feat: activity audit log written from all resource routes

Add the activity_log table, a best-effort recordActivity() service and a
GET /api/activity feed, and write entries on create/update/delete of
patients, notes, appointments, prescriptions and tasks. The Activity page
now shows the real audit trail (actor, action, patient context, time);
the fabricated signing hashes / approval badges are gone — that vision
stays deferred.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/routes/activity.ts

@@ -0,0 +1,17 @@
+import { Router } from "express";
+
+import { requireAuth, requireOrg } from "../middleware/auth.js";
+import * as service from "../services/activity.js";
+
+export const activityRouter = Router();
+
+// The audit feed is readable by any clinic member.
+activityRouter.use(requireAuth, requireOrg);
+
+activityRouter.get("/", async (req, res, next) => {
+  try {
+    res.json(await service.listActivity(req.organizationId!));
+  } catch (err) {
+    next(err);
+  }
+});

backend/src/routes/appointments.ts

@@ -7,6 +7,7 @@ import {
   requireOrg,
   requirePermission,
 } from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
 import * as service from "../services/appointments.js";
 
 export const appointmentsRouter = Router();
@@ -37,6 +38,15 @@ appointmentsRouter.post(
         req.user!.id,
         input,
       );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Scheduled appointment for ${created.name} on ${created.date}`,
+        entityType: "appointment",
+        entityId: created.id,
+        patientName: created.name,
+        patientFileNumber: created.fileNumber || null,
+      });
       res.status(201).json(created);
     } catch (err) {
       next(err);
@@ -56,6 +66,15 @@ appointmentsRouter.put(
         input,
       );
       if (!updated) throw new HttpError(404, "Appointment not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Updated appointment for ${updated.name}`,
+        entityType: "appointment",
+        entityId: updated.id,
+        patientName: updated.name,
+        patientFileNumber: updated.fileNumber || null,
+      });
       res.json(updated);
     } catch (err) {
       next(err);
@@ -73,6 +92,13 @@ appointmentsRouter.delete(
         req.params.id as string,
       );
       if (!ok) throw new HttpError(404, "Appointment not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Deleted appointment",
+        entityType: "appointment",
+        entityId: req.params.id as string,
+      });
       res.status(204).end();
     } catch (err) {
       next(err);

backend/src/routes/notes.ts

@@ -3,6 +3,7 @@ import { Router } from "express";
 import { HttpError } from "../lib/http-error.js";
 import { noteInputSchema } from "../lib/note-validation.js";
 import { requireAuth, requireOrg } from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
 import * as service from "../services/notes.js";
 
 export const notesRouter = Router();
@@ -27,6 +28,13 @@ notesRouter.post("/", async (req, res, next) => {
       req.user!.id,
       input,
     );
+    await recordActivity({
+      orgId: req.organizationId!,
+      actor: { id: req.user!.id, name: req.user!.name },
+      action: `Created note — ${created.title}`,
+      entityType: "note",
+      entityId: created.id,
+    });
     res.status(201).json(created);
   } catch (err) {
     next(err);
@@ -57,6 +65,13 @@ notesRouter.put("/:id", async (req, res, next) => {
       input,
     );
     if (!updated) throw new HttpError(404, "Note not found.");
+    await recordActivity({
+      orgId: req.organizationId!,
+      actor: { id: req.user!.id, name: req.user!.name },
+      action: `Updated note — ${updated.title}`,
+      entityType: "note",
+      entityId: updated.id,
+    });
     res.json(updated);
   } catch (err) {
     next(err);
@@ -71,6 +86,13 @@ notesRouter.delete("/:id", async (req, res, next) => {
       req.params.id as string,
     );
     if (!ok) throw new HttpError(404, "Note not found.");
+    await recordActivity({
+      orgId: req.organizationId!,
+      actor: { id: req.user!.id, name: req.user!.name },
+      action: "Deleted note",
+      entityType: "note",
+      entityId: req.params.id as string,
+    });
     res.status(204).end();
   } catch (err) {
     next(err);

backend/src/routes/patients.ts

@@ -7,6 +7,7 @@ import {
   requireOrg,
   requirePermission,
 } from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
 import * as service from "../services/patients.js";
 
