Change Notifications & the Audit Log (Foodops)

Plain-English summary

Owners and admins often ask "does the main admin / owner get notified when someone makes a change?" — for example when a staff member edits a menu item, changes a price, edits a modifier group, or changes a setting. The honest answer on the current Foodops stack: there is no push alert on edits. Nobody gets a push, email, or SMS when a change is made. Instead the system keeps a full audit trail you review on demand — the model is pull, not push: you open the Audit Log or a record's History to see who changed what.

When you'd use this

• An owner wants to know whether they'll be alerted when staff change prices, items, or settings.
• Investigating who edited a record (a modifier group, an item, a register session, an expense).
• Setting expectations: the admin sees changes by reviewing them, not by being pinged.

No push alert on edits

The system does not send the owner a notification (push, email, or SMS) when a staff member edits a menu item, changes a price, edits a modifier group, or changes a setting. The in-app notification bell at the top of the admin app (polled about every 2 minutes) carries operational notifications only — chiefly file-ready links for report/data exports and imports (FileDownloadLink) and long-running background tasks — not per-edit "someone changed X" alerts. [code: foodops-admin-app/apps/admin/src/services/notificationService.ts:8-9 (only FileDownloadLink=4 / BackgroundTask=8 surfaced); apps/admin/src/components/layout/NotificationBell.tsx (unread-count poll) @ 289bf0e] Order/marketing/SMS dispatch is a separate concern handled by hubits-api-notifications, not change alerts.

What you get instead — a full audit trail (pull, not push)

• Settings → Audit Log (/settings/audit-log) — an org-wide activity log with filters for Category (Authentication, Authorization, DataAccess, UserManagement, SystemAdministration, Security, Privacy, Financial, Compliance), Risk level (Low / Medium / High / Critical), success/failure, and free-text search. Each row shows the acting user and an org-timezone timestamp. Visibility is role-gated (it sits under Settings). [code: foodops-admin-app/apps/admin/src/pages/settings/AuditLogPage.tsx; apps/admin/src/services/auditLogService.ts (GET /v1/audit-logs); backed by hubits-api-sales/Hubits.Sales.Api/Controllers/AuditLogsController.cs @ 289bf0e/99e6847]
• Per-record history / operation logs — many records keep their own change history, surfaced as a History button or an Audit / History tab:
  • Modifier groups — a History icon on each row of Catalog → Modifiers opens a change-history dialog; the sales API snapshots the group before/after every edit and writes an Edited operation-log row with the field-level diff. [code: hubits-api-sales/Hubits.Sales.Api/Controllers/ModifiersManagementController.cs:358-405 (WriteGroupLogAsync + GetSnapshotDifferences); foodops-admin-app/apps/admin/src/components/menu/ModifierHistoryDialog.tsx @ 99e6847/289bf0e]
  • Catalog items / categories / menu groups / brands — an operation-log history dialog per record. [code: foodops-admin-app/apps/admin/src/components/catalog/OperationLogHistoryDialog.tsx @ 289bf0e]
  • Register sessions — a session-history view with filter pills. [code: hubits-api-sales/Hubits.Sales.Api/Controllers/SessionsController.cs:266,453 (GET history + history/stats); foodops-admin-app/apps/admin/src/components/sales/SessionHistoryTab.tsx @ 99e6847/289bf0e]
  • Inventory documents (stock adjustments / transfers / counts) and expenses — an operation-logs / audit tab per document. [code: foodops-admin-app/apps/admin/src/components/inventory/OperationLogsTab.tsx; apps/admin/src/components/entity-tabs/EntityAuditTab.tsx; hubits-api-expenses/Hubits.Expenses.Api/Controllers/ExpensesController.cs:462,605 ({id}/operation-logs, {id}/history) @ 289bf0e/f6986b9]

So the pattern is pull, not push: the owner audits changes by opening the Audit Log or a record's History, rather than being pinged in real time.

Can the audit log be exported?

It depends which app you are in — and the honest answer for Foodops today is no.

