Skip to main content
Source snapshot: 13 October 2026. These pages describe the current implementation, including unfinished controls. See coverage and review notes.

​
Activity log

Host: admin.<ROOT_DOMAIN> · Route: /[tenant]/settings/activity

​
Purpose and access

Review tenant changes and their actors without editing the audit entries.You need an account session and a resolved membership context in the selected Mahallu (including the API’s current platform elevation path). The API independently checks the requested operation’s permissions and feature availability.

​
Screen layout

The page groups entries by day, showing actor, action description, target context, and time. Pagination loads 30 entries per page.

​
Fields and displayed information

This screen has no editable fields or filters in its rendered components.

​
Actions

Navigation and row interactions are described in the sequence below.

​
Interaction sequence

Open Activity log → inspect newest changes → navigate the page links to older entries.

​
States and rules

Denied audit.view and No activity yet have separate states. This is read-only; it does not provide an undo or audit-entry deletion workflow.

​
Implementation references

Paths below are relative to the application repository. This is source-reviewed behavior, not a recorded browser test.
  • apps/web/src/app/sites/admin/[tenant]/settings/activity/page.tsx
Data and access helpers: apps/web/src/lib/session.ts, apps/web/src/lib/server-api.ts, apps/web/src/lib/tenants.ts, apps/web/src/lib/activity.tsRelevant controller permission keys: finance.view, finance.settings.view, finance.settings.update, accounting.accounts.manage, accounting.journal.create, accounting.view, accounting.journal.cancel, accounting.ledger.view, accounting.reports.view, collections.view, collections.create, collections.update, collections.delete, collections.cancel, receipts.view, expenses.view, expenses.create, expenses.update, expenses.approve, payments.create, expenses.cancel, expenses.delete, dues.view, dues.manage, salary.view, salary.create, salary.approve, salary.pay, salary.update, banking.view, banking.manage, taxes.view, taxes.manage, reports.view, admins.view, admins.create, admins.update, admins.delete, roles.view, roles.create, roles.update, roles.delete, structure.view, structure.update, settings.view, settings.update. Keys are operation-specific; the current guard grants OWNER/ADMIN and its platform-elevation context an operational bypass. A visible control still does not establish authorization.

​
API behavior references

  • apps/api/src/tenants/admins.controller.ts
  • apps/api/src/tenants/roles.controller.ts
  • apps/api/src/tenants/tenants.controller.ts
  • apps/api/src/structure/structure.controller.ts
  • apps/api/src/notifications/notifications.controller.ts
  • apps/api/src/finance/finance.controller.ts