feat(httpapi): add local audit log with portal dual-write

Локальный audit_log (миграции pg/sqlite), GET /v1/audit, запись на CRUD и async push в auth-portal (source_app=bgp).

Co-authored-by: Cursor <[email protected]>

.agents/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.agents/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.agents/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

.claude/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.claude/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.claude/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

.codegraph/daemon.pid

@@ -1,6 +0,0 @@
-{
-  "pid": 51184,
-  "version": "0.9.9",
-  "socketPath": "\\\\.\\pipe\\codegraph-97b92efdcc5351da",
-  "startedAt": 1784215907952
-}

.cursor/mcp.json.example

@@ -11,9 +11,9 @@
       ]
     },
     "reui": {
-      "url": "https://mcp.reui.io/api/mcp?style=base-nova",
+      "url": "https://mcp.reui.io",
       "headers": {
-        "X-Reui-Style": "base-nova"
+        "Authorization": "Bearer <REUI_LICENSE_KEY>"
       }
     }
   }

.cursor/rules/kpi-hybrid.mdc

@@ -0,0 +1,29 @@
+---
+description: Только hybrid KPI — KpiStatGrid / row tile DNA (stats-12). Запрет SectionCards и hand-roll.
+alwaysApply: true
+---
+
+# KPI hybrid — только kit (stats-12 DNA)
+
+Preview: [stats-12](https://reui.io/preview/base/stats-12). SoT DNA = EvoBGP. Markup в проекте: `apps/web/src/components/reui-kit/kpi-stat-grid.tsx`.
+
+Связанные: [`reui-mcp.mdc`](reui-mcp.mdc), [`web-shadcn.mdc`](web-shadcn.mdc).
+
+## MUST
+
+| Зона | Компонент / DNA |
+|------|-----------------|
+| KPI-полосы / dashboard metrics | только `reui-kit/KpiStatGrid` (через `OpsDashboard` / `DetailPanel.Metrics` при наличии) |
+| Markup | horizontal compact hybrid: icon left `Item` `size-10.5` `bg-muted` + `border-background` + shadow + `ItemMedia` + label/Badge + value ± `variant` |
+| Row icon tiles (data-grid) | та же DNA — semantic `text-*` на `bg-muted` |
+| Quick Actions | только `reui-kit/QuickActionGrid` (sibling hybrid DNA) |
+
+Импорты UI: `@evobgp/ui/components/*`.
+
+## NEVER
+
+- SectionCards / vertical-only KPI / hand-roll Frame/Card KPI
+- Другой size / radius / solid brand fill вместо `bg-muted`
+- `card-35` как замена stats-12 hybrid KPI
+- Копипаст ReUI block в route — adapt через `reui-kit/`
+- Голый lucide `size-4` в name-cell без hybrid tile

.cursor/rules/reui-mcp.mdc

@@ -0,0 +1,111 @@
+---
+description: ReUI PRO (@reui) — MCP user-reui, Frame surface, kit, license, матрица выбора
+alwaysApply: true
+---
+
+# ReUI MCP — обязательно (PRO + free)
+
+Проект: **Base UI** (`style: base-nova`), surface lock **`frame`**.
+
+Связанные: [`shadcn-mcp.mdc`](shadcn-mcp.mdc), [`web-shadcn.mdc`](web-shadcn.mdc), [`web-shadcn.mdc`](web-shadcn.mdc), [`docs/ui-design-contract.md`](docs/ui-design-contract.md).
+
+| Документ | URL |
+|----------|-----|
+| **llms.txt** | https://reui.io/llms.txt |
+| **Get Started** | https://reui.io/docs/get-started |
+| **Styling** | https://reui.io/docs/styling |
+| **MCP** | https://reui.io/docs/mcp |
+| **Blocks** | https://reui.io/blocks |
+| **Settings blocks** | https://reui.io/blocks/application/settings |
+| **License** | https://reui.io/docs/license-setup |
+| **Base UI components** | https://reui.io/docs/components/base/<name> |
+
+## Primary MCP
+
+1. **`user-reui`** — `search` / `compose_page` / `get_block` / `get_component` / `get_install_command` / `validate_usage` / `get_audit_checklist`
+2. **`plugin-shadcn-shadcn`** — primitives `@shadcn`; для `@reui` — вторично
+
+**Обязательно** цитировать `previewUrl` + `docsUrl` для каждой UI-зоны.
+
+## Когда ReUI vs shadcn
+
+| Задача | Registry | Импорт |
+|--------|----------|--------|
+| Button, Sheet, Field, Sidebar, Tabs | `@shadcn` | `@evobgp/ui/components/*` |
+| PRO pages/sections (settings, stats, auth, dashboard) | `@reui` blocks | adapt → `apps/web/src/components/` / `reui-kit/` |
+| Data Grid | `@reui` | `@/components/reui/data-grid/*` → `ResourcePage` |
+| Filters | `@reui` | `@/components/reui/filters` |
+| Frame surface | `@reui` | `@/components/reui/frame` |
+| KPI | block [stats-12](https://reui.io/preview/base/stats-12) | `reui-kit/KpiStatGrid` — см. [`kpi-hybrid.mdc`](kpi-hybrid.mdc) |
+| Quick Actions | Frame tiles sibling KPI | `reui-kit/QuickActionGrid` |
+| Semantic badge / alert | `@reui` | `@/components/reui/badge`, `@/components/reui/alert` |
+| Number / date / autocomplete / color / kanban | `@reui` | `@/components/reui/*` |
+
+**Сложные списки** — `ResourcePage` (Frame + data-grid + filters), не raw `<table>`, не DataGridCard.  
+**Quick Actions** — только `QuickActionGrid` (не Card / Button grid).
+
+## MCP workflow
+
+0. Codegraph / поиск существующих `reui-kit/*`, `@/components/reui/*`
+1. `user-reui` `search` (`surface: "frame"`, `category` при известном)
+2. Страница целиком → `compose_page`; секция → `get_block`
+3. `get_component` для API primitives из `componentsUsed`
+4. CLI из `apps/web`: `pnpm dlx shadcn@latest add @reui/<name> --yes`
+5. Post-add: shadcn imports → `@evobgp/ui/components/*`
+6. Adapt by reuse → kit / route
+7. `validate_usage` + `get_audit_checklist`
+
+## Размещение
+
+| Слой | Путь | Импорт |
+|------|------|--------|
+| shadcn | `packages/ui/src/components/` | `@evobgp/ui/components/*` |
+| ReUI CLI | `apps/web/src/components/reui/` | `@/components/reui/*` |
+| PRO blocks (reference) | `apps/web/src/components/blocks/` | adapt into kit, не копипаст в routes |
+| Kit | `apps/web/src/components/reui-kit/` | `@/components/reui-kit/*` |
+
+## Установленные ReUI (apps/web)
+
+**Components:** `frame`, `data-grid/*`, `filters`, `kanban`, `badge`, `alert`, `autocomplete`, `number-field`, `date-selector`, `color-picker`, `timeline`, `rating`, `phone-input`, `icon-stack`
+
+**Kit:** `ResourcePage`, `KpiStatGrid`, `QuickActionGrid`, `OpsDashboard`, `KanbanBoard`, `DetailPanel`, `SettingsShell`
+
+**Blocks (reference):** `stats-12`, `card-35`, `auth-13`, `app-shell-12`, `settings-16`, `settings-8`, `empty-state-12`, `form-7`, `data-grid-filtering-2`, `dashboard-1`, …
+
+## License
+
+```env
+# .env.local (gitignored)
+REUI_LICENSE_KEY=
+```
+
+`apps/web/components.json` → `@reui` с `Authorization: Bearer ${REUI_LICENSE_KEY}`.
+
+## Эталоны preview
+
+| Зона | Preview |
+|------|---------|
+| KPI / Quick Actions | https://reui.io/preview/base/stats-12 · https://reui.io/preview/base/card-12 |
+| List | https://reui.io/preview/base/data-grid-filtering-2 |
+| Settings | https://reui.io/preview/base/settings-16 |
+| Auth | https://reui.io/preview/base/auth-13 |
+| Shell | https://reui.io/preview/base/app-shell-12 |
+| Empty | https://reui.io/preview/base/empty-state-12 |
+
+## Запрещено
+
+- Копипаст с reui.io без CLI
+- ReUI в `packages/ui` / импорт как `@evobgp/ui`
+- Radix-варианты docs — только Base UI
+- Raw `bg-emerald-*` вместо ReUI `variant`
+- Hand-roll data-grid/filters/KPI/Quick Actions/settings rows при наличии `@reui` / kit
+- Смешивать Card и Frame на ops-экране
+- Ставить shadcn/ui blocks выше ReUI PRO
+
+## Чеклист
+
+- [ ] `user-reui` search/get_block + previewUrl
+- [ ] `surface: frame`
+- [ ] CLI add из `apps/web` при новом item
+- [ ] Kit / `@/components/reui` / `@evobgp/ui` — правильный слой
+- [ ] `pnpm --filter @evobgp/web run build`

.cursor/rules/reui.mdc

@@ -11,7 +11,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.cursor/rules/web-shadcn.mdc

@@ -9,12 +9,12 @@ alwaysApply: false
 # Web UI — React + shadcn/ui + ReUI
 
 **Источники правды:**
+- **ReUI PRO first:** MCP `user-reui` ([`reui-mcp.mdc`](reui-mcp.mdc)) — pages / KPI / lists / settings / shell
+- shadcn primitives: MCP `plugin-shadcn-shadcn` (secondary)
+- ReUI Base UI: https://reui.io/docs/components/base/<name> · [llms.txt](https://reui.io/llms.txt)
 - shadcn/ui React: https://ui.shadcn.com/docs/components
-- ReUI Base UI: https://reui.io/docs/components/base/<name>
-- ReUI llms.txt: https://reui.io/llms.txt
-- MCP `plugin-shadcn-shadcn` (registries: `@shadcn`, `@reui`) — перед любой UI-задачей
 
-Общие правила Go/API: `.cursor/rules/engineering.mdc`. Стек ID: `.cursor/rules/context7-stack.mdc`.
+Иерархия: **ReUI PRO > shadcn**. Общие: `.cursor/rules/engineering.mdc`, `context7-stack.mdc`.
 
 ## Слои UI
 
@@ -23,18 +23,18 @@ alwaysApply: false
 | shadcn-примитивы | `packages/ui/src/components/` | output `shadcn add` (не трогать под кейс) |
 | ReUI enterprise | `apps/web/src/components/reui/` | output `shadcn add @reui/*` |
 | Shared обёртки | `apps/web/src/components/` | PageHeader, QueryState, ConfirmDialog, StatusBadge, LoadingButton |
-| ReUI kit | `apps/web/src/components/reui-kit/` | ResourcePage, KpiStatGrid, OpsDashboard, SettingsShell |
+| ReUI kit | `apps/web/src/components/reui-kit/` | ResourcePage, KpiStatGrid, QuickActionGrid, OpsDashboard, SettingsShell |
 | Роуты | `apps/web/src/routes/` | TanStack Router (file-based) |
 
-**Design contract:** [`docs/ui-design-contract.md`](../../docs/ui-design-contract.md). Surface: **frame**. KPI: [stats-12](https://reui.io/preview/base/stats-12). Lists: [data-grid-filtering-2](https://reui.io/preview/base/data-grid-filtering-2).
+**Design contract:** [`docs/ui-design-contract.md`](../../docs/ui-design-contract.md). Surface: **frame**. KPI hybrid SoT: [stats-12](https://reui.io/preview/base/stats-12). Lists: [data-grid-filtering-2](https://reui.io/preview/base/data-grid-filtering-2). Quick Actions: `QuickActionGrid`.
 
 Тема: `packages/ui/src/styles/globals.css`. CLI из `apps/web`: `pnpm dlx shadcn@latest add <component>`.
 
 ## Правила
 
-**WEB-01** | MUST | Перед новым UI — MCP `plugin-shadcn-shadcn`: `search_items_in_registries` → `get_item_examples_from_registries` → `get_add_command_for_items`. Только после — JSX.
+**WEB-01** | MUST | Перед новым UI — сначала MCP **`user-reui`** (`search` → `get_block` / `compose_page`, `surface: "frame"`) + cite `previewUrl`/`docsUrl`. Primitives — MCP `plugin-shadcn-shadcn`. Только после — JSX.
-*Rationale:* единый источник правды и API.
+*Rationale:* ReUI PRO выше shadcn; единый Frame surface.
-*Проверка:* review; нет самописных примитивов, если есть registry item.
+*Проверка:* review; [`reui-mcp.mdc`](reui-mcp.mdc).
 
 **WEB-02** | MUST | Отсутствующий shadcn-примитив — `pnpm dlx shadcn@latest add <component>` (из `apps/web`). ReUI — `pnpm dlx shadcn@latest add @reui/<name>`.
 *Проверка:* файлы в `packages/ui/src/components/` (для shadcn) или `apps/web/src/components/reui/` (для ReUI).
@@ -73,7 +73,7 @@ alwaysApply: false
 
 **WEB-14** | SHOULD | Нетривиальный UI — прочитать страницу компонента shadcn/ReUI (props, a11y).
 
-**WEB-15** | MUST | Сомнения — MCP `plugin-shadcn-shadcn` + shadcn CLI docs + `pnpm --filter @evobgp/web run typecheck`.
+**WEB-15** | MUST | Сомнения — MCP `user-reui` + `plugin-shadcn-shadcn` + docs + `pnpm --filter @evobgp/web run typecheck`.
 
