#174: Add User Action Logging

packages/data-provider/index.ts

@@ -10,6 +10,9 @@ export {
 export { errorHandler } from './src/middleware/errorHandler.js';
 export { type DbConfig, migrate } from '@overture-stack/lyric-data-model';
 
+// middleware
+export { actionLoggerMiddleware } from './src/middleware/actionLogger.js';
+
 // routes
 export { default as dictionaryRouters } from './src/routers/dictionaryRouter.js';
 export { default as submissionRouter } from './src/routers/submissionRouter.js';

packages/data-provider/src/middleware/actionLogger.ts

@@ -0,0 +1,48 @@
+import type { NextFunction, Response } from 'express';
+
+import type { Logger } from '../config/logger.js';
+import { ActionResult, extractActionMetadata, formatActionLog } from '../utils/actionLoggerUtils.js';
+import type { RequestWithUser } from './auth.js';
+
+export type ActionLoggerConfig = {
+	enabled: boolean;
+};
+
+/**
+ * Action Logger Middleware
+ * This middleware should be placed after authMiddleware in the router chain.
+ */
+export const actionLoggerMiddleware = (config: ActionLoggerConfig, logger: Logger) => {
+	return (req: RequestWithUser, res: Response, next: NextFunction) => {
+		// Skip logging if disabled
+		if (!config.enabled) {
+			return next();
+		}
+		// Extract request metadata
+		const metadata = extractActionMetadata(req);
+		const startTime = Date.now();
+
+		const logAction = (statusCode: number) => {
+			const duration = Date.now() - startTime;
+			const statusResult = statusCode >= 200 && statusCode < 400 ? ActionResult.ALLOWED : ActionResult.DENIED;
+
+			const logMessage = formatActionLog(metadata, statusResult, statusCode, duration);
+
+			// Use appropriate log level based on statusCode returned
+			if (statusResult === ActionResult.DENIED) {
+				logger.warn(logMessage);
+				return;
+			}
+			logger.info(logMessage);
+		};
+
+		/**
+		 * Log the action after response is sent
+		 */
+		res.on('finish', () => {
+			logAction(res.statusCode);
+		});
+
+		next();
+	};
+};

packages/data-provider/src/routers/auditRouter.ts

@@ -2,6 +2,7 @@ import { json, Router, urlencoded } from 'express';
 
 import { BaseDependencies } from '../config/config.js';
 import auditController from '../controllers/auditController.js';
+import { actionLoggerMiddleware } from '../middleware/actionLogger.js';
 import { type AuthConfig, authMiddleware } from '../middleware/auth.js';
 
 const router = ({
@@ -16,6 +17,7 @@ const router = ({
 	router.use(json());
 
 	router.use(authMiddleware(authConfig));
+	router.use(actionLoggerMiddleware({ enabled: authConfig.enabled }, baseDependencies.logger));
 
 	router.get(
 		'/category/:categoryId/organization/:organization',

packages/data-provider/src/routers/categoryRouter.ts

@@ -2,6 +2,7 @@ import { json, Router, urlencoded } from 'express';
 
 import { BaseDependencies } from '../config/config.js';
 import categoryController from '../controllers/categoryController.js';
+import { actionLoggerMiddleware } from '../middleware/actionLogger.js';
 import { type AuthConfig, authMiddleware } from '../middleware/auth.js';
 
 const router = ({
@@ -16,6 +17,7 @@ const router = ({
 	router.use(json());
 
 	router.use(authMiddleware(authConfig));
+	router.use(actionLoggerMiddleware({ enabled: authConfig.enabled }, baseDependencies.logger));
 
 	router.get('/', categoryController(baseDependencies).listAll);
 	router.get('/:categoryId', categoryController(baseDependencies).getDetails);

packages/data-provider/src/routers/dictionaryRouter.ts

@@ -2,6 +2,7 @@ import { json, Router, urlencoded } from 'express';
 
 import { BaseDependencies } from '../config/config.js';
 import dictionaryController from '../controllers/dictionaryController.js';
+import { actionLoggerMiddleware } from '../middleware/actionLogger.js';
 import { type AuthConfig, authMiddleware } from '../middleware/auth.js';
 
 const router = ({
@@ -16,6 +17,7 @@ const router = ({
 	router.use(json());
 
 	router.use(authMiddleware(authConfig));
+	router.use(actionLoggerMiddleware({ enabled: authConfig.enabled }, baseDependencies.logger));
 
 	router.post('/register', dictionaryController(baseDependencies).registerDictionary);
 

packages/data-provider/src/routers/submissionRouter.ts

@@ -6,6 +6,7 @@ import multer from 'multer';
 
