Updated Logging System to Include Application Logs

server/smoke-test.js

@@ -1869,6 +1869,18 @@ async function main() {
   if (!acctsB.length) throw new Error('Company B chart of accounts was not seeded');
   if (acctsB.some((a) => a.code === `1501-${suffix}`)) throw new Error('Company B sees company A GL account');
 
+  // ---- Application (Winston) event logs --------------------------------------
+  const appLog = await request('/api/app-logs', { headers: auth });
+  if (!appLog.logs.length) throw new Error('Application logs were empty');
+  if (!appLog.categories.includes('http')) throw new Error('Application logs did not capture HTTP events');
+  const logSample = appLog.logs[0];
+  if (!logSample.timestamp || !logSample.level || !logSample.category) throw new Error('Application log entry was missing fields');
+  const httpLogs = await request('/api/app-logs?category=http', { headers: auth });
+  if (!httpLogs.logs.length || httpLogs.logs.some((l) => l.category !== 'http')) throw new Error('Application log category filter failed');
+  // Requires the admin.logs capability — a viewer-role user is refused.
+  const logForbidden = await fetch(`${baseUrl}/api/app-logs`, { headers: limitedAuth });
+  if (logForbidden.status !== 403) throw new Error('Application logs should require the admin.logs capability');
+
   console.log('Smoke test passed');
 }