Expand activity log coverage for public updates and operational audits #879

New issue

Open

opened 2026-08-04 11:07:02 -05:00 by Codex · 0 comments

Codex commented

2026-08-04 11:07:02 -05:00

Member

Copy link

MyVideoGameList currently writes selected public gamer updates and a small set of admin records to activity_log, but many consequential state changes are not captured. The table should remain the common store while making the public feed and staff-only operational audit streams explicit, safe, and testable.

Scope

Keep gamer_updates exclusively for public, visibility-safe community activity; preserve the existing registration, game-list status, favorite/wishlist, public-blog, and public-comment events.
Add staff-only audit streams: admin, account, billing, and moderation; ensure the public feed continues querying only gamer_updates.
Record safe, stable events for self-service account lifecycle: profile and media changes, password change/reset, email-verification state, privacy changes, and self-service account deletion.
Record staff audit events for friendship changes, gamer-tag and console-list updates, game-request submission and resolution, blog visibility/deletion, and content-flag creation and moderation transitions.
Enrich existing admin game, user, user-media, and game-request records with action-specific metadata, changed field names, and safe resource identifiers.
Record donation checkout initiated/completed/cancelled/failed and Stripe subscription created/updated/cancelled transitions. Webhook records must use a system actor.
Establish one event contract: named stream, stable event name, actor and subject when available, outcome, timestamp, correlation-safe identifiers, and minimal safe metadata.
Never record passwords, reset tokens, API keys, email values, payment details, raw Stripe payloads, IP addresses, or private/free-text content.
Add a composite (log_name, created_at) index if query analysis confirms it is needed for the public-feed and staff-audit queries.

Acceptance Criteria

Public activity remains limited to gamer_updates; account, billing, moderation, security, and private-content records never appear in the public feed.
Existing public activity types retain their current visibility and rendering behavior.
Account lifecycle actions create staff-only records with stable event names, actor/subject relationships, outcomes, and safe metadata.
Friendship, gamer-tag, console-list, game-request, blog lifecycle, and content-moderation actions create staff-only records when their state changes.
Administrative game, user, media, and game-request events identify the action and safe changed-field/resource context without persisting values that may be sensitive.
Donation and subscription lifecycle events record their outcome without storing raw payment or webhook data; webhook-originated events are identifiable as system actions.
Repeated no-op actions and duplicate webhook delivery do not produce misleading duplicate activity records.
Staff audit views can filter by stream, event, actor, and subject.
The existing 365-day cleanup policy remains unchanged in this issue.

Test Coverage Required

Pest feature coverage for one representative success, no-op/duplicate, and failure or cancellation case for each account, social/content, moderation, and billing lifecycle group.
Regression tests proving the public feed includes only permitted gamer_updates records and excludes every staff-only stream.
Assertions that audit records contain required safe identifiers and changed field names, but exclude passwords, tokens, email values, payment data, raw payloads, IPs, and private/free-text content.
Coverage for authenticated actors, webhook/system actors, soft-deleted subjects, and staff authorization for audit filtering/views.
Focused affected tests, vendor/bin/pint --dirty --format agent, and composer stan before closeout.

Progress Checklist

activity_log migration and Spatie activity-log configuration exist
Public gamer_updates feed and visibility filtering exist
Initial admin game, user, media, and game-request activity records exist
Public registration, game-list, favorite/wishlist, blog, and comment activity exists
Define shared safe event contract and stream taxonomy
Add account lifecycle audit events
Add friendship, gamer-tag, console-list, game-request, and blog lifecycle audit events
Integrate content-flag moderation transitions after the flagging feature lands
Enrich existing administrative activity metadata
Add donation and subscription lifecycle audit events with system actor handling
Add staff audit filtering and evaluate the composite activity-log index
Add public-feed isolation, privacy-redaction, lifecycle, no-op, webhook, and authorization tests
Verify no sensitive, private, or raw external payload data is persisted

