📌 Description
GET /api/v1/audit returns the last 200 mutating requests globally per the README, but support/debugging a single settlement's lifecycle (open -> execute/cancel) currently requires manually scanning that global list for matching paths containing the id.
🧩 Requirements and context
- Add
GET /api/v1/settlements/:id/audit returning only audit entries whose path references that settlement id.
- Return
404 if the settlement id doesn't exist (consistent with GET /api/v1/settlements/:id); an empty array if it exists but has no audit entries (e.g. entries aged out of the ring buffer).
- Reuse the existing in-memory audit store from
middleware/auditLog.ts — no new storage needed.
🛠️ Suggested execution
- Add the route in
src/routes/settlements.ts, filtering the shared audit history by path pattern.
- Add tests in
routes/settlements.test.ts for found/not-found settlement ids and the filtered result shape.
- Document in
src/openapi.ts and the README.
✅ Acceptance criteria
🔒 Security notes
No new attack surface; read-only view filtered from data already exposed by GET /api/v1/audit.
📋 Guidelines
- Minimum 95% test coverage
- Clear documentation
- Timeframe: 96 hours
📌 Description
GET /api/v1/auditreturns the last 200 mutating requests globally per the README, but support/debugging a single settlement's lifecycle (open -> execute/cancel) currently requires manually scanning that global list for matchingpaths containing the id.🧩 Requirements and context
GET /api/v1/settlements/:id/auditreturning only audit entries whose path references that settlement id.404if the settlement id doesn't exist (consistent withGET /api/v1/settlements/:id); an empty array if it exists but has no audit entries (e.g. entries aged out of the ring buffer).middleware/auditLog.ts— no new storage needed.🛠️ Suggested execution
src/routes/settlements.ts, filtering the shared audit history by path pattern.routes/settlements.test.tsfor found/not-found settlement ids and the filtered result shape.src/openapi.tsand the README.✅ Acceptance criteria
404for an unknown settlement id.🔒 Security notes
No new attack surface; read-only view filtered from data already exposed by
GET /api/v1/audit.📋 Guidelines