@owlmeans/server-api 0.1.18-rc.52 → 0.1.18-rc.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/server-api",
-  "version": "0.1.18-rc.52",
+  "version": "0.1.18-rc.53",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -33,15 +33,15 @@
     "@fastify/helmet": "^13.1.1",
     "@fastify/middie": "^9.3.4",
     "@fastify/multipart": "^10.1.2",
-    "@owlmeans/api": "^0.1.18-rc.48",
-    "@owlmeans/auth": "^0.1.18-rc.40",
-    "@owlmeans/auth-common": "^0.1.18-rc.48",
+    "@owlmeans/api": "^0.1.18-rc.49",
+    "@owlmeans/auth": "^0.1.18-rc.41",
+    "@owlmeans/auth-common": "^0.1.18-rc.49",
     "@owlmeans/context": "^0.1.18-rc.34",
     "@owlmeans/entrypoint": "^0.1.18-rc.41",
     "@owlmeans/error": "^0.1.18-rc.38",
-    "@owlmeans/log": "^0.1.18-rc.2",
+    "@owlmeans/log": "^0.1.18-rc.3",
     "@owlmeans/route": "^0.1.18-rc.35",
-    "@owlmeans/server-context": "^0.1.18-rc.43",
+    "@owlmeans/server-context": "^0.1.18-rc.44",
     "@owlmeans/server-entrypoint": "^0.1.18-rc.40",
     "ajv-errors": "^3.0.0",
     "fastify": "^5.12.5",

package/src/server.ts

@@ -10,7 +10,7 @@ import { TOKEN_UPDATE } from '@owlmeans/auth-common'
 import { INCIDENT_ID_HEADER } from './utils/consts.js'
 import { DENIAL_KIND_HEADER } from '@owlmeans/api'
 import { logger } from '@owlmeans/log'
-import { fastifyLogger } from './utils/log.js'
+import { fastifyLogUtils } from './utils/log.js'
 
 import Fastify from 'fastify'
 import type { FastifyRequest } from 'fastify'
@@ -41,12 +41,16 @@ ajvErrors(ajv, { singleError: true })
 const http = logger('http')
 
 /**
- * Fastify logging through `@owlmeans/log`. Fastify's own request/response lines are dropped by the
- * adapter: a request is a debug record written once from `onResponse` (below), and a failed one is
- * classified by `handleError`, so an info-level process is not flooded with every call it serves.
+ * Fastify logging through `@owlmeans/log`, never with what a caller sent. The adapter writes every
+ * record's data through `safeData` (no body, raw body, multipart bytes, headers, cookies or query);
+ * the log controller drops Fastify's per-request pair — a request is a debug record written once
+ * from `onResponse` (below) — and logs a request Fastify itself refuses (a schema-invalid body, an
+ * unparsable payload, a size limit) like `handleError` logs a failed handler: method, path, status,
+ * error code and message.
  */
 const createFastify = () => Fastify({
-  loggerInstance: fastifyLogger(http),
+  loggerInstance: fastifyLogUtils.logger(http),
+  logController: fastifyLogUtils.controller(),
   bodyLimit,
 })
 
@@ -88,8 +92,7 @@ export const createApiServer = (alias: string): ApiServer => {
       if (http.enabled('debug')) {
         // The path only: a query string can carry a token.
         http.debug('request', {
-          method: request.method, path: request.url.split('?')[0], status: reply.statusCode,
-          ms: Math.round(reply.elapsedTime),
+          ...fastifyLogUtils.requestOf(request), status: reply.statusCode, ms: Math.round(reply.elapsedTime),
         })
       }
       done()

package/src/utils/error.ts

@@ -6,7 +6,7 @@ import { AccessError, AuthFailedError } from '../errors.js'
 import { AuthForbidden, AuthorizationError } from '@owlmeans/auth'
 import { isResilientError, ResilientError, SEPARATOR } from '@owlmeans/error'
 import { randomUUID } from 'node:crypto'
-import { logger } from '@owlmeans/log'
+import { fastifyLogUtils } from './log.js'
 import type { Config, HttpErrorExposure } from '../types.js'
 import { CLIENT_ERROR_FIRST, CLIENT_ERROR_LAST, SERVER_ERROR_FIRST, SERVER_ERROR_LAST } from './consts.local.js'
 import { INCIDENT_ID_HEADER } from './consts.js'
@@ -139,42 +139,14 @@ export const createHttpErrorHelper = (): HttpErrorHelper => {
     }
   }
 
