@pxp-nd/core 1.2.91 → 1.2.92

package/README.md

@@ -1,6 +1,24 @@
 # PXP-ND core
 - Core module for pxp-nd
 
+## 1.2.92
+
+Destino del audit de request. **Sin configurar nada, el comportamiento es idéntico a 1.2.91**: el default sigue siendo insertar en `tsec_log`.
+
+### `logSink` (opcional)
+
+```ts
+new PxpApp({
+  logSink: 'stdout', // 'db' | 'stdout' | 'both'
+});
+```
+
+- `db` (default): insert en `tsec_log` por `DB_LOG_CONNECTION_NAME`. El `logId` del JSON de error es el id numérico.
+- `stdout`: una línea JSON por request (`pxpLog: true`). El `logId` es un uuid, generado antes de escribir, y no se toca la base. `request`, `response` y `query` se cortan a 8 KB (`truncated: true`). CloudWatch descarta un evento de más de 256 KB.
+- `both`: la línea JSON y, en segundo plano, el insert. El uuid viaja dentro del request guardado como `__logId`. La respuesta no espera a la base.
+
+Las máscaras de `@Log` (`cc_mask`, `complete_mask`, campo en null) se aplican en los tres modos. Los decoradores existentes no hay que tocarlos.
+
 ## 1.2.91
 
 Correcciones encontradas en las pruebas de carga con la base de datos caída. Sin cambios de API ni de configuración.

package/dist/interfaces.d.ts

@@ -32,10 +32,23 @@ declare interface IModules {
 declare interface IConfigExpress {
     [name: string]: any;
 }
+/**
+ * Where a request audit line is written.
+ * `db` (default) inserts into tsec_log and returns the numeric id.
+ * `stdout` writes one JSON line and returns a uuid. No database.
+ * `both` writes the line and inserts in the background; the uuid is stored
+ * inside the row's request JSON as `__logId`.
+ */
+export declare type LogSink = 'db' | 'stdout' | 'both';
 export interface IConfigPxpApp {
     defaultDbSettings?: string;
     apiPrefix?: string;
     logDuration?: boolean;
+    /**
+     * Audit destination. Omitted or `db` matches <=1.2.91 (insert into tsec_log).
+     * `stdout` is one JSON line per request. `both` is the line plus a background insert.
+     */
+    logSink?: LogSink;
     showRoutes?: boolean;
     controllers?: any[];
     entities?: any;

package/dist/lib/pxp/Controller.d.ts

@@ -15,6 +15,7 @@
  * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 per-request controller clone (from 1.2.89), startTransaction inside try
  * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 acquire timeout + @Timeout decorator
  * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 log failures never block or crash the response (1.2.91)
+ * Last modified  : 2026-10-21 - logSink db | stdout | both (1.2.92)
  */
 import { EntityManager } from 'typeorm';
 import { Request, Response, NextFunction } from 'express';

package/dist/lib/pxp/Controller.js

@@ -40,6 +40,7 @@ exports.Controller = void 0;
  * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 per-request controller clone (from 1.2.89), startTransaction inside try
  * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 acquire timeout + @Timeout decorator
  * Last modified  : 2026-10-08 - Favio Figueroa - EF-23 log failures never block or crash the response (1.2.91)
+ * Last modified  : 2026-10-21 - logSink db | stdout | both (1.2.92)
  */
 const typeorm_1 = require("typeorm");
 const class_validator_1 = require("class-validator");
@@ -192,7 +193,7 @@ class Controller {
                         // A failing error log (e.g. database down) must never prevent the response.
                         try {
                             res.logId = await index_1.__(index_1.insertLog('nouser', 'mac', req.ip, 'error', ex.tecMessage, controllerForRequest.module, controllerForRequest.transactionCode, '', // query
-                            params, ex.stack, ex.statusCode, endsAt, logValue));
+                            params, ex.stack, ex.statusCode, endsAt, logValue, controllerForRequest.config.logSink));
                         }
                         catch (logErr) {
                             // __ wraps driver errors in PxpError(500) with a generic message; the real cause is tecMessage.
@@ -233,7 +234,7 @@ class Controller {
                         // A failing error log (e.g. database down) must never prevent the response.
                         try {
                             res.logId = (await index_1.__(index_1.insertLog(controllerForRequest.user && controllerForRequest.user.username ? controllerForRequest.user.username : 'nouser', 'mac', req.ip, 'error', ex.tecMessage, controllerForRequest.module, controllerForRequest.transactionCode, '', // query
-                            params, ex.stack, ex.statusCode, endsAt, logValue)));
+                            params, ex.stack, ex.statusCode, endsAt, logValue, controllerForRequest.config.logSink)));
                         }
                         catch (logErr) {
                             // __ wraps driver errors in PxpError(500) with a generic message; the real cause is tecMessage.
@@ -329,7 +330,7 @@ class Controller {
             const iniAt = req.start;
             const endsAt = now.valueOf() - iniAt.valueOf();
             // Fire-and-forget: without the catch a failing log is an unhandledRejection (fatal on Node >= 15).
-            index_1.__(index_1.insertLog(this.user && this.user.username ? this.user.username : 'nouser', 'mac', req.ip, 'success', 'successful transaction', this.module, this.transactionCode, '', params, JSON.stringify(metResponse), '200', endsAt, logConfig)).catch(err => console.error('[pxp-core] success log failed', err && (err.tecMessage || err.message)));
+            index_1.__(index_1.insertLog(this.user && this.user.username ? this.user.username : 'nouser', 'mac', req.ip, 'success', 'successful transaction', this.module, this.transactionCode, '', params, JSON.stringify(metResponse), '200', endsAt, logConfig, this.config.logSink)).catch(err => console.error('[pxp-core] success log failed', err && (err.tecMessage || err.message)));
         }
         //PARA REPORTES
         if (req.report && req.report.type === 'pdf') {

