@govish/shared-services 1.0.0

package/dist/services/auditService.js

@@ -0,0 +1,785 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditService = exports.AuditEventType = void 0;
+const kafkajs_1 = require("kafkajs");
+/**
+ * Audit event types
+ */
+var AuditEventType;
+(function (AuditEventType) {
+    // Authentication events
+    AuditEventType["LOGIN_SUCCESS"] = "login_success";
+    AuditEventType["LOGIN_FAILED"] = "login_failed";
+    AuditEventType["LOGIN_NOT_PERMITTED"] = "login_not_permitted";
+    AuditEventType["LOGOUT"] = "logout";
+    AuditEventType["TOKEN_GENERATED"] = "token_generated";
+    // Officer events (read-only consumption)
+    AuditEventType["OFFICER_RETRIEVED"] = "officer_retrieved";
+    AuditEventType["OFFICERS_LISTED"] = "officers_listed";
+    // Device events (read-only consumption)
+    AuditEventType["DEVICE_RETRIEVED"] = "device_retrieved";
+    AuditEventType["DEVICES_LISTED"] = "devices_listed";
+    // Arrest events
+    AuditEventType["ARREST_CREATED"] = "arrest_created";
+    AuditEventType["ARREST_UPDATED"] = "arrest_updated";
+    AuditEventType["ARREST_DELETED"] = "arrest_deleted";
+    AuditEventType["ARREST_RETRIEVED"] = "arrest_retrieved";
+    AuditEventType["ARRESTS_LISTED"] = "arrests_listed";
+    AuditEventType["ARREST_OB_GENERATED"] = "arrest_ob_generated";
+    // General access events
+    AuditEventType["ENDPOINT_ACCESSED"] = "endpoint_accessed";
+    AuditEventType["UNAUTHORIZED_ACCESS"] = "unauthorized_access";
+    AuditEventType["FORBIDDEN_ACCESS"] = "forbidden_access";
+})(AuditEventType || (exports.AuditEventType = AuditEventType = {}));
+class AuditService {
+    constructor(deps) {
+        this.isInternalConnection = false;
+        this.connectionAttempted = false;
+        this.logger = deps.logger;
+        this.serverName = deps.serverName;
+        this.auditTopic = deps.auditTopic;
+        this.enableDebugLogs = deps.enableDebugLogs || false;
+        // If Kafka brokers are provided, create internal connection
+        if (deps.kafkaBrokers) {
+            this.initializeInternalKafkaConnection(deps);
+        }
+        else if (deps.kafkaProducer) {
+            // Use provided producer (backward compatibility)
+            this.kafkaProducer = deps.kafkaProducer;
+            this.isProducerConnected = deps.isProducerConnected;
+        }
+    }
+    /**
+     * Initialize internal Kafka connection from brokers
+     */
+    initializeInternalKafkaConnection(deps) {
+        try {
+            // Parse brokers
+            const brokers = Array.isArray(deps.kafkaBrokers)
+                ? deps.kafkaBrokers
+                : typeof deps.kafkaBrokers === 'string'
+                    ? deps.kafkaBrokers.split(',').map(b => b.trim())
+                    : [];
+            if (brokers.length === 0) {
+                this.logger.warn('No valid Kafka brokers provided');
+                return;
+            }
+            const clientId = deps.kafkaClientId || 'audit-service';
+            // Create Kafka client
+            this.internalKafkaClient = new kafkajs_1.Kafka({
+                clientId,
+                brokers,
+                retry: {
+                    retries: 3,
+                    initialRetryTime: 1000,
+                    multiplier: 2,
+                    maxRetryTime: 5000,
+                },
+                connectionTimeout: 5000,
+                requestTimeout: 30000,
+            });
+            // Create producer
+            this.internalProducer = this.internalKafkaClient.producer({
+                createPartitioner: kafkajs_1.Partitioners.LegacyPartitioner,
+                retry: {
+                    retries: 8,
+                    initialRetryTime: 100,
+                    multiplier: 2,
+                    maxRetryTime: 30000,
+                },
+            });
+            this.kafkaProducer = this.internalProducer;
+            this.isInternalConnection = true;
+            // Create connection check function
+            this.isProducerConnected = () => {
+                // For internal producer, we'll check connection status
+                // KafkaJS doesn't expose connection state directly, so we track it
+                return this.connectionAttempted && this.internalProducer !== undefined;
+            };
+            this.logger.info('Internal Kafka connection initialized', {
+                brokers,
+                clientId,
+            });
+            // Try to connect immediately (non-blocking)
+            this.ensureConnected().catch((error) => {
+                this.logger.warn('Initial connection attempt failed, will retry on first send', {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            });
+        }
+        catch (error) {
+            this.logger.error('Failed to initialize internal Kafka connection', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    /**
+     * Debug log helper - only logs if debug is enabled
+     */
+    debugLog(message, data) {
+        if (this.enableDebugLogs) {
+            if (data) {
+                console.log(`[AUDIT KAFKA] ${message}`, data);
+            }