-  const http = logger('http')
-
-  /**
-   * The one log entry of a failed request, by what the failure means:
-   *
-   * | Status | Level | Why |
-   * |---|---|---|
-   * | 5xx | error | a fault — the one entry that owns type, message and stack, keyed by the incident id |
-   * | 403 | warn, `access.forbidden` | an established identity was refused; worth an operator's eye |
-   * | 401 | debug, `auth.refused` | an absent or expired credential is the ordinary shape of a sign-in |
-   * | other 4xx | debug | the caller's mistake, not the server's |
-   *
-   * The method and path are logged; the query string is not — it can carry a token.
-   */
-  const logFailure = (error: Error, reply: FastifyReply, status: number, incidentId: string): void => {
-    const request = reply.request
-    const where = { method: request?.method, path: request?.url?.split('?')[0], status, incidentId }
-    if (status >= SERVER_ERROR) {
-      http.error('Request failed', { err: error, ...where })
-    } else if (status === FORBIDDEN_ERROR) {
-      http.warn('Access forbidden', { type: (error as { type?: unknown }).type, message: error.message, ...where },
-        { event: 'access.forbidden' })
-    } else if (status === UNAUTHORIZED_ERROR) {
-      http.debug('Authentication refused', { message: error.message, ...where }, { event: 'auth.refused' })
-    } else {
-      http.debug('Request refused', { message: error.message, ...where })
-    }
-  }
-
   const handleError = (
     error: Error, reply: FastifyReply, exposure: HttpErrorExposure = 'production'
   ): void => {
     if (!reply.sent) {
       const serialized = serializeError(error, exposure)
       applyErrorHeaders(error, reply)
-      logFailure(error, reply, serialized.status, serialized.incidentId)
+      // The one record of a failed request: method, path and status — never what the caller sent.
+      fastifyLogUtils.failure(error, reply.request, serialized.status, serialized.incidentId)
       reply.header(INCIDENT_ID_HEADER, serialized.incidentId)
         .code(serialized.status)
         .send(serialized.body)

package/src/utils/log/consts.ts

@@ -0,0 +1,18 @@
+/**
+ * Keys of a Fastify log record that carry what a caller sent. They are dropped at every depth: a
+ * request body and its raw form (`rawBody`), multipart fields and file buffers, headers (with the
+ * authorization and cookie values), cookies and the parsed query string.
+ */
+export const UNSAFE_LOG_KEYS: ReadonlySet<string> = new Set([
+  'body', 'rawBody', 'payload', 'files', 'file', 'headers', 'rawHeaders', 'trailers', 'rawTrailers',
+  'query', 'querystring', 'cookies', 'cookie', 'authorization',
+])
+
+/** Deepest nesting `safeData` walks; anything below is one marker. */
+export const SAFE_DATA_DEPTH = 4
+
+/**
+ * The query string of a path or URL inside free text (a Fastify warning names `"/x?token=…"`): the
+ * path is kept (`$1`), the query is cut.
+ */
+export const QUERY_IN_TEXT = /(\/[^\s?"'`]*)\?[^\s"'`)]+/g

