Track HiveGrid Cloud planning reference

hivegrid-cloud/apps/web/app/utils/integrations/storageAudit.server.ts

@@ -0,0 +1,25 @@
+import type { PreUploadScanResult } from "@toolctrl/storage";
+import { createAdminLog } from "~/utils/db/logs.db.server";
+
+/**
+ * Build an onReject callback for storeFile's scan option that writes an
+ * "upload.rejected.scan" audit event with the verdict's bounded reason +
+ * detail + detected MIME. Callers pass the route's incoming Request so the
+ * audit row gets the right userId / url; never include the raw upload bytes
+ * in the persisted detail.
+ */
+export function auditRejectedUpload(request: Request, context: string) {
+  return async (verdict: PreUploadScanResult) => {
+    const payload = {
+      context,
+      reason: verdict.reason ?? "unknown",
+      detail: verdict.detail,
+      detectedMimeType: verdict.detectedMimeType,
+    };
+    try {
+      await createAdminLog(request, "upload.rejected.scan", JSON.stringify(payload));
+    } catch {
+      // audit write failures must never block the security signal
+    }
+  };
+}