Chore/record request ip

api/api-app/src/main/kotlin/co/nilin/opex/api/app/interceptor/RequestAuditFilter.kt

@@ -0,0 +1,125 @@
+package co.nilin.opex.api.app.interceptor
+
+import co.nilin.opex.common.security.JwtUtils
+import com.fasterxml.jackson.databind.ObjectMapper
+import org.reactivestreams.Publisher
+import org.slf4j.LoggerFactory
+import org.springframework.core.Ordered
+import org.springframework.core.annotation.Order
+import org.springframework.core.io.buffer.DataBufferUtils
+import org.springframework.http.HttpHeaders
+import org.springframework.http.server.reactive.ServerHttpRequestDecorator
+import org.springframework.http.server.reactive.ServerHttpResponseDecorator
+import org.springframework.stereotype.Component
+import org.springframework.web.server.ServerWebExchange
+import org.springframework.web.server.WebFilter
+import org.springframework.web.server.WebFilterChain
+import reactor.core.publisher.Flux
+import reactor.core.publisher.Mono
+import java.nio.charset.StandardCharsets
+import java.time.OffsetDateTime
+import java.time.ZoneOffset
+
+@Component
+@Order(Ordered.LOWEST_PRECEDENCE)
+class RequestAuditFilter(
+    private val objectMapper: ObjectMapper
+) : WebFilter {
+
+    private val logger = LoggerFactory.getLogger(RequestAuditFilter::class.java)
+    private val maxPayloadSize = 10_000
+
+    override fun filter(exchange: ServerWebExchange, chain: WebFilterChain): Mono<Void> {
+        val request = exchange.request
+        val sourceIp = resolveClientIp(exchange)
+        val token = extractBearerToken(request.headers)
+        val mobile = extractClaim(token, "mobile", "phone_number")
+        val email = extractClaim(token, "email")
+        val deviceUuid = extractClaim(token, "deviceUuid", "device_uuid")
+
+        return DataBufferUtils.join(request.body)
+            .defaultIfEmpty(exchange.response.bufferFactory().wrap(ByteArray(0)))
+            .flatMap { requestBuffer ->
+                val requestBytes = ByteArray(requestBuffer.readableByteCount())
+                requestBuffer.read(requestBytes)
+                DataBufferUtils.release(requestBuffer)
+                val requestBody = truncateBody(String(requestBytes, StandardCharsets.UTF_8))
+
+                val decoratedRequest = object : ServerHttpRequestDecorator(request) {
+                    override fun getBody() = Flux.just(exchange.response.bufferFactory().wrap(requestBytes))
+                }
+
+                val responseBody = StringBuilder()
+                val decoratedResponse = object : ServerHttpResponseDecorator(exchange.response) {
+                    override fun writeWith(body: Publisher<out org.springframework.core.io.buffer.DataBuffer>): Mono<Void> {
+                        val wrapped = Flux.from(body).map { dataBuffer ->
+                            val bytes = ByteArray(dataBuffer.readableByteCount())
+                            dataBuffer.read(bytes)
+                            DataBufferUtils.release(dataBuffer)
+                            responseBody.append(String(bytes, StandardCharsets.UTF_8))
+                            bufferFactory().wrap(bytes)
+                        }
+                        return super.writeWith(wrapped)
+                    }
+
+                    override fun writeAndFlushWith(body: Publisher<out Publisher<out org.springframework.core.io.buffer.DataBuffer>>): Mono<Void> {
+                        return writeWith(Flux.from(body).flatMapSequential { it })
+                    }
+                }
+
+                val updatedExchange = exchange.mutate()
+                    .request(decoratedRequest)
+                    .response(decoratedResponse)
+                    .build()
+
+                return@flatMap chain.filter(updatedExchange)
+                    .doFinally {
+                        val payload = mapOf(
+                            "date" to OffsetDateTime.now(ZoneOffset.UTC).toString(),
+                            "ip" to sourceIp,
+                            "mobile" to mobile,
+                            "email" to email,
+                            "deviceUuid" to deviceUuid,
+                            "method" to request.method.name(),
+                            "url" to request.uri.toString(),
+                            "requestData" to requestBody,
+                            "responseStatus" to (decoratedResponse.statusCode?.value() ?: updatedExchange.response.statusCode?.value()),
+                            "responseBody" to truncateBody(responseBody.toString())
+                        )
+                        runCatching {
+                            logger.info("API_REQUEST_AUDIT {}", objectMapper.writeValueAsString(payload))
+                        }.onFailure {
+                            logger.warn("Failed to write request audit log", it)
+                        }
+                    }
+            }
+    }
+
+    private fun extractBearerToken(headers: HttpHeaders): String? {
+        val header = headers.getFirst(HttpHeaders.AUTHORIZATION) ?: return null
+        if (!header.startsWith("Bearer ", true)) return null
+        return header.substringAfter("Bearer ").trim().takeIf { it.isNotBlank() }
+    }
+
+    private fun extractClaim(token: String?, vararg names: String): String? {
+        if (token.isNullOrBlank()) return null
+        val payload = runCatching { JwtUtils.decodePayload(token) }.getOrNull() ?: return null
+        return names.firstNotNullOfOrNull { name ->
+            payload[name]?.toString()?.takeIf { it.isNotBlank() }
+        }
+    }
+
+    private fun resolveClientIp(exchange: ServerWebExchange): String? {
+        val forwardedFor = exchange.request.headers.getFirst("X-Forwarded-For")
+        if (!forwardedFor.isNullOrBlank()) {
+            return forwardedFor.substringBefore(",").trim()
+        }
+        return exchange.request.headers.getFirst("X-Real-IP")?.takeIf { it.isNotBlank() }
+            ?: exchange.request.remoteAddress?.address?.hostAddress
+    }
+
+    private fun truncateBody(body: String): String {
+        if (body.length <= maxPayloadSize) return body
+        return body.take(maxPayloadSize) + "...(truncated)"
+    }
+}

auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/controller/AuthController.kt

@@ -16,6 +16,7 @@ import io.swagger.v3.oas.annotations.responses.ApiResponse
 import io.swagger.v3.oas.annotations.security.SecurityRequirement
 import io.swagger.v3.oas.annotations.tags.Tag
 import org.springframework.http.ResponseEntity
+import org.springframework.http.server.reactive.ServerHttpRequest
 import org.springframework.security.core.annotation.CurrentSecurityContext
 import org.springframework.security.core.context.SecurityContext
 import org.springframework.web.bind.annotation.PostMapping
@@ -48,7 +49,11 @@ Allowed values:
             )
         ]
     )
-    suspend fun requestGetToken(@RequestBody tokenRequest: PasswordFlowTokenRequest): ResponseEntity<TokenResponse> {
+    suspend fun requestGetToken(
+        @RequestBody tokenRequest: PasswordFlowTokenRequest,
+        request: ServerHttpRequest
+    ): ResponseEntity<TokenResponse> {
+        tokenRequest.ipAddress = resolveClientIp(request)
         val tokenResponse = loginService.requestGetToken(tokenRequest)
         return ResponseEntity.ok().body(tokenResponse)
     }
@@ -69,7 +74,11 @@ Behavior: Completes password-flow login after OTP verification.""",
             )
         ]
     )
-    suspend fun confirmGetToken(@RequestBody tokenRequest: ConfirmPasswordFlowTokenRequest): ResponseEntity<TokenResponse> {
+    suspend fun confirmGetToken(
+        @RequestBody tokenRequest: ConfirmPasswordFlowTokenRequest,
+        request: ServerHttpRequest
+    ): ResponseEntity<TokenResponse> {
+        tokenRequest.ipAddress = resolveClientIp(request)
         val tokenResponse = loginService.confirmGetToken(tokenRequest)
         return ResponseEntity.ok().body(tokenResponse)
     }
@@ -137,8 +146,21 @@ Behavior: Issues a new access token from a valid refresh token.""",
             )
         ]
     )
-    suspend fun refreshToken(@RequestBody tokenRequest: RefreshTokenRequest): ResponseEntity<TokenResponse> {
+    suspend fun refreshToken(
+        @RequestBody tokenRequest: RefreshTokenRequest,
+        request: ServerHttpRequest
+    ): ResponseEntity<TokenResponse> {
+        tokenRequest.ipAddress = resolveClientIp(request)
         val tokenResponse = loginService.refreshToken(tokenRequest)
         return ResponseEntity.ok().body(tokenResponse)
     }
+
+    private fun resolveClientIp(request: ServerHttpRequest): String? {
+        val forwardedFor = request.headers.getFirst("X-Forwarded-For")
+        if (!forwardedFor.isNullOrBlank()) {
+            return forwardedFor.substringBefore(",").trim()
+        }
+        return request.headers.getFirst("X-Real-IP")?.takeIf { it.isNotBlank() }
+            ?: request.remoteAddress?.address?.hostAddress
+    }
 }

auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/controller/PublicUserController.kt

@@ -10,6 +10,7 @@ import io.swagger.v3.oas.annotations.responses.ApiResponse
 import io.swagger.v3.oas.annotations.tags.Tag
 import jakarta.validation.Valid
 import org.springframework.http.ResponseEntity
+import org.springframework.http.server.reactive.ServerHttpRequest
 import org.springframework.web.bind.annotation.PostMapping
 import org.springframework.web.bind.annotation.RequestBody
 import org.springframework.web.bind.annotation.RequestMapping
@@ -112,7 +113,11 @@ Behavior: Completes registration and returns login token data.""",
             )
         ]
     )
-    suspend fun confirmRegister(@RequestBody request: ConfirmRegisterRequest): ResponseEntity<Token> {
+    suspend fun confirmRegister(
+        @RequestBody request: ConfirmRegisterRequest,
+        @io.swagger.v3.oas.annotations.Parameter(hidden = true) serverRequest: ServerHttpRequest
+    ): ResponseEntity<Token> {
+        request.ipAddress = resolveClientIp(serverRequest)
         val loginToken = registerService.confirmRegister(request)
         return ResponseEntity.ok(loginToken)
     }
@@ -224,4 +229,13 @@ Response body: No response body.""",
         forgetPasswordService.confirmForget(request)
         return ResponseEntity.ok().build()
     }
+
+    private fun resolveClientIp(request: ServerHttpRequest): String? {
+        val forwardedFor = request.headers.getFirst("X-Forwarded-For")
+        if (!forwardedFor.isNullOrBlank()) {
+            return forwardedFor.substringBefore(",").trim()
+        }
+        return request.headers.getFirst("X-Real-IP")?.takeIf { it.isNotBlank() }
+            ?: request.remoteAddress?.address?.hostAddress
+    }
 }

auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/data/Device.kt

@@ -11,4 +11,5 @@ open class Device {
     var pushToken: String? = null
     var deviceUuid: String? = null
     var buildNumber: Int? = null
+    var ipAddress: String? = null
 }

auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/data/LoginEvent.kt

@@ -14,6 +14,7 @@ data class LoginEvent(
     val platform: Platform?,
     val agent: String?,
     val buildNumber: Int?,
+    val ipAddress: String?,
     val sessionId: String,
     val expireDate: LocalDateTime
 ) : AuthEvent()

auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/service/LoginService.kt

@@ -230,6 +230,7 @@ class LoginService(
                 platform = request.platform,
                 agent = request.agent,
                 buildNumber = request.buildNumber,
+                ipAddress = request.ipAddress,
                 sessionId = sessionState ?: "",
                 expireDate = LocalDateTime.now().plusSeconds(expiresIn.toLong())
             )

auth-gateway/auth-gateway-app/src/main/kotlin/co/nilin/opex/auth/service/RegisterService.kt

@@ -126,6 +126,7 @@ class RegisterService(
                 platform = request.platform,
                 agent = request.agent,
                 buildNumber = request.buildNumber,
+                ipAddress = request.ipAddress,
                 sessionId = sessionState ?: "",
                 expireDate = LocalDateTime.now().plusSeconds(expiresIn.toLong())
             )

device-management/device-management-core/src/main/kotlin/co/nilin/opex/device/core/data/LoginEvent.kt

