fix(routes): generate request IDs at the start of the middleware chain

Echo's RequestID middleware reuses the X-Request-Id header from a proxy
or generates one, so logging and audit all see the same ID. RequestMeta
previously read the request header before any later middleware could
have set one, leaving the audit request_id mostly empty.

pkg/routes/middleware/request_meta.go

@@ -22,21 +22,18 @@ import (
 	"github.com/labstack/echo/v5"
 )
 
-// RequestMeta stashes IP, User-Agent and X-Request-ID on the request context
+// RequestMeta stashes IP, User-Agent and the request ID on the request
-// so events dispatched while handling the request carry them as message
+// context so events dispatched while handling the request carry them as
-// metadata (consumed by the audit listeners).
+// message metadata (consumed by the audit listeners). Must run after the
+// RequestID middleware, which guarantees the response header is populated.
 func RequestMeta() echo.MiddlewareFunc {
 	return func(next echo.HandlerFunc) echo.HandlerFunc {
 		return func(c *echo.Context) error {
 			req := c.Request()
-			requestID := req.Header.Get(echo.HeaderXRequestID)
-			if requestID == "" {
-				requestID = c.Response().Header().Get(echo.HeaderXRequestID)
-			}
 			ctx := events.WithRequestMeta(req.Context(), &events.RequestMeta{
 				IP:        c.RealIP(),
 				UserAgent: req.UserAgent(),
-				RequestID: requestID,
+				RequestID: c.Response().Header().Get(echo.HeaderXRequestID),
 			})
 			c.SetRequest(req.WithContext(ctx))
 			return next(c)

pkg/routes/routes.go

@@ -155,6 +155,11 @@ func NewEcho() *echo.Echo {
 
 	e.Logger = log.NewEchoLogger(config.LogEnabled.GetBool(), config.LogHTTP.GetString(), config.LogFormat.GetString())
 
+	// First middleware in the chain so every request has an ID — reuses the
+	// X-Request-Id header from a proxy or generates one — and everything
+	// downstream (logging, audit) sees the same value.
+	e.Use(middleware.RequestID())
+
 	// Logger
 	if config.LogEnabled.GetBool() && config.LogHTTP.GetString() != "off" {
 		httpLogger := log.NewHTTPLogger(config.LogEnabled.GetBool(), config.LogHTTP.GetString(), config.LogFormat.GetString())