harper 5.1.20 → 5.2.0-alpha.5

package/security/auth.ts

@@ -1,7 +1,7 @@
 import { getSuperUser } from './user.ts';
 import { server } from '../server/Server.ts';
 import { resources } from '../resources/Resources.ts';
-import { validateOperationToken, validateRefreshToken } from './tokenAuthentication.ts';
+import { validateOperationToken, validateRefreshToken, validateLoginToken, decodeJWT } from './tokenAuthentication.ts';
 import { table, type Table } from '../resources/databases.ts';
 import { v4 as uuid } from 'uuid';
 import * as env from '../utility/environment/environmentManager.ts';
@@ -10,7 +10,7 @@ import harperLogger from '../utility/logging/harper_logger.ts';
 const { forComponent, AuthAuditLog } = harperLogger;
 import serverHandlers from '../server/itc/serverHandlers.js';
 const { user } = serverHandlers;
-import { Headers } from '../server/serverHelpers/Headers.ts';
+import { Headers, addVaryHeader } from '../server/serverHelpers/Headers.ts';
 import { convertToMS } from '../utility/common_utils.ts';
 import { verifyCertificate } from './certificateVerification/index.ts';
 import { serializeMessage } from '../server/serverHelpers/contentTypes.ts';
@@ -33,16 +33,27 @@ function getSessionTable() {
 	return _sessionTable;
 }
 const ENABLE_SESSIONS = env.get(CONFIG_PARAMS.AUTHENTICATION_ENABLESESSIONS) ?? true;
+// env-var strings need boolean parsing: a raw 'false'/'0' string is truthy, which would turn
+// AUTHENTICATION_AUTHORIZELOCAL=false into an *enabled* auth bypass
+function envFlag(value: string | undefined): boolean | undefined {
+	if (value === undefined) return undefined;
+	const normalized = value.trim().toLowerCase();
+	return normalized !== 'false' && normalized !== '0' && normalized !== '';
+}
 // check the environment for a flag to bypass authentication (for testing) since it doesn't necessarily get set on child threads
 let AUTHORIZE_LOCAL =
-	process.env.AUTHENTICATION_AUTHORIZELOCAL ??
+	envFlag(process.env.AUTHENTICATION_AUTHORIZELOCAL) ??
 	env.get(CONFIG_PARAMS.AUTHENTICATION_AUTHORIZELOCAL) ??
-	process.env.DEV_MODE;
+	envFlag(process.env.DEV_MODE);
 const LOG_AUTH_SUCCESSFUL = env.get(CONFIG_PARAMS.LOGGING_AUDITAUTHEVENTS_LOGSUCCESSFUL) ?? false;
 const LOG_AUTH_FAILED = env.get(CONFIG_PARAMS.LOGGING_AUDITAUTHEVENTS_LOGFAILED) ?? false;
 
 const DEFAULT_COOKIE_EXPIRES = 'Tue, 01 Oct 8307 19:33:20 GMT';
 
