domma-cms 0.52.0 → 0.53.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/server.js

@@ -56,8 +56,31 @@ if (MANAGER_SECRET && MANAGER_SECRET.length < 32) {
     console.warn('  WARNING: MANAGER_SECRET is set but too short (minimum 32 characters). Manager notifications disabled until fixed.');
 }
 
+/**
+ * Resolve the log level.
+ *
+ * `config/server.json` → `logging.level` wins; otherwise info in development
+ * and warn in production, as before. Made configurable because `warn` hides
+ * every 4xx and every `log.info` a plugin writes, so a rejected admin action -
+ * a site that fails to create, a certificate that fails to issue - leaves no
+ * trace at all and cannot be diagnosed after the fact.
+ *
+ * An unrecognised value falls back rather than throwing: a typo here must not
+ * stop the server booting.
+ */
+function resolveLogLevel() {
+    const VALID = ['fatal', 'error', 'warn', 'info', 'debug', 'trace', 'silent'];
+    const fallback = process.env.NODE_ENV === 'development' ? 'info' : 'warn';
+    const requested = process.env.LOG_LEVEL || (config.server && config.server.logging && config.server.logging.level);
+    if (!requested) return fallback;
+    const level = String(requested).toLowerCase().trim();
+    if (VALID.includes(level)) return level;
+    console.warn(`  WARNING: unknown log level "${requested}" - falling back to "${fallback}". Valid: ${VALID.join(', ')}`);
+    return fallback;
+}
+
 const app = Fastify({
-    logger: {level: process.env.NODE_ENV === 'development' ? 'info' : 'warn'},
+    logger: {level: resolveLogLevel()},
     // When running behind a reverse proxy (e.g. domma-cms-manager), trust the
     // X-Forwarded-For header so @fastify/rate-limit keys on the real client IP
     // rather than the proxy's loopback address.