package/src/utils/log/types.ts

@@ -0,0 +1,43 @@
+import type { FastifyBaseLogger, LogController } from 'fastify'
+import type { Logger } from '@owlmeans/log'
+
+/** All a log record may say about a request: its method and its path — never the query string. */
+export interface RequestSummary {
+  method?: string
+  path?: string
+}
+
+/**
+ * How the API server's Fastify instance logs: through `@owlmeans/log`, and never with what a caller
+ * sent — a body, a raw body, multipart bytes, headers, cookies or a query string.
+ */
+export interface FastifyLogUtils {
+  /**
+   * A pino-shaped logger over `log` (scope `http` by default), handed to Fastify as its
+   * `loggerInstance`. Every record's data — Fastify's own and any plugin's — passes `safeData`.
+   */
+  logger: (log?: Logger, bindings?: Record<string, unknown>) => FastifyBaseLogger
+  /**
+   * The `logController` Fastify writes its own request lines through: no per-request pair (the
+   * server writes one debug record from `onResponse`), a request the default error handler answers
+   * is `failure`, a missing route is one debug line without its query.
+   */
+  controller: () => LogController
+  /**
+   * A copy of a record's data that is safe to write: a request becomes its `RequestSummary`, a reply
+   * its status, bytes their size, any other class instance its name; the keys that carry what a
+   * caller sent (`body`, `rawBody`, `headers`, `query`, `cookies`, files…) are dropped at every depth
+   * (a number or boolean under them stays: a count, a flag), and any string loses the query of a URL
+   * it names. An `Error` passes as it is (a copy, when its message names a URL with a query) — the
+   * log writes only its name, message, code and stack.
+   */
+  safeData: (data: unknown) => unknown
+  /** The method and the path, without the query string, of a Fastify or Node request. */
+  requestOf: (request: unknown) => RequestSummary
+  /**
+   * The one record of a failed request, by what its status means: 5xx `error` with the error,
+   * 403 `warn` `access.forbidden`, 401 `debug` `auth.refused`, any other 4xx `debug` with the error's
+   * code and message. Method, path and status only — never the request's content.
+   */
+  failure: (error: Error, request: unknown, status: number, incidentId?: string) => void
+}

package/src/utils/log.ts

@@ -1,62 +1,193 @@
-import type { FastifyBaseLogger } from 'fastify'
+import { LogController } from 'fastify'
+import type { FastifyBaseLogger, FastifyReply, FastifyRequest } from 'fastify'
+import { FORBIDDEN_ERROR, SERVER_ERROR, UNAUTHORIZED_ERROR } from '@owlmeans/api'
 import { logger, type LogLevel, type Logger } from '@owlmeans/log'
 import type { Severity } from './types.local.js'
+import { QUERY_IN_TEXT, SAFE_DATA_DEPTH, UNSAFE_LOG_KEYS } from './log/consts.js'
+import type { FastifyLogUtils, RequestSummary } from './log/types.js'
 
-/**
- * What Fastify says about itself, mapped to what an operator needs at each level.
- *
- * Fastify writes a pair of `info` lines for EVERY request and one for each unknown route, and
- * announces its own listening address. The server writes one `debug` record per request itself
- * (`onResponse`), a failed request is classified once in `handleError`, and the listening line is
- * `server.listening` — so these are dropped or lowered here, by their fixed wording, rather than by
- * a Fastify option (`disableRequestLogging` is deprecated from 5.12, `logController` does not exist
- * before it).
- */
-const levelOf = (level: Severity, message: unknown): Severity | undefined => {
-  if (typeof message !== 'string' || level !== 'info') {
-    return level
-  }
-  if (message === 'incoming request' || message === 'request completed') {
-    return undefined
-  }
-  if (message.startsWith('Server listening at') || /^Route .* not found$/.test(message)) {
-    return 'debug'
-  }
-  return level
-}
+const pathOf = (url: string): string => url.split('?')[0]
 
-/**
- * A pino-shaped logger over `@owlmeans/log`, handed to Fastify as its `loggerInstance`.
- *
- * Fastify then logs through the process's own level, format and plugins instead of a second pino
- * instance that ignores them. `(object, message)` and `(message)` are the two shapes Fastify and
- * its plugins call with; an `err` in the object travels as the record's error.
- */
-export const fastifyLogger = (log: Logger = logger('http'), bindings?: Record<string, unknown>): FastifyBaseLogger => {
-  const call = (requested: Severity) => (first: unknown, second?: unknown): void => {
-    const [object, message] = typeof first === 'string' || first instanceof Error
-      ? [undefined, first] : [first, second]
-    const level = levelOf(requested, message)
-    if (level == null) {
-      return
-    }
-    const data = bindings != null && Object.keys(bindings).length > 0
-      ? { ...bindings, ...(object != null && typeof object === 'object' ? object : {}) } : object
-    log[level](message == null ? '' : message instanceof Error ? message : String(message), data)
-  }
+const withoutQueries = (text: string): string => text.replace(QUERY_IN_TEXT, '$1')
 
