davepi-plugin-audit 0.1.0 → 0.1.1

package/README.md

@@ -57,7 +57,7 @@ Each row carries these fields (schema declared at boot):
 | `ip`, `userAgent`, `reqId` | Request metadata captured at the producing handler. May be `null` for non-HTTP producers (the MCP tools, internal jobs). |
 | `at`          | Timestamp the row was written (also drives the TTL index). |
 
-The standard `createdAt` / `updatedAt` are also there from the framework's mongoose-timestamp plugin, but `at` is the canonical time-of-event field — it's what the TTL is keyed on, and it's what you sort by when reconstructing a history.
+The standard `createdAt` / `updatedAt` are also there from the framework's built-in `timestamps`, but `at` is the canonical time-of-event field — it's what the TTL is keyed on, and it's what you sort by when reconstructing a history.
 
 ## Reading the audit log
 

package/lib/diff.js

@@ -23,10 +23,24 @@
 
 const jsonpatch = require('fast-json-patch');
 
+/**
+ * JSON-normalise a snapshot before diffing. `fast-json-patch` walks own
+ * enumerable keys, and a `Date` has none — so it sees two different
+ * `Date` instances as equal empty objects and emits no op for a changed
+ * timestamp. Serialising through JSON turns Dates into ISO strings (the
+ * exact shape the snapshots are read back as over REST), so a changed
+ * `updatedAt` / `createdAt` / `deletedAt` is captured as a real
+ * `replace` op and the diff round-trips (`applyPatch(before, diff)` ===
+ * `after`). `null` / `undefined` coerce to `{}` so the patch is a
+ * top-level add/remove series rather than a root-replace.
+ */
+function normalise(snapshot) {
+  if (snapshot === null || snapshot === undefined) return {};
+  return JSON.parse(JSON.stringify(snapshot));
+}
+
 function compare(before, after) {
-  const b = before === null || before === undefined ? {} : before;
-  const a = after === null || after === undefined ? {} : after;
-  return jsonpatch.compare(b, a);
+  return jsonpatch.compare(normalise(before), normalise(after));
 }
 
 module.exports = { compare };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "davepi-plugin-audit",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Immutable append-only audit log for dAvePi. Subscribes to the in-process record event bus and writes one row per CRUD mutation (with before/after, JSON-patch diff, actor, IP, user-agent, and request ID) into an auto-registered `audit` collection that's queryable through the standard REST + GraphQL surface. Admin-only list bypass, no API-level writes, optional TTL retention, redaction, and per-resource allow/deny lists.",
   "license": "ISC",
   "homepage": "https://docs.davepi.dev/features/plugins/",