package/dist/lib/pxp/utils/Security.d.ts

@@ -13,11 +13,14 @@
  */
 import 'reflect-metadata';
 import { EntityManager } from 'typeorm';
+import { LogSink } from '../../../interfaces';
+/** Max characters kept for request, response and query on a stdout line. CloudWatch drops an event past 256 KB. */
+declare const STDOUT_LOG_FIELD_MAX = 8192;
 interface ScriptInterface {
     scriptCode: string;
     scriptFunction: (manager: EntityManager) => void;
 }
 declare const userHasPermission: (user: any, transaction: string, permissionFunction: boolean | ((user: any, transaction: string) => Promise<boolean>)) => Promise<boolean>;
-declare const insertLog: (username: string, macaddres: string, ip: string, logType: string, desc: string, proc: string, trans: string, query: string, req: Record<string, unknown>, resp: string, err: string, timeEx: number, logConfig: Record<string, unknown>) => Promise<number>;
-export { userHasPermission, insertLog };
+declare const insertLog: (username: string, macaddres: string, ip: string, logType: string, desc: string, proc: string, trans: string, query: string, req: Record<string, unknown>, resp: string, err: string, timeEx: number, logConfig: Record<string, unknown>, logSink?: LogSink) => Promise<number | string>;
+export { userHasPermission, insertLog, STDOUT_LOG_FIELD_MAX };
 export type { ScriptInterface };

