From 3a7599c846fd14856584049895f76e0fe17699cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Fri, 15 May 2026 17:37:22 +0200 Subject: [PATCH] chore(api): delete the orphan /api/audit-log surface and seed the five README-tied admin orphans into v1.4.28 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The /api/audit-log GET handler has zero runtime callers in src/, tests/, scripts/, or docs/ — verified via grep against the route path plus the auditLog model name. The admin counterpart at /api/admin/audit-log is the surface every consumer reads from. Drops the orphan route file outright per the v1.4.27 fix-plan Section 4 Decision A. The five admin / monitoring endpoints flagged for the scope- maximization sweep all carry a README + CHANGELOG documentation reference, which the fix-plan classes as a consumer for the defer-on-tie rule: /api/admin/ai-settings — README L362–363, CHANGELOG L752 /api/admin/backup/test — README L368, CHANGELOG L752 /api/admin/status-overview — README L367, CHANGELOG L753 /api/monitoring/glitchtip/test — README L381 /api/monitoring/umami/test — README L382 All five defer to v1.4.28 for a maintainer call — either wire each to a real consumer or drop the route + README mention together. Seeds the v1.4.28 backlog entry with the per-endpoint grep findings so the decision is one read away. Also seeds the v1.4.28 backlog with the missing `insights.coach.window.lastYear` i18n key across the six locale bundles — owned by the i18n bucket. --- .planning/v1428-backlog.md | 11 ++++++++ src/app/api/audit-log/route.ts | 46 ---------------------------------- 2 files changed, 11 insertions(+), 46 deletions(-) delete mode 100644 src/app/api/audit-log/route.ts diff --git a/.planning/v1428-backlog.md b/.planning/v1428-backlog.md index 4e00b94ef..14a3835e3 100644 --- a/.planning/v1428-backlog.md +++ b/.planning/v1428-backlog.md @@ -11,3 +11,14 @@ Items deferred from v1.4.27 with a clear rationale. Sorted by source bucket. ## From bucket B1 — Dashboard rebuild (v1.4.27) - **F7 weekly-report dead click — needs maintainer screenshot.** Scan budget (30 min) across `src/` and `messages/` returned no dead affordance. Every weekly-report click target on `/insights` routes correctly to `/insights/report/[week]`. The retired `` was the only dashboard-anchored insight CTA in v1.4.27 — its removal in B1 commit 3 is the most likely reason the maintainer perceived a dead click. Ask the maintainer to point at the dead element with a screenshot. If they confirm the dashboard side, add a slim "Wochenreport für KW {N}" banner on `/` mirroring the `` from the hero, gated on a fresh advisor payload. + +## From bucket B7 — Symmetry sweep + dead-code cleanup (v1.4.27) + +- **README-referenced admin / monitoring orphan endpoints.** Five endpoints flagged by R1.6 as candidate-orphan have no runtime caller in `src/` but are documented as part of the API surface in `README.md` lines 362–382 + `CHANGELOG.md` 752–753. Per the v1.4.27 fix-plan scope-maximization directive ("if a consumer surfaces e.g. CI script, uptime probe, README reference, defer that single endpoint to v1.4.28"), each of the five defers: + - `/api/admin/ai-settings` (GET + PUT) — README line 362–363 + CHANGELOG 752 + 3261. + - `/api/admin/backup/test` (POST) — README line 368 + CHANGELOG 752. + - `/api/admin/status-overview` (GET) — README line 367 + CHANGELOG 753 + AGENTS.md 194. + - `/api/monitoring/glitchtip/test` (POST) — README line 381. + - `/api/monitoring/umami/test` (POST) — README line 382. + - **Decision needed:** either wire each endpoint to a real consumer (admin Settings UI, ops dashboard, uptime probe) or drop both the route and the README mention in the same commit. The README mention alone is not load-bearing if no operator reads it; a 30-second `gh search code` over the public mirrors of HealthLog deployments would tell us whether a downstream operator scripts against any of them. +- **i18n key `insights.coach.window.lastYear` missing across six locales.** B7 commit 6 added the `lastYear` snapshot-window enum value and wired the source-chip resolver to look up `insights.coach.window.lastYear`. The key resolves through the i18n fallback chain to the raw key string today; B6 (the i18n bucket) owns messages/*.json and should add the key to all six locales in v1.4.28. EN copy: "year so far"; DE: "Jahresrückblick"; FR/ES/IT/PL: respective locale-native translations. diff --git a/src/app/api/audit-log/route.ts b/src/app/api/audit-log/route.ts deleted file mode 100644 index 4f834c6b2..000000000 --- a/src/app/api/audit-log/route.ts +++ /dev/null @@ -1,46 +0,0 @@ -import { prisma } from "@/lib/db"; -import { apiHandler, requireAuth } from "@/lib/api-handler"; -import { annotate } from "@/lib/logging/context"; -import { apiSuccess } from "@/lib/api-response"; -import { NextRequest } from "next/server"; - -/** - * Get audit log entries for the current user. - * Query params: limit (default 50, max 200), offset (default 0) - */ -export const GET = apiHandler(async (request: NextRequest) => { - const { user } = await requireAuth(); - annotate({ action: { name: "audit-log.list" } }); - - const { searchParams } = new URL(request.url); - const limit = Math.min( - Math.max(1, parseInt(searchParams.get("limit") ?? "50", 10) || 50), - 200, - ); - const offset = Math.max( - 0, - parseInt(searchParams.get("offset") ?? "0", 10) || 0, - ); - - const [entries, total] = await Promise.all([ - prisma.auditLog.findMany({ - where: { userId: user.id }, - orderBy: { createdAt: "desc" }, - take: limit, - skip: offset, - select: { - id: true, - action: true, - ipAddress: true, - location: true, - details: true, - createdAt: true, - }, - }), - prisma.auditLog.count({ - where: { userId: user.id }, - }), - ]); - - return apiSuccess({ entries, meta: { total, limit, offset } }); -});