1.0.13

src/routes/api/notifications/+server.ts

@@ -7,6 +7,7 @@ import {
 	type NotificationEventType
 } from '$lib/server/db';
 import { authorize } from '$lib/server/authorize';
+import { auditNotification } from '$lib/server/audit';
 import type { RequestHandler } from './$types';
 
 export const GET: RequestHandler = async ({ cookies }) => {
@@ -32,7 +33,8 @@ export const GET: RequestHandler = async ({ cookies }) => {
 	}
 };
 
-export const POST: RequestHandler = async ({ request, cookies }) => {
+export const POST: RequestHandler = async (event) => {
+	const { request, cookies } = event;
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('notifications', 'create')) {
 		return json({ error: 'Permission denied' }, { status: 403 });
@@ -73,6 +75,9 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
 			eventTypes: resolvedEventTypes as NotificationEventType[]
 		});
 
+		// Audit log
+		await auditNotification(event, 'create', setting.id, setting.name);
+
 		return json(setting);
 	} catch (error: any) {
 		console.error('Error creating notification setting:', error);

src/routes/api/notifications/[id]/+server.ts

@@ -8,6 +8,8 @@ import {
 	type NotificationEventType
 } from '$lib/server/db';
 import { authorize } from '$lib/server/authorize';
+import { auditNotification } from '$lib/server/audit';
+import { computeAuditDiff } from '$lib/utils/diff';
 import type { RequestHandler } from './$types';
 
 export const GET: RequestHandler = async ({ params, cookies }) => {
@@ -43,7 +45,8 @@ export const GET: RequestHandler = async ({ params, cookies }) => {
 	}
 };
 
-export const PUT: RequestHandler = async ({ params, request, cookies }) => {
+export const PUT: RequestHandler = async (event) => {
+	const { params, request, cookies } = event;
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('notifications', 'edit')) {
 		return json({ error: 'Permission denied' }, { status: 403 });
@@ -94,6 +97,15 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
 			return json({ error: 'Failed to update notification setting' }, { status: 500 });
 		}
 
+		// Compute diff for audit (exclude config to avoid logging sensitive data)
+		const diff = computeAuditDiff(
+			{ name: existing.name, enabled: existing.enabled, eventTypes: existing.eventTypes },
+			{ name: updated.name, enabled: updated.enabled, eventTypes: updated.eventTypes }
+		);
+
+		// Audit log
+		await auditNotification(event, 'update', updated.id, updated.name, diff);
+
 		// Don't expose passwords in response
 		const safeSetting = {
 			...updated,
@@ -110,7 +122,8 @@ export const PUT: RequestHandler = async ({ params, request, cookies }) => {
 	}
 };
 
-export const DELETE: RequestHandler = async ({ params, cookies }) => {
+export const DELETE: RequestHandler = async (event) => {
+	const { params, cookies } = event;
 	const auth = await authorize(cookies);
 	if (auth.authEnabled && !await auth.can('notifications', 'delete')) {
 		return json({ error: 'Permission denied' }, { status: 403 });
@@ -122,11 +135,20 @@ export const DELETE: RequestHandler = async ({ params, cookies }) => {
 			return json({ error: 'Invalid ID' }, { status: 400 });
 		}
 
-		const deleted = await deleteNotificationSetting(id);
-		if (!deleted) {
+		// Get notification name before deletion for audit log
+		const setting = await getNotificationSetting(id);
+		if (!setting) {
 			return json({ error: 'Notification setting not found' }, { status: 404 });
 		}
 
+		const deleted = await deleteNotificationSetting(id);
+		if (!deleted) {
+			return json({ error: 'Failed to delete notification setting' }, { status: 500 });
+		}
+
+		// Audit log
+		await auditNotification(event, 'delete', id, setting.name);
+
 		return json({ success: true });
 	} catch (error) {
 		console.error('Error deleting notification setting:', error);

src/routes/api/notifications/test/+server.ts

@@ -45,11 +45,12 @@ export const POST: RequestHandler = async ({ request, cookies }) => {
 			updatedAt: new Date().toISOString()
 		};
 
-		const success = await testNotification(setting);
+		const result = await testNotification(setting);
 
 		return json({
-			success,
-			message: success ? 'Test notification sent successfully' : 'Failed to send test notification'
+			success: result.success,
+			message: result.success ? 'Test notification sent successfully' : undefined,
+			error: result.error || (result.success ? undefined : 'Failed to send test notification')
 		});
 	} catch (error: any) {
 		console.error('Error testing notification:', error);