From 367fa6c7b13a782e36609a162c7f4c9ee57dcd40 Mon Sep 17 00:00:00 2001
From: TheFlow <theflow@sydigital.com>
Date: Fri, 24 Oct 2025 20:38:16 +1300
Subject: [PATCH] fix(audit): read audit logs from MongoDB instead of JSONL
 files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Root cause: Audit analytics was reading from obsolete .memory/audit/*.jsonl
files (last updated Oct 9), while actual audit logs are written to MongoDB
auditLogs collection (current data through Oct 23).

Fixed: Updated getAuditLogs() to query MongoDB auditLogs collection.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 src/controllers/audit.controller.js | 47 ++++++-----------------------
 1 file changed, 10 insertions(+), 37 deletions(-)

diff --git a/src/controllers/audit.controller.js b/src/controllers/audit.controller.js
index 167cc400..fdad5cfd 100644
--- a/src/controllers/audit.controller.js
+++ b/src/controllers/audit.controller.js
@@ -36,48 +36,21 @@ async function getAuditLogs(req, res) {
     const startDate = new Date(today);
     startDate.setDate(today.getDate() - parseInt(days));
 
-    // Read audit files
-    const auditDir = path.join(__dirname, '../../.memory/audit');
-    const decisions = [];
+    // Read from MongoDB instead of JSONL files
+    const db = require('../utils/db.util');
+    const collection = await db.getCollection('auditLogs');
 
-    // Get all audit files in date range
-    const files = await fs.readdir(auditDir);
-    const auditFiles = files.filter(f => f.startsWith('decisions-') && f.endsWith('.jsonl'));
-
-    for (const file of auditFiles) {
-      const filePath = path.join(auditDir, file);
-      const content = await fs.readFile(filePath, 'utf8');
-
-      // Parse JSONL (one JSON object per line)
-      const lines = content.trim().split('\n');
-
-      for (const line of lines) {
-        if (!line.trim()) continue;
-
-        try {
-          const decision = JSON.parse(line);
-          const decisionDate = new Date(decision.timestamp);
-
-          if (decisionDate >= startDate) {
-            decisions.push(decision);
-          }
-        } catch (parseError) {
-          logger.error('Error parsing audit line:', parseError);
-        }
-      }
-    }
-
-    // Sort by timestamp (most recent first)
-    decisions.sort((a, b) => new Date(b.timestamp) - new Date(a.timestamp));
-
-    // Apply limit
-    const limited = decisions.slice(0, parseInt(limit));
+    const decisions = await collection
+      .find({ timestamp: { $gte: startDate } })
+      .sort({ timestamp: -1 })
+      .limit(parseInt(limit))
+      .toArray();
 
     res.json({
       success: true,
-      decisions: limited,
+      decisions,
       total: decisions.length,
-      limited: limited.length,
+      limited: decisions.length,
       dateRange: {
         start: startDate.toISOString(),
         end: today.toISOString()