feat: add initial AuditLogService and /audit-logs API endpoint

apps/api/v1/lib/audit-log.service.ts

@@ -0,0 +1,12 @@
+import type { AuditLogEvent } from "~/lib/types";
+
+export const AuditLogService = {
+  async logEvent(event: AuditLogEvent): Promise<void> {
+    console.log("Audit Log Event:", event);
+  },
+
+  async getEvents(filter?: any): Promise<AuditLogEvent[]> {
+    // Returning Expty array for now
+    return [];
+  },
+};

apps/api/v1/lib/helpers/audit-log.ts

@@ -0,0 +1,6 @@
+import { AuditLogService } from "~/lib/audit-log.service";
+import type { AuditLogEvent } from "~/lib/types";
+
+export async function EmitAuditLogEvent(event: AuditLogEvent) {
+  await AuditLogService.logEvent(event);
+}

apps/api/v1/lib/types.ts

@@ -146,6 +146,18 @@ interface EventTypeExtended extends Omit<EventType, "recurringEvent" | "location
     | any;
 }
 
+//Audit Logs for Teams
+export type AuditLogAction = "RENAME" | "DELETE" | "BOOK" | "CANCEL" | "CREATE";
+
+export interface AuditLogEvent {
+  timestamp: string;
+  userId: string;
+  orgId: string;
+  action: AuditLogAction;
+  resource: string;
+  details: Record<string, any>;
+}
+
 // EventType
 export type EventTypeResponse = BaseResponse & {
   event_type?: Partial<EventType | EventTypeExtended>;

apps/api/v1/pages/api/audit-logs/_get.ts

@@ -0,0 +1,29 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { HttpError } from "@calcom/lib/http-error";
+import { defaultResponder } from "@calcom/lib/server/defaultResponder";
+
+import { AuditLogService } from "~/lib/audit-log.service";
+import type { AuditLogEvent } from "~/lib/types";
+
+async function handler(req: NextApiRequest, res: NextApiResponse) {
+  const { orgId, userId, action } = req.query;
+
+  const filter: Record<string, string | undefined> = {
+    orgId: typeof orgId === "string" ? orgId : undefined,
+    userId: typeof userId === "string" ? userId : undefined,
+    action: typeof action === "string" ? action : undefined,
+  };
+
+  try {
+    const events: AuditLogEvent[] = await AuditLogService.getEvents?.(filter);
+    return res.status(200).json({ events });
+  } catch (error) {
+    throw new HttpError({
+      statusCode: 500,
+      message: "Failed to fetch audit logs",
+    });
+  }
+}
+
+export default defaultResponder(handler);

apps/api/v1/pages/api/audit-logs/_post.ts

@@ -0,0 +1,37 @@
+import type { NextApiRequest, NextApiResponse } from "next";
+
+import { HttpError } from "@calcom/lib/http-error";
+import { defaultResponder } from "@calcom/lib/server/defaultResponder";
+
+import { AuditLogService } from "~/lib/audit-log.service";
+import type { AuditLogEvent } from "~/lib/types";
+
+async function handler(req: NextApiRequest, res: NextApiResponse) {
+  const body = req.body as Partial<AuditLogEvent>;
+  if (!body || typeof body !== "object") {
+    throw new HttpError({
+      statusCode: 400,
+      message: "Invalid/Missing JSON body",
+    });
+  }
+
+  // Required audit event fields
+  const requiredFields = ["timestamp", "userId", "orgId", "action", "resource", "details"];
+  for (const field of requiredFields) {
+    if (!body[field as keyof AuditLogEvent]) {
+      throw new HttpError({
+        statusCode: 400,
+        message: `Missing required field: ${field}`,
+      });
+    }
+  }
+
+  try {
+    await AuditLogService.logEvent(body as AuditLogEvent);
+    return res.status(201).json({ ok: true });
+  } catch (error: unknown) {
+    throw error;
+  }
+}
+
+export default defaultResponder(handler);