 **WEB-16** | MUST | Подтверждение удаления — `ConfirmDialog` из `@/components/confirm-dialog`, не `window.confirm`.
 

.cursor/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.cursor/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.cursor/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

.gitignore

@@ -28,3 +28,7 @@ Thumbs.db
 
 # Compose runtime log sidecar output (deploy/compose/runtime-logs)
 deploy/compose/runtime-logs/
+# Local MCP configs (may contain REUI license Bearer)
+.cursor/mcp.json
+.mcp.json
+.codegraph/daemon.pid

.mcp.json

@@ -1,16 +0,0 @@
-{
-  "mcpServers": {
-    "codegraph": {
-      "type": "stdio",
-      "command": "codegraph",
-      "args": [
-        "serve",
-        "--mcp"
-      ]
-    },
-    "reui": {
-      "type": "http",
-      "url": "https://mcp.reui.io/api/mcp"
-    }
-  }
-}

.opencode/skills/reui/SKILL.md

@@ -5,7 +5,7 @@ user-invocable: false
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
 ---
 
-> **ReUI skill version `0e224b0281`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
+> **ReUI skill version `42d70dcc3d`.** If the ReUI MCP's `get_agent_skill` reports a newer `version`, re-run the ReUI installer (see `get_agent_skill` -> `install.recommended`) to update this skill. Cloud/tools-only agents have no local file and always read the latest - they can ignore this.
 
