# audit_log scene

Matrix coverage for the Audit Log V2 pipeline (`AUDIT_V2_ENABLED=true`,
`NEXUSCRM_REQUEST_CAPTURE=on`). Uses the `/admin/audit/log` privileged
read endpoint as the assertion surface — the SOQL `<Object>History`
view surfaces only a subset and applies FLS redaction, so it is not
suitable for asserting emission completeness.

## Layout

- `audit-001-create-head-row.json` — POST Account → `Action=CREATE` row emitted.
- `audit-002-update-head-row.json` — POST + PATCH → `Action=UPDATE` row emitted.
- `audit-gap-001-pii-snake-and-top-level.json` — top-level `session_token` /
  `apiKey` in payload must NOT surface in audit (scrub gap fix).
- `audit-gap-002-delete-emits-head-row.json` — POST + DELETE → `Action=DELETE`
  row emitted (wiring gap fix).
- `audit-gap-003-update-multi-changesjson.json` — PATCH Name+Description+Industry
  → head row `ChangesJSON` non-null and lists all 3 fields (payload gap fix).

## Preconditions

- Backend started with `AUDIT_V2_ENABLED=true` and
  `NEXUSCRM_REQUEST_CAPTURE=on`.
- Caller must carry the `ViewFieldAuditTrail` system permission (admin
  user works; default `admin@test.com` in local env).

## Run

```bash
cd tests/e2e-api
NEXUSCRM_URL=http://127.0.0.1:<port> \
  TIDB_HOST=127.0.0.1 TIDB_USER=root TIDB_PASSWORD= TIDB_DATABASE=nexuscrm \
  NEXUSCRM_USERNAME='admin@test.com' NEXUSCRM_PASSWORD='<local>' \
  python3 runner.py --scene audit_log --skip-setup
```