Audit activité utilisateurs

backend/src/routes/admin.js

@@ -4,6 +4,7 @@ import { z } from 'zod';
 import db from '../db/index.js';
 import { HttpError } from '../middleware/errorHandler.js';
 import { checkStatutsRetard } from '../jobs/autoStatut.js';
+import { audit } from '../utils/audit.js';
 
 // ── Helpers similarité de noms ──────────────────────────────────────────── */
 
@@ -62,6 +63,7 @@ router.patch('/users/:id/verify-email', (req, res, next) => {
     const r = db.prepare("UPDATE users SET email_verified=1, updated_at=datetime('now') WHERE id=?").run(targetId);
     if (r.changes === 0) throw new HttpError(404, 'Utilisateur introuvable');
     db.prepare('UPDATE email_verification_tokens SET used=1 WHERE user_id=? AND used=0').run(targetId);
+    audit(req, { action: 'email_verified_admin', category: 'account', actorId: req.user.id, targetUserId: targetId });
     res.json({ ok: true });
   } catch (e) { next(e); }
 });
@@ -92,6 +94,7 @@ router.post('/users', (req, res, next) => {
       `INSERT INTO investisseurs (user_id, nom, prenom, type, type_fiscal) VALUES (?, ?, ?, 'famille', 'PP')`
     ).run(userId, fullName, prenom);
 
+    audit(req, { action: 'user_created', category: 'account', actorId: req.user.id, targetUserId: userId, details: { email: body.email, role: body.role, created_by_admin: true } });
     res.status(201).json({ id: userId, email: body.email, display_name: body.displayName || null, role: body.role });
   } catch (e) { next(e); }
 });
@@ -111,6 +114,7 @@ router.patch('/users/:id/status', (req, res, next) => {
     const r = db.prepare("UPDATE users SET status=?, updated_at=datetime('now') WHERE id=?")
       .run(status, targetId);
     if (r.changes === 0) throw new HttpError(404, 'Utilisateur introuvable');
+    audit(req, { action: 'status_changed', category: 'status', actorId: req.user.id, targetUserId: targetId, details: { new_status: status } });
     res.json({ id: targetId, status });
   } catch (e) { next(e); }
 });
@@ -133,6 +137,7 @@ router.patch('/users/:id/role', (req, res, next) => {
     const r = db.prepare("UPDATE users SET role=?, updated_at=datetime('now') WHERE id=?")
       .run(role, targetId);
     if (r.changes === 0) throw new HttpError(404, 'Utilisateur introuvable');
+    audit(req, { action: 'role_changed', category: 'role', actorId: req.user.id, targetUserId: targetId, details: { new_role: role } });
 
     res.json({ id: targetId, role });
   } catch (e) { next(e); }
@@ -145,8 +150,10 @@ router.delete('/users/:id', (req, res, next) => {
     if (targetId === req.user.id) {
       throw new HttpError(400, 'Vous ne pouvez pas supprimer votre propre compte');
     }
+    const targetUser = db.prepare('SELECT email, display_name FROM users WHERE id = ?').get(targetId);
     const r = db.prepare('DELETE FROM users WHERE id = ?').run(targetId);
     if (r.changes === 0) throw new HttpError(404, 'Utilisateur introuvable');
+    audit(req, { action: 'user_deleted', category: 'account', actorId: req.user.id, details: { email: targetUser?.email, display_name: targetUser?.display_name } });
     res.status(204).end();
   } catch (e) { next(e); }
 });