Also log staff cancellations via PUT /api/registrations/:id

Registrations can be cancelled two ways: DELETE /:id (owner or admin,
already logged registration_cancelled) and PUT /:id (staff+, status
change endpoint) — the latter was silently unlogged. Since PUT /:id
is staff-only, any transition into 'cancelled' there is inherently a
staff-initiated cancellation, so it's now logged the same way.

Audited all six categories promised in the 1.10.0 changelog entry
(refunds, donation assign/unassign, manual registrations,
staff-initiated cancellations, event create/update/delete, settings
changes) against their actual logAdminAction call sites and route
wiring — this was the only other gap found.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CSWFWQsjTc9GyffPiXEDQT

CHANGELOG.md

@@ -7,6 +7,20 @@ and this project follows [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.10.3] - 2026-08-28
+
+### Fixed
+
+- Creating an event was never recorded in the admin audit log — 1.10.0 added `event_created` as a logged action on the frontend's filter list, but the backend's `createEvent` never actually called `logAdminAction`, only `updateEvent`/`deleteEvent` did. Event creation is now logged the same way.
+- Staff cancelling a registration via `PUT /api/registrations/:id` (the staff status-change endpoint, separate from the owner-facing `DELETE /:id` cancel route) wasn't logged at all — only the `DELETE` path logged `registration_cancelled`. Both paths now log it, verified against all six audit categories promised in 1.10.0 (refunds, donation assign/unassign, manual registrations, staff-initiated cancellations, event create/update/delete, settings changes) with no other gaps found.
+- Added a "Back to dashboard" link to Admin → Audit log, matching the back-link pattern already used on the Cashup page.
+
+## [1.10.2] - 2026-08-28
+
+### Fixed
+
+- Sentry wasn't instrumenting Express (`[Sentry] express is not instrumented` at startup): `express`, `cors`, and `@prisma/client` were required at the top of `backend/src/index.js` before `Sentry.init()` ran, but Sentry's auto-instrumentation patches those modules via a require hook that only works if `Sentry.init()` runs first. `Sentry.init()` now runs immediately after `dotenv.config()`, before any of the libraries it instruments are required.
+
 ## [1.10.1] - 2026-08-28
 
 ### Security

backend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "event-management-backend",
-  "version": "1.10.1",
+  "version": "1.10.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "event-management-backend",
-      "version": "1.10.1",
+      "version": "1.10.3",
       "hasInstallScript": true,
       "dependencies": {
         "@prisma/client": "^5.4.2",

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "event-management-backend",
-  "version": "1.10.1",
+  "version": "1.10.3",
   "description": "Event Management System Backend",
   "main": "src/index.js",
   "scripts": {

backend/src/controllers/eventController.js

@@ -68,8 +68,19 @@ const createEvent = async (req, res) => {
       location: location || null,
     };
 
+    const logEventCreate = (createdEvent) => logAdminAction({
+      actorId: req.user?.id,
+      actorRole: req.user?.role,
+      action: 'event_created',
+      targetType: 'Event',
+      targetId: createdEvent.id,
+      metadata: { title: createdEvent.title },
+      ip: getClientIp(req),
+    });
+
     try {
       const event = await prisma.event.create({ data });
+      logEventCreate(event);
 
       // Automatically create a main ticket (event option) with the event price — contact-only
       // events have no bookable options, so there's nothing to auto-create for them.
@@ -133,24 +144,28 @@ const createEvent = async (req, res) => {
         // @ts-ignore delete field and retry
         delete data.registrationDeadline;
         const event = await prisma.event.create({ data });
+        logEventCreate(event);
         return res.status(201).json(event);
       }
       if (msg.includes('Unknown argument `goLiveAt`')) {
         // @ts-ignore delete field and retry
         delete data.goLiveAt;
         const event = await prisma.event.create({ data });
+        logEventCreate(event);
         return res.status(201).json(event);
       }
       if (msg.includes('Unknown argument `createdById`')) {
         // @ts-ignore delete field and retry
         delete data.createdById;
         const event = await prisma.event.create({ data });
+        logEventCreate(event);
         return res.status(201).json(event);
       }
       if (msg.includes('Unknown argument `redirectUrl`')) {
         // @ts-ignore delete field and retry
         delete data.redirectUrl;
         const event = await prisma.event.create({ data });
+        logEventCreate(event);
         return res.status(201).json(event);
       }
       throw err;

backend/src/controllers/registrationController.js

@@ -626,6 +626,22 @@ const updateRegistrationStatus = async (req, res) => {
       }
     });
 
+    // This is the staff-only status-change endpoint (separate from the owner-facing
+    // DELETE /:id cancel route), so any transition into 'cancelled' here is always a
+    // staff-initiated cancellation — log it the same way DELETE /:id does, so both
+    // paths land under the one 'registration_cancelled' filter in the audit log.
+    if (status === 'cancelled' && registration.status !== 'cancelled') {
+      logAdminAction({
+        actorId: req.user.id,
+        actorRole: req.user.role,
+        action: 'registration_cancelled',
+        targetType: 'Registration',
+        targetId: req.params.id,
+        metadata: { registrationOwnerId: registration.userId, previousStatus: registration.status },
+        ip: getClientIp(req),
+      });
+    }
+
     // Generate tickets and email them when status is manually set to 'paid' by staff
     if (status === 'paid') {
       (async () => {

backend/src/index.js

@@ -1,19 +1,14 @@
-const express = require('express');
 const path = require('path');
-const { version: API_VERSION } = require('../package.json');
-const cors = require('cors');
-const rateLimit = require('express-rate-limit');
 const dotenv = require('dotenv');
-const { PrismaClient } = require('@prisma/client');
-const { notFound, errorHandler } = require('./middleware/errorMiddleware');
-const getRawBody = require('raw-body');
 
 // Load environment variables
 dotenv.config();
 
 // Error monitoring — a no-op if SENTRY_DSN isn't set, so this is safe in every
 // environment (dev, a fresh deploy that hasn't configured Sentry yet, etc.).
-// Must run before the Express app is created so its instrumentation can hook in.
+// Must run before express/@prisma/client are required below — Sentry's
+// auto-instrumentation patches those modules via a require hook, which only
+// works if Sentry.init() runs before they're first required into the cache.
 if (process.env.SENTRY_DSN) {
   const Sentry = require('@sentry/node');
   Sentry.init({
@@ -25,6 +20,14 @@ if (process.env.SENTRY_DSN) {
   });
 }
 
+const express = require('express');
+const { version: API_VERSION } = require('../package.json');
+const cors = require('cors');
+const rateLimit = require('express-rate-limit');
+const { PrismaClient } = require('@prisma/client');
+const { notFound, errorHandler } = require('./middleware/errorMiddleware');
+const getRawBody = require('raw-body');
+
 // Initialize Prisma client
 const prisma = new PrismaClient();
 

frontend/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.10.1",
+  "version": "1.10.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events-frontend",
-      "version": "1.10.1",
+      "version": "1.10.3",
       "dependencies": {
         "@hookform/resolvers": "^5.2.1",
         "@radix-ui/react-accordion": "^1.2.11",

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events-frontend",
-  "version": "1.10.1",
+  "version": "1.10.3",
   "private": true,
   "scripts": {
     "dev": "next dev --turbopack",

frontend/src/app/dashboard/admin/audit-log/page.tsx

@@ -113,7 +113,8 @@ export default function AdminAuditLogPage() {
           <History className="w-5 h-5 text-brand-600" />
         </div>
         <div>
-          <h1 className="text-2xl font-semibold text-gray-900">Admin Audit Log</h1>
+          <button className="text-xs text-brand-600 hover:underline" onClick={() => router.push("/dashboard/admin")}>← Back to dashboard</button>
+          <h1 className="text-2xl font-semibold text-gray-900 mt-0.5">Admin Audit Log</h1>
           <p className="text-sm text-gray-500">{total} action{total !== 1 ? "s" : ""} recorded</p>
         </div>
       </div>

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "hope-events",
-  "version": "1.10.1",
+  "version": "1.10.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "hope-events",
-      "version": "1.10.1",
+      "version": "1.10.3",
       "license": "ISC",
       "devDependencies": {
         "concurrently": "^9.2.1"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "hope-events",
-  "version": "1.10.1",
+  "version": "1.10.3",
   "main": "index.js",
   "scripts": {
     "dev:backend": "cd backend && npm run dev",