feat(ee): add enterprise audit logs settings page by waleedlatif1 · Pull Request #4111 · simstudioai/sim

waleedlatif1 · 2026-04-11T18:28:11Z

Summary

Add enterprise audit logs settings page with server-side search, resource type filtering, date range selection, and cursor-based pagination
Extract shared query logic (buildFilterConditions, buildOrgScopeCondition, queryAuditLogs) into a reusable module used by all 3 audit log API routes
Gate the feature behind requiresHosted + requiresEnterprise navigation flags, with all enterprise code in ee/audit-logs/

Test plan

Verify audit logs page appears only for enterprise users
Test server-side search across action, actor email/name, resource name, description
Test resource type and date range filters
Test cursor-based pagination (load more button)
Verify existing v1 and admin audit log API routes still work correctly after refactor
Verify expandable row details show resource, actor, description, and metadata

…arch Add a new audit logs page under enterprise settings that displays all actions captured via recordAudit. Includes server-side search, resource type filtering, date range selection, and cursor-based pagination. - Add internal API route (app/api/audit-logs) with session auth - Extract shared query logic (buildFilterConditions, buildOrgScopeCondition, queryAuditLogs) into app/api/v1/audit-logs/query.ts - Refactor v1 and admin audit log routes to use shared query module - Add React Query hook with useInfiniteQuery and cursor pagination - Add audit logs UI with debounced search, combobox filters, expandable rows - Gate behind requiresHosted + requiresEnterprise navigation flags - Place all enterprise audit log code in ee/audit-logs/ Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vercel · 2026-04-11T18:28:17Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 11, 2026 10:04pm

cursor · 2026-04-11T18:28:20Z

PR Summary

Medium Risk
Adds a new enterprise-facing audit log browsing surface and refactors audit-log querying/pagination used by multiple routes; mistakes could expose or omit audit events or degrade query performance.

Overview
Adds an Enterprise Audit Logs settings section (gated behind hosted + enterprise) with a client UI that supports server-side search, resource-type filtering, date range filtering, refresh, expandable row details, and cursor-based “load more” pagination.

Introduces a new /api/audit-logs route and extracts shared audit-log querying utilities into api/v1/audit-logs/query.ts (filters, org scoping including departed members, and cursor pagination), then refactors the existing v1 and admin audit-log endpoints to use this shared logic.

Broadly enhances audit event coverage/consistency by adding missing audit records (e.g., password reset requested, BYOK key updated, schedule created/deleted, workspace updated, env var deleted) and enriching many existing recordAudit calls with clearer descriptions, resourceId/resourceName, and more detailed metadata.

^{Reviewed by Cursor Bugbot for commit 4a996f4. Configure here.}

greptile-apps · 2026-04-11T18:32:12Z

Greptile Summary

This PR adds an enterprise audit logs settings page with server-side search, resource type filtering, date range selection, and cursor-based pagination, behind requiresHosted + requiresEnterprise guards. It also extracts shared query logic (buildFilterConditions, buildOrgScopeCondition, queryAuditLogs) into app/api/v1/audit-logs/query.ts reused across all three audit log routes, and backfills several previously missing audit events (CREDENTIAL_CREATED, CREDENTIAL_UPDATED, ENVIRONMENT_DELETED, BYOK_KEY_UPDATED, PASSWORD_RESET_REQUESTED, etc.).

Confidence Score: 5/5

Safe to merge — all prior P0/P1 concerns are resolved and only minor style suggestions remain.

Previously flagged issues (empty orgMemberIds crash, debounce no-op on mount) have both been addressed. The shared query module is clean, auth gating is consistent with other internal routes, and the infinite-query hook follows project conventions. The two remaining comments are P2 TypeScript hygiene and a future UX edge case for endDate that doesn't affect the current UI.

No files require special attention.

Important Files Changed

Filename	Overview
apps/sim/app/api/audit-logs/route.ts	New session-authed internal GET endpoint for the enterprise audit logs UI; delegates to shared query helpers.
apps/sim/app/api/v1/audit-logs/query.ts	New shared module with buildFilterConditions, buildOrgScopeCondition (with empty-array guard), and queryAuditLogs; cursor encoding/decoding moved here from the v1 route.
apps/sim/ee/audit-logs/components/audit-logs.tsx	Main enterprise audit logs UI with debounced search, resource-type/date-range filters, infinite scroll, and expandable row details; minor TypeScript cast concern on metadata rendering.
apps/sim/ee/audit-logs/hooks/audit-logs.ts	Correctly uses useInfiniteQuery with signal forwarding, staleTime, keepPreviousData on a variable key, and hierarchical query key factory.
apps/sim/lib/audit/types.ts	New file extracting AuditAction/AuditResourceType constants from log.ts; adds several previously missing actions.
apps/sim/app/workspace/[workspaceId]/settings/navigation.ts	Adds the audit-logs section gated behind requiresHosted + requiresEnterprise flags.
apps/sim/app/api/workspaces/[id]/environment/route.ts	Adds ENVIRONMENT_DELETED audit call on key deletion; correctly logs remaining key count.
apps/sim/ee/audit-logs/constants.ts	Generates resource type dropdown options from AuditResourceType enum with acronym and override handling.