+// RFC 9111 cache-scope directives; boundaries on both sides so a token like `public-foo` doesn't match
+const SHARED_CACHE_OPTIN = /(^|[,\s])(public|s-maxage)($|[\s,;=])/i;
+const PRIVATE_SCOPE = /(^|[,\s])(private|no-store)($|[\s,;=])/i;
+
 let authorizationCache = new Map();
 server.onInvalidatedUser(() => {
 	// TODO: Eventually we probably want to be able to invalidate individual users
@@ -61,6 +72,9 @@ export async function authentication(request, nextHandler) {
 	const cookie = headers.cookie;
 	let origin = headers.origin;
 	let responseHeaders = [];
+	// a 401 that gets rewritten to a login-redirect 302 below must still be treated as
+	// identity-dependent by applyResponseHeaders
+	let wasUnauthorized = false;
 	try {
 		if (origin) {
 			const accessList = request.isOperationsServer
@@ -80,6 +94,8 @@ export async function authentication(request, nextHandler) {
 						['Access-Control-Allow-Methods', 'POST, GET, PUT, DELETE, PATCH, OPTIONS'],
 						['Access-Control-Allow-Headers', accessControlAllowHeaders],
 						['Access-Control-Allow-Origin', origin],
+						// the preflight response is keyed on the request Origin — a shared cache must partition on it
+						['Vary', 'Origin'],
 					]);
 					if (ENABLE_SESSIONS) headers.set('Access-Control-Allow-Credentials', 'true');
 					return {
@@ -201,6 +217,10 @@ export async function authentication(request, nextHandler) {
 						case 'Bearer':
 							try {
 								newUser = await validateOperationToken(credentials);
+								// Capture the token's expiry so a live subscription opened with this bearer
+								// token can be revoked once it expires (#1414).
+								const decoded = decodeJWT(credentials);
+								if (newUser && decoded?.exp) newUser.authExpiresAt = decoded.exp;
 							} catch (error) {
 								if (error.message === 'invalid token') {
 									// see if they provided a refresh token; we can allow that and pass it on to operations API
@@ -315,14 +335,17 @@ export async function authentication(request, nextHandler) {
 					expiresAt: expires ? Date.now() + convertToMS(expires) : undefined,
 				});
 			};
-			request.login = async function (username: string, password: string) {
-				const user: any = (request.user = await server.authenticateUser(username, password, request));
+			request.login = async function (username: string, password?: string, token?: string) {
+				const user: any = (request.user = token
+					? await validateLoginToken(token)
+					: await server.authenticateUser(username, password, request));
 				request.session.update({ user: user && (user.getId?.() ?? user.username) });
 			};
 		}
 		const response = await nextHandler(request);
 		if (!response) return response;
 		if (response.status === 401) {
+			wasUnauthorized = true;
 			if (
 				headers['user-agent']?.startsWith('Mozilla') &&
 				headers.accept?.startsWith('text/html') &&
@@ -340,13 +363,50 @@ export async function authentication(request, nextHandler) {
 	}
 	function applyResponseHeaders(response) {
 		const l = responseHeaders.length;
-		if (l > 0) {
+		// a response is identity-dependent if a principal was resolved (Authorization/session/mTLS) or
+		// if we are rejecting the credentials (401, possibly rewritten to a login redirect); such a
+		// response must never be stored by a shared cache and served to a different principal (#1565)
+		const rejectedAuth = response?.status === 401 || wasUnauthorized;
+		const identityDependent = !!request.user || rejectedAuth;
+		// with CORS enabled the response is origin-dependent — ACAO reflects the request Origin, and
+		// its absence when no Origin was sent is origin-dependent too — so a shared cache must
+		// partition on Origin either way (#1518)
+		const corsEnabled = request.isOperationsServer ? operationsCors : appsCors;
+		if ((l > 0 || corsEnabled || identityDependent) && typeof response === 'object') {
 			let headers = response.headers;
-			if (!headers) response.headers = headers = new Headers();
-			for (let i = 0; i < l; ) {
+			// normalize plain-object headers so get/set below work uniformly
+			if (!headers || typeof headers.set !== 'function') response.headers = headers = new Headers(headers);
+			for (let i = 0; i < l;) {
 				const name = responseHeaders[i++];
 				headers.set(name, responseHeaders[i++]);
 			}
+			if (corsEnabled) addVaryHeader(headers, 'Origin');
+			// #1565: keep identity-dependent responses out of shared caches. An explicit
+			// `public`/`s-maxage` set by the app is RFC 9111's opt-in for shared-caching an
+			// authenticated response, so that is trusted as-is — but only for successfully
+			// authenticated responses; a credential rejection must never opt into shared caching.
+			// Otherwise partition on the credential headers and ensure a `private` scope
+			// (`private, no-cache` when none was set, so browsers still revalidate against the
+			// ETag/Last-Modified we emit).
+			if (identityDependent) {
+				const existingCacheControl = headers.get('Cache-Control');
+				const cacheControlString = existingCacheControl
+					? Array.isArray(existingCacheControl)
+						? existingCacheControl.join(', ')
+						: existingCacheControl
+					: '';
+				const optedIn = !rejectedAuth && SHARED_CACHE_OPTIN.test(cacheControlString);
+				if (!optedIn) {
+					addVaryHeader(headers, 'Authorization');
+					if (ENABLE_SESSIONS) addVaryHeader(headers, 'Cookie');
+					// a 401 never opts into shared caching: any non-private Cache-Control it carries is
+					// replaced outright (an existing private/no-store is already at least as strict)
+					if (!cacheControlString || (rejectedAuth && !PRIVATE_SCOPE.test(cacheControlString)))
+						headers.set('Cache-Control', 'private, no-cache');
+					else if (!PRIVATE_SCOPE.test(cacheControlString))
+						headers.set('Cache-Control', cacheControlString + ', private');
+				}
+			}
 		}
 		responseHeaders = null;
 		return response;
@@ -374,7 +434,7 @@ export async function login(loginObject) {
 	loginObject.baseResponse.headers.set = (name, value) => {
 		loginObject.fastifyResponse.header(name, value);
 	};
-	await loginObject.baseRequest.login(loginObject.username, loginObject.password ?? '');
+	await loginObject.baseRequest.login(loginObject.username, loginObject.password ?? '', loginObject.token);
 	return 'Login successful';
 }
 

