Audit Logging

// Initialize audit logger
const auditLogger = {
  async log(event) {
    const entry = {
      timestamp: new Date(),
      event_type: event.type,
      user_id: event.userId,
      resource: event.resource,
      action: event.action,
      details: event.details,
      ip_address: event.ip,
      user_agent: event.userAgent
    };
    
    await db.audit_logs.create(entry);
  }
};

// Middleware to capture audit events
const auditMiddleware = (req, res, next) => {
  const originalSend = res.send;
  
  res.send = function(body) {
    auditLogger.log({
      type: 'api_request',
      userId: req.user?.id,
      resource: req.originalUrl,
      action: req.method,
      details: { status: res.statusCode },
      ip: req.ip,
      userAgent: req.headers['user-agent']
    });
    
    originalSend.call(this, body);
  };
  
  next();
};

// Audit event types
const AuditEventType = {
  USER_LOGIN: 'user.login',
  USER_LOGOUT: 'user.logout',
  RESOURCE_CREATE: 'resource.create',
  RESOURCE_UPDATE: 'resource.update',
  RESOURCE_DELETE: 'resource.delete',
  PERMISSION_CHANGE: 'permission.change',
  SETTINGS_UPDATE: 'settings.update'
};

// Event handler example
async function handleUserLogin(userId, success, details) {
  await auditLogger.log({
    type: AuditEventType.USER_LOGIN,
    userId,
    action: 'login',
    details: {
      success,
      ...details
    }
  });
}

// Database schema
CREATE TABLE audit_logs (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  timestamp TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  event_type VARCHAR(50) NOT NULL,
  user_id UUID REFERENCES users(id),
  resource VARCHAR(255),
  action VARCHAR(50) NOT NULL,
  details JSONB,
  ip_address INET,
  user_agent TEXT,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

// Create indexes
CREATE INDEX idx_audit_timestamp ON audit_logs(timestamp);
CREATE INDEX idx_audit_user ON audit_logs(user_id);
CREATE INDEX idx_audit_type ON audit_logs(event_type);

// Implement retention policy
CREATE OR REPLACE FUNCTION cleanup_audit_logs()
RETURNS void AS $$
BEGIN
  DELETE FROM audit_logs
  WHERE timestamp < NOW() - INTERVAL '1 year';
END;
$$ LANGUAGE plpgsql;

// Query audit logs
async function queryAuditLogs(filters) {
  const query = db.audit_logs
    .select('*')
    .orderBy('timestamp', 'desc');
    
  if (filters.userId) {
    query.where('user_id', filters.userId);
  }
  
  if (filters.eventType) {
    query.where('event_type', filters.eventType);
  }
  
  if (filters.dateRange) {
    query.whereBetween('timestamp', [
      filters.dateRange.start,
      filters.dateRange.end
    ]);
  }
  
  return await query;
}

// Analyze patterns
async function analyzeActivityPatterns() {
  const patterns = await db.audit_logs
    .select('event_type')
    .count('* as count')
    .groupBy('event_type')
    .orderBy('count', 'desc');
    
  return patterns;
}