feat(core-cms): register audit-logs + wire GDPR audit erasure

The audit-logs collection was never registered (record() would throw),
bindAudit/createAuditErasureHook were unused, and DSR cascade-hard never
touched the audit trail (audit finding A6). core-cms now registers the
collection and wires a req-scoped afterDelete erasure hook on users;
bindAllProduction binds the audit log into consent/DSR; cascade-hard
pseudonymizes the subject's audit entries; the action select accepts
the full AuditAction enum so consent/DSR entries pass validation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/core-audit/src/audit-logs-collection.test.ts

@@ -2,17 +2,42 @@ import { describe, it, expect } from "vitest";
 import { auditLogsCollection } from "./audit-logs-collection";
 
 describe("auditLogsCollection", () => {
+  it("accepts every AuditAction enum value (A6)", () => {
+    const action = (
+      auditLogsCollection.fields as Array<{ name: string; options?: string[] }>
+    ).find((f) => f.name === "action");
+    expect(action?.options).toEqual(
+      expect.arrayContaining([
+        "VIEW",
+        "CREATE",
+        "UPDATE",
+        "DELETE",
+        "EXPORT",
+        "PERMISSION_CHANGE",
+        "CONSENT_GRANT",
+        "CONSENT_WITHDRAW",
+        "RESTRICT",
+        "UNRESTRICT",
+      ]),
+    );
+  });
+
   it("uses slug 'audit-logs'", () => {
     expect(auditLogsCollection.slug).toBe("audit-logs");
   });
 
   it("is append-only (update: () => false)", () => {
-    const access = auditLogsCollection.access as Record<string, (() => boolean) | undefined>;
+    const access = auditLogsCollection.access as Record<
+      string,
+      (() => boolean) | undefined
+    >;
     expect(access["update"]?.()).toBe(false);
   });
 
   it("has the required fields", () => {
-    const fieldNames = (auditLogsCollection.fields as Array<{ name: string }>).map((f) => f.name);
+    const fieldNames = (
+      auditLogsCollection.fields as Array<{ name: string }>
+    ).map((f) => f.name);
     // WHO
     expect(fieldNames).toContain("actorId");
     expect(fieldNames).toContain("actorType");

packages/core-audit/src/audit-logs-collection.ts

@@ -44,7 +44,21 @@ export const auditLogsCollection: CollectionConfig = {
     {
       name: "action",
       type: "select",
-      options: ["VIEW", "CREATE", "UPDATE", "DELETE", "EXPORT", "PERMISSION_CHANGE"],
+      // Mirrors the AuditAction enum in @repo/core-shared/audit — the DSR and
+      // consent cores record RESTRICT/UNRESTRICT/CONSENT_* entries, so the
+      // select must accept every enum value or record() fails validation (A6).
+      options: [
+        "VIEW",
+        "CREATE",
+        "UPDATE",
+        "DELETE",
+        "EXPORT",
+        "PERMISSION_CHANGE",
+        "CONSENT_GRANT",
+        "CONSENT_WITHDRAW",
+        "RESTRICT",
+        "UNRESTRICT",
+      ],
       required: true,
       index: true,
     },

packages/core-audit/src/hooks/audit-erasure-hook.test.ts

@@ -1,5 +1,8 @@
 import { describe, it, expect, vi } from "vitest";
-import { createAuditErasureHook } from "./audit-erasure-hook";
+import {
+  createAuditErasureHook,
+  createReqScopedAuditErasureHook,
+} from "./audit-erasure-hook";
 import type { IAuditLog } from "../audit-log.interface";
 
 function makeAuditLog(): IAuditLog {
@@ -25,7 +28,10 @@ describe("createAuditErasureHook", () => {
     const auditLog = makeAuditLog();
     const hook = createAuditErasureHook({ auditLog });
     await hook(hookArgs("user_1") as never);
-    expect(auditLog.eraseSubject).toHaveBeenCalledWith("user_1", "pseudonymize");
+    expect(auditLog.eraseSubject).toHaveBeenCalledWith(
+      "user_1",
+      "pseudonymize",
+    );
   });
 
