Add auditLogger middleware for HIPAA compliance - #274
Conversation
Addresses part of #169 ### 📝 Description This PR introduces the first foundational piece for HIPAA Compliance (Issue #169) by adding a secure Audit Logging middleware. HIPAA requires a strict audit trail to track exactly who accesses Protected Health Information (PHI), what action they performed, and when. ### 🛠️ Changes Made * **Created `server/utils/auditLogger.js`:** A new Express middleware that intercepts requests to capture: * `userId` and `userRole` (handling unauthenticated fallbacks gracefully). * HTTP `method` (GET, POST, etc.) and `resource` URL. * Response `status` code. * Client `ip` address. * Precise `timestamp`. ### ✅ Next Steps (To fully close #169) - [ ] Apply `auditLogger` to sensitive PHI routes in the main Express app. - [ ] Implement Role-Based Access Control (RBAC) middleware. - [ ] Implement database encryption at rest for sensitive patient data. ### 🧪 How to Test 1. Apply the middleware to a test route in the server setup. 2. Trigger the route via the client or Postman. 3. Verify that the `[HIPAA AUDIT LOG]` entry is securely printed in the server console with the correct metadata format.
|
@mspandey is attempting to deploy a commit to the vallabhatech's projects Team on Vercel. A member of the Team first needs to authorize it. |
📝 WalkthroughWalkthroughAdds an Express middleware that records request identity, method, URL, response status, timestamp, and client IP as a JSON audit log when the response finishes. ChangesAudit logging
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install timed out. The project may have too many dependencies for the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Warning |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@server/utils/auditLogger.js`:
- Line 17: Update the audit logging flow around the url value so it never
records req.originalUrl or its query string. Use the framework’s route template
or pathname-only value, or construct the URL from explicitly allowlisted
non-sensitive parameters, while preserving the existing endpoint audit field.
- Around line 34-37: Replace the direct console.log in the audit logging flow
with an injected, controlled durable audit logger or storage backend that
provides secure retention and reliable delivery. Keep console output limited to
development or explicitly secured centralized logging, and ensure PHI routes use
the production backend.
- Line 21: Update the IP extraction in the audit logger to use req.ip directly
instead of reading req.headers['x-forwarded-for'] or req.socket.remoteAddress.
Rely on the existing trust proxy configuration in server/index.js so the logged
audit IP follows the application’s normalized client-IP behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: dd356065-750b-45a6-9adf-04386259d56f
📒 Files selected for processing (1)
server/utils/auditLogger.js
|
|
||
| // 2. Identify the Action & Resource | ||
| const method = req.method; // e.g., GET, POST, DELETE | ||
| const url = req.originalUrl; // The endpoint accessed |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Do not audit the raw originalUrl.
req.originalUrl includes the query string, which can contain PHI, search terms, or credentials. Record a route template/path or an explicitly allowlisted set of non-sensitive parameters instead.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@server/utils/auditLogger.js` at line 17, Update the audit logging flow around
the url value so it never records req.originalUrl or its query string. Use the
framework’s route template or pathname-only value, or construct the URL from
explicitly allowlisted non-sensitive parameters, while preserving the existing
endpoint audit field.
| const status = res.statusCode; // Success or failure | ||
|
|
||
| // 3. Identify the IP Address (optional but recommended for HIPAA) | ||
| const ip = req.headers['x-forwarded-for'] || req.socket.remoteAddress; |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
rg -n -C3 "trust proxy|x-forwarded-for|req\\.ip|remoteAddress" serverRepository: vallabhatech/CareSync
Length of output: 3429
Use req.ip instead of reading x-forwarded-for directly. server/index.js already configures trust proxy, so this logger should follow the same pattern; otherwise clients can spoof or multi-value the audit IP.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@server/utils/auditLogger.js` at line 21, Update the IP extraction in the
audit logger to use req.ip directly instead of reading
req.headers['x-forwarded-for'] or req.socket.remoteAddress. Rely on the existing
trust proxy configuration in server/index.js so the logged audit IP follows the
application’s normalized client-IP behavior.
| // TODO: In a production environment, save this to a secure, append-only database | ||
| // or a logging service (like AWS CloudWatch, Datadog, or a secure file). | ||
| // For now, we will log it securely to the console. | ||
| console.log('[HIPAA AUDIT LOG]', JSON.stringify(logEntry)); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Use a controlled, durable audit sink before applying this to PHI routes.
console.log alone does not provide append-only retention, access control, integrity protection, or reliable delivery. Inject a production audit logger/storage backend and restrict console output to development or explicitly secured centralized logging.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@server/utils/auditLogger.js` around lines 34 - 37, Replace the direct
console.log in the audit logging flow with an injected, controlled durable audit
logger or storage backend that provides secure retention and reliable delivery.
Keep console output limited to development or explicitly secured centralized
logging, and ensure PHI routes use the production backend.
|
github-actions
Bot
added
backend
enhancement
|
Pls add elusoc tag |
Addresses part of #169
📝 Description
This PR introduces the first foundational piece for HIPAA Compliance (Issue #169) by adding a secure Audit Logging middleware. HIPAA requires a strict audit trail to track exactly who accesses Protected Health Information (PHI), what action they performed, and when.
🛠️ Changes Made
server/utils/auditLogger.js: A new Express middleware that intercepts requests to capture:userIdanduserRole(handling unauthenticated fallbacks gracefully).method(GET, POST, etc.) andresourceURL.statuscode.ipaddress.timestamp.✅ Next Steps (To fully close #169)
auditLoggerto sensitive PHI routes in the main Express app.🧪 How to Test
[HIPAA AUDIT LOG]entry is securely printed in the server console with the correct metadata format.Summary by CodeRabbit