Refactor code structure for improved readability and maintainability

apps/edr-freight-api/src/app.module.ts

@@ -16,7 +16,6 @@ import {
 import { IamBaselineSeeder, IamSeedModule } from "@edr/iam-seed";
 import { IamModule } from "@tria-plc/iamapi-common";
 import { SharedAuthModule } from "@tria-plc/api-common/modules/auth/shared-auth.module";
-import { MezgebModule } from "@tria-plc/auditlog";
 
 import appConfig from "./config/app.config";
 import databaseConfig from "./config/database.config";
@@ -112,7 +111,6 @@ import { LastMileRequestsModule } from "./modules/last-mile-requests/last-mile-r
 import { InterchangeDocumentsModule } from "./modules/interchange-documents/interchange-documents.module";
 import { ImportOperationsModule } from "./modules/import-operations/import-operations.module";
 import { AiModule } from "./modules/ai/ai.module";
-import { AuditModule } from "./modules/audit/audit.module";
 import { LoggerMiddleware } from "./logger.middleware";
 import { LoginAudienceMiddleware } from "./modules/auth/login-audience.middleware";
 import { PositionTypePermissionsCache } from "./common/position-type-permissions.cache";
@@ -169,19 +167,6 @@ if (!process.env.APPLICATION_NAME) {
         return dataSource;
       },
     }),
-    // Request + entity-level audit logging over RabbitMQ (@tria-plc/auditlog).
-    // Must come after TypeOrmModule above so it picks up this app's DataSource.
-    // rmqUrl falls back the same way notifications.module.ts's RABBITMQ_URL
-    // does: the dev broker only provisions the `edr` user on the `payment`
-    // vhost (docker-compose's RABBITMQ_DEFAULT_USER/VHOST), so an unset
-    // RABBITMQ_URL must land there too, not on guest@'/' (403 ACCESS_REFUSED).
-    MezgebModule.forRoot({
-      applicationName: "freight-api",
-      rmqUrl:
-        process.env.RABBITMQ_URL ??
-        process.env.PAYMENT_RABBITMQ_URL ??
-        "amqp://localhost:5672",
-    }),
     SharedAuthModule,
     IamModule.forRoot({
       applications: [EDR_FREIGHT_APPLICATION],
@@ -257,7 +242,6 @@ if (!process.env.APPLICATION_NAME) {
     EimsModule,
     FleetHistoryModule,
     AiModule,
-    AuditModule,
   ],
   providers: [
     EdrOrgSeeder,

apps/edr-freight-api/src/config/database.config.ts

@@ -56,11 +56,6 @@ import { EmployeePositionActivePeriod } from "@tria-plc/iamapi-common/entities/i
 import { UnitConfiguration } from "@tria-plc/iamapi-common/entities/iam/organization-structure/unit-configuration.entity";
 import { Site } from "@tria-plc/iamapi-common/entities/iam/site/site.entity";
 import { SiteSetting } from "@tria-plc/iamapi-common/entities/iam/site/site-setting.entity";
-import { AuditLog, AuditLogCommand } from "@tria-plc/auditlog";
-
-// @tria-plc/auditlog's entities live in node_modules, same as the iam ones —
-// the glob below only matches this app's own src/**/*.entity.ts.
-const auditEntities = [AuditLog, AuditLogCommand];
 
 const iamEntities = [
   UnitSetting,
@@ -185,7 +180,6 @@ export function buildDataSourceOptions(): DataSourceOptions {
     entities: [
       __dirname + "/../**/*.entity.{ts,js}",
       ...iamEntities,
-      ...auditEntities,
     ],
     migrations: [],
   };

apps/edr-freight-api/src/main.ts

@@ -10,7 +10,6 @@ import {
   ResponseTransformInterceptor,
   createValidationPipe,
 } from "@edr/api-common";
-import { getAuditLoggerConfig } from "@tria-plc/auditlog";
 
 import { AppModule } from "./app.module";
 
@@ -167,11 +166,6 @@ export async function createFreightApp(): Promise<NestExpressApplication> {
   app.useGlobalFilters(new HttpExceptionFilter());
   app.useGlobalInterceptors(new ResponseTransformInterceptor());
 
