Structured Logging & Audit Gate
CRITICAL RULE: When writing backend logic, controllers, or database layers, you MUST enforce the following logging and auditing principles:
- No Full Req/Res Payload Logging: NEVER log full HTTP request or response bodies for successful (200 OK) requests due to storage and PII/GDPR costs. Log only Metadata (Method, Path, StatusCode, Duration, UserID). Exception logs can contain payloads if necessary.
- Triad Logging Separation:
- Diagnostic/Exception Logs: Must be logged asynchronously. Do not write these to the main OLTP database tables fighting for IOPS.
- Security/Audit Logs: Must be immutable.
- User Activity Logs: Do NOT write hardcoded localized strings (e.g., "Sipariş güncellendi"). Save an
ActionType(e.g., "ORDER_UPDATED") andJSON Metadata. Let the frontend translate it.