apps/api/v1/pages/api/audit-logs/index.ts

@@ -0,0 +1,10 @@
+import { defaultHandler } from "@calcom/lib/server/defaultHandler";
+
+import { withMiddleware } from "~/lib/helpers/withMiddleware";
+
+export default withMiddleware()(
+  defaultHandler({
+    POST: import("./_post"),
+    GET: import("./_get"),
+  })
+);

apps/api/v2/package.json

@@ -50,6 +50,7 @@
     "@nestjs/common": "^10.0.0",
     "@nestjs/config": "^3.1.1",
     "@nestjs/core": "^10.0.0",
+    "@nestjs/event-emitter": "^3.0.1",
     "@nestjs/jwt": "^10.2.0",
     "@nestjs/passport": "^10.0.2",
     "@nestjs/platform-express": "^10.0.0",

apps/api/v2/src/app.module.ts

@@ -18,13 +18,15 @@ import { BullModule } from "@nestjs/bull";
 import { MiddlewareConsumer, Module, NestModule, RequestMethod } from "@nestjs/common";
 import { ConfigModule } from "@nestjs/config";
 import { APP_GUARD, APP_INTERCEPTOR, APP_FILTER } from "@nestjs/core";
+import { EventEmitterModule } from "@nestjs/event-emitter";
 import { seconds, ThrottlerModule } from "@nestjs/throttler";
 import { SentryModule, SentryGlobalFilter } from "@sentry/nestjs/setup";
 
 import { AppController } from "./app.controller";
 
 @Module({
   imports: [
+    EventEmitterModule.forRoot(),
     SentryModule.forRoot(),
     ConfigModule.forRoot({
       ignoreEnvFile: true,

apps/api/v2/src/ee/audit-logs/lib/audit-log.events.ts

@@ -0,0 +1,10 @@
+export const AUDIT_LOG_EVENT = "audit.log";
+
+export type AuditLogPayload = {
+  teamId: number;
+  actorId: number;
+  action: string;
+  targetType: string;
+  targetId: string;
+  metadata?: Record<string, unknown>;
+};

apps/api/v2/src/ee/audit-logs/lib/audit-log.service.ts

@@ -0,0 +1,29 @@
+import { AuditLogPayload } from "@/ee/audit-logs/lib/audit-log.events";
+import { Injectable } from "@nestjs/common";
+import { Prisma } from "@prisma/client";
+import { PrismaWriteService } from "src/modules/prisma/prisma-write.service";
+
+export abstract class AuditLogService {
+  abstract log(payload: AuditLogPayload): Promise<void>;
+}
+
+@Injectable()
+export class PrismaAuditLogService extends AuditLogService {
+  // Injecting the PrismaWriteService class
+  constructor(private readonly prismaWriteService: PrismaWriteService) {
+    super();
+  }
+
+  async log(payload: AuditLogPayload): Promise<void> {
+    await this.prismaWriteService.prisma.auditLog.create({
+      data: {
+        teamId: payload.teamId,
+        actorId: payload.actorId,
+        action: payload.action,
+        targetType: payload.targetType,
+        targetId: payload.targetId,
+        metadata: (payload.metadata || {}) as Prisma.InputJsonValue,
+      },
+    });
+  }
+}

