api: a log line per HTTP request

Requests weren't logged at all, short of what a handler logs itself. Now a middleware,
outermost on the API (and on a relay-only node's), logs a line per request as web
servers do: method and path (with the query), status, the milliseconds until the answer
began (a stream goes on after), where it came from (the address, or `unix`), and the
user (`-` where none was authenticated). The user comes back on the response:
`basic_auth` puts it there, for a token as for a password or a trusted proxy's header.

At debug, under the target `http` (`RUST_LOG=info,http=debug`, or `PUT /admin/log`):
an open dashboard alone would fill the log at info. With the target off, the request
passes untouched.

1 files changed, 4 insertions, 0 deletions

diff --git a/src/api/mod.rs b/src/api/mod.rs
index 5c7c8e7..437f932 100644
--- a/src/api/mod.rs
+++ b/src/api/mod.rs
@@ -15,6 +15,7 @@ pub(crate) mod listen;
 mod log;
 mod login;
 mod peers;
+mod request_log;
 mod stats;
 mod store;
 mod users;
@@ -142,6 +143,8 @@ pub(crate) fn router(state: AppState, auth_state: AuthState, debug_api: bool) ->
     // Outermost, so authentication failures get the error body too.
     .layer(middleware::from_fn(json_errors))
     .layer(middleware::from_fn(relative_redirects))
+    // A line per request, as it is answered.
+    .layer(middleware::from_fn(request_log::log_requests))
     .with_state(state)
 }
 
@@ -166,6 +169,7 @@ pub(crate) fn relay_only_router(
         .route("/health", get(health::health))
         .layer(middleware::from_fn(json_errors))
         .layer(middleware::from_fn(relative_redirects))
+        .layer(middleware::from_fn(request_log::log_requests))
         .with_state(relay)
 }