feat(audit): record the client surface on audit entries and identify CLI login requests

packages/audit/src/log.test.ts

@@ -15,13 +15,18 @@ vi.mock('drizzle-orm', () => ({
   or: vi.fn(),
   sql: vi.fn(),
 }))
+const { mockGetRequestContext } = vi.hoisted(() => ({
+  mockGetRequestContext: vi.fn(),
+}))
+
 vi.mock('@sim/logger', () => ({
   createLogger: () => ({
     info: vi.fn(),
     warn: vi.fn(),
     error: vi.fn(),
     debug: vi.fn(),
   }),
+  getRequestContext: mockGetRequestContext,
 }))
 vi.mock('@sim/utils/id', () => ({
   generateId: () => 'test-uuid-123',
@@ -181,6 +186,43 @@ describe('recordAudit', () => {
     )
   })
 
+  it('records the surface the request came from', async () => {
+    mockGetRequestContext.mockReturnValueOnce({
+      requestId: 'req-1',
+      client: { surface: 'cli', version: '2.1.16', source: 'header' },
+    })
+
+    recordAudit({
+      workspaceId: 'ws-1',
+      actorId: 'user-1',
+      actorName: 'Test',
+      actorEmail: 'test@test.com',
+      action: AuditAction.WORKFLOW_CREATED,
+      resourceType: AuditResourceType.WORKFLOW,
+    })
+
+    await flush()
+
+    expect(dbChainMockFns.values).toHaveBeenCalledWith(expect.objectContaining({ surface: 'cli' }))
+  })
+
+  it('records no surface outside a request', async () => {
+    mockGetRequestContext.mockReturnValueOnce(undefined)
+
+    recordAudit({
+      workspaceId: 'ws-1',
+      actorId: 'user-1',
+      actorName: 'Test',
+      actorEmail: 'test@test.com',
+      action: AuditAction.WORKFLOW_CREATED,
+      resourceType: AuditResourceType.WORKFLOW,
+    })
+
+    await flush()
+
+    expect(dbChainMockFns.values.mock.calls.at(-1)?.[0].surface).toBeUndefined()
+  })
+
   it('records null when x-forwarded-for is absent', async () => {
     const request = new Request('https://example.com', {
       headers: { 'x-real-ip': '10.0.0.1' },

packages/audit/src/log.ts

@@ -1,5 +1,5 @@
 import { auditLog, db, user } from '@sim/db'
-import { createLogger } from '@sim/logger'
+import { createLogger, getRequestContext } from '@sim/logger'
 import { createClientIpResolver } from '@sim/security/ip'
 import { generateShortId } from '@sim/utils/id'
 import { eq } from 'drizzle-orm'
@@ -66,6 +66,10 @@ export function recordAuditBatch(entries: AuditLogParams[]): void {
  * insert paths so the write shape cannot drift between them. Actor fields
  * are taken as-is — lazy actor resolution is layered on top by
  * {@link recordAudit} only.
+ *
+ * The surface comes from the ambient request context, which the route wrapper
+ * resolves once per request, so every entry recorded while serving a request
+ * is attributed without each caller passing it. It is absent outside a request.
  */
 function buildAuditRow(
   params: AuditLogParams,
@@ -86,6 +90,7 @@ function buildAuditRow(
     metadata: params.metadata ?? {},
     ipAddress: params.request ? clientIpResolver.resolve(params.request.headers) : undefined,
     userAgent: params.request?.headers.get('user-agent') ?? undefined,
+    surface: getRequestContext()?.client?.surface,
   }
 }
 

packages/db/migrations/0344_audit_log_surface.sql

@@ -0,0 +1 @@
+ALTER TABLE "audit_log" ADD COLUMN "surface" text;