+            else {
+                console.log(`[AUDIT KAFKA] ${message}`);
+            }
+        }
+    }
+    /**
+     * Debug error helper - only logs if debug is enabled
+     */
+    debugError(message, data) {
+        if (this.enableDebugLogs) {
+            if (data) {
+                console.error(`[AUDIT KAFKA] ${message}`, data);
+            }
+            else {
+                console.error(`[AUDIT KAFKA] ${message}`);
+            }
+        }
+    }
+    /**
+     * Ensure producer is connected (for internal connections)
+     */
+    ensureConnected() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.isInternalConnection || !this.internalProducer) {
+                this.debugLog('Not internal connection or no internal producer', {
+                    isInternalConnection: this.isInternalConnection,
+                    hasInternalProducer: !!this.internalProducer,
+                    hasKafkaProducer: !!this.kafkaProducer,
+                });
+                return !!this.kafkaProducer;
+            }
+            // Always try to connect if not already connected
+            // Don't rely on connectionAttempted flag - actually check connection
+            try {
+                if (!this.connectionAttempted) {
+                    this.connectionAttempted = true;
+                    yield this.internalProducer.connect();
+                    this.logger.info('Internal Kafka producer connected');
+                    return true;
+                }
+                else {
+                    // Already attempted - assume connected
+                    return true;
+                }
+            }
+            catch (error) {
+                this.connectionAttempted = false;
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                this.debugError('Failed to connect internal Kafka producer', {
+                    error: errorMessage,
+                    stack: error instanceof Error ? error.stack : undefined,
+                });
+                this.logger.warn('Failed to connect internal Kafka producer', {
+                    error: errorMessage,
+                });
+                return false;
+            }
+        });
+    }
+    /**
+     * Send audit event to Kafka
+     */
+    logAuditEvent(req, payload) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            try {
+                // Get IP address - try multiple sources in order of reliability
+                let ip_address = 'unknown';
+                // Log available IP sources for debugging
+                const ipSources = {
+                    'x-forwarded-for': req.headers['x-forwarded-for'],
+                    'x-real-ip': req.headers['x-real-ip'],
+                    'cf-connecting-ip': req.headers['cf-connecting-ip'], // Cloudflare
+                    'true-client-ip': req.headers['true-client-ip'], // Cloudflare Enterprise
+                    'x-client-ip': req.headers['x-client-ip'],
+                    'req.ip': req.ip,
+                    'req.socket.remoteAddress': (_a = req.socket) === null || _a === void 0 ? void 0 : _a.remoteAddress,
+                    'req.connection.remoteAddress': (_b = req.connection) === null || _b === void 0 ? void 0 : _b.remoteAddress,
+                };
+                this.debugLog('IP address sources', ipSources);
+                // Try x-forwarded-for first (most common behind proxies/load balancers)
+                // Format: "client, proxy1, proxy2" - we want the first (original client)
+                if (req.headers['x-forwarded-for']) {
+                    const forwardedFor = String(req.headers['x-forwarded-for']).trim();
+                    if (forwardedFor) {
+                        // Split by comma and get first IP, then trim whitespace
+                        const firstIp = forwardedFor.split(',')[0].trim();
+                        if (firstIp && firstIp !== 'unknown') {
+                            ip_address = firstIp;
+                            this.logger.debug('Using IP from x-forwarded-for', { ip: ip_address });
+                        }
+                    }
+                }
+                // Try Cloudflare specific header
+                if (ip_address === 'unknown' && req.headers['cf-connecting-ip']) {
+                    const cfIp = String(req.headers['cf-connecting-ip']).trim();
+                    if (cfIp) {
+                        ip_address = cfIp;
+                        this.logger.debug('Using IP from cf-connecting-ip', { ip: ip_address });
+                    }
+                }
+                // Try x-real-ip (common with nginx)
+                if (ip_address === 'unknown' && req.headers['x-real-ip']) {
+                    const realIp = String(req.headers['x-real-ip']).trim();
+                    if (realIp) {
+                        ip_address = realIp;
+                        this.logger.debug('Using IP from x-real-ip', { ip: ip_address });
+                    }
+                }
+                // Try true-client-ip (Cloudflare Enterprise)
+                if (ip_address === 'unknown' && req.headers['true-client-ip']) {
