: "A-2" } }];
+        const rows: any[] = [];
+        for await (const doc of internalRest.aggregateStream(SLUG, pipeline, { batchSize: 10 })) {
+            rows.push(doc);
+        }
+        expect(rows.length).toBe(1);
+
+        const logged = await lastActivity("aggregateStream", since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.input.pipeline).toEqual(pipeline);
+        expect(logged.operation.result).toBeNull();
+    });
+
+    it("audits a stream that breaks early (the entry is written on `finally`)", async () => {
+        const since = new Date();
+        for await (const _doc of internalRest.findStream(SLUG, {}, { batchSize: 1 })) {
+            break; // consumer stops after the first document
+        }
+
+        const logged = await lastActivity("findStream", since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.status).toBe("success");
+    });
+
+    it("audits `watch` with its parameters and no result", async () => {
+        const since = new Date();
+        const pipeline = [{ $match: { "fullDocument.ref": "A-1" } }];
+        const stream = await internalRest.watch(SLUG, pipeline, {});
+        expect(stream).toBeDefined();
+
+        const logged = await lastActivity("watch", since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.input.pipeline).toEqual(pipeline);
+        expect(logged.operation.result).toBeNull();
+
+        await stream.close().catch(() => {});
+    });
+});
+
+describe("audit — services", () => {
+    it("audits an internal `rest.runService` call and marks it as internal", async () => {
+        const since = new Date();
+        const result: any = await internalRest.runService(SERVICE, "charge", { amount: 42 });
+        expect(result).toEqual({ charged: 42 }); // the caller still gets the payload
+
+        const logged = await lastActivity("runService", since);
+        expect(logged).not.toBeNull();
+        expect(logged.operation.collection).toBe(SERVICE);
+        expect(logged.operation.input.action).toBe("charge");
+        expect(logged.operation.input.data).toEqual({ amount: 42 });
+        expect(logged.operation.result).toBeNull();
+        expect(logged.internal).toBe(true);
+    });
+
+    it("audits the HTTP route once — not twice — and marks it as not internal", async () => {
+        const since = new Date();
+        const before = await internalRest.db.collection(AUDIT_COLLECTION)
+            .countDocuments({ "operation.action": "runService" });
+
+        const res = await fetch(`${url}/api/${TENANT}/services/${SERVICE}/charge`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ data: { amount: 7 } }),
+        });
+        expect(res.status).toBe(200);
+        expect(await res.json()).toEqual({ charged: 7 });
+
+        await lastActivity("runService", since);
+        const after = await internalRest.db.collection(AUDIT_COLLECTION)
+            .countDocuments({ "operation.action": "runService" });
+
+        expect(after - before).toBe(1); // exactly one entry — the route no longer logs its own
+        const logged = await lastActivity("runService", since);
+        expect(logged.internal).toBe(false);
+        expect(logged.operation.input.data).toEqual({ amount: 7 });
+    });
+
+    it("records a failing service action with its error, and rethrows it unchanged", async () => {
+        const since = new Date();
+        await expect(internalRest.runService(SERVICE, "boom")).rejects.toThrow("service-kaboom");
+
+        const logged = await lastActivity("runService", since);
+        expect(logged.operation.status).toBe("error");
+        expect(logged.operation.error.message).toBe("service-kaboom");
+        expect(logged.operation.result).toBeNull();
+    });
+
+    it("records an unknown service", async () => {
+        const since = new Date();
+        await expect(internalRest.runService("nope", "charge")).rejects.toThrow();
+
+        const logged = await lastActivity("runService", since);
+        expect(logged.operation.status).toBe("error");
+        expect(logged.operation.error.code).toBe("SERVICE_NOT_FOUND");
+    });
+});

package/tests/audit-redact.test.ts

@@ -0,0 +1,259 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { ObjectId } from "mongodb";
+import { createApp } from "../server/hono";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { useRest } from "../database/rest";
+import { AUDIT_COLLECTION } from "../database/audit";
+import { REDACTED, redactPayload } from "../lib/redact";
+
+const TENANT = "redact-test";
+const DB = "mongodb://localhost:27017/_AUDIT_REDACT_TEST";
+const SLUG = "patients";
+
+let rest: InstanceType<typeof useRest>;
+let server: any;
+let url = "";
+
+/** Latest audited entry for an action, written *after* `since` (fire-and-forget logging) */
+async function lastActivity(action: string, since?: Date) {
+    for (let i = 0; i < 40; i++) {
+        const found: any = await rest.db.collection(AUDIT_COLLECTION).findOne(
+            { "operation.action": action, ...(since ? { ts: { $gte: since } } : {}) },
+            { sort: { ts: -1 } },
+        );
