fix(api): harden optional audit and session fields

packages/api/src/router/system-role-config-procedure-support.ts

@@ -40,7 +40,7 @@ export async function updateSystemRoleConfig(
     entityId: input.role,
     entityName: result.label,
     action: "UPDATE",
-    userId: ctx.dbUser?.id,
+    ...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
     before: (existing ?? {}) as unknown as Record<string, unknown>,
     after: result as unknown as Record<string, unknown>,
     source: "ui",

packages/api/src/router/user-self-service-procedure-support.ts

@@ -157,7 +157,7 @@ export async function generateTotpSecret(ctx: UserSelfServiceContext) {
   const secret = new Secret({ size: 20 });
   const totp = new TOTP({
     issuer: "CapaKraken",
-    label: ctx.session.user?.email ?? ctx.dbUser!.id,
+    label: ctx.session?.user?.email ?? ctx.dbUser!.id,
     algorithm: "SHA1",
     digits: 6,
     period: 30,

packages/api/src/router/utilization-category-procedure-support.ts

@@ -74,7 +74,7 @@ export async function createUtilizationCategory(
     entityId: created.id,
     entityName: created.name,
     action: "CREATE",
-    userId: ctx.dbUser?.id,
+    ...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
     after: created as unknown as Record<string, unknown>,
     source: "ui",
   });
@@ -112,7 +112,7 @@ export async function updateUtilizationCategory(
     entityId: updated.id,
     entityName: updated.name,
     action: "UPDATE",
-    userId: ctx.dbUser?.id,
+    ...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
     before,
     after: updated as unknown as Record<string, unknown>,
     source: "ui",