+                    const trueClientIp = String(req.headers['true-client-ip']).trim();
+                    if (trueClientIp) {
+                        ip_address = trueClientIp;
+                        this.logger.debug('Using IP from true-client-ip', { ip: ip_address });
+                    }
+                }
+                // Try x-client-ip
+                if (ip_address === 'unknown' && req.headers['x-client-ip']) {
+                    const clientIp = String(req.headers['x-client-ip']).trim();
+                    if (clientIp) {
+                        ip_address = clientIp;
+                        this.logger.debug('Using IP from x-client-ip', { ip: ip_address });
+                    }
+                }
+                // Try req.ip (requires trust proxy to be set)
+                if (ip_address === 'unknown' && req.ip) {
+                    const reqIp = String(req.ip).trim();
+                    if (reqIp && reqIp !== '::1' && reqIp !== '127.0.0.1') {
+                        ip_address = reqIp;
+                        this.logger.debug('Using IP from req.ip', { ip: ip_address });
+                    }
+                }
+                // Try socket.remoteAddress (direct connection)
+                if (ip_address === 'unknown' && ((_c = req.socket) === null || _c === void 0 ? void 0 : _c.remoteAddress)) {
+                    const socketIp = String(req.socket.remoteAddress).trim();
+                    // Remove IPv6 prefix if present
+                    const cleanIp = socketIp.replace(/^::ffff:/, '');
+                    if (cleanIp && cleanIp !== '::1' && cleanIp !== '127.0.0.1') {
+                        ip_address = cleanIp;
+                        this.logger.debug('Using IP from socket.remoteAddress', { ip: ip_address, original: socketIp });
+                    }
+                }
+                // Try connection.remoteAddress (fallback)
+                if (ip_address === 'unknown' && ((_d = req.connection) === null || _d === void 0 ? void 0 : _d.remoteAddress)) {
+                    const connIp = String(req.connection.remoteAddress).trim();
+                    const cleanIp = connIp.replace(/^::ffff:/, '');
+                    if (cleanIp && cleanIp !== '::1' && cleanIp !== '127.0.0.1') {
+                        ip_address = cleanIp;
+                        this.logger.debug('Using IP from connection.remoteAddress', { ip: ip_address, original: connIp });
+                    }
+                }
+                // Log final IP address
+                this.logger.debug('Final IP address determined', {
+                    ip_address,
+                    all_sources: ipSources
+                });
+                // Get user agent
+                const user_agent = req.headers['user-agent'] || 'unknown';
+                // Extract user/device/microservice information from request
+                const authType = req.authType;
+                const officer = req.officer; // Use officer directly, as it has all the properties
+                const device = req.device;
+                const apiKey = req.apiKey;
+                const authenticatedMicroservice = req.microservice;
+                // Get microservice name from environment or default
+                const microserviceName = this.serverName || 'Package Name';
+                // Determine event type if not provided
+                let eventType = payload.event_type;
+                if (!eventType) {
+                    eventType = AuditService.determineEventType(req);
+                }
+                // Build audit payload - start with base fields
+                const auditPayload = {
+                    timestamp: new Date().toISOString(),
+                    microservice: authenticatedMicroservice || microserviceName,
+                    event_type: eventType,
+                    endpoint: req.originalUrl || req.url,
+                    method: req.method,
+                    path: req.path,
+                    query_params: Object.keys(req.query).length > 0 ? req.query : undefined,
+                    ip_address,
+                    user_agent,
+                };
+                // Add officer information if authenticated
+                if (officer) {
+                    auditPayload.user_id = officer.id;
+                    auditPayload.officer_id = officer.id;
+                    auditPayload.officer_name = officer.name || undefined;
+                    auditPayload.officer_service_number = officer.service_number || undefined;
+                    auditPayload.officer_email = officer.email || undefined;
+                }
+                // Add device information if authenticated (minimal - just ID)
+                if (device) {
+                    // Ensure device.id is a number
+                    const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                    // Set user_id to device_id if no officer is authenticated
+                    if (!auditPayload.user_id && !isNaN(deviceId)) {
+                        auditPayload.user_id = deviceId;
+                    }
+                    if (!isNaN(deviceId)) {