apps/api/v2/src/ee/bookings/2024-08-13/services/bookings.service.ts

@@ -1,3 +1,4 @@
+import { AUDIT_LOG_EVENT, AuditLogPayload } from "@/ee/audit-logs/lib/audit-log.events";
 import { BookingsRepository_2024_08_13 } from "@/ee/bookings/2024-08-13/bookings.repository";
 import { CalendarLink } from "@/ee/bookings/2024-08-13/outputs/calendar-links.output";
 import { ErrorsBookingsService_2024_08_13 } from "@/ee/bookings/2024-08-13/services/errors.service";
@@ -20,6 +21,7 @@ import { UsersService } from "@/modules/users/services/users.service";
 import { UsersRepository, UserWithProfile } from "@/modules/users/users.repository";
 import { ConflictException, Injectable, Logger, NotFoundException } from "@nestjs/common";
 import { BadRequestException } from "@nestjs/common";
+import { EventEmitter2 } from "@nestjs/event-emitter";
 import { Request } from "express";
 import { DateTime } from "luxon";
 import { z } from "zod";
@@ -53,7 +55,7 @@ import {
   CancelBookingInput,
 } from "@calcom/platform-types";
 import { PrismaClient } from "@calcom/prisma";
-import { EventType, User, Team } from "@calcom/prisma/client";
+import { Booking, EventType, User, Team } from "@calcom/prisma/client";
 
 type CreatedBooking = {
   hosts: { id: number }[];
@@ -95,7 +97,8 @@ export class BookingsService_2024_08_13 {
     private readonly organizationsRepository: OrganizationsRepository,
     private readonly teamsRepository: TeamsRepository,
     private readonly teamsEventTypesRepository: TeamsEventTypesRepository,
-    private readonly errorsBookingsService: ErrorsBookingsService_2024_08_13
+    private readonly errorsBookingsService: ErrorsBookingsService_2024_08_13,
+    private readonly eventEmitter: EventEmitter2
   ) {}
 
   async createBooking(request: Request, body: CreateBookingInput) {
@@ -385,6 +388,20 @@ export class BookingsService_2024_08_13 {
       throw new Error(`Booking with id=${booking.bookingId} was not found in the database`);
     }
 
+    // AUDIT LOG: Only emit an event if the event type belongs to a team.
+    if (eventType.teamId) {
+      this._emitAuditEvent({
+        action: "booking.created",
+        actorId: bookingRequest.userId,
+        teamId: eventType.teamId, // This is now guaranteed to be a number
+        booking: databaseBooking,
+        metadata: {
+          instant: true,
+          bookerEmail: body.attendee.email,
+        },
+      });
+    }
+
     return this.outputService.getOutputBooking(databaseBooking);
   }
 
@@ -1018,4 +1035,30 @@ export class BookingsService_2024_08_13 {
       t: await getTranslation("en", "common"),
     });
   }
+
+  private _emitAuditEvent(data: {
+    action: string;
+    actorId: number;
+    teamId: number;
+    booking: Partial<Booking & { uid?: string }>;
+    metadata?: Record<string, unknown>;
+  }) {
+    if (!data.teamId) {
+      return; // Don't log if there's no associated team/org
+    }
+
+    const payload: AuditLogPayload = {
+      action: data.action,
+      actorId: data.actorId,
+      teamId: data.teamId,
+      targetType: "Booking",
+      targetId: String(data.booking.id),
+      metadata: {
+        bookingUid: data.booking.uid,
+        bookingTitle: data.booking.title,
+        ...data.metadata,
+      },
+    };
+    this.eventEmitter.emit(AUDIT_LOG_EVENT, payload);
+  }
 }

packages/prisma/migrations/20250718092001_add_audit_log/migration.sql

@@ -0,0 +1,28 @@
+-- CreateTable
+CREATE TABLE "AuditLog" (
+    "id" SERIAL NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "teamId" INTEGER NOT NULL,
+    "actorId" INTEGER NOT NULL,
+    "action" TEXT NOT NULL,
+    "targetType" TEXT NOT NULL,
+    "targetId" TEXT NOT NULL,
+    "metadata" JSONB NOT NULL,
+
+    CONSTRAINT "AuditLog_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "AuditLog_teamId_idx" ON "AuditLog"("teamId");
+
+-- CreateIndex
+CREATE INDEX "AuditLog_actorId_idx" ON "AuditLog"("actorId");
+
+-- CreateIndex
+CREATE INDEX "AuditLog_targetType_targetId_idx" ON "AuditLog"("targetType", "targetId");
+
+-- AddForeignKey
+ALTER TABLE "AuditLog" ADD CONSTRAINT "AuditLog_teamId_fkey" FOREIGN KEY ("teamId") REFERENCES "Team"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "AuditLog" ADD CONSTRAINT "AuditLog_actorId_fkey" FOREIGN KEY ("actorId") REFERENCES "users"("id") ON DELETE CASCADE ON UPDATE CASCADE;

packages/prisma/schema.prisma

@@ -421,6 +421,9 @@ model User {
   creditBalance                  CreditBalance?
   whitelistWorkflows             Boolean                       @default(false)
 
