@prosopo/api-express-router 3.1.42 → 3.1.43

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/api-express-router@3.1.42 build:cjs
+> @prosopo/api-express-router@3.1.43 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -51,8 +51,8 @@ Build end
 rendering chunks...
 dist/cjs/errorHandler.cjs                                      0.49 kB
 dist/cjs/apiExpressRouterFactory.cjs                           0.92 kB
-dist/cjs/middlewares/requestLoggerMiddleware.cjs               1.06 kB
 dist/cjs/endpointAdapter/apiExpressDefaultEndpointAdapter.cjs  1.12 kB
 dist/cjs/index.cjs                                             1.16 kB
 dist/cjs/middlewares/authMiddleware.cjs                        1.86 kB
-✓ built in 81ms
+dist/cjs/middlewares/requestLoggerMiddleware.cjs               1.98 kB
+✓ built in 128ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/api-express-router@3.1.42 build:tsc
+> @prosopo/api-express-router@3.1.43 build:tsc
 > tsc --build --verbose
 
-10:35:23 AM - Projects in this build: 
+1:22:15 PM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../util/tsconfig.json
     * ../logger/tsconfig.json
@@ -22,41 +22,41 @@
     * ../env/tsconfig.json
     * tsconfig.json
 
-10:35:23 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-10:35:23 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/provider/api.ts' is older than output '../types/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/provider/api.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/error.ts' is older than output '../common/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/index.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/index.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/tests/testRedisConnection.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/types/captcha.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/types/bannedDomain.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/mongoGlobalSetup.ts' is older than output '../database/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/mongoGlobalSetup.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/pair/decode.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/env.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/env.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
+1:22:15 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-10:35:24 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+1:22:15 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
 
-10:35:24 AM - Building project '/home/runner/work/captcha/captcha/packages/api-express-router/tsconfig.json'...
+1:22:15 PM - Building project '/home/runner/work/captcha/captcha/packages/api-express-router/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/api-express-router@3.1.42 build
+> @prosopo/api-express-router@3.1.43 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/api-express-router@3.1.42 build:cross-env
+> @prosopo/api-express-router@3.1.43 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -56,7 +56,7 @@ rendering chunks...
 dist/errorHandler.js                                      0.39 kB
 dist/index.js                                             0.78 kB
 dist/apiExpressRouterFactory.js                           0.78 kB
-dist/middlewares/requestLoggerMiddleware.js               0.95 kB
 dist/endpointAdapter/apiExpressDefaultEndpointAdapter.js  1.01 kB
 dist/middlewares/authMiddleware.js                        1.73 kB
-✓ built in 137ms
+dist/middlewares/requestLoggerMiddleware.js               1.86 kB
+✓ built in 177ms

