[Backend] Add Queryable Audit Log API with Filtering and Export

[llinsss]

⚠️ This is a backend issue — work is done inside the backend/ folder

Description

backend/src/modules/audit/audit.service.ts only has a log() method — there is no way to query, filter, or export audit logs via the API. Admins and compliance officers have no interface to review who accessed or modified records, which is a compliance gap.

Current State

• AuditService.log() — writes audit entries
• AuditLog entity has: userId, entityType, entityId, action, ipAddress, userAgent, createdAt
• No findAll, findByUser, or export methods exist
• AuditController exists in backend/src/audit/ but is separate from the module — needs consolidation

What Needs to Be Built

1. Query DTO

export class AuditQueryDto {
  @IsOptional() @IsUUID()       userId?: string;
  @IsOptional() @IsString()     entityType?: string;
  @IsOptional() @IsEnum(AuditAction) action?: AuditAction;
  @IsOptional() @IsDateString() dateFrom?: string;
  @IsOptional() @IsDateString() dateTo?: string;
  @IsOptional() @IsIn(['ASC','DESC']) order?: string;
  @IsOptional() @Min(1)         page?: number;
  @IsOptional() @Min(1) @Max(100) limit?: number;
}

2. Service Methods

async findAll(query: AuditQueryDto): Promise<PaginatedResult<AuditLog>>
async findByEntity(entityType: string, entityId: string): Promise<AuditLog[]>
async exportCsv(query: AuditQueryDto): Promise<Buffer>

3. Controller Endpoints (Admin only)

GET  /audit?userId=&entityType=&action=&dateFrom=&dateTo=&page=&limit=
GET  /audit/entity/:entityType/:entityId
GET  /audit/export?format=csv   (streams CSV download)

4. Access Control

• All audit endpoints require ADMIN role
• Users can query their own audit trail via GET /audit/me

Acceptance Criteria

• All filter combinations return correct paginated results
• GET /audit/export streams a valid CSV file
• Non-admin users receive 403 on admin endpoints
• Users can view their own audit trail via /audit/me
• Integration tests cover filtering, pagination, and CSV export

Files to Modify / Create

• backend/src/modules/audit/audit.service.ts
• backend/src/modules/audit/audit.controller.ts
• backend/src/modules/audit/dto/audit-query.dto.ts (new)
• backend/src/modules/audit/audit.service.spec.ts (new)

Priority

High — compliance requirement for medical data access tracking

Estimated Effort

2 days

[Amas-01]

@Amas-01 has applied to work on this issue as part of the Stellar Wave Program's 5th wave.

Hello Maintainer
I'll like to work on this Issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Amas-01 to this issue.

[sevencat2004]

@sevencat2004 has applied to work on this issue as part of the Stellar Wave Program's 5th wave.

Hi maintainer, I would love to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @sevencat2004 to this issue.

[yosemite01]

@yosemite01 has applied to work on this issue as part of the Stellar Wave Program's 5th wave.

Hello Maintainer
I'll like to work on this Issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @yosemite01 to this issue.

[drips-wave]

Congratulations, @yosemite01! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 2, 2026.

🧑‍💻 @yosemite01: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