 # ReUI for Agents
 

.opencode/skills/reui/rules/cli.md

@@ -29,6 +29,8 @@ REUI_LICENSE_KEY=your-license-key
 }
 ```
 
+The shadcn CLI expands `${REUI_LICENSE_KEY}` from `.env.local` inside `components.json`, but an MCP client config never expands variables, so a ReUI MCP server config must carry the raw token instead (for example `reui_pat_your_token_here`).
+
 The MCP `get_project_context` tool returns the right config. Full guide: https://reui.io/docs/registry
 
 ## Installing

.opencode/skills/reui/rules/components.md

@@ -1,6 +1,6 @@
 # ReUI components
 
-The 17 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `filters`, `frame`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
+The 19 ReUI building blocks: `alert`, `autocomplete`, `badge`, `data-grid`, `date-selector`, `event-calendar`, `filters`, `frame`, `gantt`, `icon-stack`, `kanban`, `number-field`, `phone-input`, `rating`, `scrollspy`, `sortable`, `stepper`, `timeline`, `tree`. Examples and blocks are composed from these.
 
 **Rule one: never guess a component's API. Read it first.** Call **`get_component(name)`** for its inline `api` (props + usage, no web fetch), and **share the result's `docsUrl`** (the component's API documentation page) with the user whenever you work with that component's API, so they have the full reference (the `/llms.txt` index is a further fallback). Then call **`get_examples(name)`** to install a worked example and copy real composition. The contracts below are first-try orientation (required props, composition shape, the one gotcha); the inline `api` is the full reference. No single block fits? Compose: search the components you need, read each `get_component`, install a `get_examples` example per component, and adapt.
 
@@ -32,6 +32,34 @@ Common mistakes:
 - **Incorrect:** a raw `<table>` / hand-rolled pagination. **Correct:** use `data-grid`; read its API for sticky header, pagination, virtualization, row selection.
 - **Incorrect:** styling rows/cells with arbitrary classes. **Correct:** drive layout via `tableLayout` and the documented `ColumnMeta` (e.g. `cellClassName`, `headerTitle`).
 
+## event-calendar
+
+**Required:** events via `events`/`onEventsChange` (controlled) or `defaultEvents` (uncontrolled), plus a height on the root.
+**Shape:**
+
+```tsx
+<EventCalendar defaultEvents={events} defaultView="month" className="h-[560px]">
+  <EventCalendarNav />
+  <EventCalendarContent />
+</EventCalendar>
+```
+
+**Gotcha:** headless-first: `EventCalendarContent` renders the active view (month/week/day/days/agenda; a resource view activates when `resources` is passed) - there is no per-view JSX to compose. Events are `{ id, title, start, end (exclusive), allDay?, color?, recurrence?, resourceId? }`. Mutations flow through `onEventUpdate`/`canDropEvent` (return `false` to reject); the root needs an explicit height because it is a min-h-0 flex column.
+
+## gantt
+
+**Required:** `resources` (the left tree) plus bars via `events`/`defaultEvents` attached by `resourceId`.
+**Shape:**
+
+```tsx
+<Gantt defaultEvents={bars} resources={tasks} defaultScale="month" className="h-[480px]">
+  <GanttNav />
+  <GanttView />
+</Gantt>
+```
+
+**Gotcha:** bars move along the time axis only (never across rows) and are all-day spans with exclusive `end`; `progress` is 0-100. Scales are `day | week | month | quarter | year`. Zoom control, infinite scroll, summary rollups, and row checkboxes are ON by default - turn off what you do not need. Same `onEventUpdate`/`canDropEvent` commit pipeline as `event-calendar`; the root needs an explicit height.
+
 ## kanban
 
 **Required:** `value` (`Record<string, T[]>`), `onValueChange`, `getItemValue`

apps/web/src/components/layout/app-shell.tsx

@@ -46,7 +46,6 @@ import { AppsMenu } from '@/components/layout/apps-menu'
 import { CommandPalette, type CommandPaletteItem } from '@/components/layout/command-palette'
 import { NavUser } from '@/components/layout/nav-user'
 import { SystemMonitorPopover } from '@/components/layout/system-monitor-popover'
-import { ModeToggle } from '@/components/mode-toggle'
 import { can, isAuthEnabled, permissionForPath } from '@/lib/auth'
 
 interface NavItem {
@@ -219,7 +218,6 @@ export function AppShell({ children }: { children: ReactNode }) {
             <div className="ml-auto flex items-center gap-2">
               <AppsMenu />
               <SystemMonitorPopover />
-              <ModeToggle />
             </div>
           </header>
           <main className="flex flex-1 flex-col gap-4 px-4 py-4 md:gap-6 md:px-6 md:py-5">

apps/web/src/components/layout/nav-user.tsx

@@ -1,12 +1,20 @@
 import { Link } from '@tanstack/react-router'
+import { useEffect, useState } from 'react'
+import { useTheme } from 'next-themes'
 import {
   ChevronsUpDownIcon,
   ExternalLinkIcon,
   LogOutIcon,
+  MonitorIcon,
+  MoonIcon,
+  PaletteIcon,
   SettingsIcon,
+  SunIcon,
 } from 'lucide-react'
 
+import { cn } from '@evobgp/ui/lib/utils'
 import { Avatar, AvatarFallback } from '@evobgp/ui/components/avatar'
+import { Button } from '@evobgp/ui/components/button'
 import {
   DropdownMenu,
   DropdownMenuContent,
@@ -33,12 +41,71 @@ import {
   resetPortalHandoff,
 } from '@/lib/auth'
 
-/**
+/** Sidebar footer account menu — ReUI app-shell-1 NavUser. @see https://reui.io/preview/base/app-shell-1 */
- * Sidebar footer account menu.
+
- * Portal mode → shows JWT email + logout via auth-portal.
+const THEMES = [
- * Local mode  → shows the API-key hint + clears the local token.
+  {
- * @see https://reui.io/preview/base/app-shell-12
+    value: 'light',
- */
+    label: 'Светлая',
+    icon: <SunIcon className="size-3.5" aria-hidden />,
+  },
+  {
+    value: 'dark',
+    label: 'Тёмная',
+    icon: <MoonIcon className="size-3.5" aria-hidden />,
+  },
+  {
+    value: 'system',
+    label: 'Системная',
+    icon: <MonitorIcon className="size-3.5" aria-hidden />,
+  },
+] as const
+
+function ThemeSegmentedToggle() {
+  const { theme, setTheme } = useTheme()
+  const [mounted, setMounted] = useState(false)
+
+  useEffect(() => {
+    setMounted(true)
+  }, [])
+
+  const currentTheme = mounted ? (theme ?? 'system') : 'system'
+
+  return (
+    <div
+      role="radiogroup"
+      aria-label="Тема"
+      className="bg-muted/60 inline-flex items-center gap-0.5 rounded-full p-0.5"
+      onClick={(e) => e.stopPropagation()}
+      onPointerDown={(e) => e.stopPropagation()}
+    >
+      {THEMES.map(({ value, label, icon }) => {
+        const isActive = currentTheme === value
+        return (
+          <Button
+            key={value}
+            type="button"
+            role="radio"
+            aria-checked={isActive}
+            aria-label={label}
+            variant="ghost"
+            size="icon-xs"
+            onClick={() => setTheme(value)}
+            className={cn(
+              'rounded-full',
+              isActive
+                ? 'bg-background text-foreground shadow-sm'
+                : 'text-muted-foreground hover:text-foreground',
+            )}
+          >
+            {icon}
+          </Button>
+        )
+      })}
+    </div>
+  )
+}
+
 function initials(source: string): string {
   const base = source.trim()
   if (!base) return '?'
@@ -56,8 +123,7 @@ export function NavUser() {
 
   const name = claims?.name?.trim() || (authOn ? 'Пользователь' : 'Гость')
   const email =
-    claims?.email?.trim() ||
+    claims?.email?.trim() || (authOn ? '' : 'локальный API-токен')
-    (authOn ? '' : 'локальный API-токен')
   const fallback = initials(name || email)
 
   function handleSignOut() {
@@ -87,9 +153,7 @@ export function NavUser() {
             }
           >
             <Avatar className="size-8 rounded-lg">
-              <AvatarFallback className="rounded-lg text-xs">
+              <AvatarFallback className="rounded-lg text-xs">{fallback}</AvatarFallback>
-                {fallback}
-              </AvatarFallback>
             </Avatar>
             <div className="grid flex-1 text-left text-sm leading-tight">
               <span className="truncate font-semibold">{name}</span>
@@ -140,6 +204,13 @@ export function NavUser() {
                   Открыть Auth Portal
                 </DropdownMenuItem>
               ) : null}
+              <DropdownMenuItem className="cursor-default focus:bg-transparent">
+                <PaletteIcon aria-hidden />
+                Тема
+                <div className="ml-auto">
+                  <ThemeSegmentedToggle />
+                </div>
+              </DropdownMenuItem>
             </DropdownMenuGroup>
 
             <DropdownMenuSeparator />

apps/web/src/components/mode-toggle.tsx

@@ -1,29 +0,0 @@
-import { Moon, Sun } from 'lucide-react'
-import { useTheme } from 'next-themes'
-
-import { Button } from '@evobgp/ui/components/button'
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-} from '@evobgp/ui/components/dropdown-menu'
-
-export function ModeToggle() {
-  const { setTheme } = useTheme()
-
-  return (
-    <DropdownMenu>
-      <DropdownMenuTrigger render={<Button variant="ghost" size="icon" />}>
-        <Sun className="size-5 scale-100 rotate-0 transition-all dark:scale-0 dark:-rotate-90" />
-        <Moon className="absolute size-5 scale-0 rotate-90 transition-all dark:scale-100 dark:rotate-0" />
-        <span className="sr-only">Сменить тему</span>
-      </DropdownMenuTrigger>
-      <DropdownMenuContent align="end">
-        <DropdownMenuItem onClick={() => setTheme('light')}>Светлая</DropdownMenuItem>
-        <DropdownMenuItem onClick={() => setTheme('dark')}>Тёмная</DropdownMenuItem>
-        <DropdownMenuItem onClick={() => setTheme('system')}>Системная</DropdownMenuItem>
-      </DropdownMenuContent>
-    </DropdownMenu>
-  )
-}

apps/web/src/components/reui-kit/kpi-cols.ts

@@ -0,0 +1,10 @@
+/** Shared grid column classes for hybrid KPI / Quick Actions tiles. */
+export function kpiCols(count: number): string {
+  if (count <= 1) return 'grid-cols-1'
+  if (count === 2) return 'grid-cols-1 @xl:grid-cols-2'
+  if (count === 3) return 'grid-cols-1 @3xl:grid-cols-3'
+  if (count === 4) return 'grid-cols-1 @3xl:grid-cols-2 @6xl:grid-cols-4'
+  if (count === 5) return 'grid-cols-2 @3xl:grid-cols-3 xl:grid-cols-5'
+  if (count === 6) return 'grid-cols-2 sm:grid-cols-3 xl:grid-cols-6'
+  return 'grid-cols-2 sm:grid-cols-3 lg:grid-cols-4'
+}

apps/web/src/components/reui-kit/kpi-stat-grid.tsx

@@ -4,6 +4,7 @@ import { Link } from '@tanstack/react-router'
 import { Frame, FramePanel } from '@/components/reui/frame'
 import { Badge } from '@/components/reui/badge'
 import { cn } from '@evobgp/ui/lib/utils'
+import { kpiCols } from './kpi-cols'
 import { Item, ItemMedia } from '@evobgp/ui/components/item'
 import { Skeleton } from '@evobgp/ui/components/skeleton'
 
@@ -47,16 +48,6 @@ const VALUE_VARIANT_CLASS: Record<KpiStatVariant, string> = {
   destructive: 'text-destructive',
 }
 
-function kpiCols(count: number): string {
-  if (count <= 1) return 'grid-cols-1'
-  if (count === 2) return 'grid-cols-1 @xl:grid-cols-2'
-  if (count === 3) return 'grid-cols-1 @3xl:grid-cols-3'
-  if (count === 4) return 'grid-cols-1 @3xl:grid-cols-2 @6xl:grid-cols-4'
-  if (count === 5) return 'grid-cols-2 @3xl:grid-cols-3 xl:grid-cols-5'
-  if (count === 6) return 'grid-cols-2 sm:grid-cols-3 xl:grid-cols-6'
-  return 'grid-cols-2 sm:grid-cols-3 lg:grid-cols-4'
-}
-
 function handleCardKeyDown(onActivate: () => void, event: KeyboardEvent<HTMLDivElement>) {
   if (event.key === 'Enter' || event.key === ' ') {
     event.preventDefault()

apps/web/src/components/reui-kit/quick-action-grid.tsx

@@ -10,6 +10,7 @@ import {
 import { Badge } from '@/components/reui/badge'
 import { Item, ItemMedia } from '@evobgp/ui/components/item'
 import { cn } from '@evobgp/ui/lib/utils'
+import { kpiCols } from './kpi-cols'
 
 export interface QuickActionItem {
   id: string
@@ -30,16 +31,6 @@ interface QuickActionGridProps {
 
 const DEFAULT_ICON_CLASS = 'text-muted-foreground [&_svg]:text-current'
 
-function kpiCols(count: number): string {
-  if (count <= 1) return 'grid-cols-1'
-  if (count === 2) return 'grid-cols-1 @xl:grid-cols-2'
-  if (count === 3) return 'grid-cols-1 @3xl:grid-cols-3'
-  if (count === 4) return 'grid-cols-1 @3xl:grid-cols-2 @6xl:grid-cols-4'
-  if (count === 5) return 'grid-cols-2 @3xl:grid-cols-3 xl:grid-cols-5'
-  if (count === 6) return 'grid-cols-2 sm:grid-cols-3 xl:grid-cols-6'
-  return 'grid-cols-2 sm:grid-cols-3 lg:grid-cols-4'
-}
-
 function QuickActionBody({ action }: { action: QuickActionItem }) {
   return (
     <div className="relative z-10 flex h-full items-start gap-3">

apps/web/src/lib/auth.ts

@@ -259,6 +259,30 @@ export function can(required: string): boolean {
   return hasPermission(claims.permissions, required)
 }
 
+/**
+ * Whether /v1/auth/session may manage API keys (`bgp:access:admin`).
+ * Mirrors backend `requirePerm` for JWT (is_admin / permissions) and API-key operator.
+ */
+export function sessionCanManageApiKeys(session: {
+  role?: string
+  kind?: string
+  is_admin?: boolean
+  permissions?: readonly string[]
+} | null | undefined): boolean {
+  if (!session) return false
+  const jwtPath =
+    session.kind === 'jwt' ||
+    session.is_admin === true ||
+    (session.permissions?.length ?? 0) > 0
+  if (jwtPath) {
+    return (
+      session.is_admin === true ||