-  const adapter = {
-    get level(): string { return levelName(log) },
-    set level(_value: string) { /* the level belongs to the process, not to this server */ },
-    fatal: call('error'), error: call('error'), warn: call('warn'),
-    info: call('info'), debug: call('debug'), trace: call('debug'),
-    silent: () => undefined,
-    child: (extra: Record<string, unknown>) => fastifyLogger(log, { ...bindings, ...extra }),
+/** The error itself, or — when its message names a URL with a query — a copy without the query. */
+const safeError = (error: Error): Error => {
+  const message = withoutQueries(error.message)
+  if (message === error.message) {
+    return error
   }
-  return adapter as unknown as FastifyBaseLogger
+  const copy: Error = Object.assign(Object.create(Object.getPrototypeOf(error) as object) as Error, error)
+  copy.message = message
+  copy.stack = error.stack != null ? withoutQueries(error.stack) : undefined
+  return copy
+}
+
+const isPlain = (value: object): boolean => {
+  const proto = Object.getPrototypeOf(value)
+  return proto === Object.prototype || proto === null
 }
 
 const levelName = (log: Logger): string => {
   const order: LogLevel[] = ['debug', 'info', 'warn', 'error']
   return order.find(level => log.enabled(level)) ?? 'silent'
 }
+
+export const createFastifyLogUtils = (): FastifyLogUtils => {
+  const http = logger('http')
+
+  const requestOf = (request: unknown): RequestSummary => {
+    const { method, url } = (request ?? {}) as { method?: unknown, url?: unknown }
+    return {
+      ...(typeof method === 'string' ? { method } : {}),
+      ...(typeof url === 'string' ? { path: pathOf(url) } : {}),
+    }
+  }
+
+  /** A class instance as a record may carry it: a request or reply by summary, anything else by name. */
+  const instanceOf = (value: object): unknown => {
+    const shape = value as { method?: unknown, url?: unknown, statusCode?: unknown }
+    if (typeof shape.method === 'string' && typeof shape.url === 'string') {
+      return requestOf(value)
+    }
+    if (typeof shape.statusCode === 'number') {
+      return { statusCode: shape.statusCode }
+    }
+    const name = value.constructor?.name ?? 'object'
+    if (ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {
+      return `[${name} ${value.byteLength} bytes]`
+    }
+    return `[${name}]`
+  }
+
+  const safe = (value: unknown, depth: number, seen: WeakSet<object>): unknown => {
+    if (typeof value === 'string') {
+      return withoutQueries(value)
+    }
+    if (value instanceof Error) {
+      return safeError(value)
+    }
+    if (value == null || typeof value !== 'object' || value instanceof Date) {
+      return value
+    }
+    if (seen.has(value)) {
+      return '[circular]'
+    }
+    if (!Array.isArray(value) && !isPlain(value)) {
+      return instanceOf(value)
+    }
+    if (depth >= SAFE_DATA_DEPTH) {
+      return '[…]'
+    }
+    seen.add(value)
+    if (Array.isArray(value)) {
+      return value.map(item => safe(item, depth + 1, seen))
+    }
+    const out: Record<string, unknown> = {}
+    for (const [key, item] of Object.entries(value)) {
+      // A count or a flag under such a key (`limits.files: 5`) says nothing a caller sent.
+      if (UNSAFE_LOG_KEYS.has(key) && typeof item !== 'number' && typeof item !== 'boolean') {
+        continue
+      }
+      out[key] = key === 'url' && typeof item === 'string' ? pathOf(item) : safe(item, depth + 1, seen)
+    }
+    return out
+  }
+
+  const safeData = (data: unknown): unknown => safe(data, 0, new WeakSet())
+
+  const failure: FastifyLogUtils['failure'] = (error, request, status, incidentId) => {
+    const where = { ...requestOf(request), status, ...(incidentId != null ? { incidentId } : {}) }
+    const safe = safeError(error)
+    if (status >= SERVER_ERROR) {
+      http.error('Request failed', { err: safe, ...where })
+    } else if (status === FORBIDDEN_ERROR) {
+      http.warn('Access forbidden', { type: (error as { type?: unknown }).type, message: safe.message, ...where },
+        { event: 'access.forbidden' })
+    } else if (status === UNAUTHORIZED_ERROR) {
