feat: add Activity Logging System

- Add migration 008_activity_logs.sql with activity_logs table and indexes
- Create lib/activity/ service with ActivityService (log + list with filtering/pagination)
- Add activity:view permission to all roles in auth constants
- Integrate logging into contract creation, milestone CRUD, escrow funding/release/refund, and dispute creation
- Create GET /api/activity route (RBAC-protected, filterable by actionType, contractId, projectId, actorId)
- Add Activity Log page in dashboard with type filtering, pagination, and timeline UI
- Add Activity nav item to dashboard sidebar

Closes #152

Author: opencode-bot

app/api/activity/route.ts

@@ -0,0 +1,33 @@
+export const dynamic = 'force-dynamic'
+
+import { NextRequest, NextResponse } from 'next/server'
+import { withRbac, RbacContext } from '@/lib/auth/rbacMiddleware'
+import { activityService } from '@/lib/activity'
+
+export const GET = withRbac('activity:view', async (request: NextRequest, auth: RbacContext) => {
+  try {
+    const { searchParams } = new URL(request.url)
+
+    const result = await activityService.list(
+      {
+        walletAddress: auth.walletAddress,
+        limitParam: searchParams.get('limit'),
+        offsetParam: searchParams.get('offset'),
+        contractId: searchParams.get('contractId'),
+        projectId: searchParams.get('projectId'),
+        actionType: searchParams.get('actionType'),
+        actorId: searchParams.get('actorId'),
+      },
+      auth.userId,
+      auth.role
+    )
+
+    return NextResponse.json(result)
+  } catch (err) {
+    console.error('[activity] Failed to list activity logs:', err)
+    return NextResponse.json(
+      { error: 'Failed to fetch activity logs', code: 'ACTIVITY_FETCH_FAILED' },
+      { status: 500 }
+    )
+  }
+})

app/api/contracts/deploy/route.ts

@@ -2,7 +2,9 @@ export const dynamic = 'force-dynamic'
 
 import { NextRequest, NextResponse } from 'next/server'
 import { withAuth } from '@/lib/auth/middleware'
+import { sql } from '@/lib/db'
 import { deploySorobanEscrow, SorobanDeployError } from '@/lib/soroban/deploy'
+import { activityService } from '@/lib/activity'
 import {
   createContract,
   createMilestones,
@@ -164,6 +166,24 @@ export const POST = withAuth(async (request: NextRequest, auth) => {
     return NextResponse.json({ error: 'Failed to persist contract data', code: 'DB_ERROR' }, { status: 500 })
   }
 
+  const users = await sql`SELECT id FROM users WHERE wallet_address = ${auth.walletAddress} LIMIT 1`
+  const actorId = users[0]?.id as string | undefined
+  if (actorId) {
+    activityService.log({
+      actorId,
+      contractId: String(contract.id),
+      projectId: String(job.id),
+      actionType: 'contract_created',
+      description: `Contract created for project "${job.title}" with freelancer ${freelancer.wallet_address}`,
+      metadata: {
+        totalAmount: body.totalAmount,
+        currency,
+        milestonesCount: milestones.length,
+        freelancerId: body.freelancerId,
+      },
+    }).catch((err: unknown) => console.error('[activity] Failed to log contract_created:', err))
+  }
+
   return NextResponse.json(
     {
       contractId: contract.id,

app/api/disputes/route.ts

@@ -3,6 +3,7 @@ export const dynamic = 'force-dynamic'
 import { NextRequest, NextResponse } from 'next/server'
 import { sql } from '@/lib/db'
 import { withRbac, RbacContext } from '@/lib/auth/rbacMiddleware'
+import { activityService } from '@/lib/activity'
 
 export const POST = withRbac('dispute:create', async (request: NextRequest, auth: RbacContext) => {
   try {
@@ -15,6 +16,15 @@ export const POST = withRbac('dispute:create', async (request: NextRequest, auth
     if (!job) return NextResponse.json({ error: 'Job not found', code: 'JOB_NOT_FOUND' }, { status: 404 })
     const [dispute] = await sql`INSERT INTO disputes (job_id, raised_by, reason) VALUES (${job.id}, ${auth.userId}, ${reason}) RETURNING *`
     await sql`UPDATE jobs SET status = 'disputed', updated_at = CURRENT_TIMESTAMP WHERE id = ${jobId}`
+
+    activityService.log({
+      actorId: auth.userId,
+      disputeId: dispute.id,
+      actionType: 'dispute_created',
+      description: `Dispute raised on job "${job.title}": "${reason}"`,
+      metadata: { jobId, reason },
+    }).catch((err: unknown) => console.error('[activity] Failed to log dispute_created:', err))
+
     return NextResponse.json(dispute, { status: 201 })
   } catch {
     return NextResponse.json({ error: 'Failed to raise dispute', code: 'DISPUTE_CREATION_FAILED' }, { status: 500 })

