feat(settings): redesign Audit log, Setup health and Data platform

apps/api/src/routes/v2/setup-audit.http.test.ts

@@ -21,6 +21,8 @@ import { PlanetScaleDiscoveryService } from "@maple/backend/services/integration
 import { PlanetScaleOAuthService } from "@maple/backend/services/auth/PlanetScaleOAuthService"
 import { RecommendationIssueService } from "@maple/backend/services/errors/RecommendationIssueService"
 import { ScrapeTargetsService } from "@maple/backend/services/integrations/ScrapeTargetsService"
+import { OnboardingService } from "@maple/backend/services/org/OnboardingService"
+import { OrganizationService } from "@maple/backend/services/org/OrganizationService"
 import { SetupAuditService } from "@maple/backend/services/org/SetupAuditService"
 import { IntegrationInventoryService } from "@maple/backend/services/integrations/IntegrationInventoryService"
 import { SignalPresenceService } from "@maple/backend/services/org/SignalPresenceService"
@@ -138,7 +140,20 @@ const makeHarness = (warehouse: WarehouseQueryServiceApi = warehouseStub()) => {
 			Layer.provide(planetScaleStubs),
 		),
 		Layer.effect(SetupAuditService, SetupAuditService.make).pipe(
-			Layer.provide(Layer.mergeAll(warehouseLive, IntegrationInventoryService.layer)),
+			Layer.provide(
+				Layer.mergeAll(
+					warehouseLive,
+					IntegrationInventoryService.layer,
+					OnboardingService.layer,
+					// An undatable org: the audit may stamp an existing row but never creates one.
+					Layer.succeed(OrganizationService, {
+						retrieve: () => Effect.die("org lookup not exercised"),
+					}),
+					Layer.effect(SignalPresenceService, SignalPresenceService.make).pipe(
+						Layer.provide(warehouseLive),
+					),
+				),
+			),
 		),
 		// Sibling group in `AllV2GroupLayersLive`; the stub bundle is deliberately
 		// unused here, so it needs its own (warehouse-only) layer.

apps/api/src/routes/v2/telemetry-signals.http.test.ts

@@ -17,6 +17,8 @@ import { IngestAttributeMappingService } from "@maple/backend/services/org/Inges
 import { OrgIngestKeysService } from "@maple/backend/services/org/OrgIngestKeysService"
 import { RecommendationIssueService } from "@maple/backend/services/errors/RecommendationIssueService"
 import { ScrapeTargetsService } from "@maple/backend/services/integrations/ScrapeTargetsService"
+import { OnboardingService } from "@maple/backend/services/org/OnboardingService"
+import { OrganizationService } from "@maple/backend/services/org/OrganizationService"
 import { SetupAuditService } from "@maple/backend/services/org/SetupAuditService"
 import { IntegrationInventoryService } from "@maple/backend/services/integrations/IntegrationInventoryService"
 import { PlanetScaleDiscoveryService } from "@maple/backend/services/integrations/PlanetScaleDiscoveryService"
@@ -123,7 +125,20 @@ const makeHarness = (warehouse: WarehouseQueryServiceApi) => {
 			Layer.provide(planetScaleStubs),
 		),
 		Layer.effect(SetupAuditService, SetupAuditService.make).pipe(
-			Layer.provide(Layer.mergeAll(warehouseLive, IntegrationInventoryService.layer)),
+			Layer.provide(
+				Layer.mergeAll(
+					warehouseLive,
+					IntegrationInventoryService.layer,
+					OnboardingService.layer,
+					// An undatable org: the audit may stamp an existing row but never creates one.
+					Layer.succeed(OrganizationService, {
+						retrieve: () => Effect.die("org lookup not exercised"),
+					}),
+					Layer.effect(SignalPresenceService, SignalPresenceService.make).pipe(
+						Layer.provide(warehouseLive),
+					),
+				),
+			),
 		),
 		Layer.effect(SignalPresenceService, SignalPresenceService.make).pipe(Layer.provide(warehouseLive)),
 	).pipe(Layer.provideMerge(Layer.mergeAll(envLive, testDb.layer)))

