@uns-kit/api 3.0.20 → 3.0.22

package/dist/request-log.d.ts

@@ -1,2 +1,3 @@
 import type { NextFunction, Request, Response } from "express";
-export declare const logRequestContext: (req: Request, _res: Response, next: NextFunction) => void;
+export declare const SAFE_REQUEST_LOGGING_VERSION = 1;
+export declare const logRequestContext: (req: Request, res: Response, next: NextFunction) => void;

package/dist/request-log.js

@@ -1,28 +1,28 @@
-import jwt from "jsonwebtoken";
+import { randomUUID } from "node:crypto";
+import { performance } from "node:perf_hooks";
 import logger from "@uns-kit/core/logger.js";
-const resolveUser = (req) => {
-    const authHeader = req.headers.authorization;
-    if (!authHeader || !authHeader.startsWith("Bearer ")) {
-        return "Anonymous";
-    }
-    const token = authHeader.slice(7);
-    try {
-        const decoded = jwt.decode(token);
-        if (decoded?.email && typeof decoded.email === "string") {
-            return decoded.email;
-        }
-        return "Unknown";
-    }
-    catch {
-        return "Unknown";
-    }
-};
-export const logRequestContext = (req, _res, next) => {
-    logger.info({
-        timestamp: new Date().toISOString(),
-        user: resolveUser(req),
-        endpoint: `${req.method} ${req.originalUrl || req.url}`,
-        message: "Request received",
-    });
+// Capability marker for applications that must reject the older unsafe logger.
+export const SAFE_REQUEST_LOGGING_VERSION = 1;
+// This is server-local metadata, not an HTTP header a caller can forge.
+const requestIdSymbol = Symbol.for("uns.http.request-id");
+const methods = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
+export const logRequestContext = (req, res, next) => {
+    const requestId = randomUUID();
+    req[requestIdSymbol] = requestId;
+    res.setHeader("x-request-id", requestId);
+    const method = methods.has(req.method) ? req.method : "OTHER";
+    const startedAt = performance.now();
+    // URLs carry UNS topics/query parameters; decoded JWTs are not authenticated identities.
+    // Downstream authenticated handlers can attach verified caller IDs to this request ID.
+    logger.info({ timestamp: new Date().toISOString(), event: "http.received", requestId, method, message: "Request received" });
+    let completed = false;
+    const finish = (outcome) => {
+        if (completed)
+            return;
+        completed = true;
+        logger.info({ timestamp: new Date().toISOString(), event: "http.transport.completed", requestId, method, status: res.statusCode, outcome, durationMs: Math.round(performance.now() - startedAt), message: "Request completed" });
+    };
+    res.once("finish", () => finish("completed"));
+    res.once("close", () => finish(res.writableFinished ? "completed" : "disconnected"));
     next();
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uns-kit/api",
-  "version": "3.0.20",
+  "version": "3.0.22",
   "description": "Express-powered API gateway plugin for UnsProxyProcess with JWT/JWKS support.",
   "type": "module",
   "license": "MIT",
@@ -37,7 +37,7 @@
     "multer": "^2.2.0",
     "hyparquet-writer": "^0.16.5",
     "uuid": "^14.0.1",
-    "@uns-kit/core": "3.0.20"
+    "@uns-kit/core": "3.0.22"
   },
   "devDependencies": {
     "@types/cookie-parser": "^1.4.10",