feat: activity audit log written from all resource routes

Add the activity_log table, a best-effort recordActivity() service and a
GET /api/activity feed, and write entries on create/update/delete of
patients, notes, appointments, prescriptions and tasks. The Activity page
now shows the real audit trail (actor, action, patient context, time);
the fabricated signing hashes / approval badges are gone — that vision
stays deferred.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/db/schema/activity.ts

@@ -0,0 +1,29 @@
+import { index, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+
+import type { ActivityEntityType } from "../../types/activity.js";
+import { organization, user } from "./auth.js";
+
+// One row per record change, scoped to a clinic (organization). Written
+// best-effort from the resource routes (patients / notes / appointments /
+// prescriptions / tasks). `actorName` is denormalized so the feed renders even
+// after the user is removed (FK is set null).
+export const activityLog = pgTable(
+  "activity_log",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    actorId: text("actor_id").references(() => user.id, {
+      onDelete: "set null",
+    }),
+    actorName: text("actor_name").notNull(),
+    action: text("action").notNull(),
+    entityType: text("entity_type").$type<ActivityEntityType>().notNull(),
+    entityId: text("entity_id"),
+    patientName: text("patient_name"),
+    patientFileNumber: text("patient_file_number"),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+  },
+  (t) => [index("activity_org_created_idx").on(t.organizationId, t.createdAt)],
+);

backend/src/db/schema/index.ts

@@ -4,3 +4,4 @@ export * from "./notes.js";
 export * from "./appointments.js";
 export * from "./prescriptions.js";
 export * from "./tasks.js";
+export * from "./activity.js";

backend/src/index.ts

@@ -5,6 +5,7 @@ import express from "express";
 import { auth } from "./auth.js";
 import { env } from "./env.js";
 import { errorHandler, notFound } from "./middleware/error.js";
+import { activityRouter } from "./routes/activity.js";
 import { appointmentsRouter } from "./routes/appointments.js";
 import { notesRouter } from "./routes/notes.js";
 import { patientsRouter } from "./routes/patients.js";
@@ -51,6 +52,7 @@ app.use("/api/notes", notesRouter);
 app.use("/api/appointments", appointmentsRouter);
 app.use("/api/prescriptions", prescriptionsRouter);
 app.use("/api/tasks", tasksRouter);
+app.use("/api/activity", activityRouter);
 
 app.use(notFound);
 app.use(errorHandler);
@@ -63,4 +65,5 @@ app.listen(env.PORT, () => {
   console.log(`  • appts:    /api/appointments`);
   console.log(`  • rx:       /api/prescriptions`);
   console.log(`  • tasks:    /api/tasks`);
+  console.log(`  • activity: /api/activity`);
 });

backend/src/routes/activity.ts

@@ -0,0 +1,17 @@
+import { Router } from "express";
+
+import { requireAuth, requireOrg } from "../middleware/auth.js";
+import * as service from "../services/activity.js";
+
+export const activityRouter = Router();
+
+// The audit feed is readable by any clinic member.
+activityRouter.use(requireAuth, requireOrg);
+
+activityRouter.get("/", async (req, res, next) => {
+  try {
+    res.json(await service.listActivity(req.organizationId!));
+  } catch (err) {
+    next(err);
+  }
+});

backend/src/routes/appointments.ts

@@ -7,6 +7,7 @@ import {
   requireOrg,
   requirePermission,
 } from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
 import * as service from "../services/appointments.js";
 
 export const appointmentsRouter = Router();
@@ -37,6 +38,15 @@ appointmentsRouter.post(
         req.user!.id,
         input,
       );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Scheduled appointment for ${created.name} on ${created.date}`,
+        entityType: "appointment",
+        entityId: created.id,
+        patientName: created.name,
+        patientFileNumber: created.fileNumber || null,
+      });
       res.status(201).json(created);
     } catch (err) {
       next(err);
@@ -56,6 +66,15 @@ appointmentsRouter.put(
         input,
       );
       if (!updated) throw new HttpError(404, "Appointment not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Updated appointment for ${updated.name}`,
+        entityType: "appointment",
+        entityId: updated.id,
+        patientName: updated.name,
+        patientFileNumber: updated.fileNumber || null,
+      });
       res.json(updated);
     } catch (err) {
       next(err);
@@ -73,6 +92,13 @@ appointmentsRouter.delete(
         req.params.id as string,
       );
       if (!ok) throw new HttpError(404, "Appointment not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Deleted appointment",
+        entityType: "appointment",
+        entityId: req.params.id as string,
+      });
       res.status(204).end();
     } catch (err) {
       next(err);