Sequence Diagram

sequenceDiagram
    participant UI as AuditLogs Component
    participant Hook as useAuditLogs
    participant Route as /api/audit-logs GET
    participant Auth as validateEnterpriseAuditAccess
    participant Query as query.ts
    participant DB as Database

    UI->>Hook: filters change
    Hook->>Route: fetch with search params
    Route->>Auth: check session + enterprise membership
    Auth-->>Route: orgMemberIds
    Route->>Query: buildOrgScopeCondition
    Query->>DB: workspace lookup (if includeDeparted)
    DB-->>Query: workspace ids
    Query-->>Route: scope SQL
    Route->>Query: buildFilterConditions
    Query-->>Route: filter conditions
    Route->>Query: queryAuditLogs(conditions, limit, cursor)
    Query->>DB: SELECT with AND conditions, cursor pagination
    DB-->>Query: rows
    Query-->>Route: data and nextCursor
    Route-->>Hook: JSON response
    Hook-->>UI: pages for infinite scroll

_{Reviews (7): Last reviewed commit: "fix(audit-logs): fix OAuth label display..." | Re-trigger Greptile}

apps/sim/app/api/audit-logs/route.ts

apps/sim/app/api/v1/audit-logs/query.ts

apps/sim/ee/audit-logs/components/audit-logs.tsx

- Fix import path: @/lib/utils → @/lib/core/utils/cn - Guard against empty orgMemberIds array in buildOrgScopeCondition - Skip debounce effect on mount when search is already synced Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-11T18:43:23Z

@greptile

waleedlatif1 · 2026-04-11T18:43:26Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 36a1aa4. Configure here.}

Use ternary instead of && chain to prevent unknown type from being returned as ReactNode. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-11T18:52:57Z

@greptile

waleedlatif1 · 2026-04-11T18:53:01Z

@cursor review

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/sim/app/api/v1/audit-logs/query.ts

- Add PASSWORD_RESET_REQUESTED audit on forget-password with user lookup - Add CREDENTIAL_CREATED/UPDATED/DELETED audit on credential CRUD routes with metadata (credentialType, providerId, updatedFields, envKey) - Add SCHEDULE_CREATED audit on schedule creation with cron/timezone metadata - Fix SCHEDULE_DELETED (was incorrectly using SCHEDULE_UPDATED for deletes) - Enhance existing schedule update/disable/reactivate audit with structured metadata (operation, updatedFields, sourceType, previousStatus) - Add CREDENTIAL resource type and Credential filter option to audit logs UI - Enhance password reset completed description with user email Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Add actorName/actorEmail to all new credential and schedule audit calls to match the established pattern (e.g., api-keys, byok-keys, knowledge) - Add resourceId and resourceName to forget-password audit call - Enhance forget-password description with user email Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…ype entries Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Instead of maintaining a separate hardcoded list, the filter dropdown now derives its options directly from the AuditResourceType const object. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

- Move resource type filter options to ee/audit-logs/constants.ts (derived from AuditResourceType, no separate list to maintain) - Remove export from internal cursor helpers in query.ts - Add 5 new AuditAction entries: BYOK_KEY_UPDATED, ENVIRONMENT_DELETED, INVITATION_RESENT, WORKSPACE_UPDATED, ORG_INVITATION_RESENT - Enrich ~80 recordAudit calls across the codebase with structured metadata (knowledge bases, connectors, documents, workspaces, members, invitations, workflows, deployments, templates, MCP servers, credential sets, organizations, permission groups, files, tables, notifications, copilot operations) - Sync audit mock with all new entries Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

…dit fields Remove metadata entries that duplicate resourceName, workspaceId, or other top-level recordAudit fields. Also remove noisy fileNames arrays from bulk document upload audits (kept fileCount). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Extract AuditAction, AuditResourceType, and their types into lib/audit/types.ts (client-safe, no @sim/db dependency). The server-only recordAudit stays in log.ts and re-exports the types for backwards compatibility. constants.ts now imports from types.ts directly, breaking the postgres -> tls client bundle chain. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-11T20:51:31Z

@greptile

waleedlatif1 · 2026-04-11T20:51:35Z

@cursor review

apps/sim/app/api/knowledge/[id]/documents/route.ts

apps/sim/app/api/v1/audit-logs/query.ts

Escape %, _, and \ characters in the search parameter before embedding in the LIKE pattern to prevent unintended broad matches. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-11T21:37:36Z

