feat(audit): filter the audit log by resource, and by resource + action

[pfreixes]

Important

#6983 must be merged first. This PR is stacked on it — the base branch is pau/audit-event-vocabulary, not master. GitHub retargets this to master automatically once that lands.

Demo: https://www.loom.com/share/412ec2bf2dc94ccfb1e1c72dc350fa8e

• Adds resource and resource_action materialized search columns to audit_trail_events, each with a set skip index. resource_action is a column of its own rather than two conditions because two set indexes AND-ed prune per column, not per pair — a granule holding connection.created and api_key.deleted satisfies both resource='connection' and action='deleted' while containing no connection.deleted. Measured on 200k local rows, resource_action='api_key.deleted' prunes 25 granules to 2.
• Exposes the filters on GET /api/v1/audit-trail as comma-separated resources / actions query params. actions without resources is rejected with a 400 rather than silently widened, since a match is against a single resource.action value and needs both halves.
• Wires two selectors into the dashboard audit log. Action stays disabled until exactly one resource is selected — with a tooltip saying why — and resets whenever the resource selection changes. This is a deliberate middle ground rather than a limitation: the store can already match actions across several resources, but offering the union of every selected resource's actions makes for a long list full of pairs that can never match. Narrowing to one resource keeps the action list meaningful, and picking several resources is still supported on its own.

On the query param encoding

Both encodings exist in the tree, so I counted: comma-separated is used by four query params (integrationIds on both connections endpoints, filter on records, syncs on sync status) against two for repeated (ids on records, include on integrations). The deciding factor in the existing code is whether a value can contain a comma — getRecords uses both in one schema and says so for ids. Resources and actions are snake_case identifiers that can't, so CSV it is.

One deliberate difference from the existing CSV params: the querystring is typed as the string that goes on the wire, not as the array it denotes. GetConnections['Querystring'] declares integrationIds?: string[] while sending a comma-joined string, which is untested and simply wrong; typing it honestly means the contract can't drift from the encoding.

The filter list is a checked twin, not a hand-kept copy

@nangohq/types emits no JavaScript, so the vocabulary table can't cross the package boundary as a value. The dashboard keeps a runtime twin in packages/webapp/src/pages/Audit/constants.ts, kept in step exactly as apiKeyScopes in @nangohq/utils is: satisfies { [R in AuditResource]: readonly AuditActionOf<R>[] } rejects an action its resource doesn't record, and an Exclude<AuditEventKey, …> extends [never] assertion rejects a recorded event missing from the list.

That is what #6983 unblocks and why this PR is now stacked on it. The list was previously hand-maintained against a union the dashboard couldn't import, and it had already drifted — 14 of the 51 recorded pairs were missing, every lifecycle and authentication event from the coverage PRs that merged after this branch was cut. Adding an audited event now fails the build until the list is updated.

Notes

There is no standalone action column: filtering by action alone isn't offered, so it would index nothing anyone queries.

The ALTER only fills new parts. Older parts evaluate the expression on read — correct results, just unpruned — and pick up the column when they next merge. No MATERIALIZE step, because the table is empty at this migration and on a large one it would be a blocking mutation at metering boot.

Test plan

• Store-level integration tests for filtering by resource, by several resources, by a resource narrowed to an action, an action matched against a resource that never records it, actions passed without a resource, and combination with the date window and keyset pagination
• Endpoint tests for the CSV encoding and for the 400 on actions without resources; verified red by making the split a no-op
• Migration test asserts both search columns get a set index
• Every new assertion proven red by deliberate break
• Verified end to end in the browser against local ClickHouse with seeded events across eight resources, re-run after the CSV switch — 14 rows unfiltered, 4 for connection, 1 for connection+deleted, 6 for connection+api_key
• Granule pruning confirmed with EXPLAIN indexes=1
• ts-build, oxlint and prettier clean; audit + audit-trail suites pass (32 tests)
• After deploy: confirm the two columns and indexes exist in the audit database on dev

[github-actions]

Preview Deploy

Status	URL	Deploy Logs	Last Updated
✅ Ready	Preview URL	Deploy Logs	3 Aug 2026, 08:59 UTC

[cubic-dev-ai]

1 issue found and verified against the latest diff

Confidence score: 4/5

• In packages/webapp/src/pages/Audit/Show.tsx, the ConditionalTooltip trigger is attached to a non-focusable <span>, so keyboard users can’t access the disabled Action filter explanation, which creates an accessibility gap and can block understanding of why the control is unavailable — make the trigger focusable (or use a semantic focusable element) so tooltip content is reachable via keyboard.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/webapp/src/pages/Audit/Show.tsx">

<violation number="1" location="packages/webapp/src/pages/Audit/Show.tsx:107">
P2: Keyboard users cannot reach the explanation for the disabled Action filter. `ConditionalTooltip` is configured with `asChild`, so its trigger semantics are applied to this `<span>`, but the span is not focusable and the nested `FilterMultiSelect` renders a disabled native button; the tooltip therefore only appears on pointer hover. Making the wrapper focusable allows the existing tooltip to be announced on focus as well.

(Based on your team's feedback about focusable tooltip triggers.) [FEEDBACK_USED].</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Keyboard users cannot reach the explanation for the disabled Action filter. ConditionalTooltip is configured with asChild, so its trigger semantics are applied to this <span>, but the span is not focusable and the nested FilterMultiSelect renders a disabled native button; the tooltip therefore only appears on pointer hover. Making the wrapper focusable allows the existing tooltip to be announced on focus as well.

(Based on your team's feedback about focusable tooltip triggers.) .

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/webapp/src/pages/Audit/Show.tsx, line 107:

<comment>Keyboard users cannot reach the explanation for the disabled Action filter. `ConditionalTooltip` is configured with `asChild`, so its trigger semantics are applied to this `<span>`, but the span is not focusable and the nested `FilterMultiSelect` renders a disabled native button; the tooltip therefore only appears on pointer hover. Making the wrapper focusable allows the existing tooltip to be announced on focus as well.

(Based on your team's feedback about focusable tooltip triggers.) .</comment>

<file context>
@@ -83,9 +99,22 @@ export const AuditShow: React.FC = () => {
                     <div className="flex gap-2">
+                        <FilterMultiSelect label="Resource" options={resourceOptions} selected={resources} defaultSelect={[ALL]} onChange={onResourcesChange} />
+                        <ConditionalTooltip condition={!singleResource} content="Select a single resource to filter by action" asChild>
+                            <span>
+                                <FilterMultiSelect
+                                    label="Action"
</file context>

Suggested change

	<span>
	<span tabIndex={0}>