refactor: replace database logging with file logging and admin audit log

app/Http/Middleware/RequestLog.php

@@ -2,23 +2,59 @@
 
 namespace App\Http\Middleware;
 
+use App\Models\AdminAuditLog;
 use Closure;
 
 class RequestLog
 {
-    /**
-     * Handle an incoming request.
-     *
-     * @param \Illuminate\Http\Request $request
-     * @param \Closure $next
-     * @return mixed
-     */
+    private const SENSITIVE_KEYS = ['password', 'token', 'secret', 'key', 'api_key'];
+
     public function handle($request, Closure $next)
     {
-        if ($request->method() === 'POST') {
-            $path = $request->path();
-            info("POST {$path}");
-        };
-        return $next($request);
+        if ($request->method() !== 'POST') {
+            return $next($request);
+        }
+
+        $response = $next($request);
+
+        try {
+            $admin = $request->user();
+            if (!$admin || !$admin->is_admin) {
+                return $response;
+            }
+
+            $action = $this->resolveAction($request->path());
+            $data = collect($request->all())->except(self::SENSITIVE_KEYS)->toArray();
+
+            AdminAuditLog::insert([
+                'admin_id' => $admin->id,
+                'action' => $action,
+                'method' => $request->method(),
+                'uri' => $request->getRequestUri(),
+                'request_data' => json_encode($data, JSON_UNESCAPED_UNICODE),
+                'ip' => $request->getClientIp(),
+                'created_at' => time(),
+                'updated_at' => time(),
+            ]);
+        } catch (\Throwable $e) {
+            \Log::warning('Audit log write failed: ' . $e->getMessage());
+        }
+
+        return $response;
+    }
+
+    private function resolveAction(string $path): string
+    {
+        // api/v2/{secure_path}/user/update → user.update
+        $path = preg_replace('#^api/v[12]/[^/]+/#', '', $path);
+        // gift-card/create-template → gift_card.create_template
+        $path = str_replace('-', '_', $path);
+        // user/update → user.update, server/manage/sort → server_manage.sort
+        $segments = explode('/', $path);
+        $method = array_pop($segments);
+        $resource = implode('_', $segments);
+
+        return $resource . '.' . $method;
     }
 }
+