feat: structured logs /api/webhooks

[ayaoba24]

Summary

• Added src/middleware/accessLog.ts for structured access logging
• Included correlation ID generation and header propagation
• Added app/api/webhooks/route.ts with boundary input validation
• Added tests for middleware and route with >90% coverage
• Implemented standardized error envelopes for payload validation

Security Changes

Type of Security Change

• SAST rule update
• Dependency vulnerability fix
• Exemption addition/renewal
• Security workflow modification
• Container image update
• Other: Added boundary input validation and structured security logging for webhooks

Vulnerability Details (if applicable)

CVE/Advisory ID:

• CVE-ID: N/A
• GHSA-ID: N/A

Affected Package:

• Name: N/A
• Version: N/A
• Severity: [ ] Critical [ ] High [ ] Medium [x] Low

Fix Applied:

• Package version bump
• Code change to mitigate
• Configuration update
• Exemption granted (see below)

Exemption Request (if applicable)

Exemption ID: N/A

Justification:
N/A

Mitigation Applied:
N/A

Expiry Date: N/A

Review Plan:
N/A

Testing

• Ran npm audit locally - output attached or no new vulnerabilities
• Security workflow passes on this branch
• Test suite passes: npm test
• Build succeeds: npm run build

Security Impact Analysis

Affected Components:

• Authentication/Authorization
• Payment processing
• Data encryption
• API endpoints
• Dependencies
• Container images
• CI/CD pipeline
• Other: Boundary Validation & Audit Logging

Risk Assessment:
This change introduces strong boundary checks to the /api/webhooks POST endpoint, preventing malformed JSON or unprocessable entity types from reaching downstream services. It introduces structured logging with correlation IDs mapping to x-correlation-id, which improves auditability of inbound requests without logging potentially sensitive webhook payload data (PII).

Documentation Updates

• Updated README.md (if workflow changed)
• Updated SECURITY-CI-SETUP.md (if process changed)
• Updated security-exemptions.json (if applicable)
• Added security notes to code comments

Checklist

• No secrets or keys committed
• No PII or sensitive data in logs
• All security scans pass (or exemptions documented)
• Branch protection requirements met
• Code review from security team (for critical changes)

Additional Notes

The webhook payload body is intentionally excluded from the access logs to avoid accidental PII spillage.

Test Output

# Paste npm test output here
npm test

# Paste npm audit output here (if relevant)
npm audit

CI Run Link

Workflow Run:

---

Security Review Required: @security-team
Compliance Impact: No

closes #1112