app/api/escrow/dispute/route.ts

@@ -23,6 +23,7 @@ import {
   escrowErrorToHttpStatus,
   type DisputeRaisedBy,
 } from '@/lib/escrow'
+import { activityService } from '@/lib/activity'
 
 export const POST = withAuth(async (request: NextRequest, auth) => {
   let body: Record<string, unknown>
@@ -63,6 +64,20 @@ export const POST = withAuth(async (request: NextRequest, auth) => {
       responseDeadline: body.responseDeadline as string | undefined,
     })
 
+    activityService.log({
+      actorId: userId,
+      contractId: result.contract.id,
+      disputeId: result.dispute.id,
+      milestoneId: result.dispute.milestoneId ?? undefined,
+      actionType: 'dispute_created',
+      description: `Dispute raised by ${raisedBy}: "${body.reason}"`,
+      metadata: {
+        raisedBy,
+        reason: body.reason,
+        desiredOutcome: body.desiredOutcome ?? null,
+      },
+    }).catch((err: unknown) => console.error('[activity] Failed to log dispute_created:', err))
+
     return NextResponse.json(
       {
         disputeId: result.dispute.id,

app/api/escrow/fund/route.ts

@@ -12,7 +12,9 @@
 
 import { NextRequest, NextResponse } from 'next/server'
 import { withRbac, RbacContext } from '@/lib/auth/rbacMiddleware'
+import { sql } from '@/lib/db'
 import { escrowService, EscrowError, escrowErrorToHttpStatus } from '@/lib/escrow'
+import { activityService } from '@/lib/activity'
 
 export const POST = withRbac('escrow:fund', async (request: NextRequest, auth: RbacContext) => {
   let body: Record<string, unknown>
@@ -33,6 +35,18 @@ export const POST = withRbac('escrow:fund', async (request: NextRequest, auth: R
       amount: body.amount as string,
     })
 
+    activityService.log({
+      actorId: auth.userId,
+      contractId: result.contract.id,
+      actionType: 'escrow_funded',
+      description: `Escrow funded with ${body.amount} for contract ${result.contract.id}`,
+      metadata: {
+        amount: body.amount,
+        fundingTxHash: body.fundingTxHash,
+        escrowStatus: result.contract.escrowStatus,
+      },
+    }).catch((err: unknown) => console.error('[activity] Failed to log escrow_funded:', err))
+
     return NextResponse.json({
       contractId: result.contract.id,
       escrowStatus: result.contract.escrowStatus,

app/api/escrow/refund/route.ts

@@ -12,6 +12,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { withAnyRbac, RbacContext } from '@/lib/auth/rbacMiddleware'
 import { escrowService, EscrowError, escrowErrorToHttpStatus } from '@/lib/escrow'
+import { activityService } from '@/lib/activity'
 
 export const POST = withAnyRbac(['escrow:refund', 'admin:contracts_freeze'], async (request: NextRequest, auth: RbacContext) => {
   let body: Record<string, unknown>
@@ -31,6 +32,19 @@ export const POST = withAnyRbac(['escrow:refund', 'admin:contracts_freeze'], asy
       reason: body.reason as string,
     })
 
+    activityService.log({
+      actorId: auth.userId,
+      contractId: result.contract.id,
+      actionType: 'escrow_refunded',
+      description: `Escrow refunded: "${body.reason}"`,
+      metadata: {
+        reason: body.reason,
+        refundTxHash: result.refundTxHash,
+        contractStatus: result.contract.status,
+        escrowStatus: result.contract.escrowStatus,
+      },
+    }).catch((err: unknown) => console.error('[activity] Failed to log escrow_refunded:', err))
+
     return NextResponse.json({
       contractId: result.contract.id,
       contractStatus: result.contract.status,

app/api/escrow/release/route.ts

@@ -12,6 +12,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { withRbac, RbacContext } from '@/lib/auth/rbacMiddleware'
 import { escrowService, EscrowError, escrowErrorToHttpStatus } from '@/lib/escrow'
+import { activityService } from '@/lib/activity'
 
 export const POST = withRbac('escrow:release', async (request: NextRequest, auth: RbacContext) => {
   let body: Record<string, unknown>
@@ -31,6 +32,21 @@ export const POST = withRbac('escrow:release', async (request: NextRequest, auth
       callerWalletAddress: auth.walletAddress,
     })
 