+                        auditPayload.device_id = deviceId;
+                    }
+                    auditPayload.device_device_id = device.device_id;
+                }
+                // Set user type and add API Key / Microservice information
+                if (authType === 'api_key' || authType === 'microservice') {
+                    auditPayload.user_type = 'microservice';
+                    auditPayload.authenticated_microservice = authenticatedMicroservice || (apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice);
+                    auditPayload.api_key_id = apiKey === null || apiKey === void 0 ? void 0 : apiKey.id;
+                    // Set microservice name in the main microservice field
+                    if (authenticatedMicroservice || (apiKey === null || apiKey === void 0 ? void 0 : apiKey.microservice)) {
+                        auditPayload.microservice = authenticatedMicroservice || apiKey.microservice;
+                    }
+                    // For microservice authentication, we don't have a user_id
+                }
+                else if (authType === 'both') {
+                    auditPayload.user_type = 'both';
+                    // When both are authenticated, prioritize officer as user_id
+                    if (officer) {
+                        auditPayload.user_id = officer.id;
+                    }
+                }
+                else if (authType === 'device') {
+                    auditPayload.user_type = 'device';
+                    // Use device id as user_id when only device is authenticated
+                    if (device) {
+                        const deviceId = typeof device.id === 'string' ? parseInt(device.id, 10) : device.id;
+                        if (!isNaN(deviceId)) {
+                            auditPayload.user_id = deviceId;
+                        }
+                    }
+                }
+                else if (authType === 'officer') {
+                    auditPayload.user_type = 'officer';
+                    // Use officer id as user_id when only officer is authenticated
+                    if (officer) {
+                        auditPayload.user_id = officer.id;
+                    }
+                }
+                // Extract arrest-specific information from request body or response
+                this.addArrestInformation(req, auditPayload, payload);
+                // Merge custom keys from payload
+                // Custom keys can override standard fields if explicitly provided
+                // This allows users to add custom metadata or override standard fields when needed
+                Object.keys(payload).forEach(key => {
+                    if (payload[key] !== undefined) {
+                        // Allow custom keys to override standard fields if explicitly provided
+                        // This gives users full control over the audit payload
+                        auditPayload[key] = payload[key];
+                    }
+                });
+                // Build user info string for logging
+                const userInfo = auditPayload.officer_name
+                    ? `${auditPayload.officer_name} (Officer ID: ${auditPayload.officer_id})`
+                    : auditPayload.device_device_id
+                        ? `Device: ${auditPayload.device_device_id} (Device ID: ${auditPayload.device_id})`
+                        : auditPayload.authenticated_microservice
+                            ? `Microservice: ${auditPayload.authenticated_microservice}`
+                            : 'Unknown user';
+                // Log to console for visibility (can be controlled by enableDebugLogs)
+                if (this.enableDebugLogs) {
+                    console.log(`[AUDIT] ${userInfo} accessed ${auditPayload.method} ${auditPayload.endpoint}`, {
+                        user_type: auditPayload.user_type,
+                        user_id: auditPayload.user_id,
+                        officer_id: auditPayload.officer_id,
+                        device_id: auditPayload.device_id,
+                        event_type: auditPayload.event_type,
+                        response_status: auditPayload.response_status,
+                        ip_address: auditPayload.ip_address,
+                    });
+                }
+                // Also log via logger (respects log level configuration)
+                this.logger.info(`Audit: ${userInfo} accessed ${auditPayload.method} ${auditPayload.endpoint}`, {
+                    endpoint: auditPayload.endpoint,
+                    method: auditPayload.method,
+                    user_type: auditPayload.user_type,
+                    user_id: auditPayload.user_id,
+                    officer_id: auditPayload.officer_id,
+                    device_id: auditPayload.device_id,
+                    event_type: auditPayload.event_type,
+                    response_status: auditPayload.response_status,
+                    ip_address: auditPayload.ip_address,
+                    topic: this.auditTopic || 'audit-log'
+                });
+                // Send to Kafka
