@hed-hog/core 0.0.367 → 0.0.368

package/src/user/user.service.ts

@@ -1,6 +1,7 @@
 import { getLocaleText } from '@hed-hog/api-locale';
 import { PaginationService } from '@hed-hog/api-pagination';
 import { PrismaService } from '@hed-hog/api-prisma';
+import type { Prisma, user_change_log } from '@hed-hog/api-prisma';
 import {
     BadRequestException,
     Inject,
@@ -55,6 +56,18 @@ const USER_SORT_FIELDS = [
 
 const USER_SEARCH_FIELDS = ['name'] as const;
 
+type UserChangeLog = user_change_log;
+type UserChangeLogActor = Prisma.userGetPayload<{
+  select: {
+    id: true;
+    name: true;
+    user_identifier: {
+      select: { value: true };
+      take: 1;
+    };
+  };
+}>;
+
 @Injectable()
 export class UserService {
   constructor(
@@ -213,7 +226,12 @@ export class UserService {
     return { user, challenge };
   }
 
-  async update(locale: string, userId: number, { name }: UpdateDTO) {
+  async update(
+    locale: string,
+    userId: number,
+    { name }: UpdateDTO,
+    actorUserId?: number,
+  ) {
     const user = await this.findUserById(locale, userId);
 
     const result = await this.prismaService.user.update({
@@ -221,6 +239,17 @@ export class UserService {
       data: { name: name ?? user.name },
     });
 
+    if (result.name !== user.name) {
+      await this.recordUserChange({
+        targetUserId: userId,
+        actorUserId,
+        action: 'update',
+        summary: `name: "${user.name ?? ''}" → "${result.name ?? ''}"`,
+        beforeData: { name: user.name },
+        afterData: { name: result.name },
+      });
+    }
+
     await this.integrationApi.publishEvent({
       eventName: 'core.user.updated',
       sourceModule: 'core',
@@ -236,6 +265,7 @@ export class UserService {
     locale: string,
     userId: number,
     { password }: ResetPasswordDTO,
+    actorUserId?: number,
   ) {
     await this.validateUserExists(locale, userId);
 
@@ -266,6 +296,13 @@ export class UserService {
 
     await this.registerUserActivity(userId, 'resetPassword');
 
+    await this.recordUserChange({
+      targetUserId: userId,
+      actorUserId,
+      action: 'reset_password',
+      summary: 'Password reset and flagged for required change on next login',
+    });
+
     return {
       password: nextPassword,
       requiresReset: true,
@@ -305,7 +342,12 @@ export class UserService {
   // Avatar Management
   // ==========================================
 
-  async changeAvatar(locale: string, userId: number, avatar: MulterFile) {
+  async changeAvatar(
+    locale: string,
+    userId: number,
+    avatar: MulterFile,
+    actorUserId?: number,
+  ) {
     const user = await this.validateUserExists(locale, userId);
 
     const newFile = await this.file.upload(USER_AVATAR_UPLOAD_DESTINATION, avatar);
@@ -317,6 +359,15 @@ export class UserService {
       data: { photo_id: newFile.id },
     });
 
+    await this.recordUserChange({
+      targetUserId: userId,
+      actorUserId,
+      action: 'avatar_changed',
+      summary: 'Avatar updated',
+      beforeData: { photo_id: user.photo_id },
+      afterData: { photo_id: newFile.id },
+    });
+
     return {
       id: newFile.id,
       path: newFile.path,
@@ -518,8 +569,13 @@ export class UserService {
     }));
   }
 
-  async assignRoleToUser(locale: string, userId: number, roleId: number) {
-    await Promise.all([
+  async assignRoleToUser(
+    locale: string,
+    userId: number,
+    roleId: number,
+    actorUserId?: number,
+  ) {
+    const [, role] = await Promise.all([
       this.validateUserExists(locale, userId),
       this.validateRoleExists(locale, roleId),
     ]);
@@ -530,16 +586,31 @@ export class UserService {
       return existingRoleUser;
     }
 
