Add integration tests for GET /api/audit route covering pagination and redaction of sensitive fields

[Jagadeeshftw]

📌 Description

src/routes/audit.ts exposes an admin-authenticated audit log endpoint but tests/audit.test.ts currently only covers basic happy-path retrieval. There are no tests for: pagination parameters (limit, offset), redaction of any RESTRICTED fields that might appear in details JSON blobs, or rejection of invalid limit/offset values. These gaps mean the audit endpoint could leak sensitive data or be crashed by malformed pagination parameters.

💡 Why it matters: Audit logs often contain sensitive action details; without redaction tests, a code change could accidentally expose authentication tokens or Stellar addresses in audit records.

🧩 Requirements and context

• Test GET /api/audit with ?limit=10&offset=0 — assert response array length ≤ 10
• Test GET /api/audit with ?limit=0 — assert 400 (invalid limit)
• Test GET /api/audit with ?limit=9999 — assert 400 or clamped to max
• Assert no RESTRICTED field names (authToken, authorization, x-api-key) appear in any details value
• Test unauthenticated request returns 401

Non-functional requirements

• Must be secure, tested, and documented.
• Should be efficient and easy to review.

🛠️ Suggested execution

1. Fork the repo and create a branch

git checkout -b test/audit-route-pagination-redaction

2. Implement changes

• Write/modify the relevant source: src/routes/audit.ts (if validation gaps found)
• Write comprehensive tests: tests/routes/audit.pagination.test.ts
• Add documentation: TSDoc on the pagination query parameter constraints
• Include TSDoc on the redaction assertions in tests
• Validate security assumptions: confirm details blobs go through PII sanitizer before storage

3. Test and commit

• Run tests:

npm test -- --testPathPattern=audit.pagination

• Cover edge cases: limit=0, limit=1001, offset=-1, unauthenticated request
• Include test output and security notes in the PR description.

Example commit message

test(audit): add pagination and PII-redaction tests for GET /api/audit

✅ Acceptance criteria

• limit=0 returns 400
• limit=9999 returns 400 or is clamped
• Valid pagination returns ≤ limit items
• No RESTRICTED field values appear in audit details responses
• Unauthenticated request returns 401

🔒 Security notes

The test must explicitly check that tokens, API keys, and authorization header values never appear in the details JSON of audit records. This is the most critical assertion in this issue.

📋 Guidelines

• Minimum 95% test coverage
• Clear documentation
• Timeframe: 96 hours

[Q-ARAYA]

Hello,

My name is Quiriat Mata, and I am a Computer Engineering student from Costa Rica. I am interested in working on this issue and would love the opportunity to contribute and take this issue in this project.

I have experience with JavaScript, TypeScript, React, etc. And after reviewing the requirements, I believe I can make a meaningful contribution to the requested implementation. I am also eager to learn from the project's workflow and collaborate with the community while delivering a high-quality solution.

If this issue is still available, I would be happy to work on it.

Thank you for your consideration.

[light89219]

I would love to work on this issue. thank you.

[greatest0fallt1me]

Hello Maintainers 👋,
I’m interested in picking up this issue and contributing to the project.
I have solid experience working across both frontend and blockchain layers, including building user interfaces with Next.js and developing Stellar smart contracts using Rust (Soroban). I’m familiar with translating Figma designs into pixel-accurate UIs, handling wallet integrations, and writing efficient, well-tested contract logic.
I focus on writing clean, maintainable code, following repository standards, and keeping communication transparent throughout the development process. I can start immediately and complete the work within the expected timeframe.
Excited to collaborate and add value to the project 🚀
Thank you!

[grantfox-oss]

🦊 GrantFox — @greatest0fallt1me has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #588)
2. Your PR will be reviewed by the Fluxora-Org maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@greatest0fallt1me's PR #595 was approved and merged by @Jagadeeshftw.

🏆 @greatest0fallt1me: You earned 40 FoxPoints for this contribution! Your current tier: Builder (1,228 total points). Track your full progress on GrantFox.

👏 Great work, @greatest0fallt1me! Keep contributing to Fluxora-Org.