Audit logging

[jclark118]

Added audit logging. We now log:

All events on the /api and /auth paths that are POST, PUT, PATCH, or DELETE are logged at info. Additionally:

• Any request on those paths that ends 401/403 is logged at warn
• GET and other reads are logged at debug

Individual logging for requests that need further information shown:

authentication

• user signed in
• failed login attempt (warn)

users

• user account created
• user account activated
• user account disabled / user account deleted
• user role changed
• user account locked after invalid login attempts (warn)
• user account disabled after exceeding maximum account lockouts (warn)

teams

• user added to team / user removed from team
• user added to event / user removed from event
• team member role updated

events

• team added to event / team removed from event

settings

• banner header visibility changed
• banner header text changed
• updated map settings / map settings update failed (warn)

devices

• device registered / device unregistered

permissions

• permission denied (warn) — every failed permission check flowing through withPermission

Log Levels

Routine admin actions at info, security-relevant events (failed logins, lockouts, permission denials, 401/403s) at warn. Output is controlled by MAGE_LOG_LEVEL, MONGOOSE_LOG_LEVEL, and MAGE_LOG_FORMAT=json for splunk friendly output

Mongo logs bumped from debug to info by default. New controls added for both mongoose and audit logs to use environment variables to change logging at runtime