fix(server): shorten default audit retention

docs/audit-design.md

@@ -122,13 +122,13 @@ Retention is configurable per organization.
 
 | Setting            | Default | Minimum | Maximum  |
 |--------------------|---------|---------|----------|
-| `retentionDays`    | 90      | 7       | 365      |
+| `retentionDays`    | 2       | 1       | 365      |
 
 ### Configuration
 
 ```typescript
 interface OrgAuditConfig {
-  retentionDays: number;     // Default: 90
+  retentionDays: number;     // Default: 2
   webhookUrl?: string;       // Optional webhook endpoint
   webhookEvents?: AuditAction[]; // Filter which actions trigger webhooks (default: all)
   webhookSecret?: string;    // HMAC-SHA256 signing secret for webhook payloads

packages/server/src/__tests__/audit-retention-migration.test.ts

@@ -0,0 +1,72 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import { DatabaseSync } from "node:sqlite";
+import test from "node:test";
+
+import {
+  createNodeSqliteRunner,
+  runMigrations,
+  sha256,
+  type MigrationSource,
+} from "@relayauth/migrate";
+
+const MIGRATION_ID = "0006_audit_retention_default";
+const MIGRATION_URL = new URL(
+  `../db/migrations/${MIGRATION_ID}.sql`,
+  import.meta.url,
+);
+
+test("audit retention default migration preserves explicit overrides", async (t) => {
+  const db = new DatabaseSync(":memory:");
+  t.after(() => db.close());
+
+  db.exec(`
+    CREATE TABLE audit_retention_config (
+      org_id TEXT PRIMARY KEY,
+      retention_days INTEGER NOT NULL DEFAULT 90
+    );
+    INSERT INTO audit_retention_config (org_id, retention_days)
+    VALUES ('org_override', 30);
+  `);
+
+  const sql = await readFile(MIGRATION_URL, "utf8");
+  const source: MigrationSource = {
+    async list() {
+      return [{ id: MIGRATION_ID, sql, checksum: sha256(sql) }];
+    },
+  };
+  const result = await runMigrations(createNodeSqliteRunner(db), source);
+
+  assert.deepEqual(result, { applied: [MIGRATION_ID], skipped: [] });
+  assert.deepEqual(
+    db
+      .prepare(
+        "SELECT org_id, retention_days FROM audit_retention_config ORDER BY org_id",
+      )
+      .all()
+      .map((row) => ({
+        org_id: row.org_id,
+        retention_days: row.retention_days,
+      })),
+    [{ org_id: "org_override", retention_days: 30 }],
+  );
+
+  db.prepare("INSERT INTO audit_retention_config (org_id) VALUES (?)").run(
+    "org_default",
+  );
+  assert.deepEqual(
+    db
+      .prepare(
+        "SELECT org_id, retention_days FROM audit_retention_config ORDER BY org_id",
+      )
+      .all()
+      .map((row) => ({
+        org_id: row.org_id,
+        retention_days: row.retention_days,
+      })),
+    [
+      { org_id: "org_default", retention_days: 2 },
+      { org_id: "org_override", retention_days: 30 },
+    ],
+  );
+});

packages/server/src/__tests__/audit-retention.test.ts

@@ -398,12 +398,12 @@ test("purgeExpiredEntries deletes entries older than the provided retentionDays"
   );
 });
 
-test("default retention is 90 days", async () => {
+test("default retention is 2 days", async () => {
   const retention = await loadAuditRetention();
   const { db } = createRetentionD1({
     logs: [
-      createAuditLog("aud_expired_120", "org_default", 120),
-      createAuditLog("aud_recent_30", "org_default", 30),
+      createAuditLog("aud_expired_3", "org_default", 3),
+      createAuditLog("aud_recent_1", "org_default", 1),
     ],
   });
 
@@ -421,7 +421,7 @@ test("per-org retention override is respected", async () => {
   const fallback = await retention.getRetentionConfig(db, "org_default");
 
   assertRetentionConfig(override, "org_override", 30);
-  assertRetentionConfig(fallback, "org_default", 90);
+  assertRetentionConfig(fallback, "org_default", 2);
 });
 
 test("purgeExpiredEntries returns count of deleted entries", async () => {
@@ -447,7 +447,7 @@ test("getRetentionConfig returns org-specific or default config", async () => {
   });
 
   assertRetentionConfig(await retention.getRetentionConfig(db, "org_custom"), "org_custom", 120);
-  assertRetentionConfig(await retention.getRetentionConfig(db, "org_fallback"), "org_fallback", 90);
+  assertRetentionConfig(await retention.getRetentionConfig(db, "org_fallback"), "org_fallback", 2);