-  // Audit listener: consumes the RMQ events MezgebModule's client interceptor
-  // (app.module.ts) emits and persists them via the AuditLogController /
-  // AuditLogCommandController @EventPattern handlers. Same queue config the
-  // client side uses, reused from the package so the two never drift apart.
-  app.connectMicroservice(getAuditLoggerConfig());
   await app.startAllMicroservices();
 
   const config = new DocumentBuilder()

apps/edr-freight-api/src/modules/audit/audit.controller.ts

@@ -1,32 +0,0 @@
-import { Controller, Get, Query } from "@nestjs/common";
-import { ApiOperation, ApiQuery, ApiTags } from "@nestjs/swagger";
-
-import { BookingStaff } from "../../common/booking-guards";
-import { FREIGHT_PERMS } from "../../seed/freight-permissions.registry";
-import { AuditService } from "./audit.service";
-
-@ApiTags("audit")
-@Controller("audit")
-@BookingStaff(FREIGHT_PERMS.audit.view)
-export class AuditController {
-  constructor(private readonly auditService: AuditService) {}
-
-  @Get("logs")
-  @ApiOperation({ summary: "List freight-api audit log commands" })
-  @ApiQuery({ name: "skip", type: Number, required: false })
-  @ApiQuery({ name: "take", type: Number, required: false })
-  list(@Query("skip") skip?: string, @Query("take") take?: string) {
-    // Same fallback chain @tria-plc/auditlog's client interceptor uses to
-    // stamp AuditLog.application (mezgeb/client/client-audit.interceptor.js)
-    // — reading it here instead of a hardcoded literal means this can't
-    // silently drift out of sync with whatever APPLICATION_NAME/APP_NAME
-    // actually is at runtime.
-    const application =
-      process.env.APPLICATION_NAME ?? process.env.APP_NAME ?? "DEFAULT";
-    return this.auditService.list(
-      application,
-      skip !== undefined ? parseInt(skip, 10) : undefined,
-      take !== undefined ? parseInt(take, 10) : undefined,
-    );
-  }
-}

apps/edr-freight-api/src/modules/audit/audit.module.ts

@@ -1,13 +0,0 @@
-import { Module } from "@nestjs/common";
-import { TypeOrmModule } from "@nestjs/typeorm";
-import { AuditLogCommand } from "@tria-plc/auditlog";
-
-import { AuditController } from "./audit.controller";
-import { AuditService } from "./audit.service";
-
-@Module({
-  imports: [TypeOrmModule.forFeature([AuditLogCommand])],
-  controllers: [AuditController],
-  providers: [AuditService],
-})
-export class AuditModule {}