backend/src/routes/notes.ts

@@ -3,6 +3,7 @@ import { Router } from "express";
 import { HttpError } from "../lib/http-error.js";
 import { noteInputSchema } from "../lib/note-validation.js";
 import { requireAuth, requireOrg } from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
 import * as service from "../services/notes.js";
 
 export const notesRouter = Router();
@@ -27,6 +28,13 @@ notesRouter.post("/", async (req, res, next) => {
       req.user!.id,
       input,
     );
+    await recordActivity({
+      orgId: req.organizationId!,
+      actor: { id: req.user!.id, name: req.user!.name },
+      action: `Created note — ${created.title}`,
+      entityType: "note",
+      entityId: created.id,
+    });
     res.status(201).json(created);
   } catch (err) {
     next(err);
@@ -57,6 +65,13 @@ notesRouter.put("/:id", async (req, res, next) => {
       input,
     );
     if (!updated) throw new HttpError(404, "Note not found.");
+    await recordActivity({
+      orgId: req.organizationId!,
+      actor: { id: req.user!.id, name: req.user!.name },
+      action: `Updated note — ${updated.title}`,
+      entityType: "note",
+      entityId: updated.id,
+    });
     res.json(updated);
   } catch (err) {
     next(err);
@@ -71,6 +86,13 @@ notesRouter.delete("/:id", async (req, res, next) => {
       req.params.id as string,
     );
     if (!ok) throw new HttpError(404, "Note not found.");
+    await recordActivity({
+      orgId: req.organizationId!,
+      actor: { id: req.user!.id, name: req.user!.name },
+      action: "Deleted note",
+      entityType: "note",
+      entityId: req.params.id as string,
+    });
     res.status(204).end();
   } catch (err) {
     next(err);

backend/src/routes/patients.ts

@@ -7,6 +7,7 @@ import {
   requireOrg,
   requirePermission,
 } from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
 import * as service from "../services/patients.js";
 
 export const patientsRouter = Router();
@@ -54,6 +55,15 @@ patientsRouter.post(
         req.user!.id,
         input,
       );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Created patient ${created.name}`,
+        entityType: "patient",
+        entityId: created.fileNumber,
+        patientName: created.name,
+        patientFileNumber: created.fileNumber,
+      });
       res.status(201).json(created);
     } catch (err) {
       next(err);
@@ -73,6 +83,15 @@ patientsRouter.put(
         input,
       );
       if (!updated) throw new HttpError(404, "Patient not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Updated patient ${updated.name}`,
+        entityType: "patient",
+        entityId: updated.fileNumber,
+        patientName: updated.name,
+        patientFileNumber: updated.fileNumber,
+      });
       res.json(updated);
     } catch (err) {
       next(err);
@@ -90,6 +109,14 @@ patientsRouter.delete(
         req.params.fileNumber as string,
       );
       if (!ok) throw new HttpError(404, "Patient not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Deleted patient #${req.params.fileNumber}`,
+        entityType: "patient",
+        entityId: req.params.fileNumber as string,
+        patientFileNumber: req.params.fileNumber as string,
+      });
       res.status(204).end();
     } catch (err) {
       next(err);

backend/src/routes/prescriptions.ts

@@ -7,6 +7,7 @@ import {
   requireOrg,
   requirePermission,
 } from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
 import * as service from "../services/prescriptions.js";
 
 export const prescriptionsRouter = Router();
@@ -38,6 +39,15 @@ prescriptionsRouter.post(
         req.user!.id,
         input,
       );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Prescribed ${created.medication} for ${created.name}`,
+        entityType: "prescription",
+        entityId: created.id,
+        patientName: created.name,
+        patientFileNumber: created.fileNumber || null,
+      });
       res.status(201).json(created);
     } catch (err) {
       next(err);
@@ -58,6 +68,15 @@ prescriptionsRouter.put(
         input,
       );
       if (!updated) throw new HttpError(404, "Prescription not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Updated prescription — ${updated.medication}`,
+        entityType: "prescription",
+        entityId: updated.id,
+        patientName: updated.name,
+        patientFileNumber: updated.fileNumber || null,
+      });
       res.json(updated);
     } catch (err) {
       next(err);
@@ -75,6 +94,13 @@ prescriptionsRouter.delete(
         req.params.id as string,
       );
       if (!ok) throw new HttpError(404, "Prescription not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Deleted prescription",
+        entityType: "prescription",
+        entityId: req.params.id as string,
+      });
       res.status(204).end();
     } catch (err) {
       next(err);