+                // Check if Kafka is available before attempting to send
+                // Skip if Kafka producer is not available (but we've already logged to console)
+                if (!this.kafkaProducer) {
+                    this.debugError('Kafka producer not available - skipping send', {
+                        hasKafkaProducer: !!this.kafkaProducer,
+                        hasIsProducerConnected: !!this.isProducerConnected,
+                    });
+                    return;
+                }
+                try {
+                    // For internal connections, ensure we're connected
+                    if (this.isInternalConnection) {
+                        const connected = yield this.ensureConnected();
+                        if (!connected) {
+                            this.debugError('Internal producer connection failed - skipping send');
+                            return;
+                        }
+                    }
+                    else {
+                        // For external producer, check connection status
+                        const isConnected = this.isProducerConnected ? this.isProducerConnected() : false;
+                        this.debugLog('Producer connection check', {
+                            hasIsProducerConnected: !!this.isProducerConnected,
+                            isConnected: isConnected,
+                            isInternalConnection: this.isInternalConnection,
+                        });
+                        if (!this.isProducerConnected || !isConnected) {
+                            // Producer not connected (but we've already logged to console)
+                            this.debugError('Producer not connected - skipping send', {
+                                hasKafkaProducer: !!this.kafkaProducer,
+                                hasIsProducerConnected: !!this.isProducerConnected,
+                                isConnected: isConnected,
+                            });
+                            return;
+                        }
+                    }
+                    if (!this.kafkaProducer) {
+                        this.debugError('Kafka producer not available (second check) - skipping send', {
+                            hasKafkaProducer: !!this.kafkaProducer,
+                            hasIsProducerConnected: !!this.isProducerConnected,
+                        });
+                        return;
+                    }
+                    this.debugLog('All checks passed - proceeding to send');
+                    const topic = this.auditTopic || 'audit-log';
+                    const kafkaMessage = {
+                        key: `${auditPayload.method}-${auditPayload.endpoint}-${Date.now()}`,
+                        value: JSON.stringify(auditPayload),
+                        headers: {
+                            'microservice': auditPayload.microservice,
+                            'event-type': 'audit-log',
+                        }
+                    };
+                    // Debug log the payload and topic before sending
+                    this.debugLog(`Sending to topic: ${topic}`);
+                    this.debugLog('Payload:', JSON.stringify(auditPayload, null, 2));
+                    this.debugLog(`Message key: ${kafkaMessage.key}`);
+                    yield this.kafkaProducer.send({
+                        topic: topic,
+                        messages: [kafkaMessage]
+                    })
+                        .then((result) => {
+                        this.debugLog('Audit event sent to Kafka', {
+                            result: result,
+                            endpoint: req.path,
+                            method: req.method,
+                            authType: req.authType
+                        });
+                    })
+                        .catch((error) => {
+                        this.debugError('Error sending audit event to Kafka', {
+                            error: error.message,
+                            errorStack: error.stack,
+                            endpoint: req.path,
+                            method: req.method,
+                            authType: req.authType
+                        });
+                    });
+                }
+                catch (kafkaError) {
+                    const errorMessage = (kafkaError === null || kafkaError === void 0 ? void 0 : kafkaError.message) || String(kafkaError);
+                    this.debugError('Error sending audit event to Kafka', {
+                        error: errorMessage,
+                        errorStack: kafkaError instanceof Error ? kafkaError.stack : undefined,
+                        errorName: kafkaError instanceof Error ? kafkaError.name : undefined,
+                        endpoint: req.path,
+                        method: req.method,
+                        authType: req.authType
+                    });
+                    // If it's a DNS resolution error or connection error, skip silently (Kafka is not available)
+                    if (errorMessage.includes('getaddrinfo EAI_AGAIN') ||