+      hasPermission(session.permissions ?? [], 'bgp:access:admin')
+    )
+  }
+  return session.role === 'operator'
+}
+
 /** Nav path → minimum permission to show the item. Sync with app-shell NAV. */
 export function permissionForPath(pathname: string): string | null {
   if (pathname === '/' || pathname.startsWith('/dashboard')) {

apps/web/src/routes/_auth/access.tsx

@@ -11,6 +11,7 @@ import { PageHeader } from '@/components/page-header'
 import { Badge } from '@/components/reui/badge'
 import { SectionCards, type SectionCardItem } from '@/components/section-cards'
 import { SectionCardsSkeleton } from '@/components/skeletons'
+import { sessionCanManageApiKeys } from '@/lib/auth'
 import { authSessionQueryOptions } from '@/queries/auth'
 import { apiKeysQueryOptions } from '@/queries/api-keys'
 
@@ -21,11 +22,11 @@ export const Route = createFileRoute('/_auth/access')({
 function AccessComponent() {
   const sessionQuery = useQuery(authSessionQueryOptions())
   const session = sessionQuery.data ?? null
-  const isOperator = session?.role === 'operator'
+  const canManageKeys = sessionCanManageApiKeys(session)
 
   const keysQuery = useQuery({
     ...apiKeysQueryOptions(),
-    enabled: isOperator,
+    enabled: canManageKeys,
   })
 
   const keys = keysQuery.data ?? []
@@ -73,16 +74,31 @@ function AccessComponent() {
 
   function refetchAll() {
     void sessionQuery.refetch()
-    if (isOperator) void keysQuery.refetch()
+    if (canManageKeys) void keysQuery.refetch()
   }
 
+  const sessionKindLabel =
+    session?.kind === 'jwt' ? 'Portal JWT' : session?.kind === 'apikey' ? 'API-ключ' : null
+
+  const sessionAccessLabel = (() => {
+    if (!session) return null
+    if (session.kind === 'jwt' || session.is_admin || (session.permissions?.length ?? 0) > 0) {
+      if (session.is_admin) return 'admin (portal)'
+      if (sessionCanManageApiKeys(session)) return 'bgp:access:admin'
+      return session.permissions?.length
+        ? session.permissions.slice(0, 3).join(', ')
+        : 'без access:admin'
+    }
+    return session.role || '—'
+  })()
+
   return (
     <div className="flex flex-col gap-6">
       <PageHeader
         title="Права доступа"
         description="API-ключи control plane и текущая сессия Bearer-токена."
         actions={
-          isOperator ? (
+          canManageKeys ? (
             <Button variant="outline" size="sm" onClick={refetchAll} disabled={refreshing}>
               <RefreshCw className={refreshing ? 'animate-spin' : ''} />
               Обновить
@@ -94,36 +110,48 @@ function AccessComponent() {
       {session ? (
         <PanelCard
           title="Текущая сессия"
-          description="Tenant и роль ключа, с которым открыта панель."
+          description="Tenant и права текущего Bearer (API-ключ или portal JWT)."
           contentClassName="grid gap-3 py-4 text-sm sm:grid-cols-2"
         >
+          <div>
+            <p className="text-muted-foreground">Tenant</p>
+            <p className="break-all font-mono text-xs">{session.tenant_id}</p>
+          </div>
+          <div>
+            <p className="text-muted-foreground">Доступ</p>
+            <p className="font-mono text-xs">{sessionAccessLabel}</p>
+          </div>
+          {sessionKindLabel ? (
             <div>
-              <p className="text-muted-foreground">Tenant</p>
+              <p className="text-muted-foreground">Тип</p>
-              <p className="break-all font-mono text-xs">{session.tenant_id}</p>
+              <p className="font-mono text-xs">{sessionKindLabel}</p>
             </div>
+          ) : null}
+          {session.email ? (
             <div>
-              <p className="text-muted-foreground">Роль</p>
+              <p className="text-muted-foreground">Email</p>
-              <p className="font-mono">{session.role}</p>
+              <p className="break-all text-xs">{session.email}</p>
             </div>
+          ) : null}
         </PanelCard>
       ) : (
         <PanelCard contentClassName="py-4 text-sm text-muted-foreground">
-            Не удалось определить сессию. Укажите токен в{' '}
+          Не удалось определить сессию. Укажите токен в{' '}
-            <Link
+          <Link
-              to="/settings"
+            to="/settings"
-              search={{ tab: 'connection' }}
+            search={{ tab: 'connection' }}
-              className="text-primary underline-offset-4 hover:underline"
+            className="text-primary underline-offset-4 hover:underline"
-            >
+          >
-              настройках
+            настройках
-            </Link>{' '}
+          </Link>{' '}
-            (для dev-окружения — <code className="text-xs">dev</code> при включённом demo-seed).
+          (для dev-окружения — <code className="text-xs">dev</code> при включённом demo-seed).
-            {sessionQuery.isError && sessionQuery.error instanceof Error ? (
+          {sessionQuery.isError && sessionQuery.error instanceof Error ? (
-              <span className="mt-2 block text-destructive">{sessionQuery.error.message}</span>
+            <span className="mt-2 block text-destructive">{sessionQuery.error.message}</span>
-            ) : null}
+          ) : null}
         </PanelCard>
       )}
 
-      {isOperator ? (
+      {canManageKeys ? (
         <>
           {keysQuery.isLoading ? (
             <SectionCardsSkeleton count={3} />
@@ -140,10 +168,9 @@ function AccessComponent() {
         </>
       ) : session ? (
         <PanelCard contentClassName="py-4 text-sm text-muted-foreground">
-          Управление API-ключами доступно только роли <strong>operator</strong>. Текущая роль:{' '}
+          Управление API-ключами доступно роли <strong>operator</strong> (API-ключ) или portal JWT
-          <span className="font-mono">{session.role}</span>. Для выдачи ключей войдите с
+          с <strong>is_admin</strong> / правом <code className="text-xs">bgp:access:admin</code>.
-          operator-ключом или создайте ключ через API / переменную{' '}
+          Текущий доступ: <span className="font-mono">{sessionAccessLabel}</span>.
-          <code className="text-xs">EVOBGP_API_KEYS</code>.
         </PanelCard>
       ) : null}
     </div>

apps/web/src/types/api.ts

@@ -341,13 +341,20 @@ export type JobsResponse = Page<JobRow>
 export type AppSettings = Record<string, unknown>
 
 // ---- Auth / API keys ----
+export type ApiKeyRole = 'viewer' | 'editor' | 'operator' | 'node'
+
+/** GET /v1/auth/session — API key has role; portal JWT uses kind/permissions/is_admin. */
 export type AuthSession = {
   tenant_id: string
-  role: 'viewer' | 'editor' | 'operator' | 'node'
+  /** API-key role; empty for portal JWT sessions. */
+  role: ApiKeyRole | ''
+  kind?: 'apikey' | 'jwt'
+  user_id?: string
+  email?: string
+  permissions?: string[]
+  is_admin?: boolean
 }
 
-export type ApiKeyRole = AuthSession['role']
-
 export type ApiKey = {
   id: string
   name: string

cmd/evobgp-all/main.go

@@ -42,6 +42,7 @@ func main() {
 		AuthPortalURL:           firstNonEmpty(os.Getenv("EVOBGP_AUTH_PORTAL_URL"), os.Getenv("AUTH_PORTAL_URL")),
 		PortalTenantID:          strings.TrimSpace(os.Getenv("EVOBGP_PORTAL_TENANT_ID")),
 		AuthRequired:            boolFromEnv("EVOBGP_AUTH_REQUIRED", "AUTH_REQUIRED"),
+		AuditIngestSecret:       firstNonEmpty(os.Getenv("EVOBGP_AUTH_AUDIT_INGEST_SECRET"), os.Getenv("AUTH_AUDIT_INGEST_SECRET")),
 	}
 	srv, err := httpapi.New(opts)
 	if err != nil {

cmd/evobgp-api/main.go

@@ -37,6 +37,7 @@ func main() {
 		AuthPortalURL:      firstNonEmpty(os.Getenv("EVOBGP_AUTH_PORTAL_URL"), os.Getenv("AUTH_PORTAL_URL")),
 		PortalTenantID:     strings.TrimSpace(os.Getenv("EVOBGP_PORTAL_TENANT_ID")),
 		AuthRequired:       boolFromEnv("EVOBGP_AUTH_REQUIRED", "AUTH_REQUIRED"),
+		AuditIngestSecret:  firstNonEmpty(os.Getenv("EVOBGP_AUTH_AUDIT_INGEST_SECRET"), os.Getenv("AUTH_AUDIT_INGEST_SECRET")),
 	}
 	srv, err := httpapi.New(opts)
 	if err != nil {

docs/access.md

@@ -12,6 +12,7 @@
 | `AUTH_JWT_SECRET` / `EVOBGP_AUTH_JWT_SECRET` | Тот же секрет, что `JWT_SECRET` портала (HS256) |
 | `AUTH_ISSUER` | Issuer JWT (как на портале) |
 | `AUTH_PORTAL_URL` | URL портала (также `GET /v1/auth/config`) |
+| `AUTH_AUDIT_INGEST_SECRET` / `EVOBGP_AUTH_AUDIT_INGEST_SECRET` | Shared secret для push CRUD audit в auth-portal (`POST /api/v1/ingest/audit`, `source_app=bgp`) |
 | `EVOBGP_PORTAL_TENANT_ID` | Fallback tenant для portal JWT, если в токене нет `bgp_tenant_id` / `tenants.bgp` |
 
 Источник tenant (по приоритету):
@@ -60,14 +61,18 @@ opkey|01ARZ3NDEKTSV4RRFFQ69G5FAV|operator,nodekey|01ARZ3NDEKTSV4RRFFQ69G5FAV|nod
 
 ### Управление через API и UI
 
-При подключённой БД operator может:
+При подключённой БД управлять ключами может:
 
-- `GET|POST /v1/api-keys`, `GET|PATCH|DELETE /v1/api-keys/{id}`, `POST /v1/api-keys/{id}/rotate` — см. OpenAPI, тег **API keys**.
+- API-ключ с ролью **`operator`**, или
-- В веб-панели: **Права доступа** (`/access`) → блок «API-ключи» (только для роли `operator`). Токен для браузера — в **Настройки** (`/settings`).
+- portal JWT с **`is_admin`** / правом **`bgp:access:admin`** (админ auth-portal).
+
+Эндпоинты: `GET|POST /v1/api-keys`, `GET|PATCH|DELETE /v1/api-keys/{id}`, `POST /v1/api-keys/{id}/rotate` — см. OpenAPI, тег **API keys**.
+
+В веб-панели: **Права доступа** (`/access`) → блок «API-ключи». Токен для браузера (API-key gate) — в **Настройки** (`/settings`).
 
 Полный токен возвращается **один раз** в ответе `201` (создание) и `200` (ротация). В списках — только `prefix` (первые 8 символов). В БД хранится SHA-256 токена, не plaintext.
 
-`GET /v1/auth/session` — текущие `tenant_id` и `role` (для UI).
+`GET /v1/auth/session` — `tenant_id`, `kind` (`apikey`|`jwt`), для API-ключа — `role`; для JWT — `user_id`, `email`, `permissions`, `is_admin`.
 
 ### Роли
 
@@ -178,13 +183,13 @@ http://localhost:5173,http://127.0.0.1:5173,https://ui.example.com
 
 ## Краткая матрица (ориентир)
 
-| Действие | viewer | editor | operator | node |
+| Действие | viewer | editor | operator | node | portal admin / `bgp:access:admin` |
-|----------|--------|--------|----------|------|
+|----------|--------|--------|----------|------|-----------------------------------|
-| GET модули, ревизии, peers, speakers | да | да | да | нет |
+| GET модули, ревизии, peers, speakers | да | да | да | нет | по permissions |
-| POST/PATCH/DELETE CRUD сущностей | нет | да | да | нет |
+| POST/PATCH/DELETE CRUD сущностей | нет | да | да | нет | по permissions |
-| apply, rollback, PATCH settings | нет | нет | да | нет |
+| apply, rollback, PATCH settings | нет | нет | да | нет | `bgp:operations:admin` |
-| Управление API-ключами (`/v1/api-keys`) | нет | нет | да | нет |
+| Управление API-ключами (`/v1/api-keys`) | нет | нет | да | нет | да |
-| bundle, latest revision, enroll | нет | нет | нет | да |
+| bundle, latest revision, enroll | нет | нет | нет | да | нет |
 
 Точные проверки по каждому маршруту — в коде `internal/httpapi` и в схеме безопасности операций в OpenAPI.
 

docs/api.md

@@ -116,6 +116,16 @@
 
 `{filename}` — только basename, паттерн `^[a-z0-9][a-z0-9_.-]*\.log$`. Очистка пишет строку в таблицу `runtime_log_cleanup_audit` (миграция `000026`).
 
+## CRUD audit (`/v1/audit`)
+
+Локальный журнал изменений CRUD (modules, peers, settings, API keys, …). Миграция `000030_audit_log`. Чтение — `bgp:monitoring:read` (viewer+).
+
+| Метод | Путь | Роль | Назначение |
+|-------|------|------|------------|
+| `GET` | `/v1/audit` | viewer+ | Пагинированный audit (`cursor`, `limit`, опционально `action`, `severity`) |
+
+При `AUTH_PORTAL_URL` + `AUTH_AUDIT_INGEST_SECRET` каждая запись дополнительно отправляется в auth-portal (`POST /api/v1/ingest/audit`, `source_app=bgp`).
+
 ## Соглашения из OpenAPI
 
 - Ошибки в стиле **RFC 9457** (`application/problem+json`): `type`, `title`, `status`, `detail`, и т.д.

docs/openapi.yaml

@@ -59,6 +59,8 @@ tags:
     description: Сессия текущего API-ключа (tenant и роль).
   - name: Monitoring
     description: Наблюдаемость PostgreSQL и корреляция (instance-level, viewer+). Maintenance — operator.
+  - name: Audit
+    description: Журнал CRUD-изменений tenant (локально + опциональный push в auth-portal). Чтение — bgp:monitoring:read.
   - name: Maintenance
     description: Политики обслуживания PostgreSQL (instance-scoped). CRUD и запуск — operator.
   - name: RuntimeLogs
@@ -676,13 +678,32 @@ components:
 
     AuthSession:
       type: object
-      required: [tenant_id, role]
+      required: [tenant_id, kind]
       properties:
         tenant_id:
           $ref: "#/components/schemas/ResourceId"
+        kind:
+          type: string
+          enum: [apikey, jwt]
+          description: apikey — Bearer API key; jwt — portal SSO token.
         role:
           type: string
-          enum: [viewer, editor, operator, node]
+          description: >
+            API-key role (viewer|editor|operator|node). Empty string for portal JWT sessions.
+        user_id:
+          type: string
+          description: JWT sub (portal sessions only).
+        email:
+          type: string
+          description: JWT email claim (portal sessions only).
+        permissions:
+          type: array
+          items:
+            type: string
+          description: JWT permissions (bgp:*); portal sessions only.
+        is_admin:
+          type: boolean
