감사 로그: 누가 뭘 했는지 추적

CREATE TABLE audit_logs (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  tenant_id UUID NOT NULL,
  actor_id UUID,                  -- NULL = 시스템
  actor_type VARCHAR DEFAULT 'user',  -- user, api_key, system
  action VARCHAR NOT NULL,        -- 'project.created', 'user.invited'
  resource_type VARCHAR NOT NULL, -- 'project', 'user'
  resource_id UUID,
  changes JSONB,                  -- { before, after }
  ip VARCHAR,
  user_agent VARCHAR,
  metadata JSONB,
  created_at TIMESTAMPTZ DEFAULT NOW()
);

CREATE INDEX ON audit_logs(tenant_id, created_at DESC);
CREATE INDEX ON audit_logs(resource_type, resource_id);
CREATE INDEX ON audit_logs(actor_id, created_at DESC);
CREATE INDEX ON audit_logs USING GIN (changes);

// utils/audit.ts
type AuditInput = {
  tenantId: string;
  actorId?: string;
  action: string;
  resourceType: string;
  resourceId?: string;
  before?: any;
  after?: any;
  metadata?: any;
};

export async function audit(req: Request, input: AuditInput) {
  return db.auditLog.create({
    data: {
      ...input,
      changes: input.before || input.after
        ? { before: input.before, after: input.after, diff: diff(input.before, input.after) }
        : null,
      ip: req.ip,
      userAgent: req.headers['user-agent'],
    },
  });
}


// diff 함수 (변경된 필드만)
function diff(before: any, after: any): any {
  if (!before) return { type: 'create', data: after };
  if (!after) return { type: 'delete', data: before };

  const changes: any = {};
  const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
  for (const key of keys) {
    if (JSON.stringify(before[key]) !== JSON.stringify(after[key])) {
      changes[key] = { before: before[key], after: after[key] };
    }
  }
  return { type: 'update', changes };
}

const AUDITED_MODELS = new Set(['Project', 'User', 'TenantMember', 'ApiKey']);

prisma.$use(async (params, next) => {
  if (!AUDITED_MODELS.has(params.model!)) return next(params);

  let before: any = null;
  if (['update', 'delete'].includes(params.action)) {
    before = await (prisma as any)[params.model!.toLowerCase()].findUnique({
      where: params.args.where,
    });
  }

  const result = await next(params);

  // 비동기 — 본 작업 차단 안 함
  setImmediate(async () => {
    const ctx = AsyncLocalStorage.getStore();
    if (!ctx) return;

    await db.auditLog.create({
      data: {
        tenantId: ctx.tenantId,
        actorId: ctx.userId,
        action: `${params.model!.toLowerCase()}.${params.action}`,
        resourceType: params.model!.toLowerCase(),
        resourceId: result?.id ?? params.args.where?.id,
        changes: { before, after: result },
        ip: ctx.ip,
      },
    });
  });

  return result;
});

// 미들웨어로 자동 기록 + 의미 있는 액션은 명시적
async function inviteUser(tenantId: string, email: string, role: string, inviterId: string, req: Request) {
  const invitation = await db.invitation.create({
    data: { tenantId, email, role, invitedBy: inviterId, /* ... */ },
  });

  await audit(req, {
    tenantId,
    actorId: inviterId,
    action: 'tenant.member_invited',
    resourceType: 'invitation',
    resourceId: invitation.id,
    metadata: { email, role },
  });

  return invitation;
}

app.get('/audit-logs', requirePermission('audit:read'), async (req, res) => {
  const {
    actor, resource, action,
    from, to,
    page = 1, limit = 50,
  } = req.query;

  const where: any = { tenantId: req.tenant!.id };
  if (actor) where.actorId = actor;
  if (resource) where.resourceType = resource;
  if (action) where.action = { contains: action };
  if (from || to) {
    where.createdAt = {};
    if (from) where.createdAt.gte = new Date(from as string);
    if (to) where.createdAt.lte = new Date(to as string);
  }

  const [items, total] = await Promise.all([
    db.auditLog.findMany({
      where,
      orderBy: { createdAt: 'desc' },
      skip: (Number(page) - 1) * Number(limit),
      take: Number(limit),
      include: { actor: { select: { id: true, name: true, email: true } } },
    }),
    db.auditLog.count({ where }),
  ]);

  res.json({ items, total, page: Number(page) });
});

function AuditTimeline({ logs }: { logs: AuditLog[] }) {
  return (
    <ul className="space-y-4">
      {logs.map(log => (
        <li key={log.id} className="flex gap-3">
          <Avatar src={log.actor?.avatarUrl} />
          <div className="flex-1">
            <p>
              <strong>{log.actor?.name ?? '시스템'}</strong>
              {' '}
              {actionLabel(log.action, log.changes)}
            </p>
            <time className="text-sm text-gray-500">
              {formatDistanceToNow(log.createdAt)} 전 · {log.ip}
            </time>
            {log.changes && (
              <details className="mt-1">
                <summary className="text-xs text-gray-500 cursor-pointer">변경사항</summary>
                <pre className="text-xs">{JSON.stringify(log.changes, null, 2)}</pre>
              </details>
            )}
          </div>
        </li>
      ))}
    </ul>
  );
}

법적 요구사항:
- 한국 개인정보보호법: 3년 (퇴사 후)
- 금융 (전자금융감독): 5년
- 의료 (의료법): 5년
- GDPR: 사용자 요청 시 삭제 (right to erasure)


[자동 정리]
SELECT cron.schedule('cleanup-audit', '0 4 * * 0',
  $$DELETE FROM audit_logs WHERE created_at < NOW() - INTERVAL '3 years'$$
);


[중요 액션은 영구 보존]
- 결제 (모든 거래 기록)
- 권한 변경
- 데이터 삭제