package/dist/lib/pxp/utils/Security.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.insertLog = exports.userHasPermission = void 0;
+exports.STDOUT_LOG_FIELD_MAX = exports.insertLog = exports.userHasPermission = void 0;
 /**
  * Kplian Ltda 2020
  *
@@ -18,9 +18,13 @@ exports.insertLog = exports.userHasPermission = void 0;
  * Last modified  : 2020-10-20 17:46:24
  */
 require("reflect-metadata");
+const crypto_1 = __importDefault(require("crypto"));
 const typeorm_1 = require("typeorm");
 // import { Role } from '@pxp-nd/entities';
 const Log_1 = __importDefault(require("../../../entities/Log"));
+/** Max characters kept for request, response and query on a stdout line. CloudWatch drops an event past 256 KB. */
+const STDOUT_LOG_FIELD_MAX = 8192;
+exports.STDOUT_LOG_FIELD_MAX = STDOUT_LOG_FIELD_MAX;
 const userHasPermission = async (user, transaction, permissionFunction) => {
     if (typeof permissionFunction === 'function') {
         return await permissionFunction(user, transaction);
@@ -42,24 +46,71 @@ const userHasPermission = async (user, transaction, permissionFunction) => {
     }
 };
 exports.userHasPermission = userHasPermission;
-const insertLog = async (username, macaddres, ip, logType, desc, proc, trans, query, req, resp, err, timeEx, logConfig) => {
-    if (logConfig) {
-        for (const [key, value] of Object.entries(logConfig)) {
-            if (key in req) {
-                if (!value) {
-                    delete req[key];
-                }
-                else if (value === 'cc_mask') {
-                    const aux = req[key];
-                    req[key] = '************' + aux.substr(-4);
-                }
-                else if (value === 'complete_mask') {
-                    const aux = req[key];
-                    req[key] = aux.replace(/./g, '*');
-                }
+/** uuid v4. @types/node 15 does not declare crypto.randomUUID. */
+const newLogId = () => {
+    const bytes = crypto_1.default.randomBytes(16);
+    bytes[6] = (bytes[6] & 0x0f) | 0x40;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    const hex = bytes.toString('hex');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+};
+const applyLogMask = (req, logConfig) => {
+    if (!logConfig || !req) {
+        return;
+    }
+    for (const [key, value] of Object.entries(logConfig)) {
+        if (key in req) {
+            if (!value) {
+                delete req[key];
+            }
+            else if (value === 'cc_mask') {
+                const aux = req[key];
+                req[key] = '************' + aux.substr(-4);
+            }
+            else if (value === 'complete_mask') {
+                const aux = req[key];
+                req[key] = aux.replace(/./g, '*');
             }
         }
     }
+};
+const capField = (value) => {
+    const text = value == null ? '' : String(value);
+    if (text.length <= STDOUT_LOG_FIELD_MAX) {
+        return { text, truncated: false };
+    }
+    return { text: text.slice(0, STDOUT_LOG_FIELD_MAX), truncated: true };
+};
+const serializeForLog = (value) => {
+    try {
+        return JSON.stringify(value);
+    }
+    catch (_a) {
+        return '{"error":"unserializable"}';
+    }
+};
+const emitStdoutLog = (logId, username, ip, logType, desc, proc, trans, query, req, resp, err, timeEx) => {
+    const request = capField(serializeForLog(req));
+    const response = capField(resp);
+    const queryField = capField(query);
+    console.log(JSON.stringify({
+        pxpLog: true,
+        logId,
+        type: logType,
+        user: username,
+        ip,
+        module: proc,
+        transaction: trans,
+        status: err,
+        ms: timeEx,
+        message: desc,
+        query: queryField.text,
+        request: request.text,
+        response: response.text,
+        truncated: request.truncated || response.truncated || queryField.truncated,
+    }));
+};
+const insertLogRow = async (username, macaddres, ip, logType, desc, proc, trans, query, req, resp, err, timeEx) => {
     const log = new Log_1.default();
     log.username = username;
     log.macaddres = macaddres;
@@ -74,7 +125,7 @@ const insertLog = async (username, macaddres, ip, logType, desc, proc, trans, qu
     log.execTime = timeEx;
     log.errorCode = err;
     log.shortRequest = JSON.stringify(req).substring(0, 150);
-    log.shortResponse = resp.substring(0, 150);
+    log.shortResponse = (resp || '').substring(0, 150);
     const logIds = await typeorm_1.getManager(process.env.DB_LOG_CONNECTION_NAME)
         .createQueryBuilder()
         .insert()
@@ -83,4 +134,21 @@ const insertLog = async (username, macaddres, ip, logType, desc, proc, trans, qu
         .execute();
     return logIds.identifiers[0].logId;
 };
+const insertLog = async (username, macaddres, ip, logType, desc, proc, trans, query, req, resp, err, timeEx, logConfig, logSink = 'db') => {
+    const sink = logSink || 'db';
+    if (sink === 'stdout' || sink === 'both') {
+        const snapshot = Object.assign({}, (req || {}));
+        applyLogMask(snapshot, logConfig);
+        const logId = newLogId();
+        emitStdoutLog(logId, username, ip, logType, desc, proc, trans, query, snapshot, resp, err, timeEx);
+        if (sink === 'both') {
+            const dbReq = Object.assign(Object.assign({}, snapshot), { __logId: logId });
+            insertLogRow(username, macaddres, ip, logType, desc, proc, trans, query, dbReq, resp, err, timeEx)
+                .catch((dbErr) => console.error('[pxp-core] db log failed', dbErr && (dbErr.tecMessage || dbErr.message)));
+        }
+        return logId;
+    }
+    applyLogMask(req, logConfig);
+    return insertLogRow(username, macaddres, ip, logType, desc, proc, trans, query, req, resp, err, timeEx);
+};
 exports.insertLog = insertLog;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pxp-nd/core",
-  "version": "1.2.91",
+  "version": "1.2.92",
   "description": "Contains main files for pxp-nd",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/test/stdout-log.test.ts