package/CHANGELOG.md

@@ -1,5 +1,50 @@
 # @prosopo/api-express-router
 
+## 3.1.43
+### Patch Changes
+
+- 6abff15: Fix request-scoped logger fields leaking across concurrent captcha requests, and give every endpoint a proper request/response envelope in OpenObserve.
+  
+  Three interlocking changes:
+  
+  - **`Tasks.setLogger` no longer mutates `db.logger`.** `env.getDb()` returns a
+    process-wide singleton; overwriting `db.logger` on every request meant two
+    concurrent captcha submits raced, and whichever request landed second
+    stamped its `user`/`siteKey`/`sessionId` bindings onto the *other* request's
+    DB-level log lines. In practice you'd see a `PuzzleCaptcha record updated
+    successfully` for user A's challenge tagged with user B's account and site
+    key, breaking log-based forensics. `setLogger` still updates the per-request
+    Tasks instance and its per-request manager instances (those are safe —
+    they're constructed inside the Tasks constructor) but stops mutating the
+    shared DB. Callers in `getPoWCaptchaChallenge` and `getPuzzleCaptchaChallenge`
+    now pass `req.logger` directly into `new Tasks(env, req.logger)` and drop
+    the redundant `.setLogger(req.logger)` call that followed.
+  
+  - **`requestLoggerMiddleware` now emits `Request received` and `Response sent`
+    envelope lines on every route** (with `method`, `path`, `status`,
+    `durationMs`, and the request id). Previously only `/frictionless` had a
+    `res.on('finish', ...)` block, so `getPow/PuzzleCaptchaChallenge`,
+    `submitPow/PuzzleCaptchaSolution`, `verify.ts` etc. produced no envelope in
+    OO — a challenge issued by one endpoint and verified by another shared
+    nothing you could group on. Health-probe paths (`/healthz`, `/health`,
+    `/readyz`) are excluded so they don't drown the stream. The middleware
+    also now mirrors `x-request-id` back on the outbound response so callers
+    downstream of the Node process can correlate without depending on Caddy.
+  
+  - **`requestId` (set on the request logger via `.with({requestId})`) is
+    promoted to a top-level `req_id` field on the emitted JSON log record.**
+    OpenObserve indexes top-level fields as their own columns, so
+    `WHERE req_id = '…'` is now cheap; previously the id only lived inside
+    `data.requestId`, which flattened to `data_requestid` in OO's ingestion
+    and had no top-level column. `data.requestId` is preserved for backwards
+    compatibility with existing dashboards. Two new unit tests in
+    `@prosopo/logger` cover the promotion and the "absent when unset" case.
+- Updated dependencies [6abff15]
+  - @prosopo/logger@2.0.3
+  - @prosopo/api-route@2.6.52
+  - @prosopo/common@3.1.45
+  - @prosopo/env@3.6.12
+
 ## 3.1.42
 ### Patch Changes
 

package/dist/cjs/middlewares/requestLoggerMiddleware.cjs

@@ -8,12 +8,13 @@ const getHeaderValue = (req, headerName) => {
   }
   return void 0;
 };
+const HEALTH_CHECK_PATHS = /* @__PURE__ */ new Set(["/healthz", "/health", "/readyz"]);
 function requestLoggerMiddleware(env) {
   return (req, res, next) => {
     const requestId = req.headers["x-request-id"] || `e-${uuid.v4()}`;
     const user = getHeaderValue(req, "prosopo-user");
     const siteKey = getHeaderValue(req, "prosopo-site-key");
-    const sessionId = req.body?.sessionId ? req.body.sessionId : null;
+    const sessionId = req.body?.sessionId ? req.body.sessionId : void 0;
     const logger$1 = logger.getLogger(
       logger.parseLogLevel(env.config.logLevel),
       "provider:request"
@@ -25,6 +26,37 @@ function requestLoggerMiddleware(env) {
     });
     req.logger = logger$1;
     req.requestId = requestId;
+    res.setHeader("x-request-id", requestId);
+    if (HEALTH_CHECK_PATHS.has(req.path)) {
+      next();
+      return;
+    }
+    const startNs = process.hrtime.bigint();
+    logger$1.info(() => ({
+      msg: "Request received",
+      data: {
+        method: req.method,
+        path: req.path
+      }
+    }));
+    let finished = false;
+    const emitFinish = (outcome) => {
+      if (finished) return;
+      finished = true;
+      const durationMs = Number(process.hrtime.bigint() - startNs) / 1e6;
+      logger$1.info(() => ({
+        msg: "Response sent",
+        data: {
+          method: req.method,
+          path: req.path,
+          status: res.statusCode,
+          durationMs,
+          outcome
+        }
+      }));
+    };
+    res.on("finish", () => emitFinish("finish"));
+    res.on("close", () => emitFinish("close"));
     next();
   };
 }

package/dist/middlewares/requestLoggerMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"requestLoggerMiddleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/requestLoggerMiddleware.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAa/D,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,mBAAmB,SAClD,OAAO,OAAO,QAAQ,QAAQ,YAAY,UAwBvD"}
+{"version":3,"file":"requestLoggerMiddleware.d.ts","sourceRoot":"","sources":["../../src/middlewares/requestLoggerMiddleware.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAe/D,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,mBAAmB,SAClD,OAAO,OAAO,QAAQ,QAAQ,YAAY,UAuEvD"}

