create-windy 0.2.34 → 0.3.1

package/template/apps/server/src/example-modules.ts

@@ -17,6 +17,7 @@ import { createWorkOrderRepository } from "./work-order/repository.js";
 import { createDrizzleWorkOrderRepository } from "./work-order/drizzle-repository.js";
 import { createWorkOrderRouteDefinitions } from "./work-order/routes.js";
 import { WorkOrderSearchProvider } from "./work-order/search-provider.js";
+import { createWorkOrderOpenSearchIndex } from "./work-order/opensearch-index.js";
 import { WorkOrderService } from "./work-order/service.js";
 
 export interface WorkOrderModuleDependencies {
@@ -42,6 +43,7 @@ export interface WorkOrderModule {
  */
 export function createWorkOrderModule(): WorkOrderModule {
   let service: WorkOrderService | undefined;
+  const searchIndex = createWorkOrderOpenSearchIndex(process.env);
   const requireService = () => {
     if (!service) throw new Error("示例工单模块尚未挂载");
     return service;
@@ -52,7 +54,7 @@ export function createWorkOrderModule(): WorkOrderModule {
       requireService().operationalSnapshot(
         platformDataActor("task_work_order_snapshot", "工单运营快照任务"),
       ),
-    searchProvider: new WorkOrderSearchProvider(requireService),
+    searchProvider: new WorkOrderSearchProvider(requireService, searchIndex),
   });
   return {
     ...serverModule,
@@ -67,6 +69,7 @@ export function createWorkOrderModule(): WorkOrderModule {
             ? createDrizzleWorkOrderRepository(dependencies.db)
             : createWorkOrderRepository()),
         dependencies.departments,
+        searchIndex,
       );
     },
   };

package/template/apps/server/src/guards.ts

@@ -1,5 +1,6 @@
 import type {
   ApiPermissionBinding,
+  AuditActor,
   AuditEvent,
   EntitlementKey,
   FeatureFlagDefinition,
@@ -33,6 +34,7 @@ export interface RequestGuardContext {
   actor: RequestActor;
   startedAt: string;
   clientIp?: string;
+  userAgent?: string;
   license?: {
     versionKey?: LicenseVersionKey;
     /** V1 兼容字段。新 License 不再包含 Entitlement。 */
@@ -61,6 +63,7 @@ export interface GuardDecision {
 
 export interface RequestGuardContextOptions {
   clientIp?: string;
+  userAgent?: string;
   resolveActor?: (request: Request) => RequestActor | undefined;
   resolveLicense?: (
     request: Request,
@@ -86,10 +89,24 @@ export function createRequestGuardContext(
     actor: options.resolveActor?.(request) || anonymousActor(),
     startedAt: new Date().toISOString(),
     clientIp: options.clientIp,
+    userAgent: options.userAgent,
     license: options.resolveLicense?.(request),
   };
 }
 
+export function auditActor(
+  context: Pick<RequestGuardContext, "actor" | "clientIp" | "userAgent">,
+): AuditActor {
+  return {
+    id: context.actor.id,
+    type: context.actor.type === "anonymous" ? "user" : context.actor.type,
+    name: context.actor.name,
+    roleCodes: context.actor.roleCodes,
+    ip: context.clientIp,
+    userAgent: context.userAgent,
+  };
+}
+
 export function evaluatePermissionGuard(
   context: RequestGuardContext,
   binding: PermissionGuardRequirement,
@@ -207,11 +224,7 @@ function deniedDecision(
       id: randomUUIDv7(),
       action: "security.denied",
       outcome: "denied",
-      actor: {
-        id: context.actor.id,
-        type: context.actor.type === "anonymous" ? "user" : context.actor.type,
-        name: context.actor.name,
-      },
+      actor: auditActor(context),
       target: {
         type: "guard",
         id: targetId,

