fear(client): extract client's IP and store in database and structured logs

backend/internal/httpapi/handler.go

@@ -60,6 +60,7 @@ func NewHandler(
 func (h *Handler) Convert(w http.ResponseWriter, r *http.Request) {
 	startedAt := h.now()
 	requestID := h.newRequestID()
+	clientIP := extractClientIP(r)
 
 	w.Header().Set("X-Request-ID", requestID)
 	w.Header().Set("X-Content-Type-Options", "nosniff")
@@ -89,6 +90,7 @@ func (h *Handler) Convert(w http.ResponseWriter, r *http.Request) {
 		RequestID:  requestID,
 		CreatedAt:  startedAt,
 		Duration:   duration,
+		ClientIP:   clientIP,
 		Status:     outcome.auditStatus,
 		MaskedCard: card.Mask(cardNumber),
 		ResponseJSON: audit.SanitizeResponse(
@@ -102,11 +104,17 @@ func (h *Handler) Convert(w http.ResponseWriter, r *http.Request) {
 		record.UpstreamHTTPStatus = &upstreamStatus
 	}
 
+	var clientIPValue string
+	if clientIP != nil {
+		clientIPValue = *clientIP
+	}
+
 	if err := h.audits.Save(r.Context(), record); err != nil {
 		h.logger.ErrorContext(
 			r.Context(),
 			"request audit failed",
 			"request_id", requestID,
+			"client_ip", clientIPValue,
 			"route", "/api/v1/card-to-iban",
 			"http_status", http.StatusInternalServerError,
 			"audit_status", audit.StatusInternalError,
@@ -128,6 +136,7 @@ func (h *Handler) Convert(w http.ResponseWriter, r *http.Request) {
 		r.Context(),
 		"request completed",
 		"request_id", requestID,
+		"client_ip", clientIPValue,
 		"route", "/api/v1/card-to-iban",
 		"http_status", outcome.httpStatus,
 		"audit_status", outcome.auditStatus,