+      http.debug('Authentication refused', { message: safe.message, ...where }, { event: 'auth.refused' })
+    } else {
+      const code = (error as { code?: unknown }).code
+      http.debug('Request refused', { ...(typeof code === 'string' ? { code } : {}), message: safe.message, ...where })
+    }
+  }
+
+  /**
+   * Fastify announces its listening address at info; the server writes `server.listening` itself.
+   * Its request lines no longer reach the adapter at all — `controller()` owns them.
+   */
+  const levelOf = (level: Severity, message: unknown): Severity =>
+    level === 'info' && typeof message === 'string' && message.startsWith('Server listening at') ? 'debug' : level
+
+  const fastifyLogger = (log: Logger = http, bindings?: Record<string, unknown>): FastifyBaseLogger => {
+    const call = (requested: Severity) => (first: unknown, second?: unknown): void => {
+      const [object, message] = typeof first === 'string' || first instanceof Error
+        ? [undefined, first] : [first, second]
+      const level = levelOf(requested, message)
+      if (!log.enabled(level)) {
+        return
+      }
+      const data = bindings != null && Object.keys(bindings).length > 0
+        ? { ...bindings, ...(object != null && typeof object === 'object' ? object : {}) } : object
+      const text = message == null ? '' : message instanceof Error ? safeError(message) : withoutQueries(String(message))
+      log[level](text, safeData(data))
+    }
+
+    const adapter = {
+      get level(): string { return levelName(log) },
+      set level(_value: string) { /* the level belongs to the process, not to this server */ },
+      fatal: call('error'), error: call('error'), warn: call('warn'),
+      info: call('info'), debug: call('debug'), trace: call('debug'),
+      silent: () => undefined,
+      // Fastify's second argument (pino options: its own `req`/`res` serializers) is ignored —
+      // `safeData` is this adapter's serializer.
+      child: (extra: Record<string, unknown>) => fastifyLogger(log, { ...bindings, ...extra }),
+    }
+    return adapter as unknown as FastifyBaseLogger
+  }
+
+  /**
+   * Fastify accepts a `logController` only as an instance of its own class, so this one member is a
+   * subclass; its methods use no `this`.
+   */
+  const controller = (): LogController => {
+    class SafeLogController extends LogController {
+      override incomingRequest (): void { /* `onResponse` writes the one record of a request */ }
+
+      override requestCompleted (error: Error | null | undefined, request: FastifyRequest, reply: FastifyReply): void {
+        if (error != null) {
+          http.error('Response failed', { err: error, ...requestOf(request), status: reply.statusCode })
+        }
+      }
+
+      override defaultErrorLog (error: Error, request: FastifyRequest, reply: FastifyReply): void {
+        failure(error, request, reply.statusCode)
+      }
+
+      override streamError (error: Error, request: FastifyRequest, reply: FastifyReply): void {
+        const where = { ...requestOf(request), status: reply.statusCode }
+        if ((error as { code?: unknown }).code === 'ERR_STREAM_PREMATURE_CLOSE') {
+          http.debug('Response stream closed prematurely', where)
+        } else {
+          http.warn('Response stream failed after its headers were sent', { err: error, ...where })
+        }
+      }
+
+      override routeNotFound (request: FastifyRequest): void {
+        http.debug('Route not found', requestOf(request))
+      }
+
+      override writeHeadError (error: Error, request: FastifyRequest, reply: FastifyReply): void {
+        http.warn('Response headers not written', { err: error, ...requestOf(request), status: reply.statusCode })
+      }
+
+      override serializerError (error: Error, request: FastifyRequest, _reply: FastifyReply, metadata: { statusCode: number }): void {
+        http.error('Response serializer failed', { err: error, ...requestOf(request), status: metadata.statusCode })
+      }
+    }
+    return new SafeLogController()
+  }
+
+  return { logger: fastifyLogger, controller, safeData, requestOf, failure }
+}
+
+export const fastifyLogUtils = createFastifyLogUtils()