+  // Audit Logs
+  auditLogs AuditLog[] @relation("UserAuditLogs")
+
   @@unique([email])
   @@unique([email, username])
   @@unique([username, organizationId])
@@ -546,6 +549,9 @@ model Team {
   managedOrganizations ManagedOrganization[] @relation("ManagerOrganization")
   filterSegments       FilterSegment[]
 
+  // Audit logs
+  auditLogs AuditLog[]
+
   @@unique([slug, parentId])
   @@index([parentId])
 }
@@ -2411,3 +2417,26 @@ model RolePermission {
   // TODO: come back to this with indexs.
   @@index([action])
 }
+
+model AuditLog {
+  id        Int      @id @default(autoincrement())
+  createdAt DateTime @default(now())
+
+  // The organization/team this log belongs to.
+  teamId Int
+  team   Team @relation(fields: [teamId], references: [id], onDelete: Cascade)
+
+  // Who performed the action.
+  actorId Int
+  actor   User @relation("UserAuditLogs", fields: [actorId], references: [id], onDelete: Cascade)
+
+  // What happened.
+  action     String // e.g., "event_type.created", "booking.cancelled"
+  targetType String // e.g., "EventType", "Booking", "User"
+  targetId   String
+  metadata   Json // To store details like old/new values.
+
+  @@index([teamId])
+  @@index([actorId])
+  @@index([targetType, targetId])
+}

yarn.lock

@@ -2532,6 +2532,7 @@ __metadata:
     "@nestjs/common": ^10.0.0
     "@nestjs/config": ^3.1.1
     "@nestjs/core": ^10.0.0
+    "@nestjs/event-emitter": ^3.0.1
     "@nestjs/jwt": ^10.2.0
     "@nestjs/passport": ^10.0.2
     "@nestjs/platform-express": ^10.0.0
@@ -8805,6 +8806,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@nestjs/event-emitter@npm:^3.0.1":
+  version: 3.0.1
+  resolution: "@nestjs/event-emitter@npm:3.0.1"
+  dependencies:
+    eventemitter2: 6.4.9
+  peerDependencies:
+    "@nestjs/common": ^10.0.0 || ^11.0.0
+    "@nestjs/core": ^10.0.0 || ^11.0.0
+  checksum: 9e916a3f983f37088d1b3cba3167b5b16032085b6949763cb14db604b259468c0aefe379d8911f4c8e1158c308fb761bd0ee8d08845f56d547cd649252637602
+  languageName: node
+  linkType: hard
+
 "@nestjs/jwt@npm:^10.2.0":
   version: 10.2.0
   resolution: "@nestjs/jwt@npm:10.2.0"
@@ -26863,6 +26876,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"eventemitter2@npm:6.4.9":
+  version: 6.4.9
+  resolution: "eventemitter2@npm:6.4.9"
+  checksum: be59577c1e1c35509c7ba0e2624335c35bbcfd9485b8a977384c6cc6759341ea1a98d3cb9dbaa5cea4fff9b687e504504e3f9c2cc1674cf3bd8a43a7c74ea3eb
+  languageName: node
+  linkType: hard
+
 "eventemitter3@npm:^4.0.0, eventemitter3@npm:^4.0.1, eventemitter3@npm:^4.0.4":
   version: 4.0.7
   resolution: "eventemitter3@npm:4.0.7"