Audit log test cases, for the entry somebody wrote for you

Log injection is the case that almost nobody writes and it is the one that matters most, because it turns the log from a record into an attack surface. If a user controlled field reaches a log line without its newlines encoded, then anyone can write entries that look exactly like genuine ones. The record that exists specifically to establish what happened now contains fabricated events, and an investigator has no way to distinguish them. Immutability and tamper detection sit alongside it: an entry an administrator can edit or delete, or one that can be altered in storage without detection, proves nothing about anything.

Attribution is where audit logs quietly lose their value. The straightforward case is a user acting directly. The ones that get wrong are an admin impersonating a customer, an action taken by an API key, and a change made by a background job. Each needs to record the real actor and, where relevant, on whose behalf. An impersonated action attributed to the customer is worse than no entry at all, because it asserts something false about a person. A job that records only "system" makes the change untraceable back to whoever triggered it.

The write path needs the same care as the action it describes. An entry written before commit describes a change that may never have happened, and one skipped because the log store was briefly unavailable leaves a committed change unrecorded. Both are silent, and the second is the more dangerous because the system reports success. The correct behaviour has to be a deliberate decision, either failing the action or durably queuing the entry, rather than whatever the error handling happens to do.

Finally, a log is only useful if somebody can read it and somebody does. That means searchable at volume, because a query that times out during an incident is not available when it is needed. It means cursor pagination rather than offset, since the collection only grows and offsets shift underneath you. It means retention that is actually enforced rather than an unbounded table nobody has pruned, balanced against holds that must survive it. And it means alerting on the patterns worth investigating, because the value is in acting on the log rather than in having one.