@@ -15,7 +15,7 @@ data class LoginEvent(
     val platform: Platform?,
     val agent: String?,
     val buildNumber: Int?,
+    val ipAddress: String? = null,
     val sessionId: String,
     val expireDate: LocalDateTime
 ) : SessionEvent()
-

device-management/device-management-core/src/main/kotlin/co/nilin/opex/device/core/data/Session.kt

@@ -6,6 +6,7 @@ data class Session(
     val sessionState: String,
     val userId: String,
     val deviceId: Long,
+    val ipAddress: String? = null,
     val status: SessionStatus = SessionStatus.ACTIVE,
     val createDate: LocalDateTime? = LocalDateTime.now(),
     val expireDate: LocalDateTime?

device-management/device-management-core/src/main/kotlin/co/nilin/opex/device/core/service/UserSessionDeviceService.kt

@@ -43,6 +43,7 @@ class UserSessionDeviceService(
                 sessionState = loginEvent.sessionId,
                 userId = loginEvent.uuid,
                 deviceId = device.id,
+                ipAddress = loginEvent.ipAddress,
                 expireDate = loginEvent.expireDate
             )
         )

device-management/device-management-ports/device-management-postgres/src/main/kotlin/co/nilin/opex/device/ports/postgres/impl/SessionManagerImpl.kt

@@ -26,11 +26,12 @@ class SessionManagerImpl(
     private val logger = LoggerFactory.getLogger(SessionManagerImpl::class.java)
 
     override suspend fun createOrUpdateSession(session: Session): Session? {
-        val newOrUpdatedSession = sessionRepository.findBySessionState(session.sessionState)
-            .awaitFirstOrNull()?.copy(
-                expireDate = session.expireDate,
-                status = SessionStatus.ACTIVE
-            ) ?: session.toModel()
+        val existingSession = sessionRepository.findBySessionState(session.sessionState).awaitFirstOrNull()
+        val newOrUpdatedSession = existingSession?.copy(
+            expireDate = session.expireDate,
+            ipAddress = session.ipAddress ?: existingSession.ipAddress,
+            status = SessionStatus.ACTIVE
+        ) ?: session.toModel()
         sessionRepository.save(newOrUpdatedSession).awaitSingle()
         return newOrUpdatedSession.toDto()
     }

device-management/device-management-ports/device-management-postgres/src/main/kotlin/co/nilin/opex/device/ports/postgres/model/SessionModel.kt

@@ -13,9 +13,9 @@ data class SessionModel(
     @Column("session_state") val sessionState: String,
     @Column("uuid") val userId: String,
     @Column("device_id") val deviceId: Long,
+    @Column("ip_address") val ipAddress: String? = null,
     @Column("status") val status: SessionStatus,
     @Column("create_date") val createDate: LocalDateTime? = LocalDateTime.now(),
     @Column("expire_date") val expireDate: LocalDateTime? = LocalDateTime.now(),
     @Column @Version var version: Long? = null
 )
-

device-management/device-management-ports/device-management-postgres/src/main/kotlin/co/nilin/opex/device/ports/postgres/utils/Convertor.kt

@@ -67,6 +67,7 @@ fun Session.toModel(): SessionModel {
         sessionState = sessionState,
         userId = userId,
         deviceId = deviceId,
+        ipAddress = ipAddress,
         status = status,
         createDate = createDate ?: LocalDateTime.now(),
         expireDate = expireDate
@@ -78,6 +79,7 @@ fun SessionModel.toDto(): Session {
         sessionState = sessionState,
         userId = userId,
         deviceId = deviceId,
+        ipAddress = ipAddress,
         status = status,
         createDate = createDate,
         expireDate = expireDate

device-management/device-management-ports/device-management-postgres/src/main/resources/db/migration/V5__add_ip_address_to_sessions.sql

@@ -0,0 +1,2 @@
+ALTER TABLE sessions
+    ADD COLUMN IF NOT EXISTS ip_address VARCHAR(64);