feat(activity): superuser-backed audit log helper

src/app/actions/activity.ts

@@ -0,0 +1,38 @@
+import "server-only";
+
+import { getAdminPb } from "@/lib/pb/admin";
+import type { ActivityAction } from "@/lib/pb/types";
+
+/**
+ * Write one audit row.
+ *
+ * Uses a superuser connection deliberately. `activity.createRule` is null,
+ * which in PocketBase means superuser-only — the owner's own token is refused,
+ * so a Server Action cannot insert here with the caller's connection. Without
+ * this helper the surrounding mutation succeeds and its history silently
+ * vanishes, which is the failure the audit log exists to prevent.
+ *
+ * Never call this before verifying the caller is allowed to make the change
+ * being logged. It checks nothing.
+ */
+export async function logActivity(entry: {
+  project: string;
+  card?: string;
+  actor: string;
+  action: ActivityAction;
+  field?: string;
+  oldValue?: string;
+  newValue?: string;
+}): Promise<void> {
+  const pb = await getAdminPb();
+
+  await pb.collection("activity").create({
+    project: entry.project,
+    card: entry.card ?? "",
+    actor: entry.actor,
+    action: entry.action,
+    field: entry.field ?? "",
+    old_value: entry.oldValue ?? "",
+    new_value: entry.newValue ?? "",
+  });
+}