 });
 
 test("setRetentionConfig updates org retention setting", async () => {
@@ -461,13 +461,18 @@ test("setRetentionConfig updates org retention setting", async () => {
   assertRetentionConfig(await retention.getRetentionConfig(db, "org_test"), "org_test", 180);
 });
 
-test("retention minimum is 7 days and lower values are rejected", async () => {
+test("retention minimum is 1 day and lower values are rejected", async () => {
   const retention = await loadAuditRetention();
   const { db } = createRetentionD1();
 
+  await retention.setRetentionConfig(db, "org_test", 1);
+  assertRetentionConfig(await retention.getRetentionConfig(db, "org_test"), "org_test", 1);
+
   await assert.rejects(
-    async () => retention.setRetentionConfig(db, "org_test", 6),
-    /7|minimum|retention/i,
+    async () => retention.setRetentionConfig(db, "org_test", 0),
+    (error: unknown) =>
+      error instanceof Error &&
+      error.message === "retentionDays must be at least 1 day",
   );
 });
 

packages/server/src/__tests__/retention-gc.test.ts

@@ -172,22 +172,22 @@ test("pruneExpiredTokens bounds a batch and preserves verifier clock skew", asyn
   ]);
 });
 
-test("audit retention uses overrides, a 90-day default, and bounded batches", async (t) => {
+test("audit retention uses overrides, a 2-day default, and bounded batches", async (t) => {
   const { storage, db } = createStorage(t);
 
   await storage.DB.prepare(
     "INSERT INTO audit_retention_config (org_id, retention_days) VALUES (?, ?), (?, ?), (?, ?), (?, ?)",
   )
-    .bind("org_short", 30, "org_long", 180, "org_invalid", 1, "org_fractional", 30.5)
+    .bind("org_short", 30, "org_long", 180, "org_invalid", 0, "org_fractional", 30.5)
     .run();
 
-  await insertAuditLog(storage, "aud_default_old", "org_default", daysBeforeNow(100));
-  await insertAuditLog(storage, "aud_default_recent", "org_default", daysBeforeNow(80));
+  await insertAuditLog(storage, "aud_default_old", "org_default", daysBeforeNow(3));
+  await insertAuditLog(storage, "aud_default_recent", "org_default", daysBeforeNow(1));
   await insertAuditLog(storage, "aud_short_old", "org_short", daysBeforeNow(40));
   await insertAuditLog(storage, "aud_short_recent", "org_short", daysBeforeNow(20));
   await insertAuditLog(storage, "aud_long_recent", "org_long", daysBeforeNow(100));
-  await insertAuditLog(storage, "aud_invalid_old", "org_invalid", daysBeforeNow(100));
-  await insertAuditLog(storage, "aud_fractional_recent", "org_fractional", daysBeforeNow(40));
+  await insertAuditLog(storage, "aud_invalid_old", "org_invalid", daysBeforeNow(3));
+  await insertAuditLog(storage, "aud_fractional_recent", "org_fractional", daysBeforeNow(1));
 
   assert.deepEqual(await countExpiredEntriesBatch(db, { now: NOW, limit: 2 }), {
     expiredCount: 2,
@@ -266,7 +266,7 @@ test("audit cursor windows apply config/default retention inside a bounded rowid
   await storage.DB.prepare(
     "INSERT INTO audit_retention_config (org_id, retention_days) VALUES (?, ?), (?, ?), (?, ?)",
   )
-    .bind("org_short", 30, "org_long", 180, "org_invalid", 1)
+    .bind("org_short", 30, "org_long", 180, "org_invalid", 0)
     .run();
 
   await insertAuditLog(storage, "aud_default_old", "org_default", daysBeforeNow(100), 3);

packages/server/src/__tests__/storage-sqlite.test.ts

@@ -800,3 +800,21 @@ test("TestSqliteAutoCreateTables", async (t) => {
     );
   }
 });
+
+test("TestSqliteAuditRetentionDefaultsToTwoDays", async (t) => {
+  const { storage } = createTempStorage(t);
+
+  await storage.DB.prepare(
+    "INSERT INTO audit_retention_config (org_id) VALUES (?)",
+  )
+    .bind("org_default_retention")
+    .run();
+
+  const row = await storage.DB.prepare(
+    "SELECT retention_days FROM audit_retention_config WHERE org_id = ?",
+  )
+    .bind("org_default_retention")
+    .first<{ retention_days?: number }>();
+
+  assert.equal(row?.retention_days, 2);
+});

packages/server/src/db/migrations/0006_audit_retention_default.sql

@@ -0,0 +1,15 @@
+-- Keep audit history intentionally short unless an organization explicitly
+-- opts into a longer window. SQLite cannot alter a column default in place,
+-- so rebuild this small configuration table while preserving every override.