package/dist/middlewares/requestLoggerMiddleware.js

@@ -6,12 +6,13 @@ const getHeaderValue = (req, headerName) => {
   }
   return void 0;
 };
+const HEALTH_CHECK_PATHS = /* @__PURE__ */ new Set(["/healthz", "/health", "/readyz"]);
 function requestLoggerMiddleware(env) {
   return (req, res, next) => {
     const requestId = req.headers["x-request-id"] || `e-${v4()}`;
     const user = getHeaderValue(req, "prosopo-user");
     const siteKey = getHeaderValue(req, "prosopo-site-key");
-    const sessionId = req.body?.sessionId ? req.body.sessionId : null;
+    const sessionId = req.body?.sessionId ? req.body.sessionId : void 0;
     const logger = getLogger(
       parseLogLevel(env.config.logLevel),
       "provider:request"
@@ -23,6 +24,37 @@ function requestLoggerMiddleware(env) {
     });
     req.logger = logger;
     req.requestId = requestId;
+    res.setHeader("x-request-id", requestId);
+    if (HEALTH_CHECK_PATHS.has(req.path)) {
+      next();
+      return;
+    }
+    const startNs = process.hrtime.bigint();
+    logger.info(() => ({
+      msg: "Request received",
+      data: {
+        method: req.method,
+        path: req.path
+      }
+    }));
+    let finished = false;
+    const emitFinish = (outcome) => {
+      if (finished) return;
+      finished = true;
+      const durationMs = Number(process.hrtime.bigint() - startNs) / 1e6;
+      logger.info(() => ({
+        msg: "Response sent",
+        data: {
+          method: req.method,
+          path: req.path,
+          status: res.statusCode,
+          durationMs,
+          outcome
+        }
+      }));
+    };
+    res.on("finish", () => emitFinish("finish"));
+    res.on("close", () => emitFinish("close"));
     next();
   };
 }

package/dist/middlewares/requestLoggerMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"requestLoggerMiddleware.js","sourceRoot":"","sources":["../../src/middlewares/requestLoggerMiddleware.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,MAAM,cAAc,GAAG,CACtB,GAAY,EACZ,UAAkB,EACG,EAAE;IACvB,IAAI,UAAU,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC/D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC1D,MAAM,SAAS,GACb,GAAG,CAAC,OAAO,CAAC,cAAc,CAAY,IAAI,KAAK,MAAM,EAAE,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QAElE,MAAM,MAAM,GAAG,SAAS,CACvB,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,kBAAkB,CAClB,CAAC,IAAI,CAAC;YACN,SAAS;YACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnC,CAAC,CAAC;QAGH,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACpB,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;QAG1B,IAAI,EAAE,CAAC;IACR,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"requestLoggerMiddleware.js","sourceRoot":"","sources":["../../src/middlewares/requestLoggerMiddleware.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAEpC,MAAM,cAAc,GAAG,CACtB,GAAY,EACZ,UAAkB,EACG,EAAE;IACvB,IAAI,UAAU,IAAI,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAEvE,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC/D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAI1D,MAAM,SAAS,GACb,GAAG,CAAC,OAAO,CAAC,cAAc,CAAY,IAAI,KAAK,MAAM,EAAE,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAEvE,MAAM,MAAM,GAAG,SAAS,CACvB,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,kBAAkB,CAClB,CAAC,IAAI,CAAC;YACN,SAAS;YACT,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnC,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;QACpB,GAAG,CAAC,SAAS,GAAG,SAAS,CAAC;QAI1B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAIzC,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,EAAE,CAAC;YACP,OAAO;QACR,CAAC;QAKD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClB,GAAG,EAAE,kBAAkB;YACvB,IAAI,EAAE;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;aACd;SACD,CAAC,CAAC,CAAC;QAMJ,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,UAAU,GAAG,CAAC,OAA2B,EAAE,EAAE;YAClD,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,GAAG,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAClB,GAAG,EAAE,eAAe;gBACpB,IAAI,EAAE;oBACL,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,MAAM,EAAE,GAAG,CAAC,UAAU;oBACtB,UAAU;oBACV,OAAO;iBACP;aACD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAE3C,IAAI,EAAE,CAAC;IACR,CAAC,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/api-express-router",
-	"version": "3.1.42",
+	"version": "3.1.43",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
 	"type": "module",
@@ -26,10 +26,10 @@
 	},
 	"dependencies": {
 		"@polkadot/util": "13.5.7",
-		"@prosopo/api-route": "2.6.51",
-		"@prosopo/common": "3.1.44",
-		"@prosopo/logger": "2.0.2",
-		"@prosopo/env": "3.6.11",
+		"@prosopo/api-route": "2.6.52",
+		"@prosopo/common": "3.1.45",
+		"@prosopo/logger": "2.0.3",
+		"@prosopo/env": "3.6.12",
 		"@prosopo/locale": "3.2.6",
 		"@prosopo/types": "4.9.8",
 		"@prosopo/util": "3.3.4",

