Skip to content

Feature/audit logging - #315

Open
AlphaTechini wants to merge 3 commits into
Pidoko257:mainfrom
AlphaTechini:feature/audit-logging
Open

Feature/audit logging#315
AlphaTechini wants to merge 3 commits into
Pidoko257:mainfrom
AlphaTechini:feature/audit-logging

Conversation

@AlphaTechini

@AlphaTechini AlphaTechini commented Jul 28, 2026

Copy link
Copy Markdown

Closes #26

  • Added an append-only PostgreSQL audit_logs table.
  • Captured user ID, action, entity, entity ID, IP address, user agent, and timestamp.
  • Added JSON before_state and after_state capture for sensitive updates.
  • Added transaction middleware to write operations and audit records atomically.
  • Audited API key creation and revocation.
  • Audited KYC approval, rejection, and provider-driven KYC updates.
  • Audited user role changes, including SSO role synchronization.
  • Migrated user settings to PostgreSQL with atomic audit logging.
  • Removed non-atomic response-based audit interception.
  • Prevented application-level audit log updates and deletions.
  • Added migration compatibility for the existing legacy audit table.

@Pidoko257

@AlphaTechini
feat(auth): implement JWT refresh token rotation with Redis blocklist…
286edaf 
… and HttpOnly cookies

- Access tokens expire after 15 minutes (ACCESS_TOKEN_EXPIRES_IN); refresh tokens after 7 days

- Refresh token set as HttpOnly, Secure, SameSite=Strict cookie on /api/auth path

- POST /api/auth/refresh reads token from cookie, blocklists old token in Redis, issues rotated pair

- POST /api/auth/logout blocklists token and clears cookie

- Redis blocklist check (refresh_blocklist:*) for fast reuse detection; family revoked on detection

- verifyRefreshToken now checks Redis before PostgreSQL; returns { decoded, dbRow }

- Added revokeByToken to RefreshTokenFamilyModel for per-token DB invalidation

- SSO login also sets refresh token cookie for consistency

- Added TOKEN_REUSE_DETECTED error code (HTTP 401)
@AlphaTechini
feat(auth): add API key expiry management
cf5c328
@AlphaTechini
feat(security): add audit logging for sensitive operations
14da9cc
@drips-wave

drips-wave Bot commented Jul 28, 2026

Copy link
Copy Markdown

@AlphaTechini Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

@AlphaTechini

AlphaTechini commented Jul 28, 2026

Copy link
Copy Markdown
Author

Closes #26

  • Added an append-only PostgreSQL audit_logs table.
  • Captured user ID, action, entity, entity ID, IP address, user agent, and timestamp.
  • Added JSON before_state and after_state capture for sensitive updates.
  • Added transaction middleware to write operations and audit records atomically.
  • Audited API key creation and revocation.
  • Audited KYC approval, rejection, and provider-driven KYC updates.
  • Audited user role changes, including SSO role synchronization.
  • Migrated user settings to PostgreSQL with atomic audit logging.
  • Removed non-atomic response-based audit interception.
  • Prevented application-level audit log updates and deletions.
  • Added migration compatibility for the existing legacy audit table.

@Pidoko257

This was built on top changes from #313 allowing you to merge changes without any potential conflicts.

@AlphaTechini

AlphaTechini commented Jul 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

Closes #26

  • Added an append-only PostgreSQL audit_logs table.
  • Captured user ID, action, entity, entity ID, IP address, user agent, and timestamp.
  • Added JSON before_state and after_state capture for sensitive updates.
  • Added transaction middleware to write operations and audit records atomically.
  • Audited API key creation and revocation.
  • Audited KYC approval, rejection, and provider-driven KYC updates.
  • Audited user role changes, including SSO role synchronization.
  • Migrated user settings to PostgreSQL with atomic audit logging.
  • Removed non-atomic response-based audit interception.
  • Prevented application-level audit log updates and deletions.
  • Added migration compatibility for the existing legacy audit table.

@Pidoko257

This was built on top changes from #313 allowing you to merge changes without any potential conflicts.

For changes for this issue only, view this commit: 286edaf

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Add Audit Logging Middleware for Sensitive Operations

1 participant

@AlphaTechini