+          description: Portal is_admin claim; grants all bgp permissions.
 
     ApiKey:
       type: object
@@ -1278,6 +1299,70 @@ components:
         has_more:
           type: boolean
 
+    AuditSeverity:
+      type: string
+      enum: [info, warning, critical]
+
+    AuditLogEntry:
+      type: object
+      required:
+        [id, tenant_id, event_id, source_app, action, severity, summary, created_at]
+      properties:
+        id:
+          $ref: "#/components/schemas/ResourceId"
+        tenant_id:
+          $ref: "#/components/schemas/ResourceId"
+        event_id:
+          type: string
+          description: Stable id for portal ingest deduplication (prefix bgp-).
+        source_app:
+          type: string
+          enum: [bgp]
+        action:
+          type: string
+          description: Machine action key (e.g. bgp.module.create).
+        severity:
+          $ref: "#/components/schemas/AuditSeverity"
+        actor_user_id:
+          type: ["string", "null"]
+        actor_email:
+          type: ["string", "null"]
+        actor_name:
+          type: ["string", "null"]
+        actor_api_key_prefix:
+          type: ["string", "null"]
+        target_type:
+          type: ["string", "null"]
+          enum: [app_resource, null]
+        target_id:
+          type: ["string", "null"]
+        summary:
+          type: string
+        details:
+          type: ["object", "null"]
+          additionalProperties: true
+        ip:
+          type: ["string", "null"]
+        created_at:
+          type: string
+          format: date-time
+        portal_pushed_at:
+          type: ["string", "null"]
+          format: date-time
+
+    AuditLogList:
+      type: object
+      required: [items]
+      properties:
+        items:
+          type: array
+          items:
+            $ref: "#/components/schemas/AuditLogEntry"
+        next_cursor:
+          type: string
+        has_more:
+          type: boolean
+
     RuntimeLogAutoPolicy:
       type: object
       properties:
@@ -4501,6 +4586,40 @@ paths:
         default:
           $ref: "#/components/responses/DefaultProblem"
 
+  /v1/audit:
+    get:
+      tags: [Audit]
+      summary: Журнал CRUD audit tenant
+      description: |
+        Локальный журнал изменений (modules, peers, settings, API keys и т.д.).
+        При настроенных `AUTH_PORTAL_URL` + `AUTH_AUDIT_INGEST_SECRET` события также
+        отправляются в auth-portal ingest (`source_app=bgp`).
+      operationId: listAuditLog
+      parameters:
+        - $ref: "#/components/parameters/TenantId"
+        - $ref: "#/components/parameters/Cursor"
+        - $ref: "#/components/parameters/Limit"
+        - name: action
+          in: query
+          schema:
+            type: string
+          description: Filter by action prefix/key (exact match).
+        - name: severity
+          in: query
+          schema:
+            $ref: "#/components/schemas/AuditSeverity"
+      responses:
+        "200":
+          description: Успешно.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuditLogList"
+        "400":
+          $ref: "#/components/responses/BadRequest"
+        default:
+          $ref: "#/components/responses/DefaultProblem"
+
   /v1/settings:
     get:
       tags: [Settings]

docs/ui-design-contract.md

@@ -1,100 +1,119 @@
 # UI Design Contract (ops apps)
 
-Единый контракт для vps-tracker, CFDM и EvoBGP. Surface: **ReUI Frame**. Kit API: `apps/web/src/components/reui-kit/`.
+Единый контракт для **CFDM · vps-tracker · EvoBGP · EvoFirewall · auth-portal**.  
+Surface: **ReUI Frame**. Kit: `apps/web/src/components/reui-kit/`.  
+Иерархия: **ReUI PRO > shadcn primitives**.
 
-Карта: [llms.txt](https://reui.io/llms.txt) · [Styling](https://reui.io/docs/styling) · [License](https://reui.io/docs/license-setup) · [Blocks](https://reui.io/blocks)
+Карта: [llms.txt](https://reui.io/llms.txt) · [Styling](https://reui.io/docs/styling) · [License](https://reui.io/docs/license-setup) · [Blocks](https://reui.io/blocks) · [MCP](https://reui.io/docs/mcp)
 
 ## Surface
 
+Project lock: **`surface: frame`**. Ops / list / dashboard / detail / settings — только **Frame**, не shadcn Card как shell. Не смешивать Card и Frame на одном ops-экране.
+
 ```ts
-// apps/web/src/lib/ui-surface.ts
+// apps/web/src/lib/ui-surface.ts (где есть)
 export const UI_SURFACE = 'frame' as const
 ```
 
-Ops / list / dashboard / detail / settings — только **Frame**, не shadcn Card как shell. Не смешивать Card и Frame на одном ops-экране.
+Settings: секции через Frame + `gap` (без hairline `Separator` под PageHeader); `SettingRow` без `FieldSeparator` по умолчанию (`separated` opt-in). Preview: [settings-3](https://reui.io/preview/base/settings-3) · [settings-16](https://reui.io/preview/base/settings-16).
 
 ## Canonical PRO references
 
 | Зона | Block | Preview |
 |------|-------|---------|
 | Shell | `app-shell-12` (+ cmdk/monitor где нужно) | https://reui.io/preview/base/app-shell-12 · https://reui.io/preview/base/app-shell-7 |
-| KPI | horizontal compact hybrid (icon left + label/Badge + value ± variant; EvoBGP visual) | https://reui.io/preview/base/stats-12 |
+| KPI | horizontal compact hybrid (EvoBGP SoT: icon left + label/Badge + value ± variant) | https://reui.io/preview/base/stats-12 |
+| Quick Actions | Frame tiles (sibling KPI) + Badge «Перейти» | https://reui.io/preview/base/stats-12 · https://reui.io/preview/base/card-12 |
 | Dashboard | `dashboard-1` | https://reui.io/preview/base/dashboard-1 |
 | Lists | `data-grid-filtering-2` | https://reui.io/preview/base/data-grid-filtering-2 |
-| Settings | `settings-16` + SettingRow (`settings-7`) | https://reui.io/preview/base/settings-16 · https://reui.io/preview/base/settings-7 |
+| Settings | `settings-16` + SettingRow | https://reui.io/preview/base/settings-16 |
 | Auth | `auth-13` | https://reui.io/preview/base/auth-13 |
 | Empty | `empty-state-12` | https://reui.io/preview/base/empty-state-12 |
 | Forms | `form-7` → Sheet/Drawer | https://reui.io/preview/base/form-7 |
-| Lookup | `/lookup` — Frame form + `KpiStatGrid` + DataGrid | https://reui.io/preview/base/form-7 · https://reui.io/preview/base/stats-12 · https://reui.io/preview/base/data-grid-filtering-2 · https://reui.io/preview/base/empty-state-2 |
 
 ## Kit API (`reui-kit/`)
 
 | Component | Role |
 |-----------|------|
 | `ResourcePage` | Frame + line tabs + Filters + DataGrid |
-| `KpiStatGrid` | horizontal compact hybrid KPI tiles (`variant`, Badge) |
+| `KpiStatGrid` | EvoBGP hybrid KPI tiles (`items`/`cards`, `variant`, Badge) |
-| `QuickActionGrid` | KPI-like quick action tiles under KPI (gated by `ui_show_quick_actions`) |
+| `QuickActionGrid` | KPI-like quick action tiles (gated by `showQuickActions`) |
-| `OpsDashboard` | KPI + charts + attention queue |
+| `OpsDashboard` | KPI + optional `afterKpi` + charts + attention queue |
 | `SettingsShell` | settings nav + Outlet |
 | `DetailPanel` | detail Frame sections |
 | `filter-utils` | apply/clear ReUI Filters |
 
+`KpiStatGrid` / `QuickActionGrid` markup — SoT **EvoBGP**; в остальных apps diff только `@scope/ui` imports.
+
 ## Dashboard layout
 
 | App | Section order |
 |-----|---------------|
-| EvoBGP / CFDM | KPI → **QuickActionGrid** → charts / rest |
+| EvoBGP / CFDM / EvoFirewall | KPI → **QuickActionGrid** → charts / rest |
 | vps-tracker | banner → KPI → charts → attention → **QuickActionGrid** → CSV |
+| auth-portal | portal-specific; Quick Actions при наличии dashboard |
 
-Gating: KV `ui_show_quick_actions` in `global_settings` via `PATCH /v1/settings` (default `true`).
+Gating: DB `show_quick_actions` / `showQuickActions` / `ui_show_quick_actions` (default `true`).
 
 ## Shared App Shell chrome
 
-Эталон: **EvoBGP** production [`apps/web/src/components/layout/app-shell.tsx`](../apps/web/src/components/layout/app-shell.tsx) + ReUI [app-shell-12](https://reui.io/preview/base/app-shell-12).
+Эталон разметки: production apps + ReUI [app-shell-12](https://reui.io/preview/base/app-shell-12).  
-
+При переключении между apps меняются **только** sidebar nav labels/hrefs и `main` content.
-При переключении между vps-tracker / CFDM / EvoBGP меняются **только** sidebar nav labels/hrefs и `main` content. Разметка, ширина, фон и hover chrome идентичны.
 
 | Токен / зона | Значение |
 |--------------|----------|
-| `SIDEBAR_WIDTH` / `--sidebar-width` | `240px` (в `packages/ui` sidebar + Provider style) |
+| `SIDEBAR_WIDTH` / `--sidebar-width` | `240px` |
-| Sidebar / hover colors | theme `--sidebar` / `--sidebar-accent` из `globals.css` — **без** AppShell `color-mix` override |
+| Sidebar / hover colors | theme `--sidebar` / `--sidebar-accent` — **без** AppShell `color-mix` override |
 | Header | `h-12`, `sticky`, `border-b`, `px-4 md:px-6` |
 | Header left | `SidebarTrigger` + `Separator` + Breadcrumb |
-| Header right | **AppsMenu** → **SystemMonitorPopover** → **ModeToggle** (без Search в chrome) |
+| Header right | **AppsMenu** → **SystemMonitorPopover** (тема — в NavUser) |
-| Sidebar | AppSwitcher → groups (`SidebarGroupContent`) → icons `size-4` → **пустой** `SidebarFooter` |
+| Sidebar | AppSwitcher → groups → icons `size-4` → **NavUser** в `SidebarFooter` |
 | `main` | `gap-4 md:gap-6`, `px-4 py-4 md:px-6 md:py-5` |
 | Search | hotkey ⌘K / Ctrl+K only (не кнопка в header) |
 
-Запрещено в chrome: `SidebarRail`, `NavUser` footer, sync-row footer, Search/Ctrl+K pill в header, issues Badge в header, muted/hover cascade на right-cluster, Provider `color-mix` для `--sidebar*`.
+Запрещено в chrome: `SidebarRail`, sync-row footer, Search pill в header, issues Badge в header, `ModeToggle` в header (тема только в NavUser), Provider `color-mix` для `--sidebar*`.
 
-App Switcher: source of truth — auth-portal `GET /api/v1/app-switcher`. Id: `bgp`. Admin: portal `/admin/apps`.
+NavUser (footer): avatar + name/email; dropdown — Настройки / Тема (segmented) / Выйти. Preview: [app-shell-1](https://reui.io/preview/base/app-shell-1).
 
-QuickActionGrid icons: только semantic **text** (`text-info` / `text-primary` / …) на kit `bg-muted` — без solid `bg-primary` fills. Preview: [stats-12](https://reui.io/preview/base/stats-12).
+App Switcher: auth-portal `GET /api/v1/app-switcher`. Ids: `cfdm` · `vps` · `bgp` · `fw`. Admin: portal `/admin/apps`.
+
+QuickActionGrid / KPI icons: только semantic **text** (`text-info` / `text-primary` / …) на kit `bg-muted` — без solid fills.
 
 ## System monitor
 
-`SystemMonitorPopover` in app-shell header next to `ModeToggle` (после AppsMenu). Preview: https://reui.io/preview/base/app-shell-12 · https://reui.io/preview/base/app-shell-7
+`SystemMonitorPopover` in header after AppsMenu. Preview: https://reui.io/preview/base/app-shell-12 · https://reui.io/preview/base/app-shell-7
 
 ## MCP workflow
 
-1. MCP `user-reui` — `search` / `get_block` / `get_component` with `surface: "frame"`
+1. MCP `user-reui` — `search` / `get_block` / `compose_page` / `get_component` with `surface: "frame"`
 2. Cite `previewUrl` + `docsUrl`
 3. CLI from `apps/web`: `pnpm dlx shadcn@latest add @reui/...`
-4. Adapt into kit — do not hand-roll KPI/grid/settings rows
+4. Adapt into kit — do not hand-roll KPI / Quick Actions / grid / settings rows
 5. `validate_usage` / `get_audit_checklist`
 
-Primitives: MCP `plugin-shadcn-shadcn` + `@evobgp/ui`.
+Primitives: MCP `plugin-shadcn-shadcn` + project `@scope/ui` (`@cfdm/ui` / `@evobgp/ui` / `@evofw/ui` / `@authportal/ui`).
+
+## License
+
+```env
+# apps/web/.env.local (gitignored)
+REUI_LICENSE_KEY=
+```
+
+`apps/web/components.json` → `@reui` с `Authorization: Bearer ${REUI_LICENSE_KEY}`.
 
 ## Spacing
 
-- AppShell main: `gap-4 md:gap-6`, `px-4 py-4 md:px-6 md:py-5` (shared chrome)
+- AppShell main / PageShell: `gap-4 md:gap-6`, `px-4 py-4 md:px-6 md:py-5`
 - No `space-y-*` / `space-x-*` — use `flex` + `gap-*`
 - Max 1 primary CTA per screen
-- Semantic tokens only (`variant="success"|"info"|"warning"`) — no raw `bg-emerald-*`
+- Semantic tokens only — no raw `bg-emerald-*`
 
 ## Forbidden
 
 - Card as ops list/dashboard shell
-- Hand-rolled data tables when ReUI DataGrid exists
+- Hand-rolled data tables when ReUI DataGrid / `ResourcePage` exists
-- Hand-rolled KPI grids when `KpiStatGrid` exists
+- Hand-rolled KPI when `KpiStatGrid` exists
+- Hand-rolled Quick Actions when `QuickActionGrid` exists
+- SectionCards / DataGridCard as design эталон
 - Mixing Card and Frame surfaces on one ops screen

internal/audit/portal.go

@@ -0,0 +1,118 @@
+// Package audit pushes local audit events to auth-portal ingest API.
+package audit
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	"evobgp/internal/httpclient"
+	"evobgp/internal/store"
+)
+
+const ingestPath = "/api/v1/ingest/audit"
+
+// PortalPusher sends audit rows to auth-portal (best-effort, async-friendly).
+type PortalPusher struct {
+	BaseURL    string
+	Secret     string
+	HTTPClient *http.Client
+	MarkPushed func(id string) error
+}
+
+// PushEvent posts one audit entry to portal ingest.
+func (p *PortalPusher) PushEvent(ctx context.Context, entry *store.AuditEntry) error {
+	if p == nil || entry == nil {
+		return nil
+	}
+	base := strings.TrimRight(strings.TrimSpace(p.BaseURL), "/")
+	secret := strings.TrimSpace(p.Secret)
+	if base == "" || secret == "" {
+		return nil
+	}
+	hc := p.HTTPClient
+	if hc == nil {
+		hc = httpclient.New(15 * time.Second)
+	}
+	body := map[string]any{
