Audit Logs

const auditLogSchema = new mongoose.Schema({
  actorUserId: {
    type: mongoose.Schema.Types.ObjectId,
    ref: "User"
  },
  actorEmail: String,
  actorRole: String,
  action: {
    type: String,
    required: true
  },
  resourceType: String,
  resourceId: String,
  method: {
    type: String,
    required: true
  },
  path: {
    type: String,
    required: true
  },
  statusCode: {
    type: Number,
    required: true
  },
  outcome: {
    type: String,
    enum: ["success", "failure"],
    required: true
  },
  ipAddress: String,
  userAgent: String
}, {
  timestamps: true
});

// Indexes for efficient querying
auditLogSchema.index({ createdAt: -1 });
auditLogSchema.index({ actorUserId: 1, createdAt: -1 });

import AuditLog from "../models/AuditLog.js";

const methodToAction = {
  GET: "read",
  POST: "create",
  PUT: "update",
  PATCH: "update",
  DELETE: "delete"
};

const parseRouteContext = (urlPath) => {
  const cleanPath = (urlPath || "").split("?")[0];
  const segments = cleanPath.split("/").filter(Boolean);

  if (segments.length < 2 || segments[0] !== "api") {
    return { resourceType: "Unknown", resourceId: undefined };
  }

  const resourceType = segments[2] || segments[1] || "Unknown";
  const resourceId = segments[3];

  return { resourceType, resourceId };
};

export const requestAuditTrail = (req, res, next) => {
  const watched = req.originalUrl.startsWith("/api/fhir") || 
                  req.originalUrl.startsWith("/api/admin");

  if (!watched) {
    return next();
  }

  res.on("finish", () => {
    const { resourceType, resourceId } = parseRouteContext(req.originalUrl);
    const outcome = res.statusCode >= 200 && res.statusCode < 400 ? 
      "success" : "failure";

    AuditLog.create({
      actorUserId: req.user?.sub,
      actorEmail: req.user?.email,
      actorRole: req.user?.role,
      action: methodToAction[req.method] || "unknown",
      resourceType,
      resourceId,
      method: req.method,
      path: req.originalUrl,
      statusCode: res.statusCode,
      outcome,
      ipAddress: req.ip,
      userAgent: req.get("user-agent")
    }).catch(() => {
      // Non-blocking by design to avoid impacting clinical workflows.
    });
  });

  return next();
};

import express from "express";
import { requestAuditTrail } from "./middleware/audit.js";
import fhirRoutes from "./routes/fhirRoutes.js";
import adminRoutes from "./routes/adminRoutes.js";

const app = express();

// Apply audit middleware globally
app.use(requestAuditTrail);

// Register routes
app.use("/api/fhir", fhirRoutes);
app.use("/api/admin", adminRoutes);

export default app;

import { useEffect, useState } from "react";
import { adminApi } from "../api.js";
import { useAuth } from "../context/AuthContext.jsx";

const AuditPage = () => {
  const { token } = useAuth();
  const [rows, setRows] = useState([]);
  const [page, setPage] = useState(1);
  const [total, setTotal] = useState(0);
  const [limit, setLimit] = useState(25);
  const [error, setError] = useState("");

  useEffect(() => {
    const load = async () => {
      try {
        const query = `?page=${page}&limit=${limit}`;
        const response = await adminApi.listAuditLogs(token, query);
        setRows(response.data || []);
        setTotal(response.total || 0);
        setLimit(response.limit || 25);
      } catch (err) {
        setError(err.message || "Unable to load audit logs");
      }
    };

    load();
  }, [page, limit, token]);

  const totalPages = Math.max(1, Math.ceil(total / limit));

  return (
    <section className="stack-gap">
      <h1>Audit logs</h1>
      <p className="muted-text">
        HIPAA Security Rule audit trail of access and modification activity.
      </p>
      {error ? <p className="banner banner-error">{error}</p> : null}

      <article className="card">
        <div className="table-scroll">
          <table>
            <thead>
              <tr>
                <th>Timestamp</th>
                <th>Actor</th>
                <th>Role</th>
                <th>Action</th>
                <th>Resource</th>
                <th>Status</th>
                <th>Outcome</th>
                <th>Path</th>
              </tr>
            </thead>
            <tbody>
              {rows.map((entry) => (
                <tr key={entry._id}>
                  <td>{entry.createdAt}</td>
                  <td>{entry.actorEmail || "Unknown"}</td>
                  <td>{entry.actorRole || "-"}</td>
                  <td>{entry.action}</td>
                  <td>
                    {entry.resourceType}
                    {entry.resourceId ? `/${entry.resourceId}` : ""}
                  </td>
                  <td>{entry.statusCode}</td>
                  <td>{entry.outcome}</td>
                  <td>{entry.path}</td>
                </tr>
              ))}
            </tbody>
          </table>
        </div>

        <div className="pagination">
          <button
            type="button"
            className="button button-secondary"
            onClick={() => setPage((prev) => Math.max(1, prev - 1))}
            disabled={page <= 1}
          >
            Previous
          </button>
          <span>
            Page {page} of {totalPages}
          </span>
          <button
            type="button"
            className="button button-secondary"
            onClick={() => setPage((prev) => Math.min(totalPages, prev + 1))}
            disabled={page >= totalPages}
          >
            Next
          </button>
        </div>
      </article>
    </section>
  );
};

export default AuditPage;

const totalPages = Math.max(1, Math.ceil(total / limit));

<div className="pagination">
  <button
    type="button"
    className="button button-secondary"
    onClick={() => setPage((prev) => Math.max(1, prev - 1))}
    disabled={page <= 1}
  >
    Previous
  </button>
  <span>
    Page {page} of {totalPages}
  </span>
  <button
    type="button"
    className="button button-secondary"
    onClick={() => setPage((prev) => Math.min(totalPages, prev + 1))}
    disabled={page >= totalPages}
  >
    Next
  </button>
</div>

import express from "express";
import { authenticate, authorize } from "../middleware/auth.js";
import { asyncHandler } from "../utils/asyncHandler.js";
import AuditLog from "../models/AuditLog.js";

const router = express.Router();

router.use(authenticate);

router.get(
  "/audit-logs",
  authorize("admin", "auditor"),
  asyncHandler(async (req, res) => {
    const page = Math.max(1, parseInt(req.query.page, 10) || 1);
    const limit = Math.min(100, Math.max(1, parseInt(req.query.limit, 10) || 25));
    const skip = (page - 1) * limit;

    const [logs, total] = await Promise.all([
      AuditLog.find({})
        .sort({ createdAt: -1 })
        .skip(skip)
        .limit(limit)
        .lean(),
      AuditLog.countDocuments({})
    ]);

    res.json({
      data: logs,
      total,
      page,
      limit,
      totalPages: Math.ceil(total / limit)
    });
  })
);

export default router;

const outcome = res.statusCode >= 200 && res.statusCode < 400 ? 
  "success" : "failure";

router.get(
  "/audit-logs",
  authorize("admin", "auditor"),
  asyncHandler(async (req, res) => {
    // ... audit log retrieval
  })
);

AuditLog.create({
  actorUserId: req.user?.sub,
  actorEmail: req.user?.email,
  // ... additional fields
}).catch(() => {
  // Non-blocking by design to avoid impacting clinical workflows.
});