 import { BaseDependencies } from '../config/config.js';
 import createSubmissionController from '../controllers/submissionController.js';
+import { actionLoggerMiddleware } from '../middleware/actionLogger.js';
 import { type AuthConfig, authMiddleware } from '../middleware/auth.js';
 
 const router = ({
@@ -68,6 +69,7 @@ const router = ({
 	);
 
 	router.use(authMiddleware(authConfig));
+	router.use(actionLoggerMiddleware({ enabled: authConfig.enabled }, baseDependencies.logger));
 
 	router.get('/:submissionId', submissionController.getSubmissionById);
 

packages/data-provider/src/routers/submittedDataRouter.ts

@@ -2,6 +2,7 @@ import { json, Router, urlencoded } from 'express';
 
 import { BaseDependencies } from '../config/config.js';
 import submittedDataController from '../controllers/submittedDataController.js';
+import { actionLoggerMiddleware } from '../middleware/actionLogger.js';
 import { type AuthConfig, authMiddleware } from '../middleware/auth.js';
 
 const router = ({
@@ -16,6 +17,7 @@ const router = ({
 	router.use(json());
 
 	router.use(authMiddleware(authConfig));
+	router.use(actionLoggerMiddleware({ enabled: authConfig.enabled }, baseDependencies.logger));
 
 	router.get(
 		'/category/:categoryId',

packages/data-provider/src/routers/validationRouter.ts

@@ -2,6 +2,7 @@ import { json, Router, urlencoded } from 'express';
 
 import { BaseDependencies, type ValidatorConfig } from '../config/config.js';
 import validationController from '../controllers/validationController.js';
+import { actionLoggerMiddleware } from '../middleware/actionLogger.js';
 import { type AuthConfig, authMiddleware } from '../middleware/auth.js';
 
 const router = ({
@@ -18,6 +19,7 @@ const router = ({
 	router.use(json());
 
 	router.use(authMiddleware(authConfig));
+	router.use(actionLoggerMiddleware({ enabled: authConfig.enabled }, baseDependencies.logger));
 
 	router.get(
 		'/category/:categoryId/entity/:entityName/exists',

packages/data-provider/src/utils/actionLoggerUtils.ts

@@ -0,0 +1,69 @@
+import type { RequestWithUser } from '../middleware/auth.js';
+
+export const ActionType = {
+	READ: 'READ',
+	WRITE: 'WRITE',
+} as const;
+
+export type ActionTypeValues = (typeof ActionType)[keyof typeof ActionType];
+
+export const ActionResult = {
+	ALLOWED: 'ALLOWED',
+	DENIED: 'DENIED',
+} as const;
+
+export type ActionResultValues = (typeof ActionResult)[keyof typeof ActionResult];
+
+export interface ActionLogMetadata {
+	action: ActionTypeValues;
+	method: string;
+	path: string;
+	categoryId?: number;
+	organization?: string;
+	userId?: string;
+	entityName?: string;
+	systemId?: string;
+	submissionId?: number;
+}
+
+/**
+ * Determines if an HTTP method represents a read or write operation
+ */
+export const getActionType = (method: string): ActionTypeValues => {
+	return method === 'GET' || method === 'HEAD' ? ActionType.READ : ActionType.WRITE;
+};
+
+/**
+ * Extracts all relevant metadata from a request for action logging
+ */
+export const extractActionMetadata = (req: RequestWithUser): ActionLogMetadata => {
+	return {
+		action: getActionType(req.method),
+		method: req.method,
+		path: req.originalUrl || req.path,
+	};
+};
+
+/**
+ * Formats action log metadata into a readable string for logging
+ */
+export const formatActionLog = (
+	metadata: ActionLogMetadata,
+	statusResult: ActionResultValues,
+	statusCode: number,
+	duration: number,
+	errorMessage?: string,
+): string => {
+	const actionLogResult = [`ACTION_LOG - PATH=${metadata.path}`, `type=|${metadata.action}-${metadata.method}|`];
+
+	actionLogResult.push(`userId: ${metadata.userId || 'null'}`);
+	actionLogResult.push(`result: ${statusResult}`);
+	actionLogResult.push(`status: ${statusCode}`);
+	actionLogResult.push(`duration: ${duration}ms`);
+
+	if (errorMessage) {
+		actionLogResult.push(`error: ${errorMessage}`);
+	}
+
+	return actionLogResult.join(' | ');
+};

pnpm-workspace.yaml

@@ -3,3 +3,10 @@ packages:
   - 'apps/*'
   # all packages in subdirs of packages/
   - 'packages/*'
+allowBuilds:
+  '@scarf/scarf': false
+  cpu-features: false
+  es5-ext: false
+  esbuild: false
+  protobufjs: false
+  ssh2: false