Skip to main content
Audit entries are written by src/lib/auditLogger.js into the AuditLog collection. Logins are recorded in the NextAuth signIn callback (fire-and-forget — a logging failure never blocks sign-in). There are two tables Super Admins use for this:
Open System (/admin/system) for the last eight events, then Audit logs in the sidebar for the full table. From Users, System logs goes to /admin/logs; Audit log opens the modal.

​
How to use the audit log table

1

Open System Audit Logs

Sign in as Super Admin. In the Admin sidebar choose Audit logs, or go to /admin/logs. The page is level 5 only — anyone else is sent to /dashboard.
2

Scan the columns

Newest events are first. Each row has:
3

Search the current page

Use Search logs by user, action, or details. This filter runs in the browser on the rows already loaded (50 per page). It does not search the whole collection. For a specific mailbox, use the User Email filter instead.
4

Narrow with Show Filters

Click Show Filters, then combine:Changing a filter resets you to page 1. Clear Filters restores the unfiltered list. Refresh reloads without changing filters.
5

Page through results

The API returns up to 50 rows per page (limit=50, skip advances). Previous / Next walk the total count shown in the header badge.
6

Export CSV

Export CSV downloads audit-logs-YYYY-MM-DD.csv for the rows currently on screen (after search). Columns: Timestamp, User, Email, Action, Target Type, Details, IP Address.Apply Action / Email / Date filters first if you need a slice; search-only exports are limited to the current page.
CSV export is not a full-history dump. Raise limit on GET /api/users/audit-logs (max 1000) if you need a larger pull from the API. The UI always requests 50.

​
Action values

Stored on AuditLog.action. The logs UI dropdown lists the common ones; the schema also allows the rest. Older rows may also come from embedded User.activityLog[] (backward compatibility). Those have no IP or user-agent.

​
Who can see whose logs

The list endpoint is GET /api/users/audit-logs (requireAdminActor, level ≥ 4).
  • Super Admin — every AuditLog (and matching activityLog entries).
  • Principal (level 4) — only events whose userEmail is on their school roster. Audit rows have no schoolName of their own; the API scopes by actor emails instead.
On /admin/users, click Audit log. The modal table uses the same columns (Timestamp, User, Action, Details, IP) and Refresh Logs. Principals see only their school. For filters, dates, pagination, and CSV, Super Admins should use /admin/logs.

​
How to use the users table

/admin/users is the roster Super Admins and principals manage. Principals only see levels 1–3 at their school (Super Admins at that school are omitted).
1

Filter the roster

Use the Smart Filters bar (search, level, school, status, title, date range). Click the Never signed in stat card — or Never signed in / Stale (30+ days) — to find accounts that have not used Google sign-in.
2

Sort columns

Click Name, Level, School, Last sign-in, or Status. A second click reverses direction. Last sign-in and level default to descending when you first sort those columns.
3

Export the visible rows

Export CSV on the Users section downloads the currently filtered list (users-YYYY-MM-DD.csv): Name, Email, Level, School, Title, Status, Created, Last Login.Smart Filters also has its own export control for the same filtered set.
“Never signed in” is the audit follow-up for accounts that exist in MongoDB but have never completed Google OAuth. Create the users document before the person signs in — otherwise Google returns them to /login.

​
API

Response: { success, logs, total, limit, skip }. Related: Users API, System health, Operations.