package/template/apps/server/src/http/request-source.test.ts

@@ -0,0 +1,85 @@
+import { describe, expect, test } from "bun:test";
+import {
+  requestSourcePolicyFromEnv,
+  resolveRequestSource,
+} from "./request-source.js";
+
+describe("平台请求来源信任边界", () => {
+  test("默认使用直接对端并忽略客户端伪造的转发头", () => {
+    const source = resolveRequestSource(
+      request("203.0.113.66"),
+      "198.51.100.10",
+      requestSourcePolicyFromEnv({}),
+    );
+
+    expect(source).toEqual({
+      clientIp: "198.51.100.10",
+      userAgent: "Windy-Test/1.0",
+    });
+  });
+
+  test("仅显式启用且直接对端受信时采用单一合法转发来源", () => {
+    const policy = requestSourcePolicyFromEnv({
+      WINDY_TRUST_PROXY: "true",
+      WINDY_TRUSTED_PROXY_IPS: "10.0.0.8",
+    });
+
+    expect(
+      resolveRequestSource(request("203.0.113.66"), "::1", policy).clientIp,
+    ).toBe("203.0.113.66");
+    expect(
+      resolveRequestSource(request("203.0.113.67"), "10.0.0.8", policy)
+        .clientIp,
+    ).toBe("203.0.113.67");
+    expect(
+      resolveRequestSource(request("203.0.113.68"), "10.0.0.9", policy)
+        .clientIp,
+    ).toBe("10.0.0.9");
+  });
+
+  test("多段或非法转发来源退回直接对端", () => {
+    const policy = requestSourcePolicyFromEnv({
+      WINDY_TRUST_PROXY: "true",
+    });
+    for (const forwardedFor of [
+      "203.0.113.66, 198.51.100.9",
+      "not-an-ip",
+      "203.0.113.66:443",
+    ]) {
+      expect(
+        resolveRequestSource(request(forwardedFor), "127.0.0.1", policy)
+          .clientIp,
+      ).toBe("127.0.0.1");
+    }
+  });
+
+  test("代理配置默认关闭且错误配置 fail closed", () => {
+    expect(requestSourcePolicyFromEnv({})).toEqual({
+      trustProxy: false,
+      trustedProxyIps: [],
+    });
+    expect(() =>
+      requestSourcePolicyFromEnv({
+        WINDY_TRUSTED_PROXY_IPS: "10.0.0.8",
+      }),
+    ).toThrow("WINDY_TRUST_PROXY=true");
+    expect(() =>
+      requestSourcePolicyFromEnv({ WINDY_TRUST_PROXY: "yes" }),
+    ).toThrow("只允许 true 或 false");
+    expect(() =>
+      requestSourcePolicyFromEnv({
+        WINDY_TRUST_PROXY: "true",
+        WINDY_TRUSTED_PROXY_IPS: "10.0.0.999",
+      }),
+    ).toThrow("无效 IP");
+  });
+});
+
+function request(forwardedFor: string): Request {
+  return new Request("https://windy.example.test/api/system/users", {
+    headers: {
+      "user-agent": "Windy-Test/1.0",
+      "x-forwarded-for": forwardedFor,
+    },
+  });
+}

package/template/apps/server/src/http/request-source.ts

@@ -0,0 +1,90 @@
+import { isIP } from "node:net";
+
+export interface RequestSourcePolicy {
+  trustProxy: boolean;
+  trustedProxyIps: readonly string[];
+}
+
+export interface RequestSource {
+  clientIp?: string;
+  userAgent?: string;
+}
+
+export function requestSourcePolicyFromEnv(
+  env: Record<string, string | undefined>,
+): RequestSourcePolicy {
+  const trustProxy = readBoolean(env.WINDY_TRUST_PROXY);
+  const configuredIps = (env.WINDY_TRUSTED_PROXY_IPS || "")
+    .split(",")
+    .map((value) => value.trim())
+    .filter(Boolean);
+  if (!trustProxy && configuredIps.length) {
+    throw new Error(
+      "配置 WINDY_TRUSTED_PROXY_IPS 时必须显式设置 WINDY_TRUST_PROXY=true",
+    );
+  }
+  return {
+    trustProxy,
+    trustedProxyIps: configuredIps.map((value) => {
+      const normalized = normalizeIp(value);
+      if (!normalized) {
+        throw new Error(`WINDY_TRUSTED_PROXY_IPS 包含无效 IP：${value}`);
+      }
+      return normalized;
+    }),
+  };
+}
+
+export function resolveRequestSource(
+  request: Request,
+  peerIp: string | undefined,
+  policy: RequestSourcePolicy,
+): RequestSource {
+  const normalizedPeerIp = normalizeIp(peerIp);
+  const forwardedIp = resolveForwardedIp(request, normalizedPeerIp, policy);
+  return {
+    clientIp: forwardedIp || normalizedPeerIp,
+    userAgent: normalizeUserAgent(request.headers.get("user-agent")),
+  };
+}
+
+function resolveForwardedIp(
+  request: Request,
+  peerIp: string | undefined,
+  policy: RequestSourcePolicy,
+): string | undefined {
+  if (!policy.trustProxy || !peerIp || !isTrustedProxy(peerIp, policy)) {
+    return undefined;
+  }
+  const header = request.headers.get("x-forwarded-for")?.trim();
+  if (!header || header.includes(",")) return undefined;
+  return normalizeIp(header);
+}
+
+function isTrustedProxy(peerIp: string, policy: RequestSourcePolicy): boolean {
+  if (isLoopback(peerIp)) return true;
+  return policy.trustedProxyIps.some((value) => normalizeIp(value) === peerIp);
+}
+
+function isLoopback(ip: string): boolean {
+  return ip === "::1" || (isIP(ip) === 4 && ip.startsWith("127."));
+}
+
+function normalizeIp(value: string | undefined): string | undefined {
+  const candidate = value?.trim().toLowerCase();
+  if (!candidate) return undefined;
+  const mapped = candidate.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/)?.[1];
+  const normalized = mapped && isIP(mapped) === 4 ? mapped : candidate;
+  return isIP(normalized) ? normalized : undefined;
+}
+
+function normalizeUserAgent(value: string | null): string | undefined {
+  const normalized = value?.trim();
+  return normalized ? normalized.slice(0, 1_024) : undefined;
+}
+
+function readBoolean(value: string | undefined): boolean {
+  if (value === undefined || value === "" || value === "false") return false;
+  if (value === "true") return true;
+  throw new Error("WINDY_TRUST_PROXY 只允许 true 或 false");
+}

