type Container struct {
    Config      *config.Config
    Logger      *logger.Logger
    DB          *mongo.Database
    MongoClient *mongo.Client
    EventBus    *events.EventBus
    UserService ports.UserService // ← New! For cross-module user lookups
}

func AuditContextMiddleware(userService ports.UserService) echo.MiddlewareFunc {
    return func(next echo.HandlerFunc) echo.HandlerFunc {
        return func(c echo.Context) error {
            // ... existing code ...

            // Fetch user name from user service
            if userIDStr, ok := userID.(string); ok && userIDStr != "" {
                userName := c.Get("user_name")
                if userName == nil || userName == "" || userName == userIDStr {
                    // Fetch from user service with 500ms timeout
                    userCtx, cancel := context.WithTimeout(ctx, 500*time.Millisecond)
                    defer cancel()

                    user, err := userService.Get(userCtx, userIDStr)
                    if err == nil && user != nil && user.Name != "" {
                        userName = user.Name  // ✅ Real user name!
                        c.Set("user_name", user.Name)
                    } else {
                        userName = userIDStr  // Fallback to user ID
                    }
                }
                ctx = context.WithValue(ctx, "user_name", userName)
            }
        }
    }
}

// 4. Initialize Modules
userModule := user.NewModule(container)
defer userModule.Shutdown()

// Set user service in container for cross-module access
container.UserService = userModule.Service  // ← New!

leaveModule := leave.NewModule(container)
defer leaveModule.Shutdown()

type Module struct {
    // ... existing fields ...
    container *app.Container  // ← New! For accessing cross-module dependencies
}

func (m *Module) RegisterRoutes(e *echo.Echo, cfg *config.Config) {
    protected := api.Group("")
    protected.Use(customMiddleware.AuthMiddleware(cfg))

    // Add audit context middleware after auth
    if m.container.UserService != nil {
        protected.Use(customMiddleware.AuditContextMiddleware(m.container.UserService))
    }

    // ... register routes ...
}

1. Request arrives
   ↓
2. AuthMiddleware
   - Validates Better Auth JWT
   - Sets user_id in context
   - Sets user_name = user_id (fallback)
   ↓
3. AuditContextMiddleware
   - Checks if user_name == user_id (fallback value)
   - If yes, calls userService.Get(userID)
   - Updates user_name with real name from database
   - Adds to request context
   ↓
4. Handler processes request
   ↓
5. AuditedApprovalService
   - Calls getApproverRole(), getIPFromContext(), etc.
   - Gets REAL user name from context
   - Creates audit log with actual user name

{
  "user_id": "user_2abc123",
  "user_name": "user_2abc123", // ❌ Just the ID
  "action": "APPROVE"
}

{
  "user_id": "user_2abc123",
  "user_name": "John Doe", // ✅ Real name from database!
  "action": "APPROVE"
}

// Option 1: Add Redis cache
func (m *AuditContextMiddleware) getUserName(userID string) string {
    // Check Redis cache first
    if name := redis.Get("user:name:" + userID); name != "" {
        return name
    }

    // Fetch from database
    user, _ := userService.Get(ctx, userID)
    if user != nil {
        redis.Set("user:name:" + userID, user.Name, 1*time.Hour)
        return user.Name
    }

    return userID
}

// Option 2: Store user name in Better Auth JWT metadata
// Then extract in AuthMiddleware (no database call needed)

# 1. Create a user with a name
POST /api/v1/users
{
  "auth_id": "user_2abc123",
  "email": "john@example.com",
  "name": "John Doe",
  "organization_id": "org_123"
}

# 2. Approve a leave request
POST /api/v1/leave/approvals/req_123/approve
Authorization: Bearer <auth_jwt_for_user_2abc123>
{
  "comment": "Approved"
}

# 3. Check audit log
GET /api/v1/leave/audit?entity_id=req_123

# Expected result:
{
  "logs": [{
    "user_id": "user_2abc123",
    "user_name": "John Doe",  // ✅ Real name!
    "action": "APPROVE",
    ...
  }]
}