Skip to main content

System Audit Logging Specification

Overview​

The Audit System records critical operational, security, and financial events across Learnille to provide an immutable audit trail for system administrators, security teams, and compliance officers.

📜 1. Audited Event Categories​

+-------------------------------------------------------------------------------+
|                            AUDITED SYSTEM EVENTS                              |
+-------------------+-------------------+-------------------+-------------------+
| Security & Auth   | Product Validation| Wallet & Payout   | System Admin      |
+-------------------+-------------------+-------------------+-------------------+
| USER_LOGIN        | COURSE_SUBMITTED  | WITHDRAWAL_REQ    | ROLE_CHANGE       |
| USER_LOGOUT       | COURSE_APPROVED   | WITHDRAWAL_VERIF  | USER_SUSPENDED    |
| PASSWORD_RESET    | COURSE_REJECTED   | WITHDRAWAL_PAID   | SYSTEM_CONFIG_CHG |
| AUTH_FAILURE      | CONSULTATION_APPR | REFUND_PROCESSED  | AUDIT_LOG_EXPORT  |
+-------------------+-------------------+-------------------+-------------------+

🗄 2. Audit Record Schema​

Each audit record in the database contains the following structured fields:

export interface AuditLogEntity {
  id: string;             // Unique UUID
  userId: string;         // Actor who performed the action
  userRole: string;       // Role at time of action (STUDENT, INSTRUCTOR, CONSULTANT, ADMIN)
  action: string;         // Event code (e.g. WITHDRAWAL_APPROVED)
  resourceType: string;   // Affected domain (e.g., COURSE, WITHDRAWAL, USER)
  resourceId: string;     // ID of target entity
  ipAddress: string;      // Client IPv4/IPv6 address
  userAgent: string;      // HTTP User-Agent string
  payload: Record<string, any>; // JSON snapshot of changes/context
  createdAt: Date;        // Immutable timestamp
}

🔒 3. Data Retention & Integrity​

  • Immutability: Audit log records are append-only. UPDATE and DELETE operations are disabled on the audit log table.
  • Retention Period: Audit logs are retained online in primary storage for 365 days, after which they are archived to cold object storage (S3 Glacier / MinIO archive) for 7 years.