+                        errorMessage.includes('ENOTFOUND') ||
+                        errorMessage.includes('Connection error') ||
+                        errorMessage.includes('not connected') ||
+                        errorMessage.includes('ECONNREFUSED') ||
+                        errorMessage.includes('ETIMEDOUT')) {
+                        // Kafka is not available, skip audit logging silently
+                        return;
+                    }
+                    // If connection error, try to connect and retry once
+                    if (kafkaError instanceof Error && errorMessage.includes('not connected') && this.kafkaProducer) {
+                        try {
+                            yield this.kafkaProducer.connect();
+                            // Retry send after connection
+                            const retryTopic = this.auditTopic || 'audit-log';
+                            const retryMessage = {
+                                key: `${auditPayload.method}-${auditPayload.endpoint}-${Date.now()}`,
+                                value: JSON.stringify(auditPayload),
+                                headers: {
+                                    'microservice': auditPayload.microservice,
+                                    'event-type': 'audit-log',
+                                }
+                            };
+                            // Debug log the payload and topic before retry send
+                            this.debugLog(`[RETRY] Sending to topic: ${retryTopic}`);
+                            this.debugLog('[RETRY] Payload:', JSON.stringify(auditPayload, null, 2));
+                            this.debugLog(`[RETRY] Message key: ${retryMessage.key}`);
+                            yield this.kafkaProducer.send({
+                                topic: retryTopic,
+                                messages: [retryMessage]
+                            });
+                        }
+                        catch (retryError) {
+                            // If retry also fails with connection/DNS error, skip silently
+                            const retryErrorMessage = retryError instanceof Error ? retryError.message : String(retryError);
+                            if (retryErrorMessage.includes('getaddrinfo EAI_AGAIN') ||
+                                retryErrorMessage.includes('ENOTFOUND') ||
+                                retryErrorMessage.includes('Connection error') ||
+                                retryErrorMessage.includes('ECONNREFUSED') ||
+                                retryErrorMessage.includes('ETIMEDOUT')) {
+                                return; // Skip silently
+                            }
+                            // Re-throw other errors to be caught by outer catch block
+                            throw new Error(`Kafka send failed after retry: ${retryErrorMessage}`);
+                        }
+                    }
+                    else {
+                        // Re-throw to be caught by outer catch block
+                        throw new Error(`Kafka send failed: ${errorMessage}`);
+                    }
+                }
+                this.logger.debug('Audit event sent to Kafka', {
+                    endpoint: auditPayload.endpoint,
+                    method: auditPayload.method,
+                    user_type: auditPayload.user_type,
+                    topic: this.auditTopic || 'audit-log'
+                });
+            }
+            catch (error) {
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                // Skip logging DNS/connection errors - Kafka is simply not available
+                if (errorMessage.includes('getaddrinfo EAI_AGAIN') ||
+                    errorMessage.includes('ENOTFOUND') ||
+                    errorMessage.includes('Connection error') ||
+                    errorMessage.includes('not connected') ||
+                    errorMessage.includes('ECONNREFUSED') ||
+                    errorMessage.includes('ETIMEDOUT')) {
+                    // Silently skip - Kafka is not available
+                    return;
+                }
+                // Only log unexpected errors (but don't throw - audit logging should not break the request)
+                // Use debug level instead of error to reduce noise
+                this.logger.debug('Error sending audit event to Kafka', {
+                    error: errorMessage,
+                    errorStack: error instanceof Error ? error.stack : undefined,
+                    errorName: error instanceof Error ? error.name : undefined,
+                    endpoint: req.path,
+                    method: req.method,
+                    authType: req.authType
+                });
+            }
+        });
+    }
+    /**
+     * Determine event type based on request path and method
+     */
+    static determineEventType(req) {
+        // Use originalUrl or baseUrl + path to get the full path
+        // req.path is relative to the router mount point, so for "/" route it would be just "/"
+        const fullPath = (req.originalUrl || req.baseUrl + req.path || req.path).toLowerCase();
