feat: opt-in structured access-audit logging

[alexluft]

What

Adds an opt-in access-audit log: telemetry.audit.enabled (default: false — zero behavior change unless enabled). When on, every HTTP request emits one self-contained JSON line on stdout:

{"audit":"http-access","ts":"2026-08-17T17:16:55Z","user":"alex@example.com",
 "subject":"5939ae08-…","source":"10.249.9.1","method":"GET",
 "path":"/aets/GEPACS/studies/1.2.840…","aet":"GEPACS","study":"1.2.840…",
 "status":200,"duration_ms":4886}

Motivation: in clinical deployments, "who accessed which study, when" is a legal requirement. Log pipelines (Loki, ELK, …) can select these lines by the audit discriminator and ship them to WORM storage.

Design

• Identity comes from the reverse proxy. DICOM-RST performs no authentication itself (New Feature Request: Enhance Security by Providing Auth to endpoints #15, OpenID Connect Support #42), so the middleware reads X-Auth-Request-Email / X-Auth-Request-User — the headers oauth2-proxy (set_xauthrequest) and friends inject. Documented caveat: trustworthy only when the proxy is the sole ingress. Records are emitted even without identity — an anonymous access is itself audit-relevant.
• Fail-open, never on the request path. Records go through a bounded mpsc channel (1024) to a stdout writer task. Full buffer ⇒ drop + rate-limited warn! with a running drop counter. A slow collector can never block or fail request handling; deployments with stricter needs alert on the drop warnings.
• What is recorded: method, full path+query (QIDO match params are part of "which data"), the aet/study/series/instance path parameters via RawPathParams, first X-Forwarded-For hop, status, duration, user agent. Absent fields are omitted from the JSON.
• The layer sits outside the timeout layer so timed-out requests are audited with their 408.
• Timestamps via chrono (to_rfc3339_opts(SecondsFormat::Secs, true)), which was already a transitive dependency via dicom-core — now declared directly with default-features = false, features = ["clock"].

Also included

• movescu: log the Study Instance UID on successful C-MOVE completion, so DIMSE-side retrievals are attributable in the same log stream.
• with_ansi(is_terminal) on the fmt layer — container logs lose the escape codes, TTY output keeps colors.
• docs/topics/configuration.md gained a telemetry.audit.enabled section including the trust-boundary note.

Testing

cargo fmt --check, cargo clippy --all-targets (0 warnings), cargo test (19/19, incl. new unit tests for the RFC 3339 formatter and record serialization). Running in our prod/dev clusters behind oauth2-proxy; sample line above is real (redacted).

---

⚠️ Please do not merge yet — pending internal review (@nickamzol).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Q9PMSu4fFsV5dSNojTTQaG

[feliwir]

I think it would make sense to integrate OIDC authorization first. So we could track the subject from the JWT.

Reading the user & mail from some HTTP header fields is some special case when deployed behind a reverse proxy that is not really the default setup.

[MaxOremek]

We have in Bonn developed a RUST based LDAP Audit Microservices with JWT with Access Logging to a PostGres. Would you be interested in recycling this?

[alexluft]

I'd absolutely upvote a native oidc support 👍
Until then, using oauth2 proxy is the only way to get dicom-rst integrated into sso environments.
Running web services behind reverse proxies with- or without an authentication layer is pretty common and best practice. Passing sub and more information from the reverse proxy for audit log (which is required legally) is a low hanging fruit.