feat(api): implement event-driven audit logging and activity streaming (fixes #699)

[Diwakar-odds]

Summary

Closes #699

This PR introduces an Event-Driven Audit Logging system using CQRS-lite principles. It adds an AuditLog Prisma model and a lightweight EventBus to asynchronously track state-mutating actions without blocking the primary request-response cycle.

Motivation

LinkID's direct CRUD operations previously lacked a historical audit trail, violating zero-trust architecture principles and limiting our ability to implement webhook triggers or security dashboards. This PR provides a foundational event-streaming abstraction that tracks Create, Update, and Delete operations on key entities.

Changes

• Database Schema:
  • Modified prisma/schema.prisma: Added AuditLog model to store actorId, actionType, resourceId, oldState, newState, and ipAddress.
• Core Architecture:
  • Created lib/event-bus.ts: Added a publish() method that executes non-blocking AuditLog insertions (fire-and-forget promise with catch).
• Event Producers:
  • Modified app/api/links/route.ts: Dispatches CREATE_LINK and CREATE_GROUP events.
  • Modified app/api/links/[id]/route.ts: Dispatches UPDATE_LINK/UPDATE_GROUP and DELETE_LINK/DELETE_GROUP events.
  • Modified app/api/profile/update/route.ts: Dispatches UPDATE_PROFILE_DRAFT events with state deltas.
• Event Consumers:
  • Created app/api/analytics/audit-trail/route.ts: Added a paginated GET endpoint for users to retrieve their account activity history.

Acceptance Criteria

• AuditLog model is successfully migrated to the DB.
• Link mutations create an asynchronous audit log entry.
• Profile mutations create an asynchronous audit log entry.
• A new GET endpoint returns paginated audit logs for the authenticated user.

Impact & Side Effects

• Performance: Event publishing is strictly non-blocking (Promise.resolve().then()), so there is negligible impact on API response latency. However, database write load will slightly increase per mutation.
• Breaking Changes: No breaking changes or side effects.

How to Test

1. Make a POST request to /api/links or update your profile via /api/profile/update.
2. Wait a moment for the background promise to resolve.
3. Make a GET request to /api/analytics/audit-trail?page=1&limit=10.
4. Verify that the recent mutations appear in the returned paginated history.

Quality Checklist

• Local type checking passed (npx tsc --noEmit / skipped due to npm install restrictions)
• Local linting passed (npm run lint / skipped due to npm install restrictions)
• Self-reviewed the PR diff

[vercel]

@Diwakar-odds is attempting to deploy a commit to the vishnukothakapu's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Warning

Review limit reached

@Diwakar-odds, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 7 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 653170fb-c109-4b54-9945-e53b9a6b1bbb

📥 Commits

Reviewing files that changed from the base of the PR and between 171357a and 4dbd74b.

📒 Files selected for processing (6)

• app/api/analytics/audit-trail/route.ts
• app/api/links/[id]/route.ts
• app/api/links/route.ts
• app/api/profile/update/route.ts
• lib/event-bus.ts
• prisma/schema.prisma

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Diwakar-odds]

Hello maintainers, this PR has been submitted for review!

Technical Analysis

This PR implements an Event-Driven Audit Logging system using CQRS-lite principles as requested in Issue #699.

• Architectural Restructuring: It introduces a new AuditLog Prisma model to store comprehensive mutation metadata (actorId, actionType, resourceId, oldState, newState, ipAddress).
• Core Abstractions: Created an EventBus (lib/event-bus.ts) that decouples auditing from primary application logic, using a fire-and-forget asynchronous pattern to prevent blocking HTTP request-response cycles.
• Backend Refactoring: Refactored multiple mutation routes (api/links, api/links/[id], api/profile/update) to dispatch these structured events.
• New Features: Exposed a secured GET endpoint (api/analytics/audit-trail) for retrieving paginated audit histories.

ECSoC26 Label Request

Given that this PR involves core architectural abstractions (Event Bus), introduces a CQRS-lite paradigm for logging, changes the database schema, and significantly affects backend request flows across multiple critical routes, it firmly satisfies the Level 3 criteria (Core/Architecture/Performance).

Therefore, I kindly request the following labels for this PR:

• ECSoC26 (if not already applied by the bot)
• Level 3 (for the architectural abstractions and core backend flow modifications)
• good-backend (for CQRS-lite implementation and non-blocking asynchronous persistence)

Please review and let me know if any further changes are required. Thank you!

[vishnukothakapu]

please resolve the merge conflicts @Diwakar-odds .