+        if (found) return found;
+        await Bun.sleep(25);
+    }
+    return null;
+}
+
+const PNG = Buffer.from(
+    "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==",
+    "base64",
+);
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000, jwt: { secret: "redact-secret" } },
+        tenants: [{ id: TENANT, dir: "src", database: { uri: DB } }],
+    });
+    await syncTenants();
+
+    (cfg as any).collections = [{
+        _tenant_: TENANT,
+        slug: SLUG,
+        fields: [
+            { name: "name", type: "string" },
+            { name: "password", type: "string" },
+            { name: "ssn", type: "string" },
+            { name: "profile", type: "json" },
+            { name: "list", type: "json" },
+        ],
+        api: {
+            access: { "*": true },
+            auth: {
+                enabled: true,
+                onLogin: async ({ payload, jwt }: any) => ({
+                    // `jwt.sign` is async — must be awaited, or the token fails verification
+                    token: await jwt.sign({ sub: payload.email }),
+                    data: { email: payload.email },
+                }),
+            },
+        },
+    }];
+
+    rest = new useRest({ internal: false, tenant_id: TENANT });
+
+    const app = createApp();
+    server = Bun.serve({ port: 0, fetch: app.fetch });
+    url = server.url.href.replace(/\/$/, "");
+});
+
+afterAll(async () => {
+    try { await rest.db.collection(SLUG).drop(); } catch (_) {}
+    try { await rest.db.collection(AUDIT_COLLECTION).drop(); } catch (_) {}
+    try { server.stop(true); } catch {}
+    delete (cfg.server as any).audit;
+});
+
+// The URL shape, pinned here — every surface moved to `/api/:tenant_id/<family>/…`
+describe("API layout", () => {
+    it("serves nothing on a pre-refactor path", async () => {
+        // `/api/<tenant>/<collection>/<action>` used to be a collection action. No alias
+        // is mounted, so it is a plain 404 — never a silent misroute on another handler.
+        const legacy = await fetch(`${url}/api/${TENANT}/${SLUG}/find`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ $limit: 1 }),
+        });
+        expect(legacy.status).toBe(404);
+
+        // Same for a surface that moved with its own family
+        expect((await fetch(`${url}/services/${TENANT}/billing/charge`, { method: "POST" })).status).toBe(404);
+        expect((await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST" })).status).toBe(404);
+
+        // …and the new shape is what answers
+        const current = await fetch(`${url}/api/${TENANT}/collections/${SLUG}/find`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ $limit: 1 }),
+        });
+        expect(current.status).toBe(200);
+    });
+});
+
+describe("audit redaction — defaults", () => {
+    it("masks the password of a login payload (success path)", async () => {
+        const since = new Date();
+        const res = await fetch(`${url}/api/${TENANT}/collections/${SLUG}/login`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ payload: { email: "ada@example.com", password: "SuperSecret123!" } }),
+        });
+        expect(res.status).toBe(200);
+
+        const logged = await lastActivity("login", since);
+        expect(logged.operation.status).toBe("success");
+        expect(logged.operation.input.payload.password).toBe(REDACTED);
+        expect(logged.operation.input.payload.email).toBe("ada@example.com"); // untouched
+    });
+
+    it("masks the password of a login payload (failure path)", async () => {
+        const since = new Date();
+        const res = await fetch(`${url}/api/${TENANT}/collections/${SLUG}/login`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ payload: { email: "bad", password: "WrongOne!" } }),
+        });
+        // unknown user is not the point here — whatever the status, the payload is logged
+        expect(res.status).toBeGreaterThanOrEqual(200);
+
+        const logged = await lastActivity("login", since);
+        expect(logged.operation.input.payload.password).toBe(REDACTED);
+    });
+
+    it("masks keys at any depth, in arrays, case-insensitively — and stores no result data", async () => {
+        const since = new Date();
+        const doc: any = await rest.insertOne(SLUG, {
+            name: "John",
+            password: "p4ss",
+            profile: { apiKey: "k-123", nested: { token: "tok", ok: "keep" } },
+            list: [{ key: "secret-key", label: "visible" }],
+        });
+
+        const logged = await lastActivity("insertOne", since);
+        const input = logged.operation.input.data;
+        expect(input.name).toBe("John");
+        expect(input.password).toBe(REDACTED);
+        expect(input.profile.apiKey).toBe(REDACTED);
+        expect(input.profile.nested.token).toBe(REDACTED);
+        expect(input.profile.nested.ok).toBe("keep");
+        expect(input.list[0].key).toBe(REDACTED);
+        expect(input.list[0].label).toBe("visible");
+
+        // The result holds the generated identifier only — no document, and
+        // therefore no value to leak in the first place.
