audit.middleware.ts

import { Injectable, Logger, NestMiddleware } from '@nestjs/common';
import { NextFunction, Request, Response } from 'express';

const MUTATING_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE']);

/**
 * Audits every mutating request. Implemented as middleware (not an
 * interceptor) on purpose: middleware runs *before* guards, so by hooking
 * `res.on('finish')` we capture the FINAL response status of every request —
 * including ones rejected by the API-key guard (401), which an interceptor
 * would miss because guards short-circuit before interceptors run.
 *
 * One structured line per request: method, path, status, latency, user agent.
 */
@Injectable()
export class AuditMiddleware implements NestMiddleware {
  private readonly logger = new Logger('Audit');

  use(req: Request, res: Response, next: NextFunction): void {
    if (!MUTATING_METHODS.has(req.method)) {
      return next();
    }

    const startedAt = process.hrtime.bigint();

    res.on('finish', () => {
      const durationMs =
        Number(process.hrtime.bigint() - startedAt) / 1_000_000;
      this.logger.log(
        JSON.stringify({
          timestamp: new Date().toISOString(),
          method: req.method,
          path: req.originalUrl,
          status: res.statusCode,
          durationMs: Math.round(durationMs * 100) / 100,
          userAgent: req.headers['user-agent'] ?? 'unknown',
        }),
      );
    });

    next();
  }
}