skills.rest
RomeroSilvia
RomeroSilviaCOMMUNITY
Explore all skills by this author →
GitHub

e3-audit-security

Implements audit log emission, filtered reading, and security checklist review for the EOS backend.

Updated May 1, 2026
Search Tags:#security#jest#supabase#rbac#react native#express#audit log
One-click install
npx skills add https://github.com/RomeroSilvia/Eos --skill e3-audit-security-romerosilvia
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: e3-audit-security
Source: https://github.com/RomeroSilvia/Eos/tree/main/agents/skills/e3-audit-security
Command: npx skills add https://github.com/RomeroSilvia/Eos --skill e3-audit-security-romerosilvia

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @react-native-community/datetimepicker.

What problem does it solve? It provides a complete audit trail for the EOS skincare app: recording who changed what (audit log emitters across auth, profile, routines, centers, products, specialists, and quiz modules) and exposing a filterable read endpoint plus an admin screen, while tracking the pending transversal security checklist (RBAC, TLS, error exposure, RLS). ## Core Features & Use Cases - Audit emission and consolidation: recordAuditLog emitters across modules, with routine mutations consolidated into a single audit_logs row within a 3-minute window via recordRoutineAudit. - Filtered audit reading: GET /api/admin/audit-log with filters by entity, actor name (ilike on profiles.full_name), and date range, plus an enriched admin screen (app/(tabs-admin)/audit-log.tsx) showing actor, profile, entity label, diffs, and routine step details. - Security checklist tracking: documents pending items such as login auditing, formal RBAC review, missing helmet headers, and RLS on audit_logs. - Use Case: A center admin opens the Auditoría screen, filters by actor name and date range, and inspects a consolidated routine-creation event showing all steps and before/after changes in one card. ## Quick Start Ask the agent to extend or verify the EOS M4 audit module, for example by adding a new audit emitter or fixing the audit-log filters, following the contracts in docs/e3-contracts.md.

Frequently Asked Questions about e3-audit-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I add a new audit log emitter in the EOS backend?▼

Call recordAuditLog from the module's service with action, entity, entityId, and before/after data; it is best-effort and never throws. For routine mutations, route through recordRoutineAudit in routines.service.ts so events consolidate into one row within the 3-minute window.

How does the audit log read endpoint filter by actor name?▼

GET /api/admin/audit-log accepts an actorName query param that the service resolves via an ilike search on profiles.full_name, converting matches to an actorIdIn filter. It replaces the old actorId/entityId UUID filters, which broke when users typed names.

Why are multiple routine changes merged into one audit log row?▼

recordRoutineAudit consolidates all routine mutations occurring within a 3-minute window (ROUTINE_BATCH_WINDOW_MS) into a single audit_logs row using findRecentRoutineBatch/updateRoutineBatch. This prevents one wizard flow from generating a row per backend call.

What security items are still pending in the EOS audit module?▼

Pending items include login success/failure auditing, a formal RBAC review of M1/M2/M3/M5 routes, adding helmet or equivalent security headers to backend/src/app.ts, and an RLS migration for the audit_logs table. Details are tracked in docs/e3-contracts.md and docs/e3-supabase-security.md.

Why did audit log pagination stay stuck on page 1?▼

A bug passed 1 as the max to normalizePositiveInt for the page parameter, clamping every requested page to 1. The fix uses Number.MAX_SAFE_INTEGER as the max for page, since only limit has a real cap (MAX_PAGE_SIZE of 100).

Related Skills

Explore More Software Engineering Skills→
Hashzin-0Hashzin-0

scalable-architecture

Define contracts and abstractions to decouple modules with dependency inversion.

Community
Advanced
vecearvecear

api-security-hardener

Enforce input validation, authentication, rate limiting, and security headers on REST and GraphQL APIs.

Community
Advanced
queen-of-codequeen-of-code
8

agent-monitor

Monitor defined conditions and emit structured event records on trigger.

Community
Intermediate
alissonmds00alissonmds00

logging

Standardize Fastify request logging and business audit trails in TypeScript monorepos.

Community
Intermediate