package/template/apps/server/src/index.ts

@@ -26,10 +26,7 @@ import { GovernedToolRegistry } from "./agent/tool-registry.js";
 import { PlatformMcpAdapter } from "./mcp/adapter.js";
 import { registerMcpRoutes } from "./mcp/routes.js";
 // @windy-module system.agent end
-import { registerAuthRoutes, registerAuthSessionRoute } from "./auth/routes.js";
 import { createAuthRuntime } from "./auth/runtime.js";
-import { createPlatformHttpApp } from "./http-app.js";
-import { bootstrapAdminPassword } from "./auth/bootstrap-admin.js";
 import { createServerPersistence } from "./persistence.js";
 // @windy-module system.license begin
 import { registerPlatformLicenseRoutes } from "./license/routes.js";
@@ -51,7 +48,6 @@ import { SchedulerWorker } from "./scheduler/worker.js";
 // @windy-module system.settings begin
 import { createPlatformSettingsRuntime } from "./settings/runtime.js";
 // @windy-module system.settings end
-import { registerProfileRoutes } from "./profile/routes.js";
 // @windy-module system.notification begin
 import { registerNotificationRoutes } from "./notification/routes.js";
 // @windy-module system.notification end
@@ -76,11 +72,13 @@ import { createSearchHost } from "./search/host.js";
 // @windy-module system.workflow begin
 import { registerWorkflowRoutes } from "./workflow/routes.js";
 // @windy-module system.workflow end
-import {
-  createPlatformObservability,
-  logPlatformStartup,
-} from "./observability/bootstrap.js";
 import { bootstrapServerModules } from "./module-bootstrap.js";
+import {
+  createHttpObservability,
+  createPlatformServerApp,
+  listenPlatformServer,
+  logServerStartup,
+} from "./platform-http-runtime.js";
 
