Add structured logging and request tracing

[haasonsaas]

Summary

The codebase has minimal logging. No structured fields, no request IDs, no trace context propagation. Debugging production issues or auditing behavior would be extremely difficult.

Current state

• cmd/asb-api/main.go and cmd/asb-worker/main.go use basic log package
• Service layer (internal/app/service.go) returns errors but does not log them with context
• No request-scoped context (no request IDs, no correlation IDs)
• Errors returned without wrapping — callsite context is lost
• No performance logging (latency, operation counts)

Required work

• Adopt log/slog as the structured logger throughout the codebase
• Add request ID middleware to the HTTP handler — generate a UUID per request, inject into context
• Log all state transitions at INFO level: session created/revoked/expired, grant requested/issued/denied/revoked, approval created/approved/denied/expired, artifact created/used/expired
• Log all errors at ERROR level with operation context (which endpoint, which session, which grant)
• Add timing logs for external calls (Vault, GitHub API, Postgres queries) at DEBUG level
• Propagate request IDs through ConnectRPC interceptors
• Add trace ID support (OpenTelemetry compatible) for distributed tracing

Files

• cmd/asb-api/main.go — logger initialization
• internal/api/httpapi/server.go — request ID middleware
• internal/api/connectapi/server.go — interceptor for request IDs
• internal/app/service.go — structured logging at all decision points
• internal/connectors/*/ — log external calls

Priority

High — essential for any operational deployment.

🤖 Generated with Claude Code