Foodops / Salesmade back-office (admin.foodops.io, app.salesmade.io) — no export

The Audit Log page at Settings → Audit Log is a read-and-filter screen only. There is no Export / Download / CSV / Excel button on it, and the API behind it exposes only a paged list and a single-record fetch — no export endpoint. [code: foodops-admin-app/apps/admin/src/pages/settings/AuditLogPage.tsx (no export control anywhere in the page); apps/admin/src/services/auditLogService.ts (only list() → GET /v1/audit-logs and get(id)); hubits-api-sales/Hubits.Sales.Api/Controllers/AuditLogsController.cs — [Route("api/v1/audit-logs")] with exactly two actions, [HttpGet] List and [HttpGet("{id:guid}")] Get @ main]

What you can do instead:

• Filter it down and read it in place. The page filters on Category, Risk level, success/failure and free text, and you can page through the results. Narrow to the window you care about rather than trying to pull the whole log out. [code: apps/admin/src/types/auditLog.ts — AuditLogListParams supports search/userId/action/entityType/entityId/category/riskLevel/fromDate/toDate/isSuccessful @ main]
• Export the record instead of the log. Most operational lists in the admin app (orders, invoices, sales orders, reports) do have CSV/Excel export — so if what you actually need is "a file of what happened", the report or list export is usually the better route than the audit log.
• Ask support if you need a one-off extract for an auditor or a compliance request — it is a backend query, not a self-service feature.

Shops (shop.hubits.io) — yes, Export CSV

The retail Shops app does have it. Go to Settings → Audit Logs and click the Export CSV button in the top-right of the page. [code: haafai.app.pos/Haafai.RetailPos.App/Areas/Settings/Views/AuditLogs/Index.cshtml:26-27 ("Export CSV" button) → :307-308 hidden form posting to the Export action @ master]

• The export honours whatever filters you have applied — date from/to, action, category, risk level, search term, success/failed — because the Export action re-applies the same filter chain as the list. [code: haafai.app.pos/Haafai.RetailPos.App/Areas/Settings/Controllers/AuditLogsController.cs:158-207 @ master]
• It is capped at 10,000 rows (newest first) for performance, so narrow the date range if your log is long. [code: AuditLogsController.cs:209-211 — .OrderByDescending(a => a.Timestamp).Take(10000) @ master]
• The file downloads as audit-logs-<yyyyMMdd-HHmmss>.csv with 13 columns: Timestamp, User, Email, Action, Category, Entity Type, Entity ID, Description, Status, Error Message, Risk Level, IP Address, Platform. [code: AuditLogsController.cs:231-243 @ master]

Key concepts

• No edit push alerts — changes don't trigger a notification to the owner/admin. There is no "someone changed X" push, email, or SMS.
• Notification bell = operational only — it shows export/import file-ready links and background-task completions, not change alerts.
• Audit Log — the org-wide, filterable record of who did what, under Settings (role-gated).
• Audit-log export — a Shops-only capability (Settings → Audit Logs → Export CSV, filtered, ≤10,000 rows). The Foodops/Salesmade admin audit log is read-and-filter only.
• Per-record History — many records (modifiers, catalog items, sessions, inventory docs, expenses) keep their own before/after change log, opened from a History button or Audit tab.
• Pull, not push — you find out about changes by reviewing the trail, not by being notified.

Common questions

Q: Does the main admin or owner get notified when someone makes a change? A: No — there's no push, email, or SMS alert when a staff member edits an item, price, modifier, or setting. What you get instead is a full audit trail you review on demand: Settings → Audit Log for an org-wide, filterable "who did what," plus a History button / Audit tab on individual records (modifier groups, catalog items, register sessions, inventory documents, expenses). The model is pull, not push.

Q: What does the notification bell in the admin app actually show? A: Operational notifications only — mainly file-ready links when a report/data export or import finishes, and long-running background-task completions. It is not a feed of "someone changed X" edit alerts.

