feat(core): audit logging

[pbacon-blaber]

• Adds audit logging level to internal logger
• Closes audit package #730

The main changes for the PR are in logger.go and audit.go where we add the new AUDIT log level and then add a specific method to the logger to log rewrap requests as an example. More detailed changes for other audit calls will be done as part of #719

Examples of rewrap success log:

{
  "time": "2024-05-21T11:03:18.910724-04:00",
  "level": "AUDIT",
  "msg": "{\"id\":\"4e027444-3496-4a6d-9e95-f44be19e341c\",\"object\":{\"type\":\"data_object\",\"id\":\"a96b1e6a-177d-11ef-a5c4-06f27729b9a5\",\"attributes\":{\"attrs\":[\"https://example.com/attr/attr1/value/value1\"],\"dissem\":[],\"permissions\":[]}},\"action\":{\"type\":\"read\",\"result\":\"success\"},\"actor\":{\"id\":\"68f9d36d-e103-4518-8258-70fe7cc87c90\",\"attributes\":{\"attrs\":[],\"dissem\":[],\"permissions\":null}},\"eventMetaData\":{},\"clientInfo\":{\"userAgent\":\"\",\"platform\":\"kas\",\"requestIp\":\"\"},\"diff\":{},\"timestamp\":\"2024-05-21T11:03:18-04:00\"}",
  "namespace": "kas"
}

Parsed JSON string of audit log message:

{
  "id": "4e027444-3496-4a6d-9e95-f44be19e341c",
  "object": {
    "type": "data_object",
    "id": "a96b1e6a-177d-11ef-a5c4-06f27729b9a5",
    "attributes": {
      "attrs": [
        "https://example.com/attr/attr1/value/value1"
      ],
      "dissem": [],
      "permissions": []
    }
  },
  "action": {
    "type": "read",
    "result": "success"
  },
  "actor": {
    "id": "68f9d36d-e103-4518-8258-70fe7cc87c90",
    "attributes": {
      "attrs": [],
      "dissem": [],
      "permissions": null
    }
  },
  "eventMetaData": {},
  "clientInfo": {
    "userAgent": "",
    "platform": "kas",
    "requestIp": ""
  },
  "diff": {},
  "timestamp": "2024-05-21T11:03:18-04:00"
}

[jrschumacher]

Can we abstract this to define enumerated events and the service? I'm concerned that without predefined events it's going to be hard to document and if we don't automatically scope to a service then there could be naming conflicts with the events.

Like slog.Audit(audit.KeyRelease, …) rather than leaving room for typos slog.Audit(“blah”, slog.String(“event”, “key-relaese”)) or someone abusing audit rather than using a Info slog.Audit(“blah”, slog.String(“event”, “pre-key-release”))

[jrschumacher]

@strantalis informed me that there is already a plan in place that will address my concerns!