• soft delete users so audit logs persist
• disable soft-deleted accounts without changing email to security+whatever
• create table to store audit log events
• log user events
  • login
  • create api key
  • delete api key
  • change email
  • ???
  • email sent (use https://www.shakacode.com/blog/rails_add_deliver_callbacks_to_action_mailer/)
• log gem events
  • push
  • yank
  • add owner
  • remove owner
  • ???
• add a user view of events for that user
• add a per-gem view of events for owners
• add a global view for of events for admins

Prior art from PyPi:

• https://github.com/pypi/warehouse/blob/main/warehouse/events/models.py#L203-L204
• Audit trail: implement auditable event logging for sensitive actions pypi/warehouse#5863