+        const path = req.path.toLowerCase();
+        const method = req.method.toUpperCase();
+        // Login events
+        if (fullPath.includes('/login') || path.includes('/login')) {
+            const status = req.statusCode || 200;
+            if (status === 200) {
+                return AuditEventType.LOGIN_SUCCESS;
+            }
+            else if (status === 401 || status === 403) {
+                return AuditEventType.LOGIN_NOT_PERMITTED;
+            }
+            else {
+                return AuditEventType.LOGIN_FAILED;
+            }
+        }
+        // Officer events (read-only consumption)
+        // Check both fullPath (for routes like /api/v1/officer) and path (for routes like /officer)
+        if (fullPath.includes('/officer') || fullPath.includes('/officers') ||
+            path.includes('/officer') || path.includes('/officers')) {
+            if (method === 'GET' && (fullPath.match(/\/officer\/\d+$/) || fullPath.match(/\/officers\/\d+$/) ||
+                path.match(/\/officer\/\d+$/) || path.match(/\/officers\/\d+$/))) {
+                return AuditEventType.OFFICER_RETRIEVED;
+            }
+            else if (method === 'GET') {
+                return AuditEventType.OFFICERS_LISTED;
+            }
+        }
+        // Device events (read-only consumption)
+        if (fullPath.includes('/device') || fullPath.includes('/devices') ||
+            path.includes('/device') || path.includes('/devices')) {
+            if (method === 'GET' && (fullPath.match(/\/device\/\d+$/) || fullPath.match(/\/devices\/\d+$/) ||
+                path.match(/\/device\/\d+$/) || path.match(/\/devices\/\d+$/))) {
+                return AuditEventType.DEVICE_RETRIEVED;
+            }
+            else if (method === 'GET') {
+                return AuditEventType.DEVICES_LISTED;
+            }
+        }
+        // Arrest events (sub_module_data endpoints)
+        if (fullPath.includes('/sub_module_data') || fullPath.includes('/arrest') ||
+            path.includes('/sub_module_data') || path.includes('/arrest')) {
+            if (method === 'POST') {
+                return AuditEventType.ARREST_CREATED;
+            }
+            else if (method === 'PUT') {
+                return AuditEventType.ARREST_UPDATED;
+            }
+            else if (method === 'DELETE') {
+                return AuditEventType.ARREST_DELETED;
+            }
+            else if (method === 'GET' && (fullPath.match(/\/sub_module_data\/\d+$/) || fullPath.match(/\/arrest\/\d+$/) ||
+                path.match(/\/sub_module_data\/\d+$/) || path.match(/\/arrest\/\d+$/))) {
+                return AuditEventType.ARREST_RETRIEVED;
+            }
+            else if (method === 'GET') {
+                return AuditEventType.ARRESTS_LISTED;
+            }
+        }
+        // Default to endpoint accessed
+        return AuditEventType.ENDPOINT_ACCESSED;
+    }
+    /**
+     * Log endpoint access (called from middleware)
+     */
+    logEndpointAccess(req) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.logAuditEvent(req, {
+            // Event type will be determined automatically
+            });
+        });
+    }
+    /**
+     * Log endpoint access with response status
+     */
+    logEndpointAccessWithResponse(req, res, startTime) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const duration_ms = Date.now() - startTime;
+            yield this.logAuditEvent(req, {
+                response_status: res.statusCode,
+                duration_ms,
+            });
+        });
+    }
+    /**
+     * Extract and add arrest-specific information to audit payload
+     */
+    addArrestInformation(req, auditPayload, payload) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+        // Check if this is an arrest-related endpoint
+        const path = req.path.toLowerCase();
+        if (!path.includes('/sub_module_data') && !path.includes('/arrest')) {
+            return;
+        }
+        // Extract from request body (for POST/PUT)
+        const body = req.body || {};
+        const responseData = req.responseData; // If response data is attached to request
+        // Extract arrest ID from URL params or body
+        if ((_a = req.params) === null || _a === void 0 ? void 0 : _a.id) {
+            auditPayload.arrest_id = parseInt(req.params.id) || undefined;
+        }
+        else if (body.id) {
+            auditPayload.arrest_id = body.id;
+        }
+        else if (responseData === null || responseData === void 0 ? void 0 : responseData.id) {
+            auditPayload.arrest_id = responseData.id;
+        }
+        else if ((_b = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _b === void 0 ? void 0 : _b.id) {
+            auditPayload.arrest_id = responseData.data.id;
+        }
+        // Extract OB number
+        if (body.ob_number) {
+            auditPayload.ob_number = body.ob_number;
+        }
+        else if (responseData === null || responseData === void 0 ? void 0 : responseData.ob_number) {
+            auditPayload.ob_number = responseData.ob_number;
+        }
