fix(audit): address PR review on audio body logging

Validated automated review findings (greptile, CodeRabbit) and applied the
valid ones:

- Drop /v1/audio/translations from the endpoint classifier, tests, and docs:
  the route is not registered or implemented, so classifying it was misleading
  (greptile P1). Rejected the conflicting suggestion to document it.
- Move the response-writer truncation flag inside the non-audio branch so an
  oversized audio response is not marked ResponseBodyTooBigToHandle while its
  body is fully captured by the audio handler (CodeRabbit). Add a regression test.
- Dashboard CSS: use the defined --text-muted variable instead of the undefined
  --muted (CodeRabbit).
- Clarify the audioBodyMaxBytes comment: the cap is on raw bytes; base64 is ~4/3
  larger, which matters on document stores with a hard per-record limit such as
  MongoDB's 16 MB (greptile P2).
- Set LogAudioBodies explicitly in DefaultConfig; correct the documented
  placeholder shape to {__audio__, content_type, bytes, stored: false}; note the
  10 MB cap in the CLAUDE.md reference (CodeRabbit).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: SantiagoDePolonia

CLAUDE.md

@@ -116,7 +116,7 @@ Full reference: `.env.template` and `config/config.yaml`
   - `ENABLED_PASSTHROUGH_PROVIDERS` (openai,anthropic,openrouter,zai,vllm: Comma-separated list of enabled passthrough providers)
 - **Storage:** `STORAGE_TYPE` (sqlite), `SQLITE_PATH` (data/gomodel.db), `POSTGRES_URL`, `MONGODB_URL`
 - **Models:** `MODELS_ENABLED_BY_DEFAULT` (true), `MODEL_OVERRIDES_ENABLED` (true), `KEEP_ONLY_ALIASES_AT_MODELS_ENDPOINT` (false), `CONFIGURED_PROVIDER_MODELS_MODE` (`fallback` or `allowlist`, default `fallback`; `allowlist` skips upstream `/models` for providers with configured lists); persisted overrides restrict/allow selectors with `user_paths`. When alias-only models listing is enabled, `GET /v1/models` returns only model aliases, not full concrete model specs, to operators.
-- **Audit logging:** `LOGGING_ENABLED` (false), `LOGGING_LOG_BODIES` (false), `LOGGING_LOG_AUDIO_BODIES` (false: refines `LOGGING_LOG_BODIES` for audio endpoints — base64 audio for `/v1/audio/speech` + dashboard playback, upload metadata for transcriptions; no effect unless `LOGGING_LOG_BODIES` is on, in which case audio-off records a placeholder), `LOGGING_LOG_HEADERS` (false), `LOGGING_RETENTION_DAYS` (30)
+- **Audit logging:** `LOGGING_ENABLED` (false), `LOGGING_LOG_BODIES` (false), `LOGGING_LOG_AUDIO_BODIES` (false: refines `LOGGING_LOG_BODIES` for audio endpoints — base64 audio for `/v1/audio/speech` (≤10 MB, else `too_large`) + dashboard playback, upload metadata for transcriptions; no effect unless `LOGGING_LOG_BODIES` is on, in which case audio-off records a placeholder), `LOGGING_LOG_HEADERS` (false), `LOGGING_RETENTION_DAYS` (30)
 - **Usage tracking:** `USAGE_ENABLED` (true), `ENFORCE_RETURNING_USAGE_DATA` (true), `USAGE_RETENTION_DAYS` (90)
 - **Dashboard live logs:**
   - `DASHBOARD_LIVE_LOGS_ENABLED` (true): keep enabled for low-latency dashboard previews; set false only when live streams are not needed or memory/socket usage must be minimized.

docs/advanced/audio-api.mdx

@@ -94,7 +94,7 @@ unless body logging is enabled:
 - **Body logging off** (`LOGGING_LOG_BODIES=false`) — no audio body is stored,
   regardless of this setting.
 - **Body logging on, audio off** (the default) — the audio response is recorded
-  as a lightweight `{content_type, bytes}` placeholder; no audio bytes are stored.
+  as a lightweight `{__audio__, content_type, bytes, stored: false}` placeholder; no audio bytes are stored.
 - **Body logging on, audio on** — `/v1/audio/speech` stores its text input and the
   generated audio (base64, capped at 10 MB) so the **dashboard renders an inline
   player**, and `/v1/audio/transcriptions` stores upload metadata (filename, model,