 export const patientsRouter = Router();
@@ -54,6 +55,15 @@ patientsRouter.post(
         req.user!.id,
         input,
       );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Created patient ${created.name}`,
+        entityType: "patient",
+        entityId: created.fileNumber,
+        patientName: created.name,
+        patientFileNumber: created.fileNumber,
+      });
       res.status(201).json(created);
     } catch (err) {
       next(err);
@@ -73,6 +83,15 @@ patientsRouter.put(
         input,
       );
       if (!updated) throw new HttpError(404, "Patient not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Updated patient ${updated.name}`,
+        entityType: "patient",
+        entityId: updated.fileNumber,
+        patientName: updated.name,
+        patientFileNumber: updated.fileNumber,
+      });
       res.json(updated);
     } catch (err) {
       next(err);
@@ -90,6 +109,14 @@ patientsRouter.delete(
         req.params.fileNumber as string,
       );
       if (!ok) throw new HttpError(404, "Patient not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Deleted patient #${req.params.fileNumber}`,
+        entityType: "patient",
+        entityId: req.params.fileNumber as string,
+        patientFileNumber: req.params.fileNumber as string,
+      });
       res.status(204).end();
     } catch (err) {
       next(err);

backend/src/routes/prescriptions.ts

@@ -7,6 +7,7 @@ import {
   requireOrg,
   requirePermission,
 } from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
 import * as service from "../services/prescriptions.js";
 
 export const prescriptionsRouter = Router();
@@ -38,6 +39,15 @@ prescriptionsRouter.post(
         req.user!.id,
         input,
       );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Prescribed ${created.medication} for ${created.name}`,
+        entityType: "prescription",
+        entityId: created.id,
+        patientName: created.name,
+        patientFileNumber: created.fileNumber || null,
+      });
       res.status(201).json(created);
     } catch (err) {
       next(err);
@@ -58,6 +68,15 @@ prescriptionsRouter.put(
         input,
       );
       if (!updated) throw new HttpError(404, "Prescription not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Updated prescription — ${updated.medication}`,
+        entityType: "prescription",
+        entityId: updated.id,
+        patientName: updated.name,
+        patientFileNumber: updated.fileNumber || null,
+      });
       res.json(updated);
     } catch (err) {
       next(err);
@@ -75,6 +94,13 @@ prescriptionsRouter.delete(
         req.params.id as string,
       );
       if (!ok) throw new HttpError(404, "Prescription not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Deleted prescription",
+        entityType: "prescription",
+        entityId: req.params.id as string,
+      });
       res.status(204).end();
     } catch (err) {
       next(err);

backend/src/routes/tasks.ts

@@ -7,6 +7,7 @@ import {
   requireOrg,
   requirePermission,
 } from "../middleware/auth.js";
+import { recordActivity } from "../services/activity.js";
 import * as service from "../services/tasks.js";
 
 export const tasksRouter = Router();
@@ -36,6 +37,13 @@ tasksRouter.post(
         req.user!.id,
         input,
       );
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: `Created task — ${created.title}`,
+        entityType: "task",
+        entityId: created.id,
+      });
       res.status(201).json(created);
     } catch (err) {
       next(err);
@@ -55,6 +63,19 @@ tasksRouter.patch(
         patch,
       );
       if (!updated) throw new HttpError(404, "Task not found.");
+      const action =
+        patch.done === undefined
+          ? `Updated task — ${updated.title}`
+          : patch.done
+            ? `Completed task — ${updated.title}`
+            : `Reopened task — ${updated.title}`;
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action,
+        entityType: "task",
+        entityId: updated.id,
+      });
       res.json(updated);
     } catch (err) {
       next(err);
@@ -72,6 +93,13 @@ tasksRouter.delete(
         req.params.id as string,
       );
       if (!ok) throw new HttpError(404, "Task not found.");
+      await recordActivity({
+        orgId: req.organizationId!,
+        actor: { id: req.user!.id, name: req.user!.name },
+        action: "Deleted task",
+        entityType: "task",
+        entityId: req.params.id as string,
+      });
       res.status(204).end();
     } catch (err) {
       next(err);