 const logger = pino({ name: "windy-server" });
 const platformConfig = loadPlatformConfig();
@@ -128,20 +126,17 @@ const runtime = createServerRuntime(process.env, {
   auditWriter: persistence?.auditWriter,
   // @windy-module system.audit end
 });
-const observability = createPlatformObservability({
-  databaseCheck: persistence
-    ? async () => void (await persistence.pool.query("select 1"))
-    : undefined,
-  databaseRequired: process.env.NODE_ENV === "production",
-  auditStatus: () => runtime.auditSink.status(),
-  logger,
-});
+const observability = createHttpObservability(runtime, persistence, logger);
 // @windy-module system.license begin
 platformLicenseRuntime.setAuditSink(runtime.auditSink);
 // @windy-module system.license end
 const { authRepository, authService } = createAuthRuntime({
   repository: persistence?.authRepository,
-  sessionTtlSeconds: platformConfig.security.sessionTtlSeconds,
+  sessionTtlSeconds: () => platformConfig.security.sessionTtlSeconds,
+  passwordPolicy: () => ({
+    minLength: platformConfig.security.passwordMinLength,
+    maxLength: platformConfig.security.passwordMaxLength,
+  }),
   auditWriter: (event) => runtime.auditSink.recordCriticalEvent(event),
   // @windy-module system.audit begin
   auditReader: persistence?.auditReader,
@@ -153,12 +148,17 @@ const storageRuntime = createStorageRuntime(
   persistence?.db,
   moduleHosts.uploadPolicies,
 );
+configurationRuntime.bindStorage(storageRuntime.uploads);
 // @windy-module system.storage end
 // @windy-module system.settings begin
-const platformSettings = createPlatformSettingsRuntime(persistence?.db, {
-  softwareName: platformConfig.name,
-  logoUrl: platformConfig.logoUrl,
-});
+const platformSettings = createPlatformSettingsRuntime(
+  persistence?.db,
+  {
+    softwareName: platformConfig.name,
+    logoUrl: platformConfig.logoUrl,
+  },
+  () => ({ timeZone: platformConfig.regional.timeZone }),
+);
 // @windy-module system.settings end
 // @windy-module system.search begin
 const searchHost = createSearchHost(
@@ -177,6 +177,7 @@ const {
   scheduler,
   taskDefinitions: scheduledTaskDefinitions,
   notifications: notificationRepository,
+  notificationService,
   workflow: workflowService,
   governedExportService,
   durable: durableJobRuntime,
@@ -188,6 +189,7 @@ const {
   storage: storageRuntime,
   moduleTasks: moduleTaskDefinitions,
   bulkRetentionDays: readPositiveInt(process.env.BULK_DATA_RETENTION_DAYS, 7),
+  mailConfig: platformConfig.mail,
   installModuleDurableHandlers: moduleHosts.installDurableHandlers,
 });
 const schedulerWorker = new SchedulerWorker(
@@ -197,20 +199,17 @@ const schedulerWorker = new SchedulerWorker(
   (result) => observability.metrics.observeSchedulerTick(result),
 );
 // @windy-module system.scheduler end
-await bootstrapAdminPassword({
+const app = await createPlatformServerApp({
+  runtime,
+  persistence,
+  platformConfig,
+  authRepository,
   authService,
-  authRepository: persistence?.authRepository,
   repositories: systemRepositories,
-  password: process.env.WINDY_BOOTSTRAP_ADMIN_PASSWORD,
-});
-const app = createPlatformHttpApp(runtime, observability);
-observability.register(app);
-registerAuthSessionRoute(app);
-registerAuthRoutes(app, authService, {
-  sessionCookieName: platformConfig.security.sessionCookieName,
-  secureCookie: process.env.NODE_ENV === "production",
+  features,
+  logger,
+  observability,
 });
-registerProfileRoutes(app, authRepository, runtime, features);
 
 // @windy-module system.license begin
 registerPlatformLicenseRoutes(app, platformLicenseRuntime);
@@ -220,7 +219,13 @@ registerPlatformLicenseRoutes(app, platformLicenseRuntime);
 platformSettings.register(app, runtime, features);
 // @windy-module system.settings end
 // @windy-module system.notification begin
-registerNotificationRoutes(app, notificationRepository, runtime, features);
+registerNotificationRoutes(
+  app,
+  notificationRepository,
+  runtime,
+  features,
+  notificationService,
+);
 // @windy-module system.notification end
 // @windy-module system.workflow begin
 registerWorkflowRoutes(app, workflowService, runtime);
@@ -337,13 +342,8 @@ validateInstalledRuntime({
   hosts: moduleHosts,
 });
 
-const port = process.env.PORT ? Number(process.env.PORT) : 9_747;
-app.listen(port);
+const port = listenPlatformServer(app);
 // @windy-module system.scheduler begin
 schedulerWorker.start();
 // @windy-module system.scheduler end
-logPlatformStartup(logger, {
-  featureSync,
-  persistenceEnabled: Boolean(persistence),
-  port,
-});
+logServerStartup(logger, featureSync, Boolean(persistence), port);

package/template/apps/server/src/license/routes.ts

@@ -52,6 +52,8 @@ export function registerPlatformLicenseRoutes(
       const installed = await licenseRuntime.install(rawLicense, {
         actor: context.guardContext.actor,
         requestId: context.guardContext.requestId,
+        clientIp: context.guardContext.clientIp,
+        userAgent: context.guardContext.userAgent,
       });
       if (installed.result.status === "rejected") {
         return Response.json(

