// Audit logging pattern - January 25, 2025
// Emerged from compliance requirements

class AuditedMCPServer extends OAuthProtectedMCPServer {
  constructor(config) {
    super(config);
    
    // Structured audit logging
    this.auditLogger = new AuditLogger({
      // Immutable append-only log
      storage: new ImmutableLogStorage({
        path: '/var/log/mcp-audit',
        encryption: 'aes-256-gcm',
        rotation: '1d',
        retention: '90d'
      }),
      
      // What to log
      events: {
        authentication: ['success', 'failure', 'token_refresh'],
        authorization: ['granted', 'denied', 'elevated'],
        tools: ['called', 'completed', 'failed'],
        resources: ['accessed', 'modified'],
        data: ['exported', 'imported'],
        admin: ['config_changed', 'user_modified']
      },
      
      // Compliance formats
      formats: {
        soc2: true,
        hipaa: true,
        gdpr: true
      }
    });
  }
  
  async handleToolCall(name, args, context) {
    const startTime = Date.now();
    const traceId = this.generateTraceId();
    
    try {
      // Pre-execution audit
      await this.auditLogger.log({
        event: 'tool.called',
        traceId,
        tool: name,
        user: context.userId,
        organization: context.organization,
        args: this.sanitizeArgs(args),
        permissions: context.permissions,
        timestamp: new Date()
      });
      
      // Execute
      const result = await super.handleToolCall(name, args, context);
      
      // Post-execution audit
      await this.auditLogger.log({
        event: 'tool.completed',
        traceId,
        tool: name,
        duration: Date.now() - startTime,
        resultSize: JSON.stringify(result).length,
        success: true
      });
      
      return result;
      
    } catch (error) {
      // Audit failures
      await this.auditLogger.log({
        event: 'tool.failed',
        traceId,
        tool: name,
        error: {
          type: error.constructor.name,
          message: error.message,
          code: error.code
        },
        duration: Date.now() - startTime
      });
      
      throw error;
    }
  }
  
  // Query audit logs
  async queryAuditLog(params) {
    // Only authorized users can query
    if (!params.context.hasRole('auditor')) {
      throw new AuthError('Insufficient privileges to query audit log');
    }
    
    return this.auditLogger.query({
      startTime: params.startTime,
      endTime: params.endTime,
      userId: params.userId,
      event: params.event,
      format: params.format || 'json'
    });
  }
}

// Real audit log entry example
{
  "timestamp": "2025-01-25T10:23:45.123Z",
  "traceId": "550e8400-e29b-41d4-a716-446655440000",
  "event": "tool.called",
  "tool": "update_customer_record",
  "user": "alice@company.com",
  "organization": "comp-123",
  "args": {
    "customerId": "cust-456",
    "fields": ["email", "phone"]
  },
  "permissions": ["customer:write", "pii:access"],
  "ip": "10.0.0.42",
  "sessionId": "sess-789",
  "mcp_server": "enterprise-mcp",
  "mcp_version": "1.2.0"
}