apps/web/src/components/settings/audit-log-date-range.tsx

@@ -0,0 +1,132 @@
+import { useState } from "react"
+
+import { Button } from "@maple/ui/components/ui/button"
+import { Popover, PopoverContent, PopoverTrigger } from "@maple/ui/components/ui/popover"
+import { cn } from "@maple/ui/lib/utils"
+
+import { ClockIcon } from "@/components/icons"
+import { CustomRangePicker } from "@/components/time-range-picker/custom-range-picker"
+import { useTimezonePreference } from "@/hooks/use-timezone-preference"
+import { formatTimestampInTimezone, normalizeTimestampInput } from "@/lib/timezone-format"
+
+import { AUDIT_RANGE_PRESETS, type AuditDateRange } from "./audit-log-filters"
+
+const ALL_TIME: AuditDateRange = { kind: "all" }
+
+function useRangeLabel(range: AuditDateRange): string {
+	const { effectiveTimezone } = useTimezonePreference()
+	if (range.kind === "all") return "All time"
+	if (range.kind === "preset") {
+		return AUDIT_RANGE_PRESETS.find((preset) => preset.value === range.preset)?.label ?? "All time"
+	}
+	const format = (value: string) => formatTimestampInTimezone(value, { timeZone: effectiveTimezone })
+	if (range.since !== undefined && range.until !== undefined) {
+		return `${format(range.since)} to ${format(range.until)}`
+	}
+	if (range.since !== undefined) return `Since ${format(range.since)}`
+	if (range.until !== undefined) return `Until ${format(range.until)}`
+	return "All time"
+}
+
+/** The audit log's window: everything, a rolling preset, or a fixed range. */
+export function AuditLogDateRange({
+	value,
+	onChange,
+}: {
+	value: AuditDateRange
+	onChange: (range: AuditDateRange) => void
+}) {
+	const [open, setOpen] = useState(false)
+	const [custom, setCustom] = useState(false)
+	const label = useRangeLabel(value)
+
+	function select(range: AuditDateRange) {
+		onChange(range)
+		setOpen(false)
+		setCustom(false)
+	}
+
+	const options: ReadonlyArray<{ key: string; label: string; range: AuditDateRange }> = [
+		{ key: "all", label: "All time", range: ALL_TIME },
+		...AUDIT_RANGE_PRESETS.map((preset) => ({
+			key: preset.value,
+			label: preset.label,
+			range: { kind: "preset", preset: preset.value } satisfies AuditDateRange,
+		})),
+	]
+	const activeKey = value.kind === "all" ? "all" : value.kind === "preset" ? value.preset : null
+
+	return (
+		<Popover
+			open={open}
+			onOpenChange={(next) => {
+				setOpen(next)
+				if (!next) setCustom(false)
+			}}
+		>
+			<PopoverTrigger
+				render={
+					<Button
+						variant="outline"
+						size="sm"
+						className="gap-1.5"
+						aria-label={`Date range: ${label}`}
+					>
+						<ClockIcon />
+						<span>{label}</span>
+					</Button>
+				}
+			/>
+			<PopoverContent
+				align="start"
+				className={custom ? "w-auto max-w-[calc(100vw-1.5rem)] p-4" : "w-48 p-0"}
+			>
+				{custom ? (
+					<CustomRangePicker
+						startTime={value.kind === "custom" ? value.since : undefined}
+						endTime={value.kind === "custom" ? value.until : undefined}
+						onApply={(range) =>
+							select({
+								kind: "custom",
+								since: normalizeTimestampInput(range.startTime),
+								until: normalizeTimestampInput(range.endTime),
+							})
+						}
+						onCancel={() => setCustom(false)}
+					/>
+				) : (
+					<div className="flex flex-col py-1.5">
+						{options.map((option) => (
+							<button
+								key={option.key}
+								type="button"
+								onClick={() => select(option.range)}
+								className={cn(
+									"flex h-7 items-center px-3 text-left text-xs transition-colors hover:bg-muted/50",
+									option.key === activeKey
+										? "font-medium text-foreground"
+										: "text-foreground/80",
+								)}
+							>
+								{option.label}
+							</button>
+						))}
+						<div className="mx-3 my-1 h-px bg-border/60" />
+						<button
+							type="button"
+							onClick={() => setCustom(true)}
+							className={cn(
+								"flex h-7 items-center px-3 text-left text-xs transition-colors hover:bg-muted/50 hover:text-foreground",
+								value.kind === "custom"
+									? "font-medium text-foreground"
+									: "text-muted-foreground",
+							)}
+						>
+							Custom range…
+						</button>
+					</div>
+				)}
+			</PopoverContent>
+		</Popover>
+	)
+}