+		"events": []map[string]any{p.eventPayload(entry)},
+	}
+	raw, err := json.Marshal(body)
+	if err != nil {
+		return fmt.Errorf("audit: marshal ingest: %w", err)
+	}
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, base+ingestPath, bytes.NewReader(raw))
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("Authorization", "Bearer "+secret)
+	resp, err := hc.Do(req)
+	if err != nil {
+		return fmt.Errorf("audit: portal ingest: %w", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode >= 300 {
+		b, _ := io.ReadAll(io.LimitReader(resp.Body, 4096))
+		return fmt.Errorf("audit: portal ingest %s: %s", resp.Status, strings.TrimSpace(string(b)))
+	}
+	if p.MarkPushed != nil {
+		if err := p.MarkPushed(entry.ID); err != nil {
+			log.Printf("audit: mark portal pushed id=%s: %v", entry.ID, err)
+		}
+	}
+	return nil
+}
+
+func (p *PortalPusher) eventPayload(entry *store.AuditEntry) map[string]any {
+	ev := map[string]any{
+		"event_id":   entry.EventID,
+		"source_app": store.AuditSourceAppBGP,
+		"action":     entry.Action,
+		"severity":   entry.Severity,
+		"summary":    entry.Summary,
+		"created_at": entry.CreatedAt.UTC().Format(time.RFC3339Nano),
+	}
+	if entry.ActorUserID != "" {
+		ev["actor_user_id"] = entry.ActorUserID
+	} else {
+		ev["actor_user_id"] = nil
+	}
+	if entry.ActorEmail != "" {
+		ev["actor_email"] = entry.ActorEmail
+	} else {
+		ev["actor_email"] = nil
+	}
+	if entry.ActorName != "" {
+		ev["actor_name"] = entry.ActorName
+	} else {
+		ev["actor_name"] = nil
+	}
+	if entry.TargetType != "" {
+		ev["target_type"] = entry.TargetType
+	} else {
+		ev["target_type"] = nil
+	}
+	if entry.TargetID != "" {
+		ev["target_id"] = entry.TargetID
+	} else {
+		ev["target_id"] = nil
+	}
+	if entry.Details != nil {
+		ev["details"] = entry.Details
+	} else {
+		ev["details"] = nil
+	}
+	if entry.IP != "" {
+		ev["ip"] = entry.IP
+	} else {
+		ev["ip"] = nil
+	}
+	return ev
+}

internal/audit/portal_test.go

@@ -0,0 +1,63 @@
+package audit
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"evobgp/internal/store"
+)
+
+func TestPortalPusherPushEvent(t *testing.T) {
+	var got struct {
+		Events []map[string]any `json:"events"`
+	}
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != ingestPath {
+			t.Fatalf("path=%s", r.URL.Path)
+		}
+		if r.Header.Get("Authorization") != "Bearer test-secret" {
+			t.Fatalf("auth=%q", r.Header.Get("Authorization"))
+		}
+		_ = json.NewDecoder(r.Body).Decode(&got)
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]int{"accepted": 1, "duplicates": 0})
+	}))
+	defer srv.Close()
+
+	marked := false
+	p := &PortalPusher{
+		BaseURL: srv.URL,
+		Secret:  "test-secret",
+		MarkPushed: func(id string) error {
+			marked = id == "local-id"
+			return nil
+		},
+	}
+	entry := &store.AuditEntry{
+		ID:         "local-id",
+		EventID:    "bgp-test-event",
+		Action:     "bgp.module.create",
+		Severity:   store.AuditSeverityInfo,
+		Summary:    "Created module",
+		SourceApp:  store.AuditSourceAppBGP,
+		CreatedAt:  time.Now().UTC(),
+		TargetType: store.AuditTargetAppResource,
+		TargetID:   "mod-1",
+	}
+	if err := p.PushEvent(context.Background(), entry); err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Events) != 1 {
+		t.Fatalf("events=%d", len(got.Events))
+	}
+	if got.Events[0]["source_app"] != "bgp" {
+		t.Fatalf("source_app=%v", got.Events[0]["source_app"])
+	}
+	if !marked {
+		t.Fatal("expected mark pushed")
+	}
+}

internal/httpapi/routes.go

@@ -83,6 +83,7 @@ func (s *Server) registerV1(m *http.ServeMux) {
 	m.HandleFunc("GET /speakers/{speaker_id}/bundle/{revision_id}", s.handleNodeBundle)
 	m.HandleFunc("POST /nodes/enroll", s.handleNodeEnroll)
 	s.registerCRUDRoutes(m)
+	s.registerAuditRoutes(m)
 	s.registerPostgresMonitoringRoutes(m)
 	s.registerPostgresMaintenanceRoutes(m)
 	s.registerMaintenanceRoutes(m)

internal/httpapi/routes_api_keys.go

@@ -131,6 +131,7 @@ func (s *Server) handlePostAPIKey(w http.ResponseWriter, r *http.Request) {
 	}
 	out := apiKeyJSON(&created.APIKey)
 	out["token"] = created.Token
+	s.recordCRUDAudit(r, a, "bgp.api_key.create", "Created API key "+created.Name, created.ID, map[string]any{"api_key_id": created.ID, "role": created.Role})
 	writeJSON(w, http.StatusCreated, out)
 }
 
@@ -187,6 +188,7 @@ func (s *Server) handlePatchAPIKey(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusInternalServerError, "Internal Server Error", "failed to reload api keys")
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.api_key.update", "Updated API key "+k.Name, k.ID, map[string]any{"api_key_id": k.ID, "role": k.Role})
 	writeJSON(w, http.StatusOK, apiKeyJSON(k))
 }
 
@@ -195,7 +197,8 @@ func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
 	if !ok || !s.requirePerm(w, a, "bgp:access:admin") {
 		return
 	}
-	if err := s.store.RevokeAPIKey(a.TenantID, r.PathValue("id")); err != nil {
+	keyID := r.PathValue("id")
+	if err := s.store.RevokeAPIKey(a.TenantID, keyID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
@@ -203,6 +206,7 @@ func (s *Server) handleDeleteAPIKey(w http.ResponseWriter, r *http.Request) {
 		writeProblem(w, http.StatusInternalServerError, "Internal Server Error", "failed to reload api keys")
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.api_key.revoke", "Revoked API key", keyID, map[string]any{"api_key_id": keyID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -222,5 +226,6 @@ func (s *Server) handleRotateAPIKey(w http.ResponseWriter, r *http.Request) {
 	}
 	out := apiKeyJSON(&rotated.APIKey)
 	out["token"] = rotated.Token
+	s.recordCRUDAudit(r, a, "bgp.api_key.rotate", "Rotated API key "+rotated.Name, rotated.ID, map[string]any{"api_key_id": rotated.ID})
 	writeJSON(w, http.StatusOK, out)
 }

internal/httpapi/routes_audit.go

@@ -0,0 +1,171 @@
+package httpapi
+
+import (
+	"context"
+	"log"
+	"net"
+	"net/http"
+	"strings"
+	"time"
+
+	"evobgp/internal/audit"
+	"evobgp/internal/store"
+)
+
+func (s *Server) registerAuditRoutes(m *http.ServeMux) {
+	m.HandleFunc("GET /audit", s.handleListAudit)
+}
+
+func (s *Server) handleListAudit(w http.ResponseWriter, r *http.Request) {
+	a, ok := authFromContext(r.Context())
+	if !ok || !s.requirePerm(w, a, "bgp:monitoring:read") {
+		return
+	}
+	cursor := r.URL.Query().Get("cursor")
+	limit := parseLimitQuery(r, 20, 200)
+	filter := store.AuditListFilter{
+		Action:   strings.TrimSpace(r.URL.Query().Get("action")),
+		Severity: strings.TrimSpace(r.URL.Query().Get("severity")),
+	}
+	if filter.Severity != "" && !store.ValidAuditSeverity(filter.Severity) {
+		writeProblem(w, http.StatusBadRequest, "Bad Request", "invalid severity")
+		return
+	}
+	items, next, hasMore, err := s.store.ListAudit(a.TenantID, cursor, limit, filter)
+	if err != nil {
+		writeInternalError(w, "audit_list", err)
+		return
+	}
+	out := make([]map[string]any, 0, len(items))
+	for _, row := range items {
+		out = append(out, auditEntryJSON(row))
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"items": out, "next_cursor": next, "has_more": hasMore})
+}
+
+func auditEntryJSON(row *store.AuditEntry) map[string]any {
+	if row == nil {
+		return map[string]any{}
+	}
+	m := map[string]any{
+		"id":                   row.ID,
+		"tenant_id":            row.TenantID,
+		"event_id":             row.EventID,
+		"source_app":           row.SourceApp,
+		"action":               row.Action,
+		"severity":             row.Severity,
+		"actor_user_id":        strPtrOrNull(row.ActorUserID),
+		"actor_email":          strPtrOrNull(row.ActorEmail),
+		"actor_name":           strPtrOrNull(row.ActorName),
+		"actor_api_key_prefix": strPtrOrNull(row.ActorAPIKeyPrefix),
+		"target_type":          strPtrOrNull(row.TargetType),
+		"target_id":            strPtrOrNull(row.TargetID),
+		"summary":              row.Summary,
+		"details":              row.Details,
+		"ip":                   strPtrOrNull(row.IP),
+		"created_at":           row.CreatedAt.UTC().Format(time.RFC3339Nano),
+		"portal_pushed_at":     nil,
+	}
+	if row.PortalPushedAt != nil {
+		m["portal_pushed_at"] = row.PortalPushedAt.UTC().Format(time.RFC3339Nano)
+	}
+	if m["details"] == nil {
+		m["details"] = nil
+	}
+	return m
+}
+
+func (s *Server) recordCRUDAudit(r *http.Request, a Auth, action, summary, targetID string, details map[string]any) {
+	if s == nil || s.store == nil {
+		return
+	}
+	in := store.AuditAppendInput{
+		TenantID:   a.TenantID,
+		Action:     action,
+		Severity:   store.AuditSeverityInfo,
+		TargetType: store.AuditTargetAppResource,
+		TargetID:   targetID,
+		Summary:    summary,
+		Details:    details,
+		IP:         clientIP(r),
+	}
+	fillAuditActor(&in, a)
+	entry, err := s.store.AppendAudit(in)
+	if err != nil {
+		log.Printf("httpapi: audit append action=%s: %v", action, err)
+		return
+	}
+	s.pushAuditToPortal(entry)
+}
+
+func fillAuditActor(in *store.AuditAppendInput, a Auth) {
+	if in == nil {
+		return
+	}
+	if a.Kind == AuthKindJWT {
+		in.ActorUserID = strings.TrimSpace(a.UserID)
+		in.ActorEmail = strings.TrimSpace(a.Email)
+		if in.ActorEmail != "" {
+			in.ActorName = in.ActorEmail
+		}
+		return
+	}
+	prefix := actorPrefix(a)
+	in.ActorAPIKeyPrefix = prefix
+	if prefix != "" {
+		in.ActorName = "apikey:" + prefix
+	}
+}
+
+func (s *Server) pushAuditToPortal(entry *store.AuditEntry) {
+	if s == nil || s.auditPusher == nil || entry == nil {
+		return
+	}
+	pusher := s.auditPusher
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+		defer cancel()
+		if err := pusher.PushEvent(ctx, entry); err != nil {
+			log.Printf("httpapi: audit portal push event_id=%s: %v", entry.EventID, err)
+		}
+	}()
+}
+
+func clientIP(r *http.Request) string {
+	if r == nil {
+		return ""
+	}
+	if xff := strings.TrimSpace(r.Header.Get("X-Forwarded-For")); xff != "" {
+		parts := strings.Split(xff, ",")
+		if len(parts) > 0 {
+			return strings.TrimSpace(parts[0])
+		}
+	}
+	if xrip := strings.TrimSpace(r.Header.Get("X-Real-IP")); xrip != "" {
+		return xrip
+	}
+	host, _, err := net.SplitHostPort(strings.TrimSpace(r.RemoteAddr))
+	if err != nil {
+		return strings.TrimSpace(r.RemoteAddr)
+	}
+	return host
+}
+
+// initAuditPusher wires portal push when URL and secret are configured.
+func (s *Server) initAuditPusher(portalURL, ingestSecret string) {
+	base := strings.TrimSpace(portalURL)
+	secret := strings.TrimSpace(ingestSecret)
+	if base == "" || secret == "" {
+		return
+	}
+	s.auditPusher = &audit.PortalPusher{
+		BaseURL: base,
+		Secret:  secret,
+		MarkPushed: func(id string) error {
+			if s.store == nil {
+				return nil
+			}
+			return s.store.MarkAuditPortalPushed(id)
+		},
+	}
+}

internal/httpapi/routes_audit_test.go

@@ -0,0 +1,52 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"evobgp/internal/store"
+)
+
+func TestHandleListAudit(t *testing.T) {
+	mem := store.NewMemory()
+	mem.SeedDemo()
+	tenant, _, _, _, _ := mem.DemoIDs()
+
+	srv, err := New(Options{SeedDemo: false, InsecureDev: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv.store = mem
+
+	_, err = mem.AppendAudit(store.AuditAppendInput{
+		TenantID: tenant,
+		Action:   "bgp.module.create",
+		Summary:  "Created module demo",
+		TargetID: "mod-x",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/audit", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	rec := httptest.NewRecorder()
+	srv.Handler().ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var body struct {
+		Items []map[string]any `json:"items"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	if len(body.Items) != 1 {
+		t.Fatalf("items=%d", len(body.Items))
+	}
+	if body.Items[0]["action"] != "bgp.module.create" {
+		t.Fatalf("action=%v", body.Items[0]["action"])
+	}
+}

internal/httpapi/routes_crud.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"log"
 	"net/http"
+	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -113,6 +114,7 @@ func (s *Server) handlePostModule(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.module.create", "Created module "+mod.Name, mod.ID, map[string]any{"module_id": mod.ID, "type": mod.Type, "name": mod.Name})
 	writeJSON(w, http.StatusCreated, moduleJSON(mod))
 }
 
@@ -174,6 +176,7 @@ func (s *Server) handlePatchModule(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.module.update", "Updated module "+mod.Name, mod.ID, map[string]any{"module_id": mod.ID, "name": mod.Name})
 	writeJSON(w, http.StatusOK, moduleJSON(mod))
 }
 
@@ -193,6 +196,7 @@ func (s *Server) handleDeleteModule(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.module.delete", "Deleted module", moduleID, map[string]any{"module_id": moduleID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -369,6 +373,7 @@ func (s *Server) handlePostCDNSource(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.cdn_source.create", "Created CDN source", x.ID, map[string]any{"module_id": mid, "source_id": x.ID, "url": x.URL})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "cdn_source_create")
 	writeJSON(w, http.StatusCreated, cdnSourceJSON(x))
 }
@@ -399,6 +404,7 @@ func (s *Server) handlePatchCDNSource(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.cdn_source.update", "Updated CDN source", x.ID, map[string]any{"module_id": mid, "source_id": x.ID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "cdn_source_patch")
 	writeJSON(w, http.StatusOK, cdnSourceJSON(x))
 }
@@ -409,10 +415,12 @@ func (s *Server) handleDeleteCDNSource(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteCDNSource(a.TenantID, mid, r.PathValue("source_id")); err != nil {
