Add audit logging for connection approve/deny events #45
Description
Problem
The current implementation logs approval state changes at the debug level but does not produce a persistent audit trail of which connections were approved or denied, by whom, and when. For a security-sensitive access control feature this is valuable.
Proposed solution
- Emit structured log entries (via the existing
logger) when a connection is approved or denied - Include: timestamp, client IP, geolocation, user agent, challenge code, outcome (approved/denied), and client ID
- Consider writing to a separate audit log file (e.g.
--audit-log <path>) in addition to stdout
Example log line
[AUDIT] 2024-01-15T10:23:45Z approved clientId=abc123 ip=1.2.3.4 geo="New York, NY, US" ua="Mozilla/5.0 ..." code=X7K2