Implement audit logging functionality across services and middleware

- Introduced a new `auditlog` package to handle audit logging for user actions, including creation, updates, deletions, and authentication events.
- Enhanced existing services (customer, user) to log relevant actions using the new audit logger, capturing details such as actor ID, action type, target type, and success status.
- Added middleware to enrich request context with metadata for audit logging, ensuring comprehensive tracking of user interactions.
- Integrated Elasticsearch for persistent storage of audit logs, with fallback to file-only logging if Elasticsearch is unavailable.
- Updated API documentation to include new audit log endpoints for administrative access.

This update significantly improves the system's ability to track and audit user actions, enhancing security and accountability within the application.

cmd/web/bootstrap/bootstrap.go

@@ -4,8 +4,10 @@ import (
 	"fmt"
 	"time"
 	ai_summarizer "tm/pkg/ai_summarizer"
+	"tm/pkg/audit"
 	"tm/pkg/authorization"
 	"tm/pkg/config"
+	"tm/pkg/elasticsearch"
 	"tm/pkg/filestore"
 	"tm/pkg/gorules"
 	"tm/pkg/hcaptcha"
@@ -90,6 +92,7 @@ func InitHTTPServer(conf Config, log logger.Logger) *echo.Echo {
 	// Add middleware
 	e.Use(middleware.Recover())
 	e.Use(middleware.RequestID())
+	e.Use(audit.RequestMetaMiddleware())
 	e.Use(middleware.Logger())
 	e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
 		AllowOrigins: []string{"*"},
@@ -132,7 +135,7 @@ func InitHTTPServer(conf Config, log logger.Logger) *echo.Echo {
 	e.GET("/swagger*", echoSwagger.WrapHandler)
 
 	log.Info("HTTP server initialized successfully", map[string]interface{}{
-		"middleware": []string{"recover", "request_id", "logger", "cors", "custom_logging"},
+		"middleware": []string{"recover", "request_id", "audit_meta", "logger", "cors", "custom_logging"},
 	})
 
 	return e
@@ -402,3 +405,34 @@ func InitGoRulesClient(_ GoRulesConfig, log logger.Logger) gorules.Client {
 		return client
 	*/
 }
+
+// InitElasticsearch creates an Elasticsearch client for audit log storage.
+func InitElasticsearch(conf config.ElasticsearchConfig, log logger.Logger) elasticsearch.Client {
+	esConfig := elasticsearch.Config{
+		URL:             conf.URL,
+		Username:        conf.Username,
+		Password:        conf.Password,
+		IndexPrefix:     conf.IndexPrefix,
+		Enabled:         conf.Enabled,
+		RequestTimeout:  conf.RequestTimeout,
+		BulkFlushPeriod: conf.BulkFlushPeriod,
+		QueueSize:       conf.QueueSize,
+	}
+
+	client, err := elasticsearch.NewClient(esConfig, log)
+	if err != nil {
+		log.Warn("Elasticsearch unavailable, audit logs will be file-only", map[string]interface{}{
+			"error": err.Error(),
+			"url":   conf.URL,
+		})
+		return elasticsearch.NewNoopClient()
+	}
+
+	return client
+}
+
+// InitAuditLogger creates a composite audit logger with optional Elasticsearch persistence.
+func InitAuditLogger(log logger.Logger, esClient elasticsearch.Client) (audit.Logger, audit.Store) {
+	store := elasticsearch.NewAuditStore(esClient)
+	return audit.NewCompositeLogger(log, store), store
+}

cmd/web/bootstrap/config.go

@@ -23,6 +23,7 @@ type Config struct {
 	DocumentScraper DocumentScraperConfig
 	AISummarizer    AISummarizerConfig
 	GoRules         GoRulesConfig
+	Elasticsearch   config.ElasticsearchConfig
 }
 
 type ScraperConfig struct {