Q: How do I see who changed a price or edited a modifier? A: Open the record's History (e.g. the History icon on a Catalog → Modifiers row shows the before/after field-level diff of every edit), or use Settings → Audit Log and filter by category/user/date. Both show the acting user and a timestamp.

Q: Can I get real-time alerts when staff make changes? A: Not today — there's no real-time change-alert mechanism. That's a feature request. The current tool for oversight is the audit trail (Audit Log + per-record History), reviewed when you want it.

Q: Is the Audit Log visible to everyone? A: No — it sits under Settings and is role-gated, so only users whose role grants Settings/audit access can open it.

Q: Can I export the audit log? A: In the Shops retail app, yes — Settings → Audit Logs → Export CSV; it downloads the currently-filtered log (up to 10,000 rows, newest first) as audit-logs-<timestamp>.csv. In the Foodops / Salesmade back-office, no — the Settings → Audit Log page is read-and-filter only; there's no export button and no export endpoint behind it. Narrow the filters and read it in place, or ask support for a one-off extract if an auditor needs a file.

Q: How do I download the audit log to Excel? A: There's no Excel export of the audit log in the Foodops/Salesmade admin app. Shops offers a CSV export (Settings → Audit Logs → Export CSV) which opens fine in Excel. If you need a spreadsheet of activity in Foodops, the report and list exports (orders, invoices, sales orders) are the exportable surfaces — the audit log itself is not.

Q: How far back does the audit log go / how much can I pull out at once? A: The Shops CSV export is capped at 10,000 rows per download, newest first — so for a long history, export in date-range slices. The Foodops/Salesmade audit log has no export at all, so there's no bulk pull; you page through it on screen.

Edge cases and known issues

Expecting a notification that never comes

• Symptom: An owner waits to be alerted when staff change something and nothing arrives.
• Cause: By design — there are no per-edit push notifications; the bell carries only export/background-task items.
• Workaround: Check Settings → Audit Log or the record's History tab; that's where changes are recorded.

Related

• Foodops Reports Catalogue — the report set (this audit-log detail was split out of Reports so it retrieves on its own)

• Users, Roles & Permissions — who can see the Audit Log (role-gated)

• Menu Modifiers — modifier-group History / change log

• 2026-07-27 — Added the "Can the audit log be exported?" section, four export Q&As and export-vocabulary aliases, closing a real support_bot coverage gap. Codebase-only, no live walk. Verified ABSENT in Foodops/Salesmade: foodops-admin-app@main pages/settings/AuditLogPage.tsx has no export/download/CSV control and services/auditLogService.ts exposes only list()/get(id); hubits-api-sales@main Controllers/AuditLogsController.cs (api/v1/audit-logs) declares exactly two actions — [HttpGet] List and [HttpGet("{id:guid}")] Get. Verified PRESENT in Shops: haafai.app.pos@master Areas/Settings/Views/AuditLogs/Index.cshtml:26-27 renders an Export CSV button that posts the hidden form at :307-308 to AuditLogsController.Export (:158+), which re-applies the list filters, .Take(10000), and returns audit-logs-<timestamp>.csv with the 13 columns listed. Added haafai/haafai.app.pos to source_repos.

• 2026-07-17 — Authored as a dedicated entry (codebase-only; not live-walked), split out of reports.md's audit-log section so the "does the owner get notified when changes are made?" grounded-negative retrieves + grounds as its own unit (support_bot L3 finding: a buried section retrieves the parent doc, not the answer). Content grounded against foodops-admin-app@289bf0e (notificationService.ts:8-9 = only FileDownloadLink/BackgroundTask surfaced; AuditLogPage.tsx/auditLogService.ts; the per-record History dialogs) + hubits-api-sales@99e6847 (AuditLogsController, ModifiersManagementController:358-405 snapshot/diff, SessionsController:266,453) + hubits-api-expenses@f6986b9 (ExpensesController:462,605). No push/email/SMS change-alert mechanism found — the honest answer is pull-not-push. Notification-vocabulary aliases moved here from reports.md so this focused entry is the retrieval target. Live screenshots UI-TODO.