@@ -0,0 +1,242 @@
+/**
+ * logSink tests. No database.
+ *
+ * stdout writes one JSON line and returns a uuid without calling getManager.
+ * both writes the line and inserts in the background; the caller is not blocked on the insert.
+ * db (the default) still inserts and returns the numeric id.
+ */
+import 'reflect-metadata';
+import http from 'http';
+import { AddressInfo } from 'net';
+import express from 'express';
+import * as typeorm from 'typeorm';
+import { insertLog, STDOUT_LOG_FIELD_MAX } from '../src/lib/pxp/utils/Security';
+import { Controller } from '../src/lib/pxp/Controller';
+import { Authentication, Post, ReadOnly } from '../src/lib/pxp/Decorators';
+import { PxpError } from '../src/lib/pxp/PxpError';
+import { IConfigPxpApp } from '../src/interfaces';
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+const baseArgs = (req: Record<string, unknown>, logConfig: Record<string, unknown> = {}) =>
+  ['user', 'mac', '127.0.0.1', 'success', 'ok', 'mod', 'mod.tx', '', req, '{"ok":true}', '200', 12, logConfig] as const;
+
+const pxpLines = (spy: jest.SpyInstance): any[] =>
+  spy.mock.calls
+    .map((call) => call[0])
+    .filter((line) => typeof line === 'string' && line.includes('"pxpLog":true'))
+    .map((line) => JSON.parse(line));
+
+describe('insertLog sinks', () => {
+  let logSpy: jest.SpyInstance;
+  let getManager: jest.SpyInstance;
+  let execute: jest.Mock;
+  let values: jest.Mock;
+
+  beforeEach(() => {
+    logSpy = jest.spyOn(console, 'log').mockImplementation(() => undefined);
+    execute = jest.fn().mockResolvedValue({ identifiers: [{ logId: 7 }] });
+    values = jest.fn();
+    const qb = {
+      insert: jest.fn(),
+      into: jest.fn(),
+      values,
+      execute,
+    };
+    qb.insert.mockReturnValue(qb);
+    qb.into.mockReturnValue(qb);
+    values.mockReturnValue(qb);
+    getManager = jest.spyOn(typeorm, 'getManager').mockReturnValue({ createQueryBuilder: () => qb } as any);
+  });
+
+  afterEach(() => {
+    logSpy.mockRestore();
+    getManager.mockRestore();
+  });
+
+  test('stdout returns a uuid, writes one line, and does not touch the database', async () => {
+    const req = { card: '4111111111111111', keep: 'yes' };
+    const id = await insertLog(...baseArgs(req, { card: 'cc_mask' }), 'stdout');
+
+    expect(id).toMatch(UUID);
+    expect(getManager).not.toHaveBeenCalled();
+    expect(req).toEqual({ card: '4111111111111111', keep: 'yes' });
+
+    const [line] = pxpLines(logSpy);
+    expect(line.logId).toBe(id);
+    expect(line.type).toBe('success');
+    expect(line.user).toBe('user');
+    expect(line.transaction).toBe('mod.tx');
+    expect(line.status).toBe('200');
+    expect(line.truncated).toBe(false);
+    expect(line.request).toContain('************1111');
+    expect(line.request).not.toContain('4111111111111111');
+    expect(line.request).toContain('yes');
+  });
+
+  test('stdout drops masked-out fields and caps oversized bodies', async () => {
+    const req = { favicon: 'png', note: 'x'.repeat(STDOUT_LOG_FIELD_MAX + 500) };
+    await insertLog(...baseArgs(req, { favicon: null }), 'stdout');
+
+    const [line] = pxpLines(logSpy);
+    expect(line.request.startsWith('{"note":')).toBe(true);
+    expect(line.request).not.toContain('favicon');
+    expect(line.request.length).toBe(STDOUT_LOG_FIELD_MAX);
+    expect(line.truncated).toBe(true);
+    expect(req.favicon).toBe('png');
+  });
+
+  test('both returns the uuid before the insert finishes and stores __logId on the row', async () => {
+    let release: (value: unknown) => void = () => undefined;
+    execute.mockReturnValue(new Promise((resolve) => {
+      release = resolve;
+    }));
+
+    const id = await Promise.race([
+      insertLog(...baseArgs({ a: 1 }), 'both'),
+      new Promise((_resolve, reject) => setTimeout(() => reject(new Error('waited for the database')), 200)),
+    ]);
+
+    expect(id).toMatch(UUID);
+    const [line] = pxpLines(logSpy);
+    expect(line.logId).toBe(id);
+    expect(execute).toHaveBeenCalledTimes(1);
+
+    const row = values.mock.calls[0][0][0];
+    expect(JSON.parse(row.request).__logId).toBe(id);
+
