Summary

Add structured access logs on /api/webhooks with correlation ID support, following the same pattern used by all other API routes (/api/users, /api/auth, /api/markets, /api/feature-flags, etc.).

Changes

src/middleware/accessLog.ts

• Added webhooks_access_log log name mapping for requests starting with /api/webhooks

src/routes/webhooks.ts

• Imported and mounted accessLog middleware as the first middleware on the router
• Updated JSDoc to document the structured access log behavior
• All webhook endpoints now emit a structured webhooks_access_log entry on response finish
• The X-Correlation-Id response header is set on all webhook responses

tests/webhooksAccessLog.test.ts (new)

• 21 focused unit tests covering:
  • Log name emission (webhooks_access_log)
  • All HTTP methods (GET, POST, PATCH, DELETE)
  • Correlation ID resolution (header, fallback, UUID generation)
  • Status codes (200, 400, 404, 500)
  • Actor capture (authenticated + anonymous)
  • Response header echo
  • All required payload fields (method, path, statusCode, durationMs, ip, size, actor)
  • Sub-path handling under /api/webhooks
  • IP resolution (X-Forwarded-For + fallback)

Testing

• All 21 new tests pass: npx jest tests/webhooksAccessLog.test.ts
• ESLint passes with zero errors
• Follows the same patterns used in tests/usersAccessLog.test.ts and tests/featureFlagsAccessLog.test.ts

Related

Closes #429