auditing

server/src/modules/settings/router.ts

@@ -40,6 +40,5 @@ settingsRouter.put("/company-profile", requirePermissions([permissions.companyWr
     return fail(response, 400, "INVALID_INPUT", "Company settings payload is invalid.");
   }
 
-  return ok(response, await updateActiveCompanyProfile(parsed.data));
+  return ok(response, await updateActiveCompanyProfile(parsed.data, request.authUser?.id));
 });
-

server/src/modules/settings/service.ts

@@ -1,5 +1,6 @@
 import type { CompanyProfileDto, CompanyProfileInput } from "@mrp/shared";
 
+import { logAuditEvent } from "../../lib/audit.js";
 import { prisma } from "../../lib/prisma.js";
 
 type CompanyProfileRecord = Awaited<ReturnType<typeof prisma.companyProfile.findFirstOrThrow>>;
@@ -39,7 +40,7 @@ export async function getActiveCompanyProfile() {
   );
 }
 
-export async function updateActiveCompanyProfile(payload: CompanyProfileInput) {
+export async function updateActiveCompanyProfile(payload: CompanyProfileInput, actorId?: string | null) {
   const current = await prisma.companyProfile.findFirstOrThrow({
     where: { isActive: true },
   });
@@ -67,6 +68,18 @@ export async function updateActiveCompanyProfile(payload: CompanyProfileInput) {
     },
   });
 
+  await logAuditEvent({
+    actorId,
+    entityType: "company-profile",
+    entityId: profile.id,
+    action: "updated",
+    summary: `Updated company profile for ${profile.companyName}.`,
+    metadata: {
+      companyName: profile.companyName,
+      legalName: profile.legalName,
+      logoFileId: profile.logoFileId,
+    },
+  });
+
   return mapCompanyProfile(profile);
 }
-