From fa590585ca3f13e56146db46a77d231d10b14807 Mon Sep 17 00:00:00 2001
From: Vishnuvardhan Reddy <vvr3ddy@proton.me>
Date: Sun, 1 Mar 2026 15:28:26 +0000
Subject: [PATCH] feat(audit): Phase 5 - Integrate audit logging with channels

Add audit logging to channel operations:

- Log rejected messages (allowlist filtering) in base.go
- Log send failures in manager.go
- Include message ID and channel context for tracing

This provides visibility into:
- Security events (rejected messages)
- Delivery failures
- Channel-specific issues
---
 pkg/channels/base.go    | 5 +++++
 pkg/channels/manager.go | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/pkg/channels/base.go b/pkg/channels/base.go
index 063a66523..4d12772d2 100644
--- a/pkg/channels/base.go
+++ b/pkg/channels/base.go
@@ -10,6 +10,7 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/sipeed/picoclaw/pkg/audit"
 	"github.com/sipeed/picoclaw/pkg/bus"
 	"github.com/sipeed/picoclaw/pkg/config"
 	"github.com/sipeed/picoclaw/pkg/identity"
@@ -240,10 +241,14 @@ func (c *BaseChannel) HandleMessage(
 	}
 	if sender.CanonicalID != "" || sender.PlatformID != "" {
 		if !c.IsAllowedSender(sender) {
+			// Audit log rejected message
+			audit.LogMessage(ctx, "inbound_rejected", "text", content, messageID)
 			return
 		}
 	} else {
 		if !c.IsAllowed(senderID) {
+			// Audit log rejected message
+			audit.LogMessage(ctx, "inbound_rejected", "text", content, messageID)
 			return
 		}
 	}
diff --git a/pkg/channels/manager.go b/pkg/channels/manager.go
index 155e50b39..ebec4f7d3 100644
--- a/pkg/channels/manager.go
+++ b/pkg/channels/manager.go
@@ -17,6 +17,7 @@ import (
 
 	"golang.org/x/time/rate"
 
+	"github.com/sipeed/picoclaw/pkg/audit"
 	"github.com/sipeed/picoclaw/pkg/bus"
 	"github.com/sipeed/picoclaw/pkg/config"
 	"github.com/sipeed/picoclaw/pkg/constants"
@@ -537,6 +538,9 @@ func (m *Manager) sendWithRetry(ctx context.Context, name string, w *channelWork
 		"error":   lastErr.Error(),
 		"retries": maxRetries,
 	})
+	
+	// Audit log the send failure
+	audit.LogError(ctx, "send_failed", fmt.Sprintf("channel=%s chat_id=%s: %v", name, msg.ChatID, lastErr), false)
 }
 
 func (m *Manager) dispatchOutbound(ctx context.Context) {