+        else if ((_c = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _c === void 0 ? void 0 : _c.ob_number) {
+            auditPayload.ob_number = responseData.data.ob_number;
+        }
+        // Extract sync_id
+        if (body.sync_id) {
+            auditPayload.sync_id = body.sync_id;
+        }
+        else if (responseData === null || responseData === void 0 ? void 0 : responseData.sync_id) {
+            auditPayload.sync_id = responseData.sync_id;
+        }
+        else if ((_d = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _d === void 0 ? void 0 : _d.sync_id) {
+            auditPayload.sync_id = responseData.data.sync_id;
+        }
+        // Extract IPRS ID
+        if (body.iprsId || body.iprs_id) {
+            auditPayload.iprs_id = body.iprsId || body.iprs_id;
+        }
+        else if ((responseData === null || responseData === void 0 ? void 0 : responseData.iprsId) || (responseData === null || responseData === void 0 ? void 0 : responseData.iprs_id)) {
+            auditPayload.iprs_id = responseData.iprsId || responseData.iprs_id;
+        }
+        else if (((_e = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _e === void 0 ? void 0 : _e.iprsId) || ((_f = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _f === void 0 ? void 0 : _f.iprs_id)) {
+            auditPayload.iprs_id = responseData.data.iprsId || responseData.data.iprs_id;
+        }
+        // Extract arresting officer ID
+        if (body.arrestingOfficer || body.arresting_officer) {
+            auditPayload.arresting_officer_id = body.arrestingOfficer || body.arresting_officer;
+        }
+        else if ((responseData === null || responseData === void 0 ? void 0 : responseData.arrestingOfficer) || (responseData === null || responseData === void 0 ? void 0 : responseData.arresting_officer)) {
+            auditPayload.arresting_officer_id = responseData.arrestingOfficer || responseData.arresting_officer;
+        }
+        else if (((_g = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _g === void 0 ? void 0 : _g.arrestingOfficer) || ((_h = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _h === void 0 ? void 0 : _h.arresting_officer)) {
+            auditPayload.arresting_officer_id = responseData.data.arrestingOfficer || responseData.data.arresting_officer;
+        }
+        // Extract arresting station ID
+        if (body.arrestingStation || body.arresting_station) {
+            auditPayload.arresting_station_id = body.arrestingStation || body.arresting_station;
+        }
+        else if ((responseData === null || responseData === void 0 ? void 0 : responseData.arrestingStation) || (responseData === null || responseData === void 0 ? void 0 : responseData.arresting_station)) {
+            auditPayload.arresting_station_id = responseData.arrestingStation || responseData.arresting_station;
+        }
+        else if (((_j = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _j === void 0 ? void 0 : _j.arrestingStation) || ((_k = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _k === void 0 ? void 0 : _k.arresting_station)) {
+            auditPayload.arresting_station_id = responseData.data.arrestingStation || responseData.data.arresting_station;
+        }
+        // Extract sub_module_id
+        if (body.subModuleId || body.sub_module_id || body.sub_moduleId) {
+            auditPayload.sub_module_id = body.subModuleId || body.sub_module_id || body.sub_moduleId;
+        }
+        else if ((responseData === null || responseData === void 0 ? void 0 : responseData.subModuleId) || (responseData === null || responseData === void 0 ? void 0 : responseData.sub_module_id) || (responseData === null || responseData === void 0 ? void 0 : responseData.sub_moduleId)) {
+            auditPayload.sub_module_id = responseData.subModuleId || responseData.sub_module_id || responseData.sub_moduleId;
+        }
+        else if (((_l = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _l === void 0 ? void 0 : _l.subModuleId) || ((_m = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _m === void 0 ? void 0 : _m.sub_module_id) || ((_o = responseData === null || responseData === void 0 ? void 0 : responseData.data) === null || _o === void 0 ? void 0 : _o.sub_moduleId)) {
+            auditPayload.sub_module_id = responseData.data.subModuleId || responseData.data.sub_module_id || responseData.data.sub_moduleId;
+        }
+        // Override with explicit payload values if provided
+        if (payload.arrest_id)
+            auditPayload.arrest_id = payload.arrest_id;
+        if (payload.ob_number)
+            auditPayload.ob_number = payload.ob_number;
+        if (payload.sync_id)
+            auditPayload.sync_id = payload.sync_id;
+        if (payload.iprs_id)
+            auditPayload.iprs_id = payload.iprs_id;
+        if (payload.arresting_officer_id)
+            auditPayload.arresting_officer_id = payload.arresting_officer_id;
+        if (payload.arresting_station_id)
+            auditPayload.arresting_station_id = payload.arresting_station_id;
+        if (payload.sub_module_id)
+            auditPayload.sub_module_id = payload.sub_module_id;
+    }
+}
+exports.AuditService = AuditService;