The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Feb 18, 2026 7:50pm

Greptile Summary

This PR expands the audit logging system across 10 API routes by adding new audit events for templates (CRUD), billing (credit purchases), credentials (invitation accept/resend, member self-leave), password resets, global environment variable updates, and deployment version activation. It also enriches existing audit calls across 18+ routes with actorName/actorEmail by threading user identity through AuthResult, McpAuthContext, and session objects.

• Adds 8 new AuditAction entries and 3 new AuditResourceType entries to the central audit enum, with matching updates to the test mock
• Instruments credential set invitation accept, resend, and self-revoke routes with dedicated audit actions (addresses prior review feedback about reusing CREDENTIAL_SET_INVITATION_CREATED for resends)
• Adds onPasswordReset callback in better-auth config to audit password resets with the actual user identity (addresses prior review feedback about using actorId: 'system')
• Extends AuthResult and McpAuthContext interfaces with optional userName/userEmail fields, populated for session-based auth
• All new recordAudit calls are correctly placed after successful operations (fire-and-forget pattern), and audit metadata avoids logging sensitive values

Confidence Score: 4/5

• This PR is safe to merge — all changes are additive audit instrumentation with no behavioral changes to existing logic.
• Score reflects that changes are purely additive (new audit events and actor info propagation) with no modifications to existing business logic. All recordAudit calls follow the established fire-and-forget pattern and are placed after successful operations. The audit mock is kept in sync. Minor observation: userName/userEmail are only populated for session auth (not API key or internal JWT), but this is a pre-existing limitation and not a regression.
• No files require special attention. All changes follow established patterns consistently.

Important Files Changed

Flowchart

flowchart TD
    subgraph Auth["Auth Layer"]
        Session["Session Auth"]
        APIKey["API Key Auth"]
        JWT["Internal JWT"]
    end

    subgraph AuthResult["AuthResult / McpAuthContext"]
        UID["userId"]
        UNAME["userName (new)"]
        UEMAIL["userEmail (new)"]
    end

    Session -->|populates| UID
    Session -->|populates| UNAME
    Session -->|populates| UEMAIL
    APIKey -->|populates| UID
    APIKey -.->|undefined| UNAME
    APIKey -.->|undefined| UEMAIL
    JWT -->|populates| UID
    JWT -.->|undefined| UNAME
    JWT -.->|undefined| UEMAIL

    subgraph NewAuditEvents["New Audit Events"]
        CP["CREDIT_PURCHASED"]
        CSL["CREDENTIAL_SET_MEMBER_LEFT"]
        CSIA["CREDENTIAL_SET_INVITATION_ACCEPTED"]
        CSIR["CREDENTIAL_SET_INVITATION_RESENT"]
        PR["PASSWORD_RESET"]
        TC["TEMPLATE_CREATED"]
        TU["TEMPLATE_UPDATED"]
        TD2["TEMPLATE_DELETED"]
        WDA["WORKFLOW_DEPLOYMENT_ACTIVATED"]
        EU["ENVIRONMENT_UPDATED"]
    end

    subgraph Routes["Instrumented Routes"]
        R1["/api/billing/credits"]
        R2["/api/credential-sets/memberships"]
        R3["/api/credential-sets/invite/token"]
        R4["/api/credential-sets/id/invite/invId"]
        R5["/auth (onPasswordReset)"]
        R6["/api/templates"]
        R7["/api/templates/id"]
        R8["/api/workflows/id/deployments/ver"]
        R9["/api/environment"]
    end

    R1 --> CP
    R2 --> CSL
    R3 --> CSIA
    R4 --> CSIR
    R5 --> PR
    R6 --> TC
    R7 --> TU
    R7 --> TD2
    R8 --> WDA
    R9 --> EU

    AuthResult --> NewAuditEvents
    NewAuditEvents -->|recordAudit| AuditDB[(Audit Log DB)]

_{Last reviewed commit: aeeead0}

@cursor review

@greptile

@greptile

@cursor review