+	sourceID := r.PathValue("source_id")
+	if err := s.store.DeleteCDNSource(a.TenantID, mid, sourceID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.cdn_source.delete", "Deleted CDN source", sourceID, map[string]any{"module_id": mid, "source_id": sourceID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "cdn_source_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
@@ -471,6 +479,7 @@ func (s *Server) handlePostAS(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.as_entry.create", "Created AS entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "asn": x.ASN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "as_entry_create")
 	writeJSON(w, http.StatusCreated, asEntryJSON(x))
 }
@@ -491,6 +500,7 @@ func (s *Server) handlePatchAS(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.as_entry.update", "Updated AS entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "asn": x.ASN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "as_entry_patch")
 	writeJSON(w, http.StatusOK, asEntryJSON(x))
 }
@@ -501,10 +511,12 @@ func (s *Server) handleDeleteAS(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteASEntry(a.TenantID, mid, r.PathValue("entry_id")); err != nil {
+	entryID := r.PathValue("entry_id")
+	if err := s.store.DeleteASEntry(a.TenantID, mid, entryID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.as_entry.delete", "Deleted AS entry", entryID, map[string]any{"module_id": mid, "entry_id": entryID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "as_entry_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
@@ -548,6 +560,7 @@ func (s *Server) handlePostDomain(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.domain_entry.create", "Created domain entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "fqdn": x.FQDN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "domain_entry_create")
 	writeJSON(w, http.StatusCreated, domainEntryJSON(x))
 }
@@ -568,6 +581,7 @@ func (s *Server) handlePatchDomain(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.domain_entry.update", "Updated domain entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "fqdn": x.FQDN})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "domain_entry_patch")
 	writeJSON(w, http.StatusOK, domainEntryJSON(x))
 }
@@ -578,10 +592,12 @@ func (s *Server) handleDeleteDomain(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteDomainEntry(a.TenantID, mid, r.PathValue("entry_id")); err != nil {
+	entryID := r.PathValue("entry_id")
+	if err := s.store.DeleteDomainEntry(a.TenantID, mid, entryID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.domain_entry.delete", "Deleted domain entry", entryID, map[string]any{"module_id": mid, "entry_id": entryID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "domain_entry_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
@@ -625,6 +641,7 @@ func (s *Server) handlePostIPRange(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.ip_range.create", "Created IP range entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "prefix": x.Prefix})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "ip_range_create")
 	writeJSON(w, http.StatusCreated, ipRangeJSON(x))
 }
@@ -645,6 +662,7 @@ func (s *Server) handlePatchIPRange(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.ip_range.update", "Updated IP range entry", x.ID, map[string]any{"module_id": mid, "entry_id": x.ID, "prefix": x.Prefix})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "ip_range_patch")
 	writeJSON(w, http.StatusOK, ipRangeJSON(x))
 }
@@ -655,10 +673,12 @@ func (s *Server) handleDeleteIPRange(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	mid := r.PathValue("module_id")
-	if err := s.store.DeleteIPRangeEntry(a.TenantID, mid, r.PathValue("entry_id")); err != nil {
+	entryID := r.PathValue("entry_id")
+	if err := s.store.DeleteIPRangeEntry(a.TenantID, mid, entryID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.ip_range.delete", "Deleted IP range entry", entryID, map[string]any{"module_id": mid, "entry_id": entryID})
 	s.enqueueModuleRefreshIfEnabled(a.TenantID, mid, "ip_range_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
@@ -850,6 +870,7 @@ func (s *Server) handlePostDoh(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.doh_profile.create", "Created DoH profile "+x.Name, x.ID, map[string]any{"profile_id": x.ID, "name": x.Name})
 	writeJSON(w, http.StatusCreated, dohJSON(x))
 }
 
@@ -868,6 +889,7 @@ func (s *Server) handlePatchDoh(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.doh_profile.update", "Updated DoH profile "+x.Name, x.ID, map[string]any{"profile_id": x.ID, "name": x.Name})
 	writeJSON(w, http.StatusOK, dohJSON(x))
 }
 
@@ -876,10 +898,12 @@ func (s *Server) handleDeleteDoh(w http.ResponseWriter, r *http.Request) {
 	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
-	if err := s.store.DeleteDohProfile(a.TenantID, r.PathValue("id")); err != nil {
+	profileID := r.PathValue("id")
+	if err := s.store.DeleteDohProfile(a.TenantID, profileID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.doh_profile.delete", "Deleted DoH profile", profileID, map[string]any{"profile_id": profileID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -936,6 +960,7 @@ func (s *Server) handlePostComm(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.community.create", "Created community "+x.Community, x.ID, map[string]any{"community_id": x.ID, "community": x.Community})
 	writeJSON(w, http.StatusCreated, commJSON(x))
 }
 
@@ -954,6 +979,7 @@ func (s *Server) handlePatchComm(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.community.update", "Updated community "+x.Community, x.ID, map[string]any{"community_id": x.ID, "community": x.Community})
 	writeJSON(w, http.StatusOK, commJSON(x))
 }
 
@@ -962,10 +988,12 @@ func (s *Server) handleDeleteComm(w http.ResponseWriter, r *http.Request) {
 	if !ok || !s.requirePerm(w, a, "bgp:directories:write") {
 		return
 	}
-	if err := s.store.DeleteCommunity(a.TenantID, r.PathValue("id")); err != nil {
+	commID := r.PathValue("id")
+	if err := s.store.DeleteCommunity(a.TenantID, commID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.community.delete", "Deleted community", commID, map[string]any{"community_id": commID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -988,6 +1016,7 @@ func (s *Server) handlePostPeer(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.peer.create", "Created BGP peer "+x.Name, x.ID, map[string]any{"peer_id": x.ID, "neighbor": x.Neighbor})
 	s.enqueuePeerReconcile(a.TenantID, "peer_create")
 	writeJSON(w, http.StatusCreated, peerJSON(x))
 }
@@ -1031,6 +1060,7 @@ func (s *Server) handlePatchPeer(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.peer.update", "Updated BGP peer "+x.Name, x.ID, map[string]any{"peer_id": x.ID, "neighbor": x.Neighbor})
 	s.enqueuePeerReconcile(a.TenantID, "peer_patch")
 	writeJSON(w, http.StatusOK, peerJSON(x))
 }
@@ -1051,6 +1081,7 @@ func (s *Server) handleDeletePeer(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.peer.delete", "Deleted BGP peer", peerID, map[string]any{"peer_id": peerID})
 	s.enqueuePeerReconcile(a.TenantID, "peer_delete")
 	w.WriteHeader(http.StatusNoContent)
 }
@@ -1074,6 +1105,7 @@ func (s *Server) handlePostSpeaker(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.speaker.create", "Created speaker "+x.ID, x.ID, map[string]any{"speaker_id": x.ID, "role": x.Role})
 	resp := speakerJSONFromStore(s.store, x)
 	if meta := store.ParseSpeakerMeta(x.MetaJSON); meta.AgentSecret != "" {
 		resp["agent_secret"] = meta.AgentSecret
@@ -1109,6 +1141,7 @@ func (s *Server) handlePatchSpeaker(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.speaker.update", "Updated speaker "+x.ID, x.ID, map[string]any{"speaker_id": x.ID, "role": x.Role})
 	writeJSON(w, http.StatusOK, speakerJSONFromStore(s.store, x))
 }
 
@@ -1117,10 +1150,12 @@ func (s *Server) handleDeleteSpeaker(w http.ResponseWriter, r *http.Request) {
 	if !ok || !s.requirePerm(w, a, "bgp:network:write") {
 		return
 	}
-	if err := s.store.DeleteSpeaker(a.TenantID, r.PathValue("speaker_id")); err != nil {
+	speakerID := r.PathValue("speaker_id")
+	if err := s.store.DeleteSpeaker(a.TenantID, speakerID); err != nil {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.speaker.delete", "Deleted speaker", speakerID, map[string]any{"speaker_id": speakerID})
 	w.WriteHeader(http.StatusNoContent)
 }
 
@@ -1187,9 +1222,22 @@ func (s *Server) handlePatchSettings(w http.ResponseWriter, r *http.Request) {
 		writeStoreErr(w, err)
 		return
 	}
+	s.recordCRUDAudit(r, a, "bgp.settings.update", "Updated tenant settings", a.TenantID, map[string]any{"keys": settingsAuditKeys(body)})
 	writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 }
 
+func settingsAuditKeys(body map[string]any) []string {
+	if len(body) == 0 {
+		return nil
+	}
+	keys := make([]string, 0, len(body))
+	for k := range body {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
 func parseRevisionRetentionMinutes(v any) (int, bool) {
 	const minMinutes = 15
 	const maxMinutes = 30 * 24 * 60

internal/httpapi/server.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"evobgp/internal/audit"
 	"evobgp/internal/jobs"
 	"evobgp/internal/maintenance"
 	"evobgp/internal/pgmonitor"
@@ -38,11 +39,13 @@ type Server struct {
 	mux                     *http.ServeMux
 
 	// Portal / dual-auth (JWT) configuration.
-	jwtSecret      string
+	jwtSecret         string
-	authIssuer     string
+	authIssuer        string
-	authPortalURL  string
+	authPortalURL     string
-	portalTenantID string
+	portalTenantID    string
-	authRequired   bool
+	authRequired      bool
+	auditIngestSecret string
+	auditPusher       *audit.PortalPusher
 }
 
 // Options configures the API server.
@@ -63,6 +66,8 @@ type Options struct {
 	AuthPortalURL  string // AUTH_PORTAL_URL (returned by /v1/auth/config for the UI)
 	PortalTenantID string // fallback when JWT has no bgp_tenant_id / tenants.bgp
 	AuthRequired   bool   // AUTH_REQUIRED / EVOBGP_AUTH_REQUIRED (surfaced via /v1/auth/config)
+	// AuditIngestSecret — AUTH_AUDIT_INGEST_SECRET for portal push (optional).
+	AuditIngestSecret string
 }
 
 // New constructs Server and wiring for async jobs.
@@ -123,10 +128,12 @@ func New(opts Options) (*Server, error) {
 		authPortalURL:           strings.TrimSpace(opts.AuthPortalURL),
 		portalTenantID:          strings.TrimSpace(opts.PortalTenantID),
 		authRequired:            opts.AuthRequired,
+		auditIngestSecret:       strings.TrimSpace(opts.AuditIngestSecret),
 	}
 	if s.authIssuer == "" {
 		s.authIssuer = "https://auth.shnt.top"
 	}
+	s.initAuditPusher(s.authPortalURL, s.auditIngestSecret)
 	s.mux = http.NewServeMux()
 	s.registerRoutes()
 	return s, nil

internal/repository/postgres_audit.go

@@ -0,0 +1,186 @@
+package repository
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+
+	"evobgp/internal/store"
+)
+
+// AppendAudit inserts a tenant-scoped audit row.
+func (p *Postgres) AppendAudit(in store.AuditAppendInput) (*store.AuditEntry, error) {
+	if strings.TrimSpace(in.TenantID) == "" || strings.TrimSpace(in.Action) == "" || strings.TrimSpace(in.Summary) == "" {
+		return nil, store.ErrInvalidInput
+	}
+	sev := strings.TrimSpace(in.Severity)
+	if sev == "" {
+		sev = store.AuditSeverityInfo
+	}
+	if !store.ValidAuditSeverity(sev) {
+		return nil, store.ErrInvalidInput
+	}
+	ctx := context.Background()
+	id := uuid.NewString()
+	eventID := "bgp-" + uuid.NewString()
+	var detailJSON []byte
+	if in.Details != nil {
+		detailJSON, _ = json.Marshal(in.Details)
+	}
+	var createdAt time.Time
+	err := p.pool.QueryRow(ctx, `
+		INSERT INTO audit_log
+			(id, tenant_id, event_id, source_app, action, severity,
+			 actor_user_id, actor_email, actor_name, actor_api_key_prefix,
+			 target_type, target_id, summary, details_json, ip, created_at)
+		VALUES ($1, $2, $3, 'bgp', $4, $5, $6, $7, $8, $9, $10, $11, $12, $13::jsonb, $14, now())
+		RETURNING created_at`,
+		id, strings.TrimSpace(in.TenantID), eventID, strings.TrimSpace(in.Action), sev,
+		nullIfEmpty(in.ActorUserID), nullIfEmpty(in.ActorEmail), nullIfEmpty(in.ActorName),
+		nullIfEmpty(in.ActorAPIKeyPrefix), nullIfEmpty(in.TargetType), nullIfEmpty(in.TargetID),
+		strings.TrimSpace(in.Summary), nullJSONBytes(detailJSON), nullIfEmpty(in.IP),
+	).Scan(&createdAt)
+	if err != nil {
+		return nil, err
+	}
+	return &store.AuditEntry{
+		ID:                id,
+		TenantID:          strings.TrimSpace(in.TenantID),
+		EventID:           eventID,
+		SourceApp:         store.AuditSourceAppBGP,
+		Action:            strings.TrimSpace(in.Action),
+		Severity:          sev,
+		ActorUserID:       strings.TrimSpace(in.ActorUserID),
+		ActorEmail:        strings.TrimSpace(in.ActorEmail),
+		ActorName:         strings.TrimSpace(in.ActorName),
+		ActorAPIKeyPrefix: strings.TrimSpace(in.ActorAPIKeyPrefix),
+		TargetType:        strings.TrimSpace(in.TargetType),
+		TargetID:          strings.TrimSpace(in.TargetID),
+		Summary:           strings.TrimSpace(in.Summary),
+		Details:           in.Details,
+		IP:                strings.TrimSpace(in.IP),
+		CreatedAt:         createdAt.UTC(),
+	}, nil
+}
+
+// ListAudit returns paginated audit rows for a tenant.
+func (p *Postgres) ListAudit(tenantID, cursor string, limit int, filter store.AuditListFilter) ([]*store.AuditEntry, string, bool, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	off := 0