backend/src/routes/tasks.ts

@@ -7,6 +7,7 @@ import {
   requireOrg,
   requirePermission,
 } from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
 import * as service from "../services/tasks.js";
 
 export const tasksRouter = Router();
@@ -36,6 +37,13 @@ tasksRouter.post(
         req.user!.id,
         input,
       );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Created task — ${created.title}`,
+        entityType: "task",
+        entityId: created.id,
+      });
       res.status(201).json(created);
     } catch (err) {
       next(err);
@@ -55,6 +63,19 @@ tasksRouter.patch(
         patch,
       );
       if (!updated) throw new HttpError(404, "Task not found.");
+      const action =
+        patch.done === undefined
+          ? `Updated task — ${updated.title}`
+          : patch.done
+            ? `Completed task — ${updated.title}`
+            : `Reopened task — ${updated.title}`;
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action,
+        entityType: "task",
+        entityId: updated.id,
+      });
       res.json(updated);
     } catch (err) {
       next(err);
@@ -72,6 +93,13 @@ tasksRouter.delete(
         req.params.id as string,
       );
       if (!ok) throw new HttpError(404, "Task not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Deleted task",
+        entityType: "task",
+        entityId: req.params.id as string,
+      });
       res.status(204).end();
     } catch (err) {
       next(err);

backend/src/services/activity.ts

@@ -0,0 +1,68 @@
+import { desc, eq } from "drizzle-orm";
+
+import { db } from "../db/index.js";
+import { activityLog } from "../db/schema/activity.js";
+import type { ActivityEntityType, ActivityEntry } from "../types/activity.js";
+
+type ActivityRow = typeof activityLog.$inferSelect;
+
+// Up to two-letter initials from a display name (e.g. "Dr. Ada Okafor" -> "AO").
+export function initialsOf(name: string): string {
+  const parts = name.trim().split(/\s+/).filter(Boolean);
+  if (parts.length === 0) return "?";
+  if (parts.length === 1) return parts[0]!.slice(0, 2).toUpperCase();
+  return (parts[0]![0]! + parts.at(-1)![0]!).toUpperCase();
+}
+
+function toEntry(row: ActivityRow): ActivityEntry {
+  return {
+    id: row.id,
+    actorName: row.actorName,
+    actorInitials: initialsOf(row.actorName),
+    action: row.action,
+    entityType: row.entityType,
+    entityId: row.entityId,
+    patientName: row.patientName,
+    patientFileNumber: row.patientFileNumber,
+    createdAt: row.createdAt.toISOString(),
+  };
+}
+
+// Best-effort: an audit entry must never fail the originating request.
+export async function recordActivity(params: {
+  orgId: string;
+  actor: { id?: string | null; name?: string | null };
+  action: string;
+  entityType: ActivityEntityType;
+  entityId?: string | null;
+  patientName?: string | null;
+  patientFileNumber?: string | null;
+}): Promise<void> {
+  try {
+    await db.insert(activityLog).values({
+      organizationId: params.orgId,
+      actorId: params.actor.id ?? null,
+      actorName: params.actor.name?.trim() || "Someone",
+      action: params.action,
+      entityType: params.entityType,
+      entityId: params.entityId ?? null,
+      patientName: params.patientName ?? null,
+      patientFileNumber: params.patientFileNumber ?? null,
+    });
+  } catch (err) {
+    console.error("Failed to record activity:", err);
+  }
+}
+
+export async function listActivity(
+  orgId: string,
+  limit = 100,
+): Promise<ActivityEntry[]> {
+  const rows = await db
+    .select()
+    .from(activityLog)
+    .where(eq(activityLog.organizationId, orgId))
+    .orderBy(desc(activityLog.createdAt))
+    .limit(limit);
+  return rows.map(toEntry);
+}

backend/src/types/activity.ts

@@ -0,0 +1,21 @@
+// The canonical activity-log entry returned by the API. A plain, tamper-evident
+// audit trail of record changes within a clinic. (The blockchain-style signing /
+// patient-approval flow from the product vision is separate and not built yet.)
+export type ActivityEntityType =
+  | "patient"
+  | "note"
+  | "appointment"
+  | "prescription"
+  | "task";
+
+export type ActivityEntry = {
+  id: string;
+  actorName: string;
+  actorInitials: string;
+  action: string;
+  entityType: ActivityEntityType;
+  entityId: string | null;
+  patientName: string | null;
+  patientFileNumber: string | null;
+  createdAt: string;
+};