   it("respects explicit mode='delete'", async () => {
@@ -63,3 +69,78 @@ describe("createAuditErasureHook", () => {
     expect(auditLog.eraseSubject).not.toHaveBeenCalled();
   });
 });
+
+describe("createReqScopedAuditErasureHook (A6)", () => {
+  function makeReqPayload(withAuditCollection: boolean) {
+    const find = vi.fn().mockResolvedValue({ docs: [{ id: "log-1" }] });
+    const update = vi.fn().mockResolvedValue({});
+    const del = vi.fn().mockResolvedValue({});
+    const payload = {
+      config: {
+        collections: withAuditCollection ? [{ slug: "audit-logs" }] : [],
+      },
+      find,
+      update,
+      delete: del,
+    };
+    return { payload, find, update, del };
+  }
+
+  function reqHookArgs(id: unknown, payload: unknown) {
+    return {
+      doc: { id },
+      req: { payload } as never,
+      id: String(id),
+      collection: {} as never,
+      context: {},
+    };
+  }
+
+  it("pseudonymizes the deleted subject's audit entries via req.payload", async () => {
+    const { payload, find, update } = makeReqPayload(true);
+    const hook = createReqScopedAuditErasureHook();
+    await hook(reqHookArgs("user_1", payload) as never);
+
+    expect(find).toHaveBeenCalledWith(
+      expect.objectContaining({
+        collection: "audit-logs",
+        where: { actorId: { equals: "user_1" } },
+      }),
+    );
+    expect(update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        collection: "audit-logs",
+        id: "log-1",
+        data: { actorId: expect.stringMatching(/^erased-/) },
+      }),
+    );
+  });
+
+  it("respects mode='delete'", async () => {
+    const { payload, del } = makeReqPayload(true);
+    const hook = createReqScopedAuditErasureHook({ mode: "delete" });
+    await hook(reqHookArgs("user_2", payload) as never);
+    expect(del).toHaveBeenCalledWith(
+      expect.objectContaining({
+        collection: "audit-logs",
+        where: { actorId: { equals: "user_2" } },
+      }),
+    );
+  });
+
+  it("no-ops when the audit-logs collection is not registered", async () => {
+    const { payload, find, update, del } = makeReqPayload(false);
+    const hook = createReqScopedAuditErasureHook();
+    await hook(reqHookArgs("user_1", payload) as never);
+    expect(find).not.toHaveBeenCalled();
+    expect(update).not.toHaveBeenCalled();
+    expect(del).not.toHaveBeenCalled();
+  });
+
+  it("skips invalid doc ids", async () => {
+    const { payload, find } = makeReqPayload(true);
+    const hook = createReqScopedAuditErasureHook();
+    await hook(reqHookArgs(undefined, payload) as never);
+    expect(find).not.toHaveBeenCalled();
+  });
+});

packages/core-audit/src/hooks/audit-erasure-hook.ts

@@ -1,5 +1,6 @@
 import type { CollectionAfterDeleteHook } from "payload";
 import type { IAuditLog } from "../audit-log.interface";
+import { PayloadAuditLog } from "../payload-audit-log";
 
 export type AuditErasureHookOpts = {
   /** The audit log impl that will perform the erasure. */
@@ -36,3 +37,35 @@ export function createAuditErasureHook(
     }
   };
 }
+
+export type ReqScopedAuditErasureHookOpts = {
+  /** Erasure mode — see AuditErasureHookOpts. Defaults to "pseudonymize". */
+  mode?: "pseudonymize" | "delete";
+};
+
+/**
+ * Variant of `createAuditErasureHook` for config-composition time (audit
+ * finding A6): a Payload collection config is built before any `IAuditLog`
+ * can exist (binding the audit log needs the built config), so this hook
+ * constructs a `PayloadAuditLog` lazily from the running instance on
+ * `req.payload` when the delete fires. No-ops when the `audit-logs`
+ * collection is not registered.
+ */
+export function createReqScopedAuditErasureHook(
+  opts: ReqScopedAuditErasureHookOpts = {},
+): CollectionAfterDeleteHook {
+  const mode = opts.mode ?? "pseudonymize";
+  return async ({ doc, req }) => {
+    if (typeof doc.id !== "string" && typeof doc.id !== "number") return;
+    const payload = req.payload;
+    const hasAuditCollection = payload.config.collections?.some(
+      (c) => c.slug === "audit-logs",
+    );
+    if (!hasAuditCollection) return;
+    const auditLog = new PayloadAuditLog(
+      payload.config,
+      async () => payload as never,
+    );
+    await auditLog.eraseSubject(String(doc.id), mode);
+  };
+}

packages/core-audit/src/hooks/index.ts

@@ -1,6 +1,8 @@
 export {
   createAuditErasureHook,
+  createReqScopedAuditErasureHook,
   type AuditErasureHookOpts,
+  type ReqScopedAuditErasureHookOpts,
 } from "./audit-erasure-hook";
 export {
   createAuditAfterReadHook,

packages/core-audit/src/index.ts

@@ -16,7 +16,9 @@ export { AUDIT_SYMBOLS } from "./di/symbols";
 export { pseudonymize } from "./pseudonymize";
 export {
   createAuditErasureHook,
+  createReqScopedAuditErasureHook,
   type AuditErasureHookOpts,
+  type ReqScopedAuditErasureHookOpts,
 } from "./hooks/audit-erasure-hook";
 // VIEW capture
 export { createAuditAfterReadHook, type AuditAfterReadHookOpts } from "./hooks";