Add structured request logging and submission provenance#52
Merged
Conversation
koinsaari
force-pushed
the
feature/request-logging-provenance
branch
from
f7b400f to
d9b7238
Compare
- Add RequestLogger HTTP middleware: logs method, path, status, latency_ms, ip, request_id, api_key_id on every request - Generate UUIDv4 request IDs, expose as X-Request-ID response header - Add mutable logFields carrier in context so auth layer can enrich the log line with the API key ID after the fact - Add APIKeyID context helpers (WithAPIKeyID, APIKeyIDFromCtx) - Enrich request context in authenticate() with resolved API key ID; sets both the log carrier and the provenance context key in one pass - Fix integration test wait strategy: replace wait.ForSQL (which polls Docker API per-attempt and times out) with ForAll(ForLog, ForListeningPort)
- Add submitted_by (UUID, internal-only) and submitted_at (exposed in responses) to Place and AccessibilityProfile models - submitted_by is auto-populated from the authenticated API key ID; never client-submitted, never serialised to JSON - Add migration 000005: submitted_by/submitted_at columns on both tables plus the write_logs audit table - Add internal/audit package: append-only write_logs entries on every create/update; failures are warn-logged but never block the write - Wire RequestLogger into the outer handler in main.go - Update OpenAPI spec: submitted_at as readOnly date-time on Place and AccessibilityProfile response schemas
koinsaari
force-pushed
the
feature/request-logging-provenance
branch
from
d9b7238 to
8ea2ded
Compare
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
claude-code-action does not support workflow_run events — it requires pull_request context (github.event.pull_request.number) to interact with PRs. Switch back to pull_request trigger with track_progress enabled, which is the officially supported configuration. Remove the auto-approve step since GITHUB_TOKEN cannot approve PRs from workflows it triggered.
Review SummaryNo must-fix issues found. The PR looks good to merge. Both features (structured request logging and submission provenance) are correctly implemented:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two independent features implementing observability and accountability for writes.
Structured request logging (#15)
RequestLoggerHTTP middleware wraps the entire handler chainX-Request-IDheaderwait.ForSQLwas polling Docker API per retry and hitting context deadline; replaced withForAll(ForLog, ForListeningPort)Submission provenance + write audit log (#11)
submitted_by(UUID FK to api_keys, internal-only, never in JSON) andsubmitted_at(timestamp, exposed read-only in responses) on bothPlaceandAccessibilityProfilewrite_logstable: append-only row per create/update with table name, record ID, API key ID, and action; indexed on record_id and api_key_id for investigationswrite_logstablesubmitted_atas readOnly on both schemasCloses #15
Closes #11