Fix issue 497

[Agencybuilds]

Closes #497

📖 Context

As part of the backend requirements for the GrantFox FWC26 campaign (Stellar Wave), we needed to introduce structured access logging for the /api/audit endpoint. This PR implements the required logging mechanism to capture critical telemetry data (correlation ID, latency, status code, response size, and the actor) to improve audit traceability and system monitoring.

🛠️ Technical Implementation

• New Router Registration:
  • Created src/routes/audit.ts to cleanly handle /api/audit API traffic.
  • Mounted the router centrally within src/index.ts.
• Structured Middleware Logging:
  • Hooked the new route into our existing robust accessLog.ts middleware.
  • Added routing logic to specifically classify and emit logs prefixed as audit_access_log.
  • The middleware inherently pulls in the required fields: req-id (Correlation ID), latency (durationMs), status (statusCode), size, and actor ID.
• Input Validation & Error Handling:
  • Included a sample query constraint on limit with boundary validation (1-100).
  • Utilized a standardized error envelope to ensure malformed requests immediately receive a structured 400 Bad Request schema payload.
• Documentation:
  • Added inline OpenAPI (@openapi) documentation in src/routes/audit.ts detailing request expectations, limits, and potential error structures.

🧪 Testing & Verification

• Unit Testing:
  • Added focused Jest tests inside src/__tests__/routes/audit.test.ts.
  • Confirmed 100% code coverage on the new lines (exceeding the 90% requirement threshold).
• Tested Scenarios:
  • Verified a successful standard GET response (200 OK).
  • Validated boundary limits on inputs (testing upper bounds, lower bounds, and NaN conditions) expecting strict 400 Bad Request error envelopes.
  • Verified that the logger hook correctly captures payload sizes and timestamps.

✅ Checklist

• Code adheres to the repository's linting and style guidelines.
• Minimum 90% test coverage applied to all newly added/modified lines.
• Input boundaries firmly secured and validated.
• Structured logs accurately mapped with correlation IDs.
• API changes visually documented with clear inline comments.

---

Please let me know if you need any additional modifications or further details added to this PR body!

[drips-wave]

@Agencybuilds Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits