@heavybit/pendoadmin-shared-lib 1.1.6 → 1.1.7

package/src/logging/index.ts

@@ -1,31 +1,143 @@
 import winston from 'winston';
+import DailyRotateFile from 'winston-daily-rotate-file';
+import { mkdirSync } from 'fs';
+import { resolve } from 'path';
 
-const { combine, timestamp, json, errors, colorize, simple } = winston.format;
+const { combine, timestamp, json, errors, colorize, printf, splat } = winston.format;
+
+/**
+ * Custom dev console format that renders meta cleanly and warns when callers
+ * pass a Promise as the message (a common forgotten-await bug).
+ *
+ *   info: SMS sent { batchId: 'xyz', recipients: 1 }
+ *   error: DB failed Error: connection refused
+ *       at ...stack...
+ */
+const devConsoleFormat = printf((info) => {
+  const { level, message, timestamp: ts, service, stack, ...rest } = info as Record<string, unknown> & {
+    level: string;
+    message: unknown;
+    timestamp?: string;
+    service?: string;
+    stack?: string;
+  };
+
+  // Detect forgotten-await: someone passed a Promise as the message.
+  let renderedMessage: string;
+  if (message && typeof (message as { then?: unknown }).then === 'function') {
+    renderedMessage = '[Promise — forgot to await?]';
+  } else if (message instanceof Error) {
+    renderedMessage = message.message;
+  } else if (typeof message === 'object' && message !== null) {
+    renderedMessage = JSON.stringify(message);
+  } else {
+    renderedMessage = String(message ?? '');
+  }
+
+  // Strip winston-internal symbols/keys before serialising meta
+  const meta: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(rest)) {
+    if (k === 'splat' || k.startsWith('Symbol(')) continue;
+    meta[k] = v;
+  }
+
+  const metaStr = Object.keys(meta).length > 0 ? ` ${JSON.stringify(meta)}` : '';
+  const tag = service ? `[${service}] ` : '';
+  const stackStr = stack ? `\n${stack}` : '';
+  return `${ts ?? ''} ${level}: ${tag}${renderedMessage}${metaStr}${stackStr}`;
+});
+
+/**
+ * LOG_TARGET controls where logs are shipped:
+ *   console  — stdout only (default for dev)
+ *   file     — rotating files only
+ *   both     — stdout + rotating files (default for staging/production)
+ *
+ * LOG_DIR         — directory for log files (default: /app/logs)
+ * LOG_MAX_SIZE    — max size per log file before rotation (default: 20m)
+ * LOG_MAX_FILES   — retention period or count, e.g. 14d or 30 (default: 14d)
+ */
+function resolveLogTarget(): 'console' | 'file' | 'both' {
+  const raw = (process.env.LOG_TARGET || 'console').toLowerCase().trim();
+  if (raw === 'file' || raw === 'both') return raw;
+  return 'console';
+}
+
+function buildFileTransports(service: string, level: string): DailyRotateFile[] {
+  const logDir = resolve(process.env.LOG_DIR || '/app/logs');
+  const maxSize = process.env.LOG_MAX_SIZE || '20m';
+  const maxFiles = process.env.LOG_MAX_FILES || '14d';
+
+  try {
+    mkdirSync(logDir, { recursive: true });
+  } catch {
+    // Ignore — directory may already exist or be read-only
+  }
+
+  const shared = {
+    dirname: logDir,
+    datePattern: 'YYYY-MM-DD',
+    zippedArchive: true,
+    maxSize,
+    maxFiles,
+    format: combine(errors({ stack: true }), splat(), timestamp(), json()),
+  };
+
+  return [
+    new DailyRotateFile({
+      ...shared,
+      filename: `${service}-%DATE%-combined.log`,
+      level,
+    }),
+    new DailyRotateFile({
+      ...shared,
+      filename: `${service}-%DATE%-error.log`,
+      level: 'error',
+    }),
+  ];
+}
 
 export function createLogger(service: string, level?: string): winston.Logger {
   const isProduction = process.env.NODE_ENV === 'production';
+  const resolvedLevel = level || process.env.LOG_LEVEL || (isProduction ? 'info' : 'debug');
+  const target = resolveLogTarget();
 
-  return winston.createLogger({
-    level: level || process.env.LOG_LEVEL || (isProduction ? 'info' : 'debug'),
-    defaultMeta: { service },
+  const consoleTransport = new winston.transports.Console({
     format: combine(
       errors({ stack: true }),
+      splat(),
       timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
-      isProduction ? json() : combine(colorize(), simple())
+      isProduction ? json() : combine(colorize({ level: true }), devConsoleFormat),
     ),
-    transports: [
-      new winston.transports.Console(),
-    ],
+  });
+
+  const transports: winston.transport[] = [];
+  if (target === 'console' || target === 'both') transports.push(consoleTransport);
+  if (target === 'file' || target === 'both') transports.push(...buildFileTransports(service, resolvedLevel));
+
+  return winston.createLogger({
+    level: resolvedLevel,
+    defaultMeta: { service },
+    format: combine(errors({ stack: true }), splat(), timestamp()),
+    transports,
   });
 }
 
 export function createAuditLogger(service: string): winston.Logger {
+  const target = resolveLogTarget();
+
+  const consoleTransport = new winston.transports.Console({
+    format: combine(splat(), timestamp(), json()),
+  });
+
+  const transports: winston.transport[] = [];
+  if (target === 'console' || target === 'both') transports.push(consoleTransport);
+  if (target === 'file' || target === 'both') transports.push(...buildFileTransports(`${service}-audit`, 'info'));
+
   return winston.createLogger({
     level: 'info',
     defaultMeta: { service, type: 'audit' },
-    format: combine(timestamp(), json()),
-    transports: [
-      new winston.transports.Console(),
-    ],
+    format: combine(splat(), timestamp(), json()),
+    transports,
   });
 }

package/src/types/index.ts

@@ -53,6 +53,8 @@ export interface IJwtPayload {
   roles: string[];
   permissions: string[];
   isSuperAdmin: boolean;
+  /** Whether the user has completed post-login OTP verification for this session. */
+  otpVerified?: boolean;
   iat?: number;
   exp?: number;
   iss?: string;