feat(tests): Jest backend (38 tests), Jest RTL frontend (28 tests), Playwright E2E spec

backend/src/middleware/auditMiddleware.js

@@ -21,36 +21,40 @@ function auditMiddleware(tableName, model, idParam = 'id') {
       // Attach before-state so route handlers can reference it if needed
       req._auditBefore = before;
 
-      // Wrap res.json to intercept the response
-      const originalJson = res.json.bind(res);
-      res.json = async function (data) {
-        // Only log on successful mutations
+      // Shared audit writer — called by both res.json and res.send interceptors
+      async function writeAuditLog() {
         if (res.statusCode >= 200 && res.statusCode < 300) {
           try {
             const action = req.method === 'DELETE' ? 'DELETE' : 'UPDATE';
             const after = action === 'DELETE' ? null : await model.findUnique({ where: { id: recordId } });
-
-            const changes = {
-              before,
-              after,
-            };
-
             await prisma.auditLog.create({
               data: {
                 table_name: tableName,
                 record_id: recordId,
                 action,
-                changes,
+                changes: { before, after },
               },
             });
           } catch (auditErr) {
-            // Audit failures should never block the primary response
             console.error('Audit log write failed:', auditErr.message);
           }
         }
+      }
+
+      // Wrap res.json (used by JSON-returning routes)
+      const originalJson = res.json.bind(res);
+      res.json = async function (data) {
+        await writeAuditLog();
         return originalJson(data);
       };
 
+      // Wrap res.send (used by DELETE 204 routes)
+      const originalSend = res.send.bind(res);
+      res.send = async function (data) {
+        await writeAuditLog();
+        return originalSend(data);
+      };
+
       next();
     } catch (err) {
       next(err);