Chore/record request ip

[fatemeh-i]

No description provided.

[Copilot]

Pull request overview

This PR extends the authentication/session flow to capture the client IP address and persist it with session records, and also introduces an API-side request audit filter that logs IP and selected request/response metadata.

Changes:

• Add ip_address column to sessions and propagate ipAddress through device-management session DTO/model conversions and session upsert logic.
• Extend auth-gateway request/device models and login/register event construction to carry ipAddress.
• Add WebFlux controllers’ client-IP resolution and introduce an api-app RequestAuditFilter to log request audit events.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
device-management/device-management-ports/device-management-postgres/src/main/resources/db/migration/V5__add_ip_address_to_sessions.sql	Adds ip_address column to sessions.
device-management/device-management-ports/device-management-postgres/src/main/kotlin/co/nilin/opex/device/ports/postgres/utils/Convertor.kt	Maps ipAddress between persistence model and core DTO.
device-management/device-management-ports/device-management-postgres/src/main/kotlin/co/nilin/opex/device/ports/postgres/model/SessionModel.kt	Adds ipAddress column mapping to session DB model.
device-management/device-management-ports/device-management-postgres/src/main/kotlin/co/nilin/opex/device/ports/postgres/impl/SessionManagerImpl.kt	Preserves/stores ipAddress during session create/update.
device-management/device-management-core/src/main/kotlin/co/nilin/opex/device/core/service/UserSessionDeviceService.kt	Populates Session.ipAddress from login event.
device-management/device-management-core/src/main/kotlin/co/nilin/opex/device/core/data/Session.kt	Adds ipAddress field to core session DTO.
device-management/device-management-core/src/main/kotlin/co/nilin/opex/device/core/data/LoginEvent.kt	Adds ipAddress field to device-management login event.
auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/service/RegisterService.kt	Passes request.ipAddress into emitted login event.
auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/service/LoginService.kt	Passes request.ipAddress into emitted login event.
auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/data/LoginEvent.kt	Adds ipAddress to auth-gateway login event payload.
auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/data/Device.kt	Adds mutable ipAddress field to request device base class.
auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/controller/PublicUserController.kt	Resolves client IP and injects into confirm-register flow.
auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/controller/AuthController.kt	Resolves client IP and injects into token/confirm/refresh flows.
api/api-app/src/main/kotlin/co/nilin/opex/api/app/interceptor/RequestAuditFilter.kt	Adds request audit logging filter (IP + selected metadata).

Suppressed comments (3)

api/api-app/src/main/kotlin/co/nilin/opex/api/app/interceptor/RequestAuditFilter.kt:58

• responseBody is appended with the full response content, so it can grow without bound even though it’s truncated only at log time. This can lead to high memory usage on large/streaming responses.

                    override fun writeWith(body: Publisher<out org.springframework.core.io.buffer.DataBuffer>): Mono<Void> {
                        val wrapped = Flux.from(body).map { dataBuffer ->
                            val bytes = ByteArray(dataBuffer.readableByteCount())
                            dataBuffer.read(bytes)
                            DataBufferUtils.release(dataBuffer)

auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/controller/AuthController.kt:79

• The injected ServerHttpRequest parameter is likely being picked up by OpenAPI/Swagger as an endpoint parameter. Mark it as hidden so it doesn’t appear in the API contract.

        request: ServerHttpRequest

auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/controller/AuthController.kt:151

• The injected ServerHttpRequest parameter is likely being picked up by OpenAPI/Swagger as an endpoint parameter. Mark it as hidden so it doesn’t appear in the API contract.

        request: ServerHttpRequest

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.