docs/advanced/configuration.mdx

@@ -112,7 +112,7 @@ Storage is shared by audit logging, usage tracking, and future features like IAM
   dashboard can play it back, and `/v1/audio/transcriptions` stores upload metadata
   (never the raw audio bytes). It defaults to `false` because audio payloads are
   large and grow the audit store quickly. When body logging is on but this is off,
-  audio responses are recorded as a lightweight `{content_type, bytes}` placeholder;
+  audio responses are recorded as a lightweight `{__audio__, content_type, bytes, stored: false}` placeholder;
   when body logging is off, no audio body is stored at all.
 </Note>
 

internal/admin/dashboard/static/css/dashboard.css

@@ -2895,7 +2895,7 @@ textarea:focus {
 
 .audit-audio-meta {
   font-size: 12px;
-  color: var(--muted, #888);
+  color: var(--text-muted, #888);
 }
 
 .audit-audio-empty {
@@ -2910,7 +2910,7 @@ textarea:focus {
 
 .audit-audio-note {
   font-size: 12px;
-  color: var(--muted, #888);
+  color: var(--text-muted, #888);
 }
 
 .conversation-body-highlight {

internal/auditlog/audio_body.go

@@ -5,9 +5,12 @@ import (
 	"strings"
 )
 
-// audioBodyMaxBytes caps how much audio is embedded as base64 in an audit log
-// entry. Larger payloads are recorded as metadata-only placeholders so the
-// audit store does not balloon on long generations.
+// audioBodyMaxBytes caps how much *raw* audio is embedded as base64 in an audit
+// log entry; larger payloads are recorded as metadata-only placeholders so the
+// audit store does not balloon on long generations. Note the stored base64 is
+// ~4/3 of this (≈13.3 MB at the cap). On document stores with a hard per-record
+// ceiling (e.g. MongoDB's 16 MB BSON limit) a near-cap clip plus other entry
+// fields can approach that ceiling; lower this if you log audio to such a store.
 const audioBodyMaxBytes = 10 * 1024 * 1024
 
 // AudioBodyLog is the audit representation of an audio request/response body.

internal/auditlog/auditlog.go

@@ -261,6 +261,7 @@ func DefaultConfig() Config {
 	return Config{
 		Enabled:               false,
 		LogBodies:             false,
+		LogAudioBodies:        false,
 		LogHeaders:            false,
 		BufferSize:            1000,
 		FlushInterval:         5 * time.Second,

internal/auditlog/auditlog_test.go

@@ -535,6 +535,47 @@ func TestMiddleware_SkipsStreamingResponseWriterCapture(t *testing.T) {
 	}
 }
 
+// TestMiddleware_AudioResponseNotMarkedTruncated verifies that an oversized audio
+// response — which trips the response writer's truncation flag — does NOT set
+// ResponseBodyTooBigToHandle on the audit entry. The audio handler captures the
+// body losslessly via its own path, so a truncation flag here would produce
+// conflicting metadata (a fully-stored body alongside a "too big" marker).
+func TestMiddleware_AudioResponseNotMarkedTruncated(t *testing.T) {
+	e := echo.New()
+	logger := &capturingLogger{cfg: Config{Enabled: true, LogBodies: true}}
+
+	req := httptest.NewRequest(http.MethodPost, "/v1/audio/speech", strings.NewReader(`{"model":"gpt-4o-mini-tts","input":"hi","voice":"alloy"}`))
+	rec := httptest.NewRecorder()
+	c := e.NewContext(req, rec)
+
+	oversized := bytes.Repeat([]byte{0xff}, int(MaxBodyCapture)+16)
+	var capture *responseBodyCapture
+	handler := Middleware(logger)(func(c *echo.Context) error {
+		capture, _ = c.Response().(*responseBodyCapture)
+		c.Response().Header().Set("Content-Type", "audio/mpeg")
+		c.Response().WriteHeader(http.StatusOK)
+		_, err := c.Response().Write(oversized)
+		return err
+	})
+
+	if err := handler(c); err != nil {
+		t.Fatalf("handler returned error: %v", err)
+	}
+	if capture == nil || !capture.truncated {
+		t.Fatal("expected the response writer to mark the oversized body as truncated")
+	}
+	if len(logger.entries) != 1 {
+		t.Fatalf("len(entries) = %d, want 1", len(logger.entries))
+	}
+	entry := logger.entries[0]
+	if entry.Data != nil && entry.Data.ResponseBodyTooBigToHandle {
+		t.Error("audio response must not set ResponseBodyTooBigToHandle; the handler owns audio body capture")
+	}
+	if entry.Data != nil && entry.Data.ResponseBody != nil {
+		t.Errorf("middleware must not store the audio response body, got %T", entry.Data.ResponseBody)
+	}
+}
+
 func TestMiddleware_PrefersWorkflowOverLegacyResolution(t *testing.T) {
 	e := echo.New()
 	logger := &capturingLogger{
@@ -920,7 +961,6 @@ func TestIsModelInteractionPath(t *testing.T) {
 		{"batches prefix overmatch", "/v1/batcheship", false},
 		{"audio speech", "/v1/audio/speech", true},
 		{"audio transcriptions", "/v1/audio/transcriptions", true},
-		{"audio translations", "/v1/audio/translations", true},
 		{"models", "/v1/models", false},
 		{"models with subpath", "/v1/models/gpt-4", false},
 		{"health", "/health", false},