+        expect(logged.operation.result).toEqual({ _id: doc._id });
+
+        // …while the caller still received the real values
+        expect(doc.password).toBe("p4ss");
+    });
+
+    it("never alters non-plain values (Date, ObjectId) or the payload reference when nothing matches", async () => {
+        // Direct check on the redactor: non-plain objects pass through untouched
+        const when = new Date();
+        const id = new ObjectId();
+        const clean = { name: "x", when, id, list: [when] };
+        expect(redactPayload(clean)).toBe(clean); // same reference — no allocation
+
+        const dirty = redactPayload({ when, id, password: "p" });
+        expect(dirty.when).toBe(when);
+        expect(dirty.id).toBe(id);
+        expect(dirty.password).toBe(REDACTED);
+
+        // …and on a real entry: only the generated id comes back
+        const since = new Date();
+        await rest.insertOne(SLUG, { name: "dates" });
+        const logged = await lastActivity("insertOne", since);
+        expect(logged.operation.result._id).toBeString();
+        expect(typeof logged.operation.duration).toBe("number");
+    });
+
+    it("redacts the request headers and query string", async () => {
+        const since = new Date();
+        const res = await fetch(`${url}/api/${TENANT}/collections/${SLUG}/find?token=query-secret&page=2`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: "Bearer fake.jwt",
+                "X-API-Key": "api-key-secret",
+                "X-Trace": "keep-me",
+            },
+            body: JSON.stringify({ $limit: 1 }),
+        });
+        expect(res.status).toBe(200);
+
+        const logged = await lastActivity("find", since);
+        // `authorization` and `cookie` are dropped by the request middleware
+        expect(logged.request.headers.authorization).toBeUndefined();
+        // …the rest goes through the redactor: `x-api-key` → `api_key`, `token` → `token`
+        expect(logged.request.headers["x-api-key"]).toBe(REDACTED);
+        expect(logged.request.query.token).toBe(REDACTED);
+        // innocuous values are kept
+        expect(logged.request.headers["x-trace"]).toBe("keep-me");
+        expect(logged.request.query.page).toBe("2");
+    });
+
+    it("masks the headers-like `authorization` key of a custom activity", async () => {
+        await rest.audit.addActivities([{
+            internal: true,
+            trace: { id: crypto.randomUUID() },
+            meta: { authorization: "Bearer abc" },
+            operation: {
+                tenant: TENANT, action: "manual", collection: SLUG,
+                status: "success", input: { authorization: "Bearer xyz", token: "t" },
+                result: null, error: null, duration: 0, transaction: false,
+            },
+            ts: new Date(),
+        } as any]);
+
+        const logged: any = await rest.db.collection(AUDIT_COLLECTION).findOne({ "operation.action": "manual" });
+        expect(logged.operation.input.authorization).toBe(REDACTED);
+        expect(logged.operation.input.token).toBe(REDACTED);
+        expect(logged.meta.authorization).toBe(REDACTED);
+    });
+});
+
+describe("audit redaction — configuration", () => {
+    it("uses a custom key list instead of the defaults", async () => {
+        (cfg.server as any).audit = { redact: ["ssn"] };
+
+        const since = new Date();
+        await rest.insertOne(SLUG, { name: "custom", password: "keep-me", ssn: "123-45-6789" });
+
+        const logged = await lastActivity("insertOne", since);
+        expect(logged.operation.input.data.ssn).toBe(REDACTED);
+        expect(logged.operation.input.data.password).toBe("keep-me");
+    });
+
+    it("can be disabled with `redact: false`", async () => {
+        (cfg.server as any).audit = { redact: false };
+
+        const since = new Date();
+        await rest.insertOne(SLUG, { name: "off", password: "clear" });
+
+        const logged = await lastActivity("insertOne", since);
+        expect(logged.operation.input.data.password).toBe("clear");
+    });
+
+    it("falls back to the defaults when unset", async () => {
+        delete (cfg.server as any).audit;
+
