API access audit-logged

Audit logs are the difference between detecting a breach in hours and discovering it months later during an external notification. CWE-778 (Insufficient Logging) and OWASP API Security Top 10 2023 API9 (Improper Inventory Management / Insufficient Logging & Monitoring) both flag missing logs as an incident response failure, not just a monitoring gap. OWASP A09 2021 (Security Logging and Monitoring Failures) is one of the top-10 precisely because log absence is correlated with breach longevity. SOC 2 CC7.2, PCI DSS Requirement 10, and HIPAA audit controls all require API access to be logged with user, resource, and outcome. Logs with passwords or tokens embedded become a secondary breach surface — redact before writing.

Add a structured logging middleware that writes one JSON line per request with user, endpoint, method, status, and duration. Redact sensitive fields before writing — never log Authorization headers, request bodies containing passwords, or PII.

// src/middleware.ts
export function middleware(req: NextRequest) {
  const start = Date.now()
  const res = NextResponse.next()

  res.headers.set('x-request-start', String(start))  // pass to route for duration calc
  return res
}

// src/lib/audit-log.ts
export function logApiAccess({
  userId, method, path, statusCode, durationMs
}: AuditEntry) {
  const entry = {
    timestamp: new Date().toISOString(),
    userId: userId ?? 'anonymous',
    method, path, statusCode, durationMs
    // DO NOT include: headers, body, tokens, passwords
  }
  // Write to structured log sink (stdout for Vercel/CloudWatch pickup)
  console.log(JSON.stringify(entry))
}

Ship logs to a persistent sink (CloudWatch, Datadog, Logtail) — in-memory logs are lost on restart.