package/src/middlewares/requestLoggerMiddleware.ts

@@ -27,13 +27,18 @@ const getHeaderValue = (
 	return undefined;
 };
 
+const HEALTH_CHECK_PATHS = new Set(["/healthz", "/health", "/readyz"]);
+
 export function requestLoggerMiddleware(env: ProviderEnvironment) {
 	return (req: Request, res: Response, next: NextFunction) => {
+		// Honour an inbound `x-request-id` (Caddy/upstream proxy assigns one and
+		// we want the same value to link Caddy access logs to Node app logs).
+		// Fall back to `e-<uuid>` when the upstream didn't set one.
 		const requestId =
-			(req.headers["x-request-id"] as string) || `e-${uuidv4()}`; // use prefix to differentiate from other IDs
+			(req.headers["x-request-id"] as string) || `e-${uuidv4()}`;
 		const user = getHeaderValue(req, "prosopo-user");
 		const siteKey = getHeaderValue(req, "prosopo-site-key");
-		const sessionId = req.body?.sessionId ? req.body.sessionId : null;
+		const sessionId = req.body?.sessionId ? req.body.sessionId : undefined;
 
 		const logger = getLogger(
 			parseLogLevel(env.config.logLevel),
@@ -45,11 +50,55 @@ export function requestLoggerMiddleware(env: ProviderEnvironment) {
 			...(sessionId ? { sessionId } : {}),
 		});
 
-		// Attach logger to the request
 		req.logger = logger;
 		req.requestId = requestId;
 
-		// Continue to next middleware
+		// Mirror the requestId back to the client so downstream systems can
+		// correlate their own logs to ours.
+		res.setHeader("x-request-id", requestId);
+
+		// Skip request/response envelope logging for high-volume health probes
+		// so they don't drown out useful captcha-endpoint entries.
+		if (HEALTH_CHECK_PATHS.has(req.path)) {
+			next();
+			return;
+		}
+
+		// Emit a single request-received line so every endpoint has an entry
+		// log in OpenObserve even when the handler itself doesn't log. Kept at
+		// info level; drop to debug if the volume becomes a problem.
+		const startNs = process.hrtime.bigint();
+		logger.info(() => ({
+			msg: "Request received",
+			data: {
+				method: req.method,
+				path: req.path,
+			},
+		}));
+
+		// Log a response-finished line. `finish` fires when the response was
+		// sent successfully; `close` fires when the client disconnects before
+		// the response was fully sent. Guard against both firing (once() would
+		// only cover a single event source).
+		let finished = false;
+		const emitFinish = (outcome: "finish" | "close") => {
+			if (finished) return;
+			finished = true;
+			const durationMs = Number(process.hrtime.bigint() - startNs) / 1e6;
+			logger.info(() => ({
+				msg: "Response sent",
+				data: {
+					method: req.method,
+					path: req.path,
+					status: res.statusCode,
+					durationMs,
+					outcome,
+				},
+			}));
+		};
+		res.on("finish", () => emitFinish("finish"));
+		res.on("close", () => emitFinish("close"));
+
 		next();
 	};
 }