From 727161fa3a45838744d84f27a08a91dca8d05b76 Mon Sep 17 00:00:00 2001
From: yummybomb <19238148+yummybomb@users.noreply.github.com>
Date: Fri, 17 Jul 2026 15:05:38 +0000
Subject: [PATCH 1/2] Show user IDs in audit log search

---
 cmd/audit_logs.go      | 3 ++-
 cmd/audit_logs_test.go | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/cmd/audit_logs.go b/cmd/audit_logs.go
index aa6bd85..31a7112 100644
--- a/cmd/audit_logs.go
+++ b/cmd/audit_logs.go
@@ -112,7 +112,7 @@ func (c AuditLogsCmd) Search(ctx context.Context, in AuditLogsSearchInput) error
 		return nil
 	}
 
-	table := pterm.TableData{{"Timestamp", "Method", "Status", "Path", "User", "Duration (ms)", "Client IP"}}
+	table := pterm.TableData{{"Timestamp", "Method", "Status", "Path", "User", "User ID", "Duration (ms)", "Client IP"}}
 	for _, entry := range entries {
 		table = append(table, []string{
 			util.FormatLocal(entry.Timestamp),
@@ -120,6 +120,7 @@ func (c AuditLogsCmd) Search(ctx context.Context, in AuditLogsSearchInput) error
 			strconv.FormatInt(entry.Status, 10),
 			entry.Path,
 			formatAuditLogUser(entry),
+			entry.UserID,
 			strconv.FormatInt(entry.DurationMs, 10),
 			entry.ClientIP,
 		})
diff --git a/cmd/audit_logs_test.go b/cmd/audit_logs_test.go
index 32a1d47..66349de 100644
--- a/cmd/audit_logs_test.go
+++ b/cmd/audit_logs_test.go
@@ -88,6 +88,7 @@ func TestAuditLogsSearchBuildsParamsAndPrintsTable(t *testing.T) {
 	assert.Contains(t, out, "POST")
 	assert.Contains(t, out, "201")
 	assert.Contains(t, out, "dev@example.com")
+	assert.Contains(t, out, "user_123")
 	assert.Contains(t, out, "203.0.113.7")
 }
 

From 3d0e97684f748f49f545c81f8eb1c9af0c98236e Mon Sep 17 00:00:00 2001
From: yummybomb <19238148+yummybomb@users.noreply.github.com>
Date: Fri, 17 Jul 2026 15:28:05 +0000
Subject: [PATCH 2/2] Avoid repeating audit log user IDs

---
 cmd/audit_logs.go      | 9 +++------
 cmd/audit_logs_test.go | 7 +++++++
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/cmd/audit_logs.go b/cmd/audit_logs.go
index 31a7112..aa5b308 100644
--- a/cmd/audit_logs.go
+++ b/cmd/audit_logs.go
@@ -157,13 +157,10 @@ func parseAuditLogTime(value string) (time.Time, error) {
 }
 
 func formatAuditLogUser(entry kernel.AuditLogEntry) string {
-	if entry.Email != "" {
-		return entry.Email
+	if entry.Email == "" {
+		return "-"
 	}
-	if entry.UserID != "" {
-		return entry.UserID
-	}
-	return "-"
+	return entry.Email
 }
 
 func getAuditLogsHandler(cmd *cobra.Command) AuditLogsCmd {
diff --git a/cmd/audit_logs_test.go b/cmd/audit_logs_test.go
index 66349de..e574af1 100644
--- a/cmd/audit_logs_test.go
+++ b/cmd/audit_logs_test.go
@@ -92,6 +92,13 @@ func TestAuditLogsSearchBuildsParamsAndPrintsTable(t *testing.T) {
 	assert.Contains(t, out, "203.0.113.7")
 }
 
+func TestFormatAuditLogUserDoesNotRepeatUserIDWhenEmailMissing(t *testing.T) {
+	entry := sampleAuditLogEntry("POST", "/browsers")
+	entry.Email = ""
+
+	assert.Equal(t, "-", formatAuditLogUser(entry))
+}
+
 func TestAuditLogsSearchRejectsInvalidStart(t *testing.T) {
 	c := AuditLogsCmd{auditLogs: &FakeAuditLogsService{}}