+    activityService.log({
+      actorId: auth.userId,
+      contractId: result.contract.id,
+      milestoneId: result.milestone.id,
+      actionType: 'payment_released',
+      description: `Payment of ${result.milestone.amount} released for milestone "${result.milestone.title}"`,
+      metadata: {
+        amount: result.milestone.amount,
+        currency: result.milestone.currency,
+        releaseTxHash: result.releaseTxHash,
+        milestoneStatus: result.milestone.status,
+        allMilestonesPaid: result.allMilestonesPaid,
+      },
+    }).catch((err: unknown) => console.error('[activity] Failed to log payment_released:', err))
+
     return NextResponse.json({
       milestoneId: result.milestone.id,
       milestoneStatus: result.milestone.status,

app/api/milestones/[id]/approve/route.ts

@@ -3,6 +3,7 @@ export const dynamic = 'force-dynamic'
 import { NextRequest, NextResponse } from 'next/server'
 import { withAnyRbac, RbacContext } from '@/lib/auth/rbacMiddleware'
 import { sql } from '@/lib/db'
+import { activityService } from '@/lib/activity'
 
 // Only the contract client can approve (or reject) a submitted milestone
 export const POST = withAnyRbac(['milestone:approve', 'milestone:reject'], async (request: NextRequest, auth: RbacContext) => {
@@ -59,6 +60,17 @@ export const POST = withAnyRbac(['milestone:approve', 'milestone:reject'], async
       RETURNING *
     `
 
+    activityService.log({
+      actorId: auth.userId,
+      milestoneId: id,
+      contractId: milestone.contract_id,
+      actionType: action === 'approve' ? 'milestone_approved' : 'milestone_rejected',
+      description: action === 'approve'
+        ? `Milestone "${updated.title}" approved`
+        : `Milestone "${updated.title}" rejected: "${rejection_reason}"`,
+      metadata: { action, rejection_reason: rejection_reason ?? null },
+    }).catch((err: unknown) => console.error('[activity] Failed to log milestone approval:', err))
+
     return NextResponse.json({ milestone: updated })
   } catch {
     return NextResponse.json({ error: 'Failed to process milestone approval', code: 'MILESTONE_APPROVE_FAILED' }, { status: 500 })

app/api/milestones/[id]/route.ts

@@ -4,6 +4,7 @@ import { NextRequest, NextResponse } from 'next/server'
 import { withAuth } from '@/lib/auth/middleware'
 import { sql } from '@/lib/db'
 import { UpdateMilestoneSchema, IMMUTABLE_MILESTONE_STATUS_VALUES } from '@/lib/validations'
+import { activityService } from '@/lib/activity'
 
 export const PATCH = withAuth(async (request: NextRequest, auth) => {
   const id = request.nextUrl.pathname.split('/').at(-1)
@@ -65,6 +66,15 @@ export const PATCH = withAuth(async (request: NextRequest, auth) => {
       RETURNING *
     `
 
+    activityService.log({
+      actorId: user.id,
+      milestoneId: id,
+      projectId: milestone.project_id,
+      actionType: 'milestone_updated',
+      description: `Milestone "${updated.title}" updated`,
+      metadata: { previousTitle: milestone.title },
+    }).catch((err: unknown) => console.error('[activity] Failed to log milestone_updated:', err))
+
     return NextResponse.json({ milestone: updated })
   } catch {
     return NextResponse.json({ error: 'Failed to update milestone', code: 'MILESTONE_UPDATE_FAILED' }, { status: 500 })

app/api/milestones/[id]/submit/route.ts

@@ -3,6 +3,7 @@ export const dynamic = 'force-dynamic'
 import { NextRequest, NextResponse } from 'next/server'
 import { withRbac, RbacContext } from '@/lib/auth/rbacMiddleware'
 import { sql } from '@/lib/db'
+import { activityService } from '@/lib/activity'
 
 // Only the contract freelancer can submit a milestone (status must be pending or in_progress)
 export const POST = withRbac('milestone:submit', async (request: NextRequest, auth: RbacContext) => {
@@ -45,6 +46,15 @@ export const POST = withRbac('milestone:submit', async (request: NextRequest, au
       RETURNING *
     `
 
+    activityService.log({
+      actorId: auth.userId,
+      milestoneId: id,
+      contractId: milestone.contract_id,
+      actionType: 'milestone_submitted',
+      description: `Milestone "${updated.title}" submitted for review`,
+      metadata: { deliverables: deliverables ?? [] },
+    }).catch((err: unknown) => console.error('[activity] Failed to log milestone_submitted:', err))
+
     return NextResponse.json({ milestone: updated })
   } catch {
     return NextResponse.json({ error: 'Failed to submit milestone', code: 'MILESTONE_SUBMIT_FAILED' }, { status: 500 })