-    return this.prismaService.role_user.create({
+    const result = await this.prismaService.role_user.create({
       data: {
         user_id: userId,
         role_id: roleId,
       },
     });
+
+    await this.recordUserChange({
+      targetUserId: userId,
+      actorUserId,
+      action: 'role_assigned',
+      summary: `Role assigned: ${role.slug}`,
+      afterData: { role_id: roleId, slug: role.slug },
+    });
+
+    return result;
   }
 
-  async removeRoleFromUser(locale: string, userId: number, roleId: number) {
-    await Promise.all([
+  async removeRoleFromUser(
+    locale: string,
+    userId: number,
+    roleId: number,
+    actorUserId?: number,
+  ) {
+    const [, role] = await Promise.all([
       this.validateUserExists(locale, userId),
       this.validateRoleExists(locale, roleId),
     ]);
@@ -554,6 +625,14 @@ export class UserService {
       where: { id: roleUser.id },
     });
 
+    await this.recordUserChange({
+      targetUserId: userId,
+      actorUserId,
+      action: 'role_removed',
+      summary: `Role removed: ${role.slug}`,
+      beforeData: { role_id: roleId, slug: role.slug },
+    });
+
     return { count: 1 };
   }
 
@@ -574,6 +653,102 @@ export class UserService {
     });
   }
 
+  // ==========================================
+  // Change Log (administrative audit trail)
+  // ==========================================
+
+  private async recordUserChange(data: {
+    targetUserId: number;
+    actorUserId?: number | null;
+    action: string;
+    summary?: string;
+    beforeData?: unknown;
+    afterData?: unknown;
+  }) {
+    return this.prismaService.user_change_log
+      .create({
+        data: {
+          target_user_id: data.targetUserId,
+          actor_user_id: data.actorUserId ?? null,
+          action: data.action,
+          summary: data.summary ?? null,
+          before_data:
+            data.beforeData === undefined
+              ? null
+              : JSON.stringify(data.beforeData),
+          after_data:
+            data.afterData === undefined
+              ? null
+              : JSON.stringify(data.afterData),
+        },
+      })
+      .catch(() => null);
+  }
+
+  async listUserChangeLogs(locale: string, userId: number, paginationParams) {
+    await this.validateUserExists(locale, userId);
+
+    const paginated = await this.paginationService.paginatePrismaModel(
+      this.prismaService.user_change_log,
+      {
+        page: paginationParams?.page,
+        pageSize: paginationParams?.pageSize,
+        sortField: paginationParams?.sortField || 'created_at',
+        sortOrder: paginationParams?.sortOrder || 'desc',
+        validSortFields: ['id', 'created_at', 'action'],
+        where: { target_user_id: userId },
+      },
+    );
+
+    const logs = (paginated.data || []) as UserChangeLog[];
+    const actorIds = [
+      ...new Set(
+        logs
+          .map((log) => log.actor_user_id)
+          .filter((id): id is number => Boolean(id)),
+      ),
+    ];
+
+    const actors: UserChangeLogActor[] = actorIds.length
+      ? await this.prismaService.user.findMany({
+          where: { id: { in: actorIds } },
+          select: {
+            id: true,
+            name: true,
+            user_identifier: {
+              where: { type: IDENTIFIER_TYPE.EMAIL, enabled: true },
+              select: { value: true },
+              take: 1,
+            },
+          },
+        })
+      : [];
+
+    const actorMap = new Map(actors.map((actor) => [actor.id, actor]));
+
+    return {
+      ...paginated,
+      data: logs.map((log) => {
+        const actor = log.actor_user_id
+          ? actorMap.get(log.actor_user_id)
+          : null;
+
+        return {
+          id: String(log.id),
+          actorUserId: log.actor_user_id ? String(log.actor_user_id) : null,
+          actorName: actor?.name ?? null,
+          actorEmail: actor?.user_identifier?.[0]?.value ?? null,
+          action: log.action,
+          summary: log.summary || '',
+          beforeData: log.before_data || '',
+          afterData: log.after_data || '',
+          ipAddress: log.ip_address || '',
+          createdAt: log.created_at?.toISOString?.() || null,
+        };
+      }),
+    };
+  }
+
   // ==========================================
   // Private Helper Methods
   // ==========================================
@@ -761,4 +936,4 @@ export class UserService {
       },
     });
   }
-}
+}