+CREATE TABLE audit_retention_config_v2 (
+  org_id TEXT PRIMARY KEY,
+  retention_days INTEGER NOT NULL DEFAULT 2
+);
+
+INSERT INTO audit_retention_config_v2 (org_id, retention_days)
+SELECT org_id, retention_days
+FROM audit_retention_config;
+
+DROP TABLE audit_retention_config;
+
+ALTER TABLE audit_retention_config_v2 RENAME TO audit_retention_config;

packages/server/src/engine/audit-retention.ts

@@ -28,8 +28,8 @@ type RetentionConfigRow = {
   retentionDays?: unknown;
 };
 
-const DEFAULT_RETENTION_DAYS = 90;
-const MIN_RETENTION_DAYS = 7;
+const DEFAULT_RETENTION_DAYS = 2;
+const MIN_RETENTION_DAYS = 1;
 const MAX_RETENTION_DAYS = 365;
 
 export async function purgeExpiredEntries(
@@ -120,7 +120,9 @@ function normalizeRetentionDays(value: unknown): number {
   const num = value;
 
   if (num < MIN_RETENTION_DAYS) {
-    throw new Error(`retentionDays must be at least ${MIN_RETENTION_DAYS} days`);
+    throw new Error(
+      `retentionDays must be at least ${MIN_RETENTION_DAYS} ${formatDays(MIN_RETENTION_DAYS)}`,
+    );
   }
 
   if (num > MAX_RETENTION_DAYS) {
@@ -130,6 +132,10 @@ function normalizeRetentionDays(value: unknown): number {
   return num;
 }
 
+function formatDays(value: number): "day" | "days" {
+  return value === 1 ? "day" : "days";
+}
+
 function createCutoffTimestamp(retentionDays: number): string {
   return new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000).toISOString();
 }

packages/server/src/engine/retention-gc.ts

@@ -369,7 +369,7 @@ export async function countExpiredTokensBatch(
 
 /**
  * Deletes one bounded batch of audit logs using each organization's configured
- * retention period, or the 90-day default when the config row is absent.
+ * retention period, or the two-day default when the config row is absent.
  */
 export async function purgeExpiredEntriesBatch(
   db: RetentionGcSqlExecutor,

specs/audit.md

@@ -549,8 +549,8 @@ interface OrgAuditRetentionConfig {
 
 Rules:
 
-- Default `retentionDays` is `90`.
-- Minimum supported value is `7`.
+- Default `retentionDays` is `2`.
+- Minimum supported value is `1`.
 - Maximum supported value is `365`.
 - Values outside this range must be rejected at write time.
 - Retention applies to all audit actions unless future product policy adds

workflows/006-audit-spec.ts

@@ -70,7 +70,7 @@ Write design outline to ${ROOT}/docs/audit-design.md covering:
 - Audit entry format: all fields from AuditEntry
 - Actions: all AuditAction values and when they fire
 - Storage: D1 table schema, indexes
-- Retention: configurable per-org, default 90 days
+- Retention: configurable per-org, default 2 days, minimum 1 day
 - Query semantics: filters, pagination, sorting
 - Export: CSV and JSON formats
 - Webhook notifications on audit events`,

workflows/054-audit-retention.ts

@@ -92,12 +92,12 @@ Use node:test + node:assert/strict. Import helpers from ./test-helpers.js.
 
 Test these behaviors:
 1. purgeExpiredEntries(db, retentionDays) deletes entries older than retentionDays
-2. Default retention is 90 days
+2. Default retention is 2 days
 3. Per-org retention override is respected
 4. purgeExpiredEntries returns count of deleted entries
 5. getRetentionConfig(db, orgId) returns org-specific or default config
 6. setRetentionConfig(db, orgId, days) updates org retention setting
-7. Retention minimum is 7 days (rejects lower values)
+7. Retention minimum is 1 day (rejects lower values)
 8. Dry run mode: countExpiredEntries() returns count without deleting`,
     verification: { type: 'exit_code' },
   })
@@ -133,8 +133,8 @@ Write to ${ROOT}/packages/server/src/engine/audit-retention.ts:
 2. countExpiredEntries(db, retentionDays?) — COUNT without deleting (dry run)
 3. getRetentionConfig(db, orgId) — read from audit_retention_config table
 4. setRetentionConfig(db, orgId, days) — upsert retention config
-5. Default retention: 90 days
-6. Minimum retention: 7 days (throw if lower)
+5. Default retention: 2 days
+6. Minimum retention: 1 day (throw if lower)
 7. Return { deletedCount } from purge
 
 Export from the package.`,