MyVideoGameList currently writes selected public gamer updates and a small set of admin records to `activity_log`, but many consequential state changes are not captured. The table should remain the common store while making the public feed and staff-only operational audit streams explicit, safe, and testable. ## Scope - Keep `gamer_updates` exclusively for public, visibility-safe community activity; preserve the existing registration, game-list status, favorite/wishlist, public-blog, and public-comment events. - Add staff-only audit streams: `admin`, `account`, `billing`, and `moderation`; ensure the public feed continues querying only `gamer_updates`. - Record safe, stable events for self-service account lifecycle: profile and media changes, password change/reset, email-verification state, privacy changes, and self-service account deletion. - Record staff audit events for friendship changes, gamer-tag and console-list updates, game-request submission and resolution, blog visibility/deletion, and content-flag creation and moderation transitions. - Enrich existing admin game, user, user-media, and game-request records with action-specific metadata, changed field names, and safe resource identifiers. - Record donation checkout initiated/completed/cancelled/failed and Stripe subscription created/updated/cancelled transitions. Webhook records must use a system actor. - Establish one event contract: named stream, stable event name, actor and subject when available, outcome, timestamp, correlation-safe identifiers, and minimal safe metadata. - Never record passwords, reset tokens, API keys, email values, payment details, raw Stripe payloads, IP addresses, or private/free-text content. - Add a composite `(log_name, created_at)` index if query analysis confirms it is needed for the public-feed and staff-audit queries. ## Acceptance Criteria - Public activity remains limited to `gamer_updates`; account, billing, moderation, security, and private-content records never appear in the public feed. - Existing public activity types retain their current visibility and rendering behavior. - Account lifecycle actions create staff-only records with stable event names, actor/subject relationships, outcomes, and safe metadata. - Friendship, gamer-tag, console-list, game-request, blog lifecycle, and content-moderation actions create staff-only records when their state changes. - Administrative game, user, media, and game-request events identify the action and safe changed-field/resource context without persisting values that may be sensitive. - Donation and subscription lifecycle events record their outcome without storing raw payment or webhook data; webhook-originated events are identifiable as system actions. - Repeated no-op actions and duplicate webhook delivery do not produce misleading duplicate activity records. - Staff audit views can filter by stream, event, actor, and subject. - The existing 365-day cleanup policy remains unchanged in this issue. ## Test Coverage Required - Pest feature coverage for one representative success, no-op/duplicate, and failure or cancellation case for each account, social/content, moderation, and billing lifecycle group. - Regression tests proving the public feed includes only permitted `gamer_updates` records and excludes every staff-only stream. - Assertions that audit records contain required safe identifiers and changed field names, but exclude passwords, tokens, email values, payment data, raw payloads, IPs, and private/free-text content. - Coverage for authenticated actors, webhook/system actors, soft-deleted subjects, and staff authorization for audit filtering/views. - Focused affected tests, `vendor/bin/pint --dirty --format agent`, and `composer stan` before closeout. ## Progress Checklist - [x] `activity_log` migration and Spatie activity-log configuration exist - [x] Public `gamer_updates` feed and visibility filtering exist - [x] Initial admin game, user, media, and game-request activity records exist - [x] Public registration, game-list, favorite/wishlist, blog, and comment activity exists - [ ] Define shared safe event contract and stream taxonomy - [ ] Add account lifecycle audit events - [ ] Add friendship, gamer-tag, console-list, game-request, and blog lifecycle audit events - [ ] Integrate content-flag moderation transitions after the flagging feature lands - [ ] Enrich existing administrative activity metadata - [ ] Add donation and subscription lifecycle audit events with system actor handling - [ ] Add staff audit filtering and evaluate the composite activity-log index - [ ] Add public-feed isolation, privacy-redaction, lifecycle, no-op, webhook, and authorization tests - [ ] Verify no sensitive, private, or raw external payload data is persisted

Codex added the

component: backend

component: billing

component: content management

component: tests

Rows
Columns