package/tests/log-adapter.spec.ts

@@ -1,6 +1,8 @@
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test'
 import { addLogPlugin, configureLog, memoryPlugin, resetLog } from '@owlmeans/log'
-import { fastifyLogger } from '../src/utils/log.js'
+import { fastifyLogUtils } from '../src/utils/log.js'
+
+const fastifyLogger = fastifyLogUtils.logger
 
 const memory = memoryPlugin('adapter')
 
@@ -12,24 +14,32 @@ beforeEach(() => {
 afterEach(() => { memory.clear(); resetLog() })
 
 describe('@owlmeans/server-api — the Fastify logger adapter', () => {
-  test('drops the request pair, lowers the listening and not-found lines, keeps the rest', () => {
+  test('lowers the listening line, keeps the rest', () => {
     const log = fastifyLogger() as unknown as Record<string, (...args: unknown[]) => void>
-    log.info({ req: {} }, 'incoming request')
-    log.info({ res: {} }, 'request completed')
     log.info('Server listening at http://127.0.0.1:80')
-    log.info({ url: '/x' }, 'Route GET:/x not found')
     log.info('something else')
     log.warn({ a: 1 }, 'warned')
     log.error({ err: new Error('boom') }, 'failed')
 
     expect(memory.records.map(r => [r.level, r.message])).toEqual([
       ['debug', 'Server listening at http://127.0.0.1:80'],
-      ['debug', 'Route GET:/x not found'],
       ['info', 'something else'],
       ['warn', 'warned'],
       ['error', 'failed'],
     ])
-    expect(memory.records[4].error?.message).toBe('boom')
+    expect(memory.records[3].error?.message).toBe('boom')
+  })
+
+  test('the controller writes no per-request pair and a missing route without its query', () => {
+    const controller = fastifyLogUtils.controller()
+    const request = { method: 'GET', url: '/x?token=abc' } as never
+    controller.incomingRequest(request, {} as never)
+    controller.requestCompleted(null, request, { statusCode: 200 } as never)
+    controller.routeNotFound(request, {} as never)
+
+    expect(memory.records.map(r => [r.level, r.message, r.data])).toEqual([
+      ['debug', 'Route not found', { method: 'GET', path: '/x' }],
+    ])
   })
 
   test('child loggers bind their fields and the level is the process level', () => {

