new funcionality

app/Http/Controllers/Admin/AuditLogController.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
+use Illuminate\Http\Request;
+
+class AuditLogController extends Controller
+{
+    public function index(Request $request)
+    {
+        return response()->json(AuditLog::paginatedFor($request));
+    }
+}

app/Http/Controllers/Admin/UserController.php

@@ -2,7 +2,9 @@
 
 namespace App\Http\Controllers\Admin;
 
+use App\Events\UserDeactivated;
 use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
 use App\Models\User;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
@@ -43,6 +45,8 @@ class UserController extends Controller
     {
         $user->update(['approved_at' => now()]);
 
+        AuditLog::record(request(), 'user.approved', 'user', $user->id, $user->email);
+
         return response()->json($this->present($user));
     }
 
@@ -65,6 +69,12 @@ class UserController extends Controller
 
         $user->assignRole($data['role']);
 
+        AuditLog::record($request, 'user.created', 'user', $user->id, $user->email, [
+            'name' => $user->name,
+            'email' => $user->email,
+            'role' => $data['role'],
+        ]);
+
         return response()->json($this->present($user), 201);
     }
 
@@ -82,6 +92,13 @@ class UserController extends Controller
             abort(422, __('messages.cannot_remove_own_admin_role'));
         }
 
+        $before = [
+            'name' => $user->name,
+            'email' => $user->email,
+            'is_active' => $user->is_active,
+            'role' => $user->getRoleNames()->first(),
+        ];
+
         $user->update([
             'name' => $data['name'],
             'email' => $data['email'],
@@ -91,7 +108,15 @@ class UserController extends Controller
 
         $user->syncRoles([$data['role']]);
 
-        return response()->json($this->present($user->fresh()));
+        $fresh = $user->fresh();
+
+        if ($before['is_active'] && ! $fresh->is_active) {
+            UserDeactivated::dispatch($fresh);
+        }
+
+        $this->recordUserUpdate($request, $fresh, $before, isset($data['password']));
+
+        return response()->json($this->present($fresh));
     }
 
     /**
@@ -106,6 +131,8 @@ class UserController extends Controller
             abort(422, __('messages.cannot_delete_last_admin'));
         }
 
+        AuditLog::record($request, 'user.deleted', 'user', $user->id, $user->email);
+
         $user->delete();
 
         return response()->noContent();
@@ -116,6 +143,8 @@ class UserController extends Controller
         $user = User::onlyTrashed()->findOrFail($id);
         $user->restore();
 
+        AuditLog::record(request(), 'user.restored', 'user', $user->id, $user->email);
+
         return response()->json($this->present($user));
     }
 
@@ -126,6 +155,8 @@ class UserController extends Controller
     {
         $user = User::onlyTrashed()->findOrFail($id);
 
+        AuditLog::record($request, 'user.force_deleted', 'user', $user->id, $user->email);
+
         $user->forceDelete();
 
         return response()->noContent();
@@ -168,6 +199,11 @@ class UserController extends Controller
             'updated_at' => now(),
         ]);
 
+        AuditLog::record($request, 'user.app_role_assigned', 'user', $user->id, $user->email, [
+            'client_id' => $data['client_id'],
+            'role' => $data['role'],
+        ]);
+
         return response()->json($data, 201);
     }
 
@@ -179,9 +215,44 @@ class UserController extends Controller
             ->where('role', $role)
             ->delete();
 
+        AuditLog::record(request(), 'user.app_role_revoked', 'user', $user->id, $user->email, [
+            'client_id' => $clientId,
+            'role' => $role,
+        ]);
+
         return response()->noContent();
     }
 
+    /**
+     * Solo registra los campos que efectivamente cambiaron (nunca la contraseña
+     * en sí, solo si cambió o no) — evita ruido en el audit log en updates que
+     * no tocan nada relevante.
+     */
+    private function recordUserUpdate(Request $request, User $user, array $before, bool $passwordChanged): void
+    {
+        $after = [
+            'name' => $user->name,
+            'email' => $user->email,
+            'is_active' => $user->is_active,
+            'role' => $user->getRoleNames()->first(),
+        ];
+
+        $changes = [];
+        foreach ($before as $field => $previous) {
+            if ($previous !== $after[$field]) {
+                $changes[$field] = ['from' => $previous, 'to' => $after[$field]];
+            }
+        }
+
+        if ($passwordChanged) {
+            $changes['password'] = ['changed' => true];
+        }
+
+        if ($changes !== []) {
+            AuditLog::record($request, 'user.updated', 'user', $user->id, $user->email, $changes);
+        }
+    }
+
     private function present(User $user): array
     {
         return [

app/Http/Controllers/Admin/UserSessionController.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\AuditLog;
+use App\Models\User;
+use App\Support\UserSessions;
+use Illuminate\Http\Request;
+
+class UserSessionController extends Controller
+{
+    public function index(User $user)
+    {
+        return response()->json(UserSessions::active($user));
+    }
+
+    public function destroy(Request $request, User $user, string $tokenId)
+    {
+        abort_unless(UserSessions::revoke($user, $tokenId), 404);
+
+        AuditLog::record($request, 'user.session_revoked', 'user', $user->id, $user->email);
+
+        return response()->noContent();
+    }
+
+    public function destroyAll(Request $request, User $user)
+    {
+        $count = UserSessions::revokeAll($user);
+
+        AuditLog::record($request, 'user.sessions_revoked_all', 'user', $user->id, $user->email, [
+            'count' => $count,
+        ]);
+
+        return response()->noContent();
+    }
+}