1.0.13

src/routes/api/config-sets/+server.ts

@@ -2,6 +2,7 @@ import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { getConfigSets, createConfigSet } from '$lib/server/db';
 import { authorize } from '$lib/server/authorize';
+import { auditConfigSet } from '$lib/server/audit';
 
 export const GET: RequestHandler = async ({ cookies }) => {
 	const auth = await authorize(cookies);
@@ -18,7 +19,8 @@ export const GET: RequestHandler = async ({ cookies }) => {
 	}
 };
 
-export const POST: RequestHandler = async ({ request, cookies }) => {
+export const POST: RequestHandler = async (event) => {
+	const { request, cookies } = event;
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('configsets', 'create')) {
 		return json({ error: 'Permission denied' }, { status: 403 });
@@ -42,6 +44,9 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
 			restartPolicy: body.restartPolicy || 'no'
 		});
 
+		// Audit log
+		await auditConfigSet(event, 'create', configSet.id, configSet.name);
+
 		return json(configSet, { status: 201 });
 	} catch (error: any) {
 		console.error('Failed to create config set:', error);

src/routes/api/config-sets/[id]/+server.ts

@@ -2,6 +2,8 @@ import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { getConfigSet, updateConfigSet, deleteConfigSet } from '$lib/server/db';
 import { authorize } from '$lib/server/authorize';
+import { auditConfigSet } from '$lib/server/audit';
+import { computeAuditDiff } from '$lib/utils/diff';
 
 export const GET: RequestHandler = async ({ params, cookies }) => {
 	const auth = await authorize(cookies);
@@ -27,7 +29,8 @@ export const GET: RequestHandler = async ({ params, cookies }) => {
 	}
 };
 
-export const PUT: RequestHandler = async ({ params, request, cookies }) => {
+export const PUT: RequestHandler = async (event) => {
+	const { params, request, cookies } = event;
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('configsets', 'edit')) {
 		return json({ error: 'Permission denied' }, { status: 403 });
@@ -39,6 +42,12 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
 			return json({ error: 'Invalid ID' }, { status: 400 });
 		}
 
+		// Get old values before update for diff
+		const oldConfigSet = await getConfigSet(id);
+		if (!oldConfigSet) {
+			return json({ error: 'Config set not found' }, { status: 404 });
+		}
+
 		const body = await request.json();
 
 		const configSet = await updateConfigSet(id, {
@@ -56,6 +65,12 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
 			return json({ error: 'Config set not found' }, { status: 404 });
 		}
 
+		// Compute diff for audit
+		const diff = computeAuditDiff(oldConfigSet, configSet);
+
+		// Audit log
+		await auditConfigSet(event, 'update', configSet.id, configSet.name, diff);
+
 		return json(configSet);
 	} catch (error: any) {
 		console.error('Failed to update config set:', error);
@@ -66,7 +81,8 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
 	}
 };
 
-export const DELETE: RequestHandler = async ({ params, cookies }) => {
+export const DELETE: RequestHandler = async (event) => {
+	const { params, cookies } = event;
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('configsets', 'delete')) {
 		return json({ error: 'Permission denied' }, { status: 403 });
@@ -78,11 +94,20 @@ export const DELETE: RequestHandler = async ({ params, cookies }) => {
 			return json({ error: 'Invalid ID' }, { status: 400 });
 		}
 
-		const deleted = await deleteConfigSet(id);
-		if (!deleted) {
+		// Get config set name before deletion for audit log
+		const configSet = await getConfigSet(id);
+		if (!configSet) {
 			return json({ error: 'Config set not found' }, { status: 404 });
 		}
 
+		const deleted = await deleteConfigSet(id);
+		if (!deleted) {
+			return json({ error: 'Failed to delete config set' }, { status: 500 });
+		}
+
+		// Audit log
+		await auditConfigSet(event, 'delete', id, configSet.name);
+
 		return json({ success: true });
 	} catch (error) {
 		console.error('Failed to delete config set:', error);