Skip to main content

Audit Trails & System Logging

LearnWay maintains a multi-layered, immutable audit trail spanning administrative actions, blockchain execution, financial payments, gamification rewards, AI interactions, and system errors.

Auditing Architecture Overview


1. Administrative Action Auditing (AdminAuditLog)

Every administrative operation modifying curriculum, users, translation, or financial state is persisted to the admin_audit_logs table:

2. Blockchain & Smart Contract Transaction Auditing

All on-chain transactions submitted by the relayer (learnway-transaction-processor) to LearnWayManager.sol on Lisk L2 are tracked in blockchain_transactions:

3. Reward & Gamification Ledger Auditing (RewardTransaction)

Every XP and Gem state change is recorded in reward_transactions with a direct cryptographic correlation link to Lisk L2:

4. Payment & Financial Webhook Auditing

All fiat on-ramp orders and app store subscriptions are audited in payment_transactions, fonbnk_orders, and revenuecat_webhook_events:
  • Full Financial Metrics: Tracks cryptoAmount, cryptoCurrency (USDT/fUSD), fiatAmount, fiatCurrency, exchangeRate, and payout channels (mobile money / airtime).
  • Raw Webhook Verification: Inbound webhook payloads from Fonbnk and RevenueCat are stored with HMAC-SHA256 signature verification logs to prevent replay attacks and aid payment reconciliation.

5. AI Interaction & Safety Auditing (AiLessonRequest)

Every student question and Google Gemini response is audited in ai_lesson_requests and ai_analytics_logs:
  • Parameters Audited: userId, lessonId, courseId, promptType, customQuestion, response, latencyMs, status (success, rejected, timeout, error), and errorCode.
  • Accuracy & Feedback Scoring: Captures user ratings (thumbs_up / thumbs_down) to track feedbackPositiveRate across 24h, 7d, and 30d sliding windows.
  • Prompt Versioning: Emits promptVersion to benchmark output quality across prompt iterations.

6. Real-Time Distributed Error Monitoring (Sentry)

  • Integration: Initialized in src/instrument.ts via @sentry/nestjs before application bootstrap.
  • Scope:
    • Captures unhandled HTTP exceptions, WebSocket disconnections, and RPC provider failures.
    • Injects request breadcrumbs, user IDs (pseudonymous), and execution environment tags for rapid debugging.