+    release({ identifiers: [{ logId: 7 }] });
+  });
+
+  test('db stays on the numeric id and writes no stdout line', async () => {
+    const id = await insertLog(...baseArgs({ a: 1 }));
+
+    expect(id).toBe(7);
+    expect(getManager).toHaveBeenCalledTimes(1);
+    expect(pxpLines(logSpy)).toEqual([]);
+  });
+
+  test('a failing background insert does not reject', async () => {
+    execute.mockRejectedValue(new Error('connect ECONNREFUSED'));
+    const errorSpy = jest.spyOn(console, 'error').mockImplementation(() => undefined);
+    const unhandled: unknown[] = [];
+    const onUnhandled = (reason: unknown) => unhandled.push(reason);
+    process.on('unhandledRejection', onUnhandled);
+
+    const id = await insertLog(...baseArgs({ a: 1 }), 'both');
+    await new Promise((resolve) => setImmediate(resolve));
+
+    expect(id).toMatch(UUID);
+    expect(errorSpy).toHaveBeenCalledWith('[pxp-core] db log failed', 'connect ECONNREFUSED');
+    expect(unhandled).toEqual([]);
+
+    process.removeListener('unhandledRejection', onUnhandled);
+    errorSpy.mockRestore();
+  });
+});
+
+class Audited extends Controller {
+  @Post()
+  @ReadOnly(true)
+  @Authentication(false)
+  async fail() {
+    throw new PxpError(400, 'audit me');
+  }
+
+  @Post()
+  @ReadOnly(true)
+  @Authentication(false)
+  async ok() {
+    return { ok: true };
+  }
+}
+
+const call = (url: string) =>
+  new Promise<{ status: number; json: any }>((resolve, reject) => {
+    const payload = '{}';
+    const req = http.request(
+      url,
+      { method: 'POST', headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) } },
+      (res) => {
+        let raw = '';
+        res.setEncoding('utf8');
+        res.on('data', (chunk) => (raw += chunk));
+        res.on('end', () => resolve({ status: res.statusCode as number, json: JSON.parse(raw) }));
+      }
+    );
+    req.on('error', reject);
+    req.end(payload);
+  });
+
+describe('controller with logSink stdout', () => {
+  let server: http.Server;
+  let base: string;
+  let logSpy: jest.SpyInstance;
+  let getManager: jest.SpyInstance;
+
+  beforeAll(async () => {
+    const config: IConfigPxpApp = {
+      apiPrefix: '/api',
+      defaultDbSettings: 'Orm',
+      middlewares: [],
+      entities: {},
+      logSink: 'stdout',
+    };
+    const app = express();
+    app.use(express.json());
+    app.use((req: any, _res, next) => {
+      req.start = new Date();
+      next();
+    });
+    app.use('/', new Audited('test', null, config).router);
+    server = http.createServer(app);
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    const { port } = server.address() as AddressInfo;
+    base = `http://127.0.0.1:${port}/api/test/Audited`;
+  });
+
+  beforeEach(() => {
+    logSpy = jest.spyOn(console, 'log').mockImplementation(() => undefined);
+    getManager = jest.spyOn(typeorm, 'getManager').mockImplementation(() => {
+      throw new Error('stdout sink must not ask for a connection');
+    });
+  });
+
+  afterEach(() => {
+    logSpy.mockRestore();
+    getManager.mockRestore();
+  });
+
+  afterAll(async () => {
+    await new Promise((resolve) => server.close(resolve));
+  });
+
+  test('an error response carries the same uuid that was written to stdout', async () => {
+    const r = await call(`${base}/fail`);
+
+    expect(r.status).toBe(400);
+    expect(r.json.error.message).toBe('audit me');
+    expect(r.json.error.logId).toMatch(UUID);
+    expect(getManager).not.toHaveBeenCalled();
+
+    const [line] = pxpLines(logSpy);
+    expect(line.logId).toBe(r.json.error.logId);
+    expect(line.type).toBe('error');
+    expect(line.status).toBe(400);
+  });
+
+  test('a successful request is logged and still answers 200', async () => {
+    const r = await call(`${base}/ok`);
+    await new Promise((resolve) => setImmediate(resolve));
+
+    expect(r.status).toBe(200);
+    expect(r.json).toEqual({ ok: true });
+    expect(r.json.logId).toBeUndefined();
+    expect(getManager).not.toHaveBeenCalled();
+
+    const [line] = pxpLines(logSpy);
+    expect(line.logId).toMatch(UUID);
+    expect(line.type).toBe('success');
+    expect(line.status).toBe('200');
+  });
+});