src/models/AuditLog.js

const mongoose = require("mongoose");

// Immutable-by-convention trail of security-sensitive actions (payment
// confirmations/rejections, role changes, logins) for accountability and
// incident investigation. Nothing sensitive (passwords, tokens, full
// payment references) is ever written here.
const auditLogSchema = new mongoose.Schema(
  {
    actor: { type: mongoose.Schema.Types.ObjectId, ref: "User", default: null },
    actorEmail: { type: String, default: null },
    action: { type: String, required: true, index: true },
    targetType: { type: String, default: null },
    targetId: { type: mongoose.Schema.Types.ObjectId, default: null },
    metadata: { type: mongoose.Schema.Types.Mixed, default: {} },
    ip: { type: String, default: null },
    userAgent: { type: String, default: null },
  },
  { timestamps: true, capped: { size: 50 * 1024 * 1024, max: 200000 } }
);

module.exports = mongoose.model("AuditLog", auditLogSchema);