internal/auditlog/middleware.go

@@ -135,18 +135,20 @@ func Middleware(logger LoggerInterface) echo.MiddlewareFunc {
 
 			// Capture response body if enabled
 			if cfg.LogBodies && responseCapture != nil && shouldCaptureResponseBody(c) && responseCapture.body.Len() > 0 {
-				// Set truncation flag if response body exceeded limit
-				if responseCapture.truncated {
-					entry.Data.ResponseBodyTooBigToHandle = true
-				}
-
 				bodyBytes := responseCapture.body.Bytes()
 
 				// Audio responses are binary; the audio handler captures them
 				// losslessly as base64 (gated by LogAudioBodies) before this
 				// runs. Skip here so we neither corrupt the bytes via UTF-8
-				// coercion nor clobber the handler-set body.
+				// coercion nor clobber the handler-set body — and do not apply
+				// the writer's truncation flag, which would conflict with the
+				// fully-stored audio body (the handler tracks its own size cap).
 				if !IsAudioContentType(c.Response().Header().Get("Content-Type")) {
+					// Set truncation flag if response body exceeded limit
+					if responseCapture.truncated {
+						entry.Data.ResponseBodyTooBigToHandle = true
+					}
+
 					// Decompress if Content-Encoding header is present
 					if contentEncoding := c.Response().Header().Get("Content-Encoding"); contentEncoding != "" {
 						if decompressed, ok := decompressBody(bodyBytes, contentEncoding); ok {

internal/core/endpoints.go

@@ -124,7 +124,7 @@ func describeEndpointPath(path string) EndpointDescriptor {
 			Dialect:          "openai_compat",
 			Operation:        OperationAudioSpeech,
 		}
-	case path == "/v1/audio/transcriptions" || path == "/v1/audio/translations":
+	case path == "/v1/audio/transcriptions":
 		return EndpointDescriptor{
 			ModelInteraction: true,
 			Dialect:          "openai_compat",

internal/core/endpoints_test.go

@@ -25,7 +25,6 @@ func TestDescribeEndpointPath(t *testing.T) {
 		{path: "/v1/files/file_1", managed: true, dialect: "openai_compat", operation: OperationFiles, bodyMode: BodyModeNone, interaction: true},
 		{path: "/v1/audio/speech", managed: false, dialect: "openai_compat", operation: OperationAudioSpeech, bodyMode: BodyModeJSON, interaction: true},
 		{path: "/v1/audio/transcriptions", managed: false, dialect: "openai_compat", operation: OperationAudioTranscriptions, bodyMode: BodyModeMultipart, interaction: true},
-		{path: "/v1/audio/translations", managed: false, dialect: "openai_compat", operation: OperationAudioTranscriptions, bodyMode: BodyModeMultipart, interaction: true},
 		{path: "/p/openai/responses", managed: true, dialect: "provider_passthrough", operation: OperationProviderPassthrough, bodyMode: BodyModeOpaque, interaction: true},
 		{path: "/v1/models", managed: false, dialect: "", operation: "", bodyMode: BodyModeNone, interaction: false},
 	}
@@ -77,7 +76,6 @@ func TestDescribeEndpoint_UsesMethodForBodyMode(t *testing.T) {
 		{method: http.MethodGet, path: "/v1/files/file_1", bodyMode: BodyModeNone},
 		{method: http.MethodPost, path: "/v1/audio/speech", bodyMode: BodyModeJSON},
 		{method: http.MethodPost, path: "/v1/audio/transcriptions", bodyMode: BodyModeMultipart},
-		{method: http.MethodPost, path: "/v1/audio/translations", bodyMode: BodyModeMultipart},
 		{method: http.MethodPost, path: "/v1/batches/batch_1/cancel", bodyMode: BodyModeNone},
 	}