Function auditWorkflowLockToggle

apps/realtime/src/database/operations.ts:301–332

* Records an audit log entry when all blocks in a workflow are locked or unlocked. * Only audits workflow-level transitions (all locked or all unlocked), not partial toggles.

(workflowId: string, actorId: string)

 * Only audits workflow-level transitions (all locked or all unlocked), not partial toggles.
 */
async function auditWorkflowLockToggle(workflowId: string, actorId: string): Promise<void> {
  const [wf] = await db
    .select({ name: workflow.name, workspaceId: workflow.workspaceId })
    .from(workflow)
    .where(eq(workflow.id, workflowId))

  if (!wf) return

  const blocks = await db
    .select({ locked: workflowBlocks.locked })
    .from(workflowBlocks)
    .where(eq(workflowBlocks.workflowId, workflowId))

  if (blocks.length === 0) return

  const allLocked = blocks.every((b) => b.locked)
  const allUnlocked = blocks.every((b) => !b.locked)

  // Only audit workflow-level transitions, not partial toggles
  if (!allLocked && !allUnlocked) return

  recordAudit({
    workspaceId: wf.workspaceId,
    actorId,
    action: allLocked ? AuditAction.WORKFLOW_LOCKED : AuditAction.WORKFLOW_UNLOCKED,
    resourceType: AuditResourceType.WORKFLOW,
    resourceId: workflowId,
    resourceName: wf.name,
    description: allLocked ? `Locked workflow "${wf.name}"` : `Unlocked workflow "${wf.name}"`,
    metadata: { blockCount: blocks.length },
  })
}

async function handleBlockOperationTx(
  tx: any,