Config change logs (fee schedules, rates) audit-trailed

Fee schedules and interest rate changes are decisions that directly affect customer balances — and they are exactly the kind of discretionary administrative action that regulators and auditors scrutinize most carefully. SOX §404 requires that internal controls over financial reporting extend to the processes that determine what rates and fees are applied; an admin who can change a fee schedule without leaving a before/after record defeats that control. NIST 800-53 AU-2 requires auditing of configuration changes. PCI-DSS 4.0 Req-10.2.1.5 explicitly requires logging of changes to identification and authentication mechanisms as well as to system configurations. CWE-778 (Insufficient Logging) applies directly. Without a config_change_logs record that captures who changed the fee, from what value to what value, and when, there is no way to reconstruct whether a customer was charged the correct rate.

Create a config_change_logs table and write a record before every config mutation in src/app/api/admin/config/route.ts or src/services/config-audit.ts:

CREATE TABLE config_change_logs (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  config_key VARCHAR(100) NOT NULL,
  old_value JSONB NOT NULL,
  new_value JSONB NOT NULL,
  changed_by UUID NOT NULL REFERENCES users(id),
  changed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  reason TEXT
);

async function updateFeeSchedule(
  newSchedule: FeeSchedule, adminId: string, reason: string
) {
  const current = await db('config').where({ key: 'fee_schedule' }).first();
  await db('config_change_logs').insert({
    config_key: 'fee_schedule',
    old_value: JSON.stringify(current.value),
    new_value: JSON.stringify(newSchedule),
    changed_by: adminId,
    reason
  });
  await db('config').where({ key: 'fee_schedule' }).update({ value: newSchedule });
}