package/tests/log-redaction.spec.ts

@@ -0,0 +1,181 @@
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, test } from 'bun:test'
+import { AppType } from '@owlmeans/context'
+import { addLogPlugin, configureLog, logStateHelper, memoryPlugin, resetLog } from '@owlmeans/log'
+import type { LogRecord, NativeConsole } from '@owlmeans/log'
+import { contract, protocol, schema, typed } from '@owlmeans/entrypoint'
+import { backend, route, RouteMethod } from '@owlmeans/route'
+import { config, makeServerContext } from '@owlmeans/server-context'
+import type { ServerConfig, ServerContext } from '@owlmeans/server-context'
+import { bind } from '@owlmeans/server-entrypoint'
+import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify'
+import { handlers } from '../src/protocol.js'
+import { appendApiServer } from '../src/server.js'
+import { fastifyLogUtils } from '../src/utils/log.js'
+
+/** What a caller sent; none of it may reach a log record or a written line. */
+const MARKER = 'pii-marker-7f3a'
+const SECRETS = ['auth-secret-91c2', 'cookie-secret-44d0', 'query-secret-0b5e']
+
+interface Inquiry { email: string, message: string }
+
+const inquiry = protocol(
+  route('server-api-test:inquiry', '/inquiry', backend(null, RouteMethod.POST)),
+  contract(schema<Inquiry>({
+    type: 'object',
+    properties: { email: { type: 'string', format: 'email' }, message: { type: 'string', maxLength: 10 } },
+    required: ['email', 'message'],
+  }), typed<{ ok: boolean }>()),
+)
+
+const memory = memoryPlugin('redaction')
+const written: string[] = []
+const saved: Partial<NativeConsole> = {}
+
+/** Every record as a plugin receives it, plus the error's own text: the sink writes no more than that. */
+const recorded = (records: LogRecord[]): string => JSON.stringify(records.map(record => ({
+  ...record, error: record.error != null ? { message: record.error.message, stack: record.error.stack } : undefined,
+})))
+
+const leaks = (): string[] => {
+  const everything = `${recorded(memory.records)}\n${written.join('\n')}`
+  return [MARKER, ...SECRETS].filter(secret => everything.includes(secret))
+}
+
+beforeEach(() => {
+  memory.clear()
+  written.length = 0
+  addLogPlugin(memory)
+  configureLog({ level: 'debug', console: 'native' })
+  // The sink itself: read what it writes, through the captured natives it writes with.
+  const native = logStateHelper.nativeConsole()
+  for (const method of ['debug', 'info', 'warn', 'error'] as const) {
+    saved[method] = native[method]
+    native[method] = (...args: unknown[]) => { written.push(args.map(String).join(' ')) }
+  }
+})
+
+afterEach(() => {
+  Object.assign(logStateHelper.nativeConsole(), saved)
+  resetLog()
+})
+
+describe('@owlmeans/server-api — a request never reaches the log', () => {
+  let server: FastifyInstance
+
+  beforeAll(async () => {
+    const service = 'server-api-redaction'
+    const context = makeServerContext(config<ServerConfig>(service, {
+      services: { [service]: { service, type: AppType.Backend, host: '127.0.0.1', default: true } },
+    } as Partial<ServerConfig>)) as ServerContext<ServerConfig>
+    const served = appendApiServer(context)
+    const api = handlers<ServerContext<ServerConfig>>()
+    context.registerEntrypoint(bind(inquiry, api.request(inquiry, async () => ({ ok: true }))))
+    context.configure()
+    await context.init()
+    server = served.getApiServer().server
+    await server.ready()
+  })
+
+  afterAll(async () => { await server?.close() })
+
+  const headers = {
+    authorization: `Bearer ${SECRETS[0]}`, cookie: `session=${SECRETS[1]}`,
+  }
+
+  test('a JSON body the schema refuses: method, path, status, code and message only', async () => {
+    const response = await server.inject({
+      method: 'POST', url: `/inquiry?token=${SECRETS[2]}`,
+      headers: { ...headers, 'content-type': 'application/json' },
+      payload: JSON.stringify({ email: `${MARKER}@`, message: `${MARKER} wrote this` }),
+    })
+
+    expect(response.statusCode).toBe(400)
+    expect(leaks()).toEqual([])
+    const refused = memory.records.find(record => record.message === 'Request refused')
+    expect(refused).toMatchObject({
+      level: 'debug', scope: 'http',
+      data: { method: 'POST', path: '/inquiry', status: 400, code: 'FST_ERR_VALIDATION' },
+    })
+    expect(Object.keys(refused!.data as object).sort()).toEqual(['code', 'message', 'method', 'path', 'status'])
+    // Nothing about a refused request is written at info.