apps/web/src/components/settings/audit-log-filters.test.ts

@@ -0,0 +1,113 @@
+import { describe, expect, it } from "vitest"
+
+import {
+	auditLogSearchFrom,
+	hasAuditLogFilters,
+	parseAuditLogSearch,
+	pickAuditLogSearch,
+	resolveAuditDateRange,
+} from "./audit-log-filters"
+
+describe("parseAuditLogSearch", () => {
+	it("reads every filter from the search params", () => {
+		const filters = parseAuditLogSearch({
+			range: "7d",
+			actor: "user_abc",
+			actor_type: "api_key",
+			outcome: "denied",
+		})
+		expect(filters).toEqual({
+			range: { kind: "preset", preset: "7d" },
+			actorId: "user_abc",
+			actorType: "api_key",
+			outcome: "denied",
+		})
+		expect(hasAuditLogFilters(filters)).toBe(true)
+	})
+
+	it("drops hand-edited values the API would reject instead of failing the page", () => {
+		const filters = parseAuditLogSearch({
+			range: "forever",
+			since: "yesterday",
+			until: "2026-10-01 12:00:00",
+			actor: "",
+			actor_type: "robot",
+			outcome: "maybe",
+		})
+		expect(filters.range).toEqual({ kind: "all" })
+		expect(filters.actorId).toBeUndefined()
+		expect(filters.actorType).toBeUndefined()
+		expect(filters.outcome).toBeUndefined()
+		expect(hasAuditLogFilters(filters)).toBe(false)
+	})
+
+	it("keeps user, API key and agent actor ids", () => {
+		for (const actor of ["user_2fj3K9dLqWm8xYbT", "key_aXwpxqBkqtYwtBtmsGbR41", "actor_4CzLmR1pTx"]) {
+			expect(parseAuditLogSearch({ actor }).actorId).toBe(actor)
+		}
+	})
+
+	it("drops actor ids the app never writes", () => {
+		for (const actor of [
+			"user_abc|2026-01-01T00:00:00Z",
+			"dash_abc",
+			"user_",
+			"bob",
+			"key_abc def",
+			"user_abc/../x",
+		]) {
+			expect(parseAuditLogSearch({ actor }).actorId).toBeUndefined()
+		}
+	})
+
+	it("treats a since/until pair as a fixed range", () => {
+		expect(
+			parseAuditLogSearch({ since: "2026-10-01T00:00:00.000Z", until: "2026-10-02T00:00:00.000Z" })
+				.range,
+		).toEqual({ kind: "custom", since: "2026-10-01T00:00:00.000Z", until: "2026-10-02T00:00:00.000Z" })
+	})
+})
+
+describe("auditLogSearchFrom", () => {
+	it("clears the params of filters that were unset", () => {
+		const search = auditLogSearchFrom({ range: { kind: "preset", preset: "24h" } })
+		expect(search).toEqual({
+			range: "24h",
+			since: undefined,
+			until: undefined,
+			actor: undefined,
+			actor_type: undefined,
+			outcome: undefined,
+		})
+	})
+
+	it("round-trips through the search params", () => {
+		const search = {
+			since: "2026-10-01T00:00:00.000Z",
+			until: "2026-10-02T00:00:00.000Z",
+			actor: "key_123",
+			actor_type: "api_key",
+			outcome: "allowed",
+		}
+		expect(pickAuditLogSearch(search)).toEqual({ range: undefined, ...search })
+	})
+})
+
+describe("resolveAuditDateRange", () => {
+	const now = Date.parse("2026-10-17T12:00:00.000Z")
+
+	it("resolves a rolling preset against the given moment", () => {
+		expect(resolveAuditDateRange({ kind: "preset", preset: "24h" }, now)).toEqual({
+			since: "2026-10-16T12:00:00.000Z",
+			until: undefined,
+		})
+	})
+
+	it("passes a fixed range through and leaves all time unbounded", () => {
+		expect(resolveAuditDateRange({ kind: "custom", since: "2026-10-01T00:00:00.000Z" }, now)).toEqual({
+			since: "2026-10-01T00:00:00.000Z",
+			until: undefined,
+		})
+		expect(resolveAuditDateRange({ kind: "all" }, now)).toEqual({ since: undefined, until: undefined })
+	})
+})