feat(audit): align chatwoot audit log payloads

internal/handler/api/v1/audit_handler.go

@@ -6,12 +6,14 @@ import (
 
 	"github.com/gin-gonic/gin"
 
+	"github.com/gochat/gochat/internal/model"
 	"github.com/gochat/gochat/internal/service"
 	applogger "github.com/gochat/gochat/pkg/logger"
-	"github.com/gochat/gochat/pkg/pagination"
 	"github.com/gochat/gochat/pkg/response"
 )
 
+const auditLogsPerPage = 25
+
 // AuditHandler handles audit log listing and retrieval.
 // Reference: Chatwoot enterprise audit logs controller + P2B M11 spec
 type AuditHandler struct {
@@ -32,20 +34,29 @@ func (h *AuditHandler) List(c *gin.Context) {
 		response.AbortWithStatusError(c, http.StatusUnauthorized, response.ErrUnauthorized, "account not identified")
 		return
 	}
+	if !isAuditAdmin(c) {
+		response.AbortWithStatusError(c, http.StatusUnauthorized, response.ErrUnauthorized, "administrator role required")
+		return
+	}
 
-	pg := pagination.Parse(c)
+	page := parseAuditPage(c.Query("page"))
 
 	action := c.Query("action")
 	auditableType := c.Query("auditable_type")
 
-	audits, total, svcErr := h.svc.ListByAccount(c.Request.Context(), accountID, action, auditableType, pg.Page, pg.PerPage)
+	audits, total, svcErr := h.svc.ListByAccount(c.Request.Context(), accountID, action, auditableType, page, auditLogsPerPage)
 	if svcErr != nil {
 		applogger.L().Errorf("AuditHandler.List account=%d: %v", accountID, svcErr)
 		handleServiceError(c, svcErr)
 		return
 	}
 
-	response.OKWithMeta(c, toInterfaceSlice(audits), pg.Page, pg.PerPage, total)
+	c.JSON(http.StatusOK, gin.H{
+		"per_page":      auditLogsPerPage,
+		"total_entries": total,
+		"current_page":  page,
+		"audit_logs":    serializeAuditLogs(audits),
+	})
 }
 
 // Get retrieves a single audit log entry by ID.
@@ -56,6 +67,10 @@ func (h *AuditHandler) Get(c *gin.Context) {
 		response.AbortWithStatusError(c, http.StatusUnauthorized, response.ErrUnauthorized, "account not identified")
 		return
 	}
+	if !isAuditAdmin(c) {
+		response.AbortWithStatusError(c, http.StatusUnauthorized, response.ErrUnauthorized, "administrator role required")
+		return
+	}
 
 	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
 	if err != nil || id == 0 {
@@ -63,14 +78,14 @@ func (h *AuditHandler) Get(c *gin.Context) {
 		return
 	}
 
-	audit, svcErr := h.svc.GetByID(c.Request.Context(), uint(id))
+	audit, svcErr := h.svc.GetByIDForAccount(c.Request.Context(), accountID, uint(id))
 	if svcErr != nil {
 		applogger.L().Errorf("AuditHandler.Get id=%d: %v", id, svcErr)
 		handleServiceError(c, svcErr)
 		return
 	}
 
-	response.OK(c, audit)
+	c.JSON(http.StatusOK, serializeAuditLog(*audit))
 }
 
 // RegisterAuditRoutes registers audit log routes on a gin.RouterGroup.
@@ -80,4 +95,46 @@ func RegisterAuditRoutes(rg *gin.RouterGroup, h *AuditHandler) {
 		audits.GET("/", h.List)
 		audits.GET("/:id", h.Get)
 	}
-}
+}
+
+func isAuditAdmin(c *gin.Context) bool {
+	role := getRole(c)
+	return role == "administrator" || role == "super_admin"
+}
+
+func parseAuditPage(raw string) int {
+	page, err := strconv.Atoi(raw)
+	if err != nil || page < 1 {
+		return 1
+	}
+	return page
+}
+
+func serializeAuditLogs(audits []model.Audit) []gin.H {
+	items := make([]gin.H, 0, len(audits))
+	for _, audit := range audits {
+		items = append(items, serializeAuditLog(audit))
+	}
+	return items
+}
+
+func serializeAuditLog(audit model.Audit) gin.H {
+	return gin.H{
+		"id":              audit.ID,
+		"auditable_id":    audit.AuditableID,
+		"auditable_type":  audit.AuditableType,
+		"auditable":       nil,
+		"associated_id":   audit.AssociatedID,
+		"associated_type": audit.AssociatedType,
+		"user_id":         audit.UserID,
+		"user_type":       audit.UserType,
+		"username":        audit.Username,
+		"action":          audit.Action,
+		"audited_changes": audit.AuditedChanges,
+		"version":         audit.Version,
+		"comment":         audit.Comment,
+		"request_uuid":    audit.RequestUUID,
+		"created_at":      audit.CreatedAt.Unix(),
+		"remote_address":  audit.RemoteAddress,
+	}
+}