+    expect(memory.records.filter(record => record.level !== 'debug')).toEqual([])
+  })
+
+  test('a multipart body the schema refuses: no field, no file byte', async () => {
+    const boundary = 'owlmeansboundary'
+    const payload = [
+      `--${boundary}`, 'Content-Disposition: form-data; name="email"', '', `${MARKER}@`,
+      `--${boundary}`, 'Content-Disposition: form-data; name="message"', '', `${MARKER} wrote this`,
+      `--${boundary}`, 'Content-Disposition: form-data; name="file"; filename="note.txt"', 'Content-Type: text/plain', '',
+      `${MARKER} file bytes`, `--${boundary}--`, '',
+    ].join('\r\n')
+    const response = await server.inject({
+      method: 'POST', url: '/inquiry', payload,
+      headers: { ...headers, 'content-type': `multipart/form-data; boundary=${boundary}` },
+    })
+
+    expect(response.statusCode).toBe(400)
+    expect(leaks()).toEqual([])
+    expect(memory.records.some(record => record.message === 'Request refused')).toBe(true)
+  })
+
+  test('an unparsable body and a missing route: no body, no query', async () => {
+    const broken = await server.inject({
+      method: 'POST', url: `/inquiry?token=${SECRETS[2]}`,
+      headers: { ...headers, 'content-type': 'application/json' }, payload: `{"email":"${MARKER}`,
+    })
+    const missing = await server.inject({ method: 'GET', url: `/nowhere?token=${SECRETS[2]}`, headers })
+
+    expect(broken.statusCode).toBe(400)
+    expect(missing.statusCode).toBe(404)
+    expect(leaks()).toEqual([])
+    expect(memory.records.find(record => record.message === 'Route not found')?.data)
+      .toEqual({ method: 'GET', path: '/nowhere' })
+  })
+})
+
+describe('@owlmeans/server-api — what the Fastify log adapter writes', () => {
+  const request = {
+    method: 'POST', url: `/inquiry?token=${SECRETS[2]}`, id: 'req-1',
+    headers: { ...{ authorization: `Bearer ${SECRETS[0]}`, cookie: `session=${SECRETS[1]}` }, 'x-note': MARKER },
+    body: { email: `${MARKER}@example.com` }, rawBody: `{"email":"${MARKER}@example.com"}`,
+    query: { token: SECRETS[2] },
+  }
+  const reply = { statusCode: 500, request, header: () => reply }
+
+  test('a request becomes its method and path, a reply its status, bytes their size', () => {
+    const fastifyRequest = Object.assign(Object.create({ kind: 'request' }) as object, request)
+    const fastifyReply = Object.assign(Object.create({ kind: 'reply' }) as object, reply)
+    const log = fastifyLogUtils.logger() as unknown as Record<string, (...args: unknown[]) => void>
+    log.error({ req: fastifyRequest, res: fastifyReply, err: new Error('boom') }, 'failed')
+    log.info({ busboyOptions: { headers: request.headers, limits: { files: 5 } } }, 'parsing')
+    log.warn({ body: request.body, rawBody: request.rawBody, file: new TextEncoder().encode(MARKER) }, 'dumped')
+    log.warn({ upload: new TextEncoder().encode(MARKER), url: request.url }, `Reply was already sent in "${request.url}"`)
+
+    expect(leaks()).toEqual([])
+    expect(memory.records.map(record => record.data)).toEqual([
+      { req: { method: 'POST', path: '/inquiry' }, res: { statusCode: 500 } },
+      { busboyOptions: { limits: { files: 5 } } },
+      {},
+      { upload: `[Uint8Array ${MARKER.length} bytes]`, url: '/inquiry' },
+    ])
+    expect(memory.records[3].message).toBe('Reply was already sent in "/inquiry"')
+  })
+
+  test('the controller logs a request the default error handler answers by its status alone', () => {
+    const controller = fastifyLogUtils.controller()
+    const asRequest = request as unknown as FastifyRequest
+    controller.defaultErrorLog(new Error('fault'), asRequest, { ...reply, statusCode: 500 } as unknown as FastifyReply)
+    controller.defaultErrorLog(new Error('denied'), asRequest, { ...reply, statusCode: 403 } as unknown as FastifyReply)
+    controller.incomingRequest(asRequest, reply as unknown as FastifyReply)
+    controller.requestCompleted(null, asRequest, reply as unknown as FastifyReply)
+
+    expect(leaks()).toEqual([])
+    expect(memory.records.map(record => [record.level, record.message, record.data])).toEqual([
+      ['error', 'Request failed', { method: 'POST', path: '/inquiry', status: 500 }],
+      ['warn', 'Access forbidden', { message: 'denied', method: 'POST', path: '/inquiry', status: 403 }],
+    ])
+    expect(memory.records[0].error?.message).toBe('fault')
+    expect(memory.records[1].event).toBe('access.forbidden')
+  })
+})