5.6 — Implement audit logging

[davidortinau]

Description

Add audit logging for security-sensitive operations: sign-in/sign-out events, authorization failures, data modifications. Logs include user ID, tenant, action, timestamp, IP address, and route to Application Insights for compliance and investigation.

Dependencies

• Depends on 1.2 — Replace DevAuthHandler with JWT Bearer authentication in API #43 (JWT Bearer auth)
• Depends on 5.1 — Enable Azure Monitor and Application Insights #60 (Application Insights)

Acceptance Criteria

• Audit logging middleware added to API
• Logged events: user sign-in, sign-out, authorization failure, data create/update/delete
• Log format: structured JSON with user_id, tenant_id, action, timestamp, ip_address, resource
• Logs exported to Application Insights via OpenTelemetry
• Retention: 90 days hot (queryable), 1 year cold storage
• Dashboards for audit queries (recent auth failures, modifications by user, etc.)
• Tested: audit logs flowing to Application Insights

Technical Notes

• Middleware: intercept requests, log security events
• Structured logging: include all relevant context for investigation
• Consider data sensitivity: don't log passwords or sensitive data
• Use Application Insights queries to analyze audit trail
• Compliance: helps with security incident investigation

---

Phase: 5 | Size: M | Owner: Zoe (Lead)