@greptile

waleedlatif1 · 2026-04-11T21:37:40Z

@cursor review

apps/sim/app/api/workspaces/[id]/api-keys/route.ts

The description was using keys.length (requested count) instead of deletedCount (actual count), which could differ if some keys didn't exist. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-11T21:57:30Z

@greptile

waleedlatif1 · 2026-04-11T21:57:34Z

@cursor review

apps/sim/ee/audit-logs/constants.ts

…down ACRONYMS set stored 'OAuth' but lookup used toUpperCase() producing 'OAUTH' which never matched. Now store all acronyms uppercase and use a display override map for special casing like OAuth. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

waleedlatif1 · 2026-04-11T22:04:34Z

@greptile

waleedlatif1 · 2026-04-11T22:04:37Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4a996f4. Configure here.}

lint

1d13c4d

greptile-apps bot reviewed Apr 11, 2026

View reviewed changes

apps/sim/app/api/audit-logs/route.ts Show resolved Hide resolved

apps/sim/app/api/v1/audit-logs/query.ts Show resolved Hide resolved

apps/sim/ee/audit-logs/components/audit-logs.tsx Show resolved Hide resolved

vercel bot deployed to Preview April 11, 2026 18:33 View deployment

vercel bot temporarily deployed to Preview April 11, 2026 18:41 Inactive

lint

36a1aa4

vercel bot temporarily deployed to Preview April 11, 2026 18:43 Inactive

cursor bot reviewed Apr 11, 2026

View reviewed changes

fix(ee): fix type error with unknown metadata in JSX expression

b9ea27d

Use ternary instead of && chain to prevent unknown type from being returned as ReactNode. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vercel bot temporarily deployed to Preview April 11, 2026 18:52 Inactive

fix(ee): align skeleton filter width with actual component layout

01dfe81

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vercel bot temporarily deployed to Preview April 11, 2026 18:54 Inactive

lint

bc4788a

vercel bot temporarily deployed to Preview April 11, 2026 18:56 Inactive

cursor bot reviewed Apr 11, 2026

View reviewed changes

apps/sim/app/api/v1/audit-logs/query.ts Show resolved Hide resolved

vercel bot temporarily deployed to Preview April 11, 2026 19:11 Inactive

vercel bot temporarily deployed to Preview April 11, 2026 19:15 Inactive

fix(testing): sync audit mock with new AuditAction and AuditResourceT…

e0ab844

…ype entries Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vercel bot temporarily deployed to Preview April 11, 2026 19:20 Inactive

refactor(audit-logs): derive resource type filter from AuditResourceType

6c2495b

Instead of maintaining a separate hardcoded list, the filter dropdown now derives its options directly from the AuditResourceType const object. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vercel bot temporarily deployed to Preview April 11, 2026 19:25 Inactive

vercel bot temporarily deployed to Preview April 11, 2026 19:40 Inactive

vercel bot temporarily deployed to Preview April 11, 2026 20:25 Inactive

vercel bot temporarily deployed to Preview April 11, 2026 20:28 Inactive

cursor bot reviewed Apr 11, 2026

View reviewed changes

apps/sim/app/api/knowledge/[id]/documents/route.ts Show resolved Hide resolved

apps/sim/app/api/v1/audit-logs/query.ts Show resolved Hide resolved

fix(audit): escape LIKE wildcards in audit log search query

6f60475

Escape %, _, and \ characters in the search parameter before embedding in the LIKE pattern to prevent unintended broad matches. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vercel bot temporarily deployed to Preview April 11, 2026 21:09 Inactive

cursor bot reviewed Apr 11, 2026

View reviewed changes

apps/sim/app/api/workspaces/[id]/api-keys/route.ts Show resolved Hide resolved

fix(audit): use actual deletedCount in bulk API key revoke description

bb514a6

The description was using keys.length (requested count) instead of deletedCount (actual count), which could differ if some keys didn't exist. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vercel bot temporarily deployed to Preview April 11, 2026 21:57 Inactive

cursor bot reviewed Apr 11, 2026

View reviewed changes

apps/sim/ee/audit-logs/constants.ts Outdated Show resolved Hide resolved

vercel bot temporarily deployed to Preview April 11, 2026 22:04 Inactive

cursor bot reviewed Apr 11, 2026

View reviewed changes

Conversation

waleedlatif1 commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

vercel bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

waleedlatif1 commented Apr 11, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

waleedlatif1 commented Apr 11, 2026 •

edited

Loading

vercel bot commented Apr 11, 2026 •

edited

Loading

cursor bot commented Apr 11, 2026 •

edited

Loading

greptile-apps bot commented Apr 11, 2026 •

edited

Loading