+        const since = new Date();
+        await rest.insertOne(SLUG, { name: "back", password: "masked-again" });
+
+        const logged = await lastActivity("insertOne", since);
+        expect(logged.operation.input.data.password).toBe(REDACTED);
+    });
+});

package/tests/audit-results.test.ts

@@ -0,0 +1,188 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { useRest } from "../database/rest";
+import { AUDIT_COLLECTION } from "../database/audit";
+import { IDS_MAX } from "../lib/auditResult";
+
+const TENANT = "results-test";
+const DB = "mongodb://localhost:27017/_AUDIT_RESULTS_TEST";
+const SLUG = "orders";
+
+let rest: InstanceType<typeof useRest>;
+
+/** Latest audited entry for an action, written *after* `since` (fire-and-forget logging) */
+async function lastActivity(action: string, since?: Date) {
+    for (let i = 0; i < 40; i++) {
+        const found: any = await rest.db.collection(AUDIT_COLLECTION).findOne(
+            { "operation.action": action, ...(since ? { ts: { $gte: since } } : {}) },
+            { sort: { ts: -1 } },
+        );
+        if (found) return found;
+        await Bun.sleep(25);
+    }
+    return null;
+}
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000 },
+        tenants: [{ id: TENANT, dir: "src", database: { uri: DB } }],
+    });
+    await syncTenants();
+
+    (cfg as any).collections = [{
+        _tenant_: TENANT,
+        slug: SLUG,
+        fields: [
+            { name: "ref", type: "string" },
+            { name: "total", type: "number" },
+        ],
+        api: { access: { "*": true } },
+    }];
+
+    rest = new useRest({ internal: false, tenant_id: TENANT });
+});
+
+afterAll(async () => {
+    try { await rest.db.collection(SLUG).drop(); } catch (_) {}
+    try { await rest.db.collection(AUDIT_COLLECTION).drop(); } catch (_) {}
+    delete (cfg.server as any).audit;
+});
+
+describe("audit results — default (`summary`)", () => {
+    it("keeps only the generated `_id` for an insert — no document", async () => {
+        const since = new Date();
+        const doc: any = await rest.insertOne(SLUG, { ref: "TOPSECRET-REF", total: 10 });
+
+        const logged = await lastActivity("insertOne", since);
+        expect(logged.operation.result).toEqual({ _id: doc._id });
+        // the payload is nowhere in the result
+        expect(JSON.stringify(logged.operation.result)).not.toContain("TOPSECRET-REF");
+        // …but the input still carries the parameters (that is the audit trail)
+        expect(logged.operation.input.data.ref).toBe("TOPSECRET-REF");
+    });
+
+    it("keeps `count` + `insertedIds` for a batch insert", async () => {
+        const since = new Date();
+        const docs: any[] = await rest.insertMany(SLUG, [
+            { ref: "B-1", total: 1 },
+            { ref: "B-2", total: 2 },
+            { ref: "B-3", total: 3 },
+        ]);
+
+        const logged = await lastActivity("insertMany", since);
+        expect(logged.operation.result.count).toBe(3);
+        expect(logged.operation.result.insertedIds).toEqual(docs.map((d) => d._id));
+        expect(logged.operation.result.truncated).toBeUndefined();
+        // the input of insertMany only holds the count — the ids are the trace
+        expect(logged.operation.input).toEqual({ count: 3 });
+    });
+
+    it("caps the identifiers of a huge batch", async () => {
+        const since = new Date();
+        const batch = Array.from({ length: IDS_MAX + 5 }, (_, i) => ({ ref: `big-${i}`, total: i }));
+        await rest.insertMany(SLUG, batch);
+
+        const logged = await lastActivity("insertMany", since);
+        expect(logged.operation.result.count).toBe(IDS_MAX + 5);
+        expect(logged.operation.result.insertedIds.length).toBe(IDS_MAX);
+        expect(logged.operation.result.truncated).toBe(true);
+    });
+
+    it("keeps the operational counters of updates, deletes and meta operations", async () => {
+        const [first] = await rest.find(SLUG, { $limit: 1 });
+
+        let since = new Date();
+        const one: any = await rest.updateOne(SLUG, first!._id, { $set: { total: 99 } });
+        expect(one.total).toBe(99); // the caller gets the document…
