Add structured audit logging for every requireAdmin-authorized action across diagnostics, backfill, and reprocess routes

[Jagadeeshftw]

Description

src/auth/middleware.ts's requireAdmin documents its callers as src/routes/diagnostics.ts, src/routes/events.ts, src/routes/backfill-events.ts, and src/routes/reprocess-events.ts, but successful admin authorizations are only counted (incAuthMetric(AUTH_METRICS.ADMIN_AUTHORIZED)), not recorded as a durable, queryable audit trail of who performed which privileged action and when. Add a dedicated audit log capturing admin identity, route, method, and outcome for every requireAdmin-gated request.

Requirements and context

• Add an admin_audit_log table (address, method, path, status_code, request_id, created_at) to src/db/schema.ts
• Write an audit row from within requireAdmin in src/auth/middleware.ts on both grant and deny, without blocking the request on the write
• Ensure no request bodies, tokens, or PII beyond the already-public wallet address are persisted
• Must be secure, tested, and documented
• Should be efficient and easy to review

Suggested execution

Fork the repo and create a branch

git checkout -b feature/admin-action-audit-log

Implement changes

• Update/Write: src/auth/middleware.ts
• Update/Write: src/db/schema.ts
• Add/Update tests: src/auth/middleware.test.ts
• Add documentation: docs/auth/middleware.md
• Include clear code comments and TS types
• Validate security assumptions

Test and commit

• Run tests: pnpm test
• Cover edge cases
• Include test output and security notes

Example commit message

feat: add audit logging for admin-authorized actions

Guidelines

• Minimum 95 percent test coverage
• Clear documentation
• Timeframe: 96 hours

[Stephan-Thomas]

📋 Grainlify Application

@Stephan-Thomas has applied to work on this issue as part of the Grainlify program.

hi, i would like to work on this.

---

Repo Maintainers: To accept this application, review their application or assign @Stephan-Thomas to this issue.

[TS-mfon]

📋 Grainlify Application

@TS-mfon has applied to work on this issue as part of the Grainlify program.

GM

i'm a blockchain developer

please can i work on this issue

---

Repo Maintainers: To accept this application, review their application or assign @TS-mfon to this issue.

[dotmantissa]

📋 Grainlify Application

@dotmantissa has applied to work on this issue as part of the Grainlify program.

Hi maintainers,

I'd like to work on this. I'll add the admin_audit_log table to schema.ts, write audit rows on both grant and deny inside requireAdmin without blocking the request, ensure no request bodies, tokens, or PII beyond the wallet address are persisted, and document the implementation in docs/auth/middleware.md with 95 percent test coverage.

I estimate I can have a PR ready within 4 hours of being assigned. Could you please assign this to me?

Thanks.

---

Repo Maintainers: To accept this application, review their application or assign @dotmantissa to this issue.