Audit trail includes all user actions: login, transfer, withdrawal, adjustment, cancellation

A transaction log that records transfers but silently omits login events, fee adjustments, and account cancellations is not a complete audit trail — it is a partial record that creates blind spots regulators will find. NIST 800-53 AU-2 requires organizations to determine which event types are auditable and to coordinate the audit function with other entities requiring audit-related information; login/logout events are explicitly called out. PCI-DSS 4.0 Req-10.2.1 enumerates specific event types that must be logged: all individual user access to cardholder data, all actions taken by any individual with root or administrative privileges, and all invalid logical access attempts. FINRA Rule 4511 requires complete books and records. CWE-778 (Insufficient Logging) is the vulnerability. An attacker who escalates privileges via a path that does not trigger a log event leaves no forensic evidence of the intrusion.

Instrument every significant user action through a centralized logger in src/services/audit-logger.ts to ensure consistent coverage:

const AUDITABLE_OPERATIONS = [
  'login', 'logout', 'transfer', 'withdrawal', 'deposit',
  'adjustment', 'cancellation', 'reversal', 'fee_change'
] as const;

export async function logAction(
  userId: string,
  operation: typeof AUDITABLE_OPERATIONS[number],
  details: Record<string, unknown>
) {
  await db('transaction_logs').insert({
    user_id: userId,
    operation_type: operation,
    details: JSON.stringify(details),
    timestamp: new Date().toISOString()
  });
}

Call logAction in each route — for login events, call it after successful credential verification, not only on successful session creation, so failed login attempts are also captured.