+        const updated = await lastActivity("updateOne", since);
+        // …but the audit keeps the identifier only (`updateOne` returns a document)
+        expect(updated.operation.result).toEqual({ _id: one._id });
+        // the parameters are there too
+        expect(updated.operation.input.update.$set.total).toBe(99);
+
+        since = new Date();
+        const many: any = await rest.updateMany(SLUG, [first!._id], { $set: { total: 100 } });
+        expect((await lastActivity("updateMany", since)).operation.result.modifiedCount).toBe(many.modifiedCount);
+
+        since = new Date();
+        await rest.countDocuments(SLUG, {});
+        expect(typeof (await lastActivity("countDocuments", since)).operation.result).toBe("number");
+
+        since = new Date();
+        const removed: any = await rest.deleteOne(SLUG, first!._id);
+        expect(removed).not.toBeNull();
+        expect((await lastActivity("deleteOne", since)).operation.result).toEqual({ deleted: true });
+
+        // a delete that matched nothing reports nothing
+        since = new Date();
+        await rest.deleteOne(SLUG, first!._id);
+        expect((await lastActivity("deleteOne", since)).operation.result).toBeNull();
+
+        // a document-producing operation never leaks the document — just its id
+        const fresh: any = await rest.insertOne(SLUG, { ref: "FOU-1", total: 5 });
+        since = new Date();
+        const found: any = await rest.findOneAndUpdate(SLUG, { _id: fresh._id }, { $set: { total: 6 } });
+        expect(found.total).toBe(6); // the caller gets the document…
+        expect((await lastActivity("findOneAndUpdate", since)).operation.result).toEqual({ _id: found._id });
+    });
+
+    it("never stores a document, whatever the operation", async () => {
+        const entries: any[] = await rest.db.collection(AUDIT_COLLECTION)
+            .find({ "operation.collection": SLUG })
+            .toArray();
+
+        for (const entry of entries) {
+            // a document would carry the collection's own fields
+            expect(entry.operation.result?.total).toBeUndefined();
+            expect(entry.operation.result?.ref).toBeUndefined();
+        }
+    });
+});
+
+describe("audit results — `none`", () => {
+    it("stores no result at all, except the generated identifiers", async () => {
+        (cfg.server as any).audit = { results: "none" };
+
+        const since = new Date();
+        const doc: any = await rest.insertOne(SLUG, { ref: "N-1", total: 1 });
+        expect((await lastActivity("insertOne", since)).operation.result).toEqual({ _id: doc._id });
+
+        let since2 = new Date();
+        await rest.updateMany(SLUG, [doc._id], { $set: { total: 2 } });
+        expect((await lastActivity("updateMany", since2)).operation.result).toBeNull();
+
+        since2 = new Date();
+        await rest.countDocuments(SLUG, {});
+        expect((await lastActivity("countDocuments", since2)).operation.result).toBeNull();
+
+        since2 = new Date();
+        await rest.deleteOne(SLUG, doc._id);
+        expect((await lastActivity("deleteOne", since2)).operation.result).toBeNull();
+    });
+});
+
+describe("audit results — `full`", () => {
+    it("stores the raw result, documents included", async () => {
+        (cfg.server as any).audit = { results: "full" };
+
+        const since = new Date();
+        const doc: any = await rest.insertOne(SLUG, { ref: "F-1", total: 1 });
+        const inserted = await lastActivity("insertOne", since);
+        expect(inserted.operation.result.ref).toBe("F-1");
+
+        const since2 = new Date();
+        await rest.deleteOne(SLUG, doc._id);
+        const deleted = await lastActivity("deleteOne", since2);
+        expect(deleted.operation.result.ref).toBe("F-1"); // the deleted document is kept
+    });
+
+    it("still never stores a result for reads and custom actions", async () => {
+        (cfg.server as any).audit = { results: "full" };
+
+        const since = new Date();
+        await rest.find(SLUG, { $limit: 1 });
+        expect((await lastActivity("find", since)).operation.result).toBeNull();
+    });
+});