feat: Add structured audit records for auth operations

[Opulencechuks]

Closes #589

Description

This PR addresses the critical need for comprehensive and structured audit logging within our authentication, logging, and audit services. Previously, authentication operations emitted standard application logs but lacked a structured, queryable audit trail.

This update introduces a robust, centralized auditing mechanism that rigorously tracks authentication flows, session lifecycles, token reuse attempts, and device trust modifications without leaking sensitive credentials into the logs.

Technical Implementation Details

1. Centralized Audit Service

• Module Migration: Extracted the AuditLogService and its related module from the localized courses/audit domain and promoted it to a top-level src/audit/AuditModule. This establishes it as the global standard for generating structured audit logs across the entire application.
• Dependency Injection: Registered AuditModule in the root AppModule and imported it into the AuthModule to make it accessible to the authentication lifecycle.

2. Strict Context Sanitization

• Credential Redaction: Implemented a sanitize() mechanism inside the AuditLogService. Before any requestContext or metadata is committed to the logs, it aggressively filters and redacts keys containing sensitive substrings (e.g., password, token, secret, authorization, cookie, refreshToken, accessToken).
• Log Safety: Guarantees that secrets and tokens never appear in the plain text logs, fulfilling strict security and compliance requirements.

3. Structured Auth Event Hooking

Injected the AuditLogService into AuthSessionService and instrumented the following operations:

• Login (createSession): Captures successful session creations, tracking the newly generated sessionId and any provided deviceHash.
• Token Refresh (refreshTokens):
  • Audits successful token rotations.
  • Audits failures due to invalid tokens, expired sessions, or revoked sessions.
• Token Reuse Detection: Generates a specialized reuse_detection failure event if an attempt is made to use an already-rotated refresh token.
• Logout Operations: Tracks both single-device logouts (revokeSession) and global logouts (revokeAllUserSessions).
• Device Management: Tracks when a user registers (add_trusted_device) or unregisters (remove_trusted_device) a device fingerprint.

4. Acceptance Criteria Checklist Met

• Actor: Every event explicitly identifies the user ID performing the action.
• Outcome: Events strictly record either SUCCESS or FAILURE states.
• Session: Binds the relevant sessionId to the log to track activity across a specific device's lifecycle.
• Correlation: Seamlessly falls back to CorrelationLoggerService.getCorrelationId() to ensure auth events can be traced alongside upstream/downstream microservice logs.
• Sanitized Request Context: Contextual data (like device hashes, failure reasons, and counts) is safely attached.
• No Secrets: Token values and passwords are fully redacted.

Testing & Verification

• Validated that [REDACTED] properly replaces values in the request context when passing mock token data.
• Confirmed that standard logs correctly output structured strings alongside pushing to the internal audit array.
• Verified that all paths in the AuthSessionService (including early throw catches) correctly emit an audit log before terminating.

[drips-wave]

@Opulencechuks Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[MaryammAli]

LGTM