package/template/apps/server/src/license/runtime-service.ts

@@ -17,7 +17,11 @@ import type {
   LicenseFailureReason,
   SignedLicense,
 } from "@southwind-ai/shared";
-import type { RequestActor } from "../guards.js";
+import {
+  auditActor,
+  type RequestActor,
+  type RequestGuardContext,
+} from "../guards.js";
 import type { InMemoryAuditSink } from "../runtime.js";
 import type {
   LicenseEntitlementResolver,
@@ -57,10 +61,10 @@ export interface PlatformLicenseRuntimeOptions {
   now?: () => Date;
 }
 
-export interface LicenseInstallActorContext {
-  actor: RequestActor;
-  requestId: string;
-}
+export type LicenseInstallActorContext = Pick<
+  RequestGuardContext,
+  "actor" | "requestId" | "clientIp" | "userAgent"
+>;
 
 export class PlatformLicenseRuntime implements LicenseEntitlementResolver {
   private readonly stateStorage: LicenseStorage;
@@ -285,12 +289,7 @@ function installAuditEvent(
     id: crypto.randomUUID(),
     action: "license.update",
     outcome: success ? "success" : "failure",
-    actor: {
-      id: context.actor.id,
-      type: "user",
-      name: context.actor.name,
-      roleCodes: context.actor.roleCodes,
-    },
+    actor: auditActor(context),
     target: {
       type: "runtime-license",
       id: result.license?.claims.licenseId || candidate?.claims.licenseId,

package/template/apps/server/src/mcp/adapter.test.ts

@@ -1,6 +1,7 @@
 import { afterEach, describe, expect, test } from "bun:test";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { MCP_API_PATH } from "@southwind-ai/shared";
 import { createFoundationSnapshot, loadSystemModules } from "../foundation.js";
 import { createServerRuntime } from "../runtime.js";
 import { createSystemRepositories } from "../system/seed.js";
@@ -150,7 +151,7 @@ async function connectClient(
   token: string,
 ): Promise<Client> {
   const transport = new StreamableHTTPClientTransport(
-    new URL("http://localhost/api/mcp"),
+    new URL(`http://localhost${MCP_API_PATH}`),
     {
       requestInit: {
         headers: { authorization: `Bearer ${token}` },
@@ -175,7 +176,7 @@ function mcpRequest(token?: string, origin?: string): Request {
   });
   if (token) headers.set("authorization", `Bearer ${token}`);
   if (origin) headers.set("origin", origin);
-  return new Request("http://localhost/api/mcp", {
+  return new Request(`http://localhost${MCP_API_PATH}`, {
     method: "POST",
     headers,
     body: JSON.stringify({

package/template/apps/server/src/mcp/adapter.ts

@@ -10,7 +10,10 @@ import type {
   ModuleToolInput,
   ModuleToolResult,
 } from "@southwind-ai/server-sdk";
-import type { FeatureFlagDefinition } from "@southwind-ai/shared";
+import {
+  MCP_SERVER_INFO,
+  type FeatureFlagDefinition,
+} from "@southwind-ai/shared";
 import { evaluateAccessGuards } from "../access-guards.js";
 import type { RequestGuardContext } from "../guards.js";
 import { findFeature } from "../route-guards.js";
@@ -69,14 +72,11 @@ export class PlatformMcpAdapter {
   }
 
   private createServer(context: RequestGuardContext): Server {
-    const server = new Server(
-      { name: "windy-platform", version: "0.1.0" },
-      {
-        capabilities: { tools: {} },
-        instructions:
-          "仅调用当前账号可见的只读业务工具；权限和数据范围由 Windy 平台逐次校验。",
-      },
-    );
+    const server = new Server(MCP_SERVER_INFO, {
+      capabilities: { tools: {} },
+      instructions:
+        "仅调用当前账号可见的只读业务工具；权限和数据范围由 Windy 平台逐次校验。",
+    });
 
     server.setRequestHandler(ListToolsRequestSchema, async () => ({
       tools: await this.allowedQueryTools(context),

package/template/apps/server/src/mcp/routes.ts

@@ -1,3 +1,4 @@
+import { MCP_ROUTE_PATH } from "@southwind-ai/shared";
 import type { RouteApp } from "../system/routes.js";
 import { PlatformMcpAdapter } from "./adapter.js";
 