apps/edr-freight-api/src/modules/audit/audit.service.ts

@@ -1,70 +0,0 @@
-import { Injectable } from "@nestjs/common";
-import { InjectRepository } from "@nestjs/typeorm";
-import { Repository } from "typeorm";
-import { AuditLogCommand } from "@tria-plc/auditlog";
-
-import { CLIENT_APP_HEADER } from "../auth/login-audience.middleware";
-
-export interface AuditLogListResult {
-  count: number;
-  items: AuditLogCommand[];
-}
-
-/**
- * Own read path onto @tria-plc/auditlog's tables, gated by AuditController's
- * @BookingStaff — the package's own AuditLogCommandController (mounted at
- * /api/audit-log-commands) ships with no guards at all, so it can't be used
- * directly for a permission-gated UI. Query mirrors the package's
- * AuditLogCommandService.buildAuditLogQuery/getAllAuditLogs exactly.
- */
-@Injectable()
-export class AuditService {
-  constructor(
-    @InjectRepository(AuditLogCommand)
-    private readonly auditLogCommandRepository: Repository<AuditLogCommand>,
-  ) {}
-
-  async list(
-    application: string,
-    skip = 0,
-    take = 10,
-  ): Promise<AuditLogListResult> {
-    const [items, count] = await this.auditLogCommandRepository
-      .createQueryBuilder("audit_log_commands")
-      .leftJoinAndSelect("audit_log_commands.auditLog", "auditLog")
-      .andWhere(
-        "(audit_log_commands.auditLogId IS NULL OR auditLog.application = :application)",
-        { application },
-      )
-      .andWhere(
-        "(audit_log_commands.auditLogId IS NULL OR auditLog.status = :status)",
-        { status: "Commit" },
-      )
-      // Backoffice-only view: portal (customer-facing) writes carry the same
-      // request-header set by every axios call from that app — see
-      // login-audience.middleware.ts. Rows with no linked auditLog (child/
-      // event commands with no request context) stay visible; they aren't
-      // attributable to any frontend, so they're not portal noise either.
-      .andWhere(
-        "(audit_log_commands.auditLogId IS NULL OR auditLog.requestHeader ->> :clientAppHeader = :clientApp)",
-        { clientAppHeader: CLIENT_APP_HEADER, clientApp: "backoffice" },
-      )
-      .select([
-        "audit_log_commands.id",
-        "audit_log_commands.createdAt",
-        "audit_log_commands.deletedAt",
-        "audit_log_commands.entityName",
-        "audit_log_commands.queryMethod",
-        "audit_log_commands.changes",
-        "audit_log_commands.payload",
-        "auditLog.id",
-        "auditLog.user",
-      ])
-      .addOrderBy("audit_log_commands.createdAt", "DESC")
-      .skip(skip)
-      .take(take)
-      .getManyAndCount();
-
-    return { count, items };
-  }
-}

apps/edr-freight-api/src/modules/payment/payment-events.consumer.ts

@@ -1,4 +1,4 @@
-import { Injectable, Logger, SetMetadata } from "@nestjs/common";
+import { Injectable, Logger } from "@nestjs/common";
 import { Nack, RabbitSubscribe } from "@golevelup/nestjs-rabbitmq";
 import { Public } from "@edr/api-common";
 import {
@@ -14,11 +14,6 @@ import { PaymentService as PaymentSvc } from "./payment.service";
 
 const FREIGHT_QUEUE = PAYMENT_QUEUES[PaymentService.FREIGHT];
 
-// @tria-plc/auditlog's global ClientLoggerInterceptor (present in deployed builds)
-// crashes on non-HTTP contexts (`originalUrl.split` on a RabbitMQ message) and the
-// resulting requeue storm blocks payment.succeeded forever. Its IgnoreLoggerAudit
-// decorator is just this metadata key — set it directly so we don't need the package.
-@SetMetadata("ignoreAuditLogger", true)
 @Injectable()
 export class PaymentEventsConsumer {
     private readonly logger = new Logger(PaymentEventsConsumer.name);

apps/edr-freight-api/src/modules/rule-engine/repositories/cargo-types.repository.ts

@@ -91,9 +91,8 @@ export class CargoTypesRepository implements ICargoTypesRepository {
 
   /**
    * Diffs the wagon-type links through the relation query builder rather than
-   * an entity save: junction-row inserts from save() broadcast afterInsert with
-   * no entity attached, which the @tria-plc/auditlog subscriber (deployed
-   * builds) dereferences and crashes the request on.
+   * an entity save, so junction rows are written without broadcasting
+   * afterInsert events for entity-less inserts.
    */
   private async syncWagonTypes(
     id: string,

apps/edr-freight-api/src/seed/freight-permissions.registry.ts

@@ -1187,11 +1187,6 @@ export const CONFIG_SETTINGS_PERMISSIONS: FreightPermissionSeed[] = [
     "edr_freight_app:settings:dropdown:manage",
     "Manage dropdown settings",
   ),
-  perm(
-    "b4c00001-0001-4000-8000-000000000001",
-    "edr_freight_app:audit:view",
-    "View audit logs",
-  ),
 ];
 
 // M. Staff / IAM admin — NEW keys only. The employee_registration / role_assignment
@@ -1894,9 +1889,6 @@ export const FREIGHT_PERMS = {
       manage: "edr_freight_app:settings:support_content:manage",
     },
   },
-  audit: {
-    view: "edr_freight_app:audit:view",
-  },
   support: {
     agentView: "edr_freight_app:support:agent_view",
     agentSend: "edr_freight_app:support:agent_send",