feat(core-audit): append-only auditLogs Payload collection

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 16:12:48 +02:00
parent 03e3ef39cd
commit 04c99346c6
2 changed files with 129 additions and 0 deletions
--- a/packages/core-audit/src/audit-logs-collection.ts
+++ b/packages/core-audit/src/audit-logs-collection.ts
@@ -0,0 +1,82 @@
+import type { CollectionConfig } from "payload";
+
+/**
+ * Append-only Payload collection for audit entries. Mounted by core-cms
+ * when this package is scaffolded (manual wiring step printed by generator).
+ *
+ * Access rules:
+ *   - read: admins only
+ *   - create: any authenticated context (filtered upstream by PayloadAuditLog)
+ *   - update: NEVER (compliance requires append-only)
+ *   - delete: admins only (used by the GDPR erasure path with overrideAccess)
+ *
+ * The `update: () => false` rule is the compliance backbone. The erasure
+ * path uses `overrideAccess: true` to bypass for pseudonymization — that's
+ * Payload's documented escape hatch for privileged operations.
+ */
+export const auditLogsCollection: CollectionConfig = {
+  slug: "audit-logs",
+  access: {
+    read: ({ req }) => {
+      const user = req.user as { roles?: string[] } | null | undefined;
+      return Array.isArray(user?.roles) && user.roles.includes("admin");
+    },
+    create: () => true,
+    update: () => false,
+    delete: ({ req }) => {
+      const user = req.user as { roles?: string[] } | null | undefined;
+      return Array.isArray(user?.roles) && user.roles.includes("admin");
+    },
+  },
+  timestamps: true,
+  fields: [
+    // WHO
+    { name: "actorId", type: "text", required: true, index: true },
+    {
+      name: "actorType",
+      type: "select",
+      options: ["user", "system", "service"],
+      required: true,
+    },
+    { name: "actorRoles", type: "json", required: true },
+
+    // WHAT
+    {
+      name: "action",
+      type: "select",
+      options: ["VIEW", "CREATE", "UPDATE", "DELETE", "EXPORT", "PERMISSION_CHANGE"],
+      required: true,
+      index: true,
+    },
+    { name: "resourceType", type: "text", required: true, index: true },
+    { name: "resourceId", type: "text" },
+    { name: "changedFields", type: "json" },
+
+    // SCOPE
+    { name: "scopeFeature", type: "text", required: true, index: true },
+    { name: "scopeEnvironment", type: "text", required: true },
+    { name: "scopeTenant", type: "text", required: true, index: true },
+
+    // WHY
+    { name: "reason", type: "text" },
+    { name: "correlationId", type: "text", index: true },
+    { name: "requestId", type: "text" },
+
+    // FROM
+    { name: "ipTruncated", type: "text", required: true },
+    { name: "userAgent", type: "text", required: true },
+
+    // PII
+    { name: "containsPii", type: "checkbox", required: true },
+    { name: "piiCategories", type: "json" },
+
+    // OUTCOME
+    {
+      name: "outcome",
+      type: "select",
+      options: ["success", "denied", "error"],
+      required: true,
+    },
+    { name: "errorCode", type: "text" },
+  ],
+};