@@ -15,7 +16,7 @@ export function registerMcpRoutes(
     const context = rawContext as McpRouteContext;
     return adapter.handle(context.request, context.guardContext, context.body);
   };
-  app.get("/mcp", handle);
-  app.post("/mcp", handle);
-  app.delete("/mcp", handle);
+  app.get(MCP_ROUTE_PATH, handle);
+  app.post(MCP_ROUTE_PATH, handle);
+  app.delete(MCP_ROUTE_PATH, handle);
 }

package/template/apps/server/src/module-bootstrap.ts

@@ -17,7 +17,7 @@ import {
 } from "./module-host.js";
 import type { ServerPersistence } from "./persistence.js";
 // @windy-module system.storage begin
-import { platformUploadPolicies } from "./storage/runtime.js";
+import { createPlatformUploadPolicies } from "./storage/runtime.js";
 // @windy-module system.storage end
 import {
   createSystemRepositories,
@@ -51,7 +51,7 @@ export async function bootstrapServerModules(
     installations: installedBusinessModules,
     baseUploadPolicies: [
       // @windy-module system.storage begin
-      ...platformUploadPolicies,
+      ...createPlatformUploadPolicies(platformConfig),
       // @windy-module system.storage end
     ],
   });

package/template/apps/server/src/module-host/request-context.ts

@@ -15,7 +15,11 @@ import {
 } from "@southwind-ai/server-sdk";
 import type { AuditEvent } from "@southwind-ai/shared";
 import type { ModuleManifest } from "@southwind-ai/modules";
-import type { RequestActor, RequestGuardContext } from "../guards.js";
+import {
+  auditActor,
+  type RequestActor,
+  type RequestGuardContext,
+} from "../guards.js";
 import type { createServerRuntime } from "../runtime.js";
 import { unavailableModuleStoragePort } from "./storage-port.js";
 
@@ -130,11 +134,7 @@ function buildAuditEvent(
     id: randomUUIDv7(),
     action,
     outcome: "success",
-    actor: {
-      id: context.actor.id,
-      type: context.actor.type === "anonymous" ? "user" : context.actor.type,
-      name: context.actor.name,
-    },
+    actor: auditActor(context),
     target: input.target,
     requestId: context.requestId,
     metadata: input.metadata,

package/template/apps/server/src/module-host/storage-scope.ts

@@ -6,7 +6,7 @@ import type {
 } from "@southwind-ai/server-sdk";
 import { evaluateAccessGuards } from "../access-guards.js";
 import { isServerScopeContext } from "../data-access/context.js";
-import type { RequestGuardContext } from "../guards.js";
+import { auditActor, type RequestGuardContext } from "../guards.js";
 import type { createServerRuntime } from "../runtime.js";
 import { findFeature } from "../route-guards.js";
 import type { ModuleStorageScope } from "./storage-port.js";
@@ -73,14 +73,7 @@ function resourceFileEvent(
     id: randomUUIDv7(),
     action: policy.auditAction,
     outcome,
-    actor: {
-      id: input.guardContext.actor.id,
-      type:
-        input.guardContext.actor.type === "anonymous"
-          ? ("user" as const)
-          : input.guardContext.actor.type,
-      name: input.guardContext.actor.name,
-    },
+    actor: auditActor(input.guardContext),
     target: {
       type: request.resourceType,
       id: request.resourceId,

package/template/apps/server/src/module-host/user-directory-port.ts

@@ -8,7 +8,7 @@ import {
 import type { AuditEvent, FeatureFlagDefinition } from "@southwind-ai/shared";
 import { DataScopedResourceService } from "../data-access/scoped-resource.js";
 import { departmentDescendantResolver } from "../data-access/department-tree.js";
-import type { RequestGuardContext } from "../guards.js";
+import { auditActor, type RequestGuardContext } from "../guards.js";
 import { evaluateRouteGuards, findFeature } from "../route-guards.js";
 import type { createServerRuntime } from "../runtime.js";
 import type { SystemRepositories } from "../system/seed.js";
@@ -125,11 +125,7 @@ function queryAuditEvent(
     id: randomUUIDv7(),
     action: auditAction,
     outcome: "success",
-    actor: {
-      id: context.actor.id,
-      type: context.actor.type === "anonymous" ? "user" : context.actor.type,
-      name: context.actor.name,
-    },
+    actor: auditActor(context),
     target: { type: "system.user-directory", id: "enabled-users" },
     requestId: context.requestId,
     metadata: {