+	if cursor != "" {
+		if n, err := strconv.Atoi(cursor); err == nil && n >= 0 {
+			off = n
+		}
+	}
+	ctx := context.Background()
+	args := []any{tenantID}
+	where := "tenant_id = $1"
+	argN := 2
+	if a := strings.TrimSpace(filter.Action); a != "" {
+		where += " AND action = $" + strconv.Itoa(argN)
+		args = append(args, a)
+		argN++
+	}
+	if s := strings.TrimSpace(filter.Severity); s != "" {
+		where += " AND severity = $" + strconv.Itoa(argN)
+		args = append(args, s)
+		argN++
+	}
+	args = append(args, limit+1, off)
+	q := `
+		SELECT id, tenant_id, event_id, source_app, action, severity,
+		       actor_user_id, actor_email, actor_name, actor_api_key_prefix,
+		       target_type, target_id, summary, details_json, ip, created_at, portal_pushed_at
+		FROM audit_log
+		WHERE ` + where + `
+		ORDER BY created_at DESC, id DESC
+		LIMIT $` + strconv.Itoa(argN) + ` OFFSET $` + strconv.Itoa(argN+1)
+	rows, err := p.pool.Query(ctx, q, args...)
+	if err != nil {
+		return nil, "", false, err
+	}
+	defer rows.Close()
+	var out []*store.AuditEntry
+	for rows.Next() {
+		row, err := scanAuditEntry(rows.Scan)
+		if err != nil {
+			return nil, "", false, err
+		}
+		out = append(out, row)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, "", false, err
+	}
+	more := len(out) > limit
+	if more {
+		out = out[:limit]
+	}
+	next := ""
+	if more {
+		next = strconv.Itoa(off + limit)
+	}
+	return out, next, more, nil
+}
+
+// MarkAuditPortalPushed sets portal_pushed_at for a row.
+func (p *Postgres) MarkAuditPortalPushed(id string) error {
+	ctx := context.Background()
+	tag, err := p.pool.Exec(ctx, `UPDATE audit_log SET portal_pushed_at = now() WHERE id = $1`, id)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return store.ErrNotFound
+	}
+	return nil
+}
+
+func scanAuditEntry(scan func(dest ...any) error) (*store.AuditEntry, error) {
+	var row store.AuditEntry
+	var actorUserID, actorEmail, actorName, actorPrefix, targetType, targetID, ip *string
+	var detailRaw []byte
+	var portalPushed *time.Time
+	if err := scan(
+		&row.ID, &row.TenantID, &row.EventID, &row.SourceApp, &row.Action, &row.Severity,
+		&actorUserID, &actorEmail, &actorName, &actorPrefix,
+		&targetType, &targetID, &row.Summary, &detailRaw, &ip, &row.CreatedAt, &portalPushed,
+	); err != nil {
+		return nil, err
+	}
+	row.CreatedAt = row.CreatedAt.UTC()
+	if actorUserID != nil {
+		row.ActorUserID = *actorUserID
+	}
+	if actorEmail != nil {
+		row.ActorEmail = *actorEmail
+	}
+	if actorName != nil {
+		row.ActorName = *actorName
+	}
+	if actorPrefix != nil {
+		row.ActorAPIKeyPrefix = *actorPrefix
+	}
+	if targetType != nil {
+		row.TargetType = *targetType
+	}
+	if targetID != nil {
+		row.TargetID = *targetID
+	}
+	if ip != nil {
+		row.IP = *ip
+	}
+	if len(detailRaw) > 0 {
+		_ = json.Unmarshal(detailRaw, &row.Details)
+	}
+	if portalPushed != nil {
+		t := portalPushed.UTC()
+		row.PortalPushedAt = &t
+	}
+	return &row, nil
+}

internal/store/audit.go

@@ -0,0 +1,67 @@
+package store
+
+import (
+	"strings"
+	"time"
+)
+
+const (
+	AuditSourceAppBGP      = "bgp"
+	AuditTargetAppResource = "app_resource"
+	AuditSeverityInfo      = "info"
+	AuditSeverityWarning   = "warning"
+	AuditSeverityCritical  = "critical"
+)
+
+// AuditEntry is a persisted CRUD / settings audit row (local + portal ingest).
+type AuditEntry struct {
+	ID                string
+	TenantID          string
+	EventID           string
+	SourceApp         string
+	Action            string
+	Severity          string
+	ActorUserID       string
+	ActorEmail        string
+	ActorName         string
+	ActorAPIKeyPrefix string
+	TargetType        string
+	TargetID          string
+	Summary           string
+	Details           map[string]any
+	IP                string
+	CreatedAt         time.Time
+	PortalPushedAt    *time.Time
+}
+
+// AuditAppendInput is input for AppendAudit.
+type AuditAppendInput struct {
+	TenantID          string
+	Action            string
+	Severity          string
+	ActorUserID       string
+	ActorEmail        string
+	ActorName         string
+	ActorAPIKeyPrefix string
+	TargetType        string
+	TargetID          string
+	Summary           string
+	Details           map[string]any
+	IP                string
+}
+
+// AuditListFilter optional query filters for ListAudit.
+type AuditListFilter struct {
+	Action   string
+	Severity string
+}
+
+// ValidAuditSeverity reports whether s is an allowed severity.
+func ValidAuditSeverity(s string) bool {
+	switch strings.ToLower(strings.TrimSpace(s)) {
+	case AuditSeverityInfo, AuditSeverityWarning, AuditSeverityCritical:
+		return true
+	default:
+		return false
+	}
+}

internal/store/backend.go

@@ -132,6 +132,11 @@ type Backend interface {
 	AppendRuntimeLogCleanupAudit(tenantID, actor, filename, action string, sizeBefore int64, sizeAfter *int64, detail map[string]any) (string, error)
 	ListRuntimeLogCleanupAudit(tenantID, cursor string, limit int) ([]*RuntimeLogCleanupAudit, string, bool, error)
 
+	// CRUD audit log (tenant-scoped; optional portal ingest push from httpapi).
+	AppendAudit(in AuditAppendInput) (*AuditEntry, error)
+	ListAudit(tenantID, cursor string, limit int, filter AuditListFilter) ([]*AuditEntry, string, bool, error)
+	MarkAuditPortalPushed(id string) error
+
 	// Firewall blocklist clients and policy rules.
 	ListFirewallClients(tenantID string) ([]*FirewallClient, error)
 	GetFirewallClient(tenantID, id string) (*FirewallClient, error)

internal/store/memory.go

@@ -50,6 +50,7 @@ type Memory struct {
 	maintenancePolicies    map[string]*MaintenancePolicy
 	maintConfigAudit       []*MaintenancePolicyConfigAudit
 	runtimeLogCleanupAudit []*RuntimeLogCleanupAudit
+	auditLog               []*AuditEntry
 
 	// DemoIDs valid after SeedDemo()
 	demoTenantID   string

internal/store/memory_audit.go

@@ -0,0 +1,117 @@
+package store
+
+import (
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+func (m *Memory) AppendAudit(in AuditAppendInput) (*AuditEntry, error) {
+	if strings.TrimSpace(in.TenantID) == "" || strings.TrimSpace(in.Action) == "" || strings.TrimSpace(in.Summary) == "" {
+		return nil, ErrInvalidInput
+	}
+	sev := strings.TrimSpace(in.Severity)
+	if sev == "" {
+		sev = AuditSeverityInfo
+	}
+	if !ValidAuditSeverity(sev) {
+		return nil, ErrInvalidInput
+	}
+	now := time.Now().UTC()
+	row := &AuditEntry{
+		ID:                uuid.NewString(),
+		TenantID:          strings.TrimSpace(in.TenantID),
+		EventID:           "bgp-" + uuid.NewString(),
+		SourceApp:         AuditSourceAppBGP,
+		Action:            strings.TrimSpace(in.Action),
+		Severity:          sev,
+		ActorUserID:       strings.TrimSpace(in.ActorUserID),
+		ActorEmail:        strings.TrimSpace(in.ActorEmail),
+		ActorName:         strings.TrimSpace(in.ActorName),
+		ActorAPIKeyPrefix: strings.TrimSpace(in.ActorAPIKeyPrefix),
+		TargetType:        strings.TrimSpace(in.TargetType),
+		TargetID:          strings.TrimSpace(in.TargetID),
+		Summary:           strings.TrimSpace(in.Summary),
+		Details:           in.Details,
+		IP:                strings.TrimSpace(in.IP),
+		CreatedAt:         now,
+	}
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.auditLog = append(m.auditLog, row)
+	return cloneAuditEntry(row), nil
+}
+
+func (m *Memory) ListAudit(tenantID, cursor string, limit int, filter AuditListFilter) ([]*AuditEntry, string, bool, error) {
+	if limit <= 0 {
+		limit = 50
+	}
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	var filtered []*AuditEntry
+	for _, row := range m.auditLog {
+		if row.TenantID != tenantID {
+			continue
+		}
+		if a := strings.TrimSpace(filter.Action); a != "" && row.Action != a {
+			continue
+		}
+		if s := strings.TrimSpace(filter.Severity); s != "" && row.Severity != s {
+			continue
+		}
+		filtered = append(filtered, row)
+	}
+	sort.Slice(filtered, func(i, j int) bool {
+		if filtered[i].CreatedAt.Equal(filtered[j].CreatedAt) {
+			return filtered[i].ID > filtered[j].ID
+		}
+		return filtered[i].CreatedAt.After(filtered[j].CreatedAt)
+	})
+	off := parseMaintCursor(cursor)
+	end := off + limit
+	next := ""
+	hasMore := false
+	if end > len(filtered) {
+		end = len(filtered)
+	} else if end < len(filtered) {
+		hasMore = true
+		next = formatMaintCursor(end)
+	}
+	if off >= len(filtered) {
+		return nil, "", false, nil
+	}
+	out := make([]*AuditEntry, end-off)
+	for i := off; i < end; i++ {
+		out[i-off] = cloneAuditEntry(filtered[i])
+	}
+	return out, next, hasMore, nil
+}
+
+func (m *Memory) MarkAuditPortalPushed(id string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for _, row := range m.auditLog {
+		if row.ID == id {
+			now := time.Now().UTC()
+			row.PortalPushedAt = &now
+			return nil
+		}
+	}
+	return ErrNotFound
+}
+
+func cloneAuditEntry(row *AuditEntry) *AuditEntry {
+	if row == nil {
+		return nil
+	}
+	cp := *row
+	if row.Details != nil {
+		cp.Details = make(map[string]any, len(row.Details))
+		for k, v := range row.Details {
+			cp.Details[k] = v
+		}
+	}
+	return &cp
+}

internal/store/memory_audit_test.go

@@ -0,0 +1,70 @@
+package store
+
+import "testing"
+
+func TestMemoryAppendAndListAudit(t *testing.T) {
+	m := NewMemory()
+	tenantA := "tenant-a"
+	tenantB := "tenant-b"
+
+	entry, err := m.AppendAudit(AuditAppendInput{
+		TenantID: tenantA,
+		Action:   "bgp.module.create",
+		Summary:  "Created module test",
+		TargetID: "mod-1",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if entry == nil || entry.EventID == "" || entry.SourceApp != AuditSourceAppBGP {
+		t.Fatalf("unexpected entry: %+v", entry)
+	}
+
+	if _, err := m.AppendAudit(AuditAppendInput{
+		TenantID: tenantB,
+		Action:   "bgp.peer.delete",
+		Summary:  "Deleted peer",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	items, _, hasMore, err := m.ListAudit(tenantA, "", 10, AuditListFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(items) != 1 || hasMore {
+		t.Fatalf("items=%d hasMore=%v", len(items), hasMore)
+	}
+	if items[0].Action != "bgp.module.create" {
+		t.Fatalf("action=%s", items[0].Action)
+	}
+
+	filtered, _, _, err := m.ListAudit(tenantA, "", 10, AuditListFilter{Action: "bgp.peer.delete"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(filtered) != 0 {
+		t.Fatalf("expected empty filter result, got %d", len(filtered))
+	}
+
+	if err := m.MarkAuditPortalPushed(entry.ID); err != nil {
+		t.Fatal(err)
+	}
+	items2, _, _, err := m.ListAudit(tenantA, "", 10, AuditListFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if items2[0].PortalPushedAt == nil {
+		t.Fatal("expected portal_pushed_at")
+	}
+}
+
+func TestMemoryAppendAuditValidation(t *testing.T) {
+	m := NewMemory()
+	if _, err := m.AppendAudit(AuditAppendInput{}); err != ErrInvalidInput {
+		t.Fatalf("err=%v", err)
+	}
+	if _, err := m.AppendAudit(AuditAppendInput{TenantID: "t", Action: "x", Summary: "s", Severity: "bad"}); err != ErrInvalidInput {
+		t.Fatalf("err=%v", err)
+	}
+}

migrations/postgres/000030_audit_log.down.sql

@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS idx_audit_log_tenant_action;
+DROP INDEX IF EXISTS idx_audit_log_tenant_created;
+DROP INDEX IF EXISTS idx_audit_log_event_id;
+DROP TABLE IF EXISTS audit_log;

migrations/postgres/000030_audit_log.up.sql

@@ -0,0 +1,30 @@
+CREATE TABLE IF NOT EXISTS audit_log (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    source_app TEXT NOT NULL DEFAULT 'bgp',
+    action TEXT NOT NULL,
+    severity TEXT NOT NULL DEFAULT 'info',
+    actor_user_id TEXT,
+    actor_email TEXT,
+    actor_name TEXT,
+    actor_api_key_prefix TEXT,
+    target_type TEXT,
+    target_id TEXT,
+    summary TEXT NOT NULL,
+    details_json JSONB,
+    ip TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+    portal_pushed_at TIMESTAMPTZ,
+    CONSTRAINT audit_log_severity_chk CHECK (severity IN ('info', 'warning', 'critical')),
+    CONSTRAINT audit_log_source_app_chk CHECK (source_app = 'bgp'),
+    CONSTRAINT audit_log_summary_chk CHECK (length(trim(summary)) > 0)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_log_event_id ON audit_log (event_id);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_created
+    ON audit_log (tenant_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_action
+    ON audit_log (tenant_id, action, created_at DESC);

migrations/sqlite/000030_audit_log.down.sql

@@ -0,0 +1,4 @@
+DROP INDEX IF EXISTS idx_audit_log_tenant_action;
+DROP INDEX IF EXISTS idx_audit_log_tenant_created;
+DROP INDEX IF EXISTS idx_audit_log_event_id;
+DROP TABLE IF EXISTS audit_log;

migrations/sqlite/000030_audit_log.up.sql

@@ -0,0 +1,27 @@
+CREATE TABLE IF NOT EXISTS audit_log (
+    id TEXT PRIMARY KEY,
+    tenant_id TEXT NOT NULL,
+    event_id TEXT NOT NULL,
+    source_app TEXT NOT NULL DEFAULT 'bgp',
+    action TEXT NOT NULL,
+    severity TEXT NOT NULL DEFAULT 'info',
+    actor_user_id TEXT,
+    actor_email TEXT,
+    actor_name TEXT,
+    actor_api_key_prefix TEXT,
+    target_type TEXT,
+    target_id TEXT,
+    summary TEXT NOT NULL,
+    details_json TEXT,
+    ip TEXT,
+    created_at TEXT NOT NULL,
+    portal_pushed_at TEXT
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_audit_log_event_id ON audit_log (event_id);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_created
+    ON audit_log (tenant_id, created_at DESC);
+
+CREATE INDEX IF NOT EXISTS idx_audit_log_tenant_action
+    ON audit_log (tenant_id, action, created_at DESC);