package/security/jsLoader.ts

@@ -8,6 +8,7 @@ import { dirname, isAbsolute } from 'node:path';
 import { pathToFileURL, fileURLToPath } from 'node:url';
 import { SourceTextModule, SyntheticModule, createContext, runInContext, runInThisContext } from 'node:vm';
 import { ApplicationScope } from '../components/ApplicationScope.ts';
+import { getSecretsForComponent, runWithComponentBinding } from '../components/componentSecrets.ts';
 import logger from '../utility/logging/harper_logger.ts';
 import { createRequire } from 'node:module';
 import * as env from '../utility/environment/environmentManager';
@@ -76,6 +77,13 @@ export async function scopedImport(filePath: string | URL, scope?: ApplicationSc
 		}
 	}
 	const moduleUrl = (filePath instanceof URL ? filePath : pathToFileURL(filePath)).toString();
+	// Bind the component-load context for the duration of the load, so the process-wide `secrets`
+	// export (reached under the native loader, or by natively-loaded dependencies that import the
+	// real `harper` package) resolves to this scope's component while its modules evaluate.
+	return runWithComponentBinding(scope?.name, () => importScoped(moduleUrl, scope));
+}
+
+async function importScoped(moduleUrl: string, scope?: ApplicationScope) {
 	try {
 		const loaderMode = scope?.mode;
 		if (scope && loaderMode !== 'native') {
@@ -773,6 +781,7 @@ function getGlobalObject(scope: ApplicationScope, copyIntrinsics = false) {
 		logger: scope.logger ?? logger,
 		resources: scope.resources,
 		config: scope.config ?? {},
+		secrets: getSecretsForComponent(scope.name),
 		fetch: APPLICATIONS_LOCKDOWN === 'ses' ? secureOnlyFetch : fetch,
 		console,
 		global: appGlobal,
@@ -790,6 +799,9 @@ function getHarperExports(scope: ApplicationScope) {
 		logger: scope.logger ?? logger,
 		resources: scope.resources,
 		config: scope.config ?? {},
+		// The scoped-secrets view (#1550), bound exactly to this scope's component — per-scope, unlike
+		// the process-wide singletons below.
+		secrets: getSecretsForComponent(scope.name),
 		Resource,
 		tables,
 		databases,

package/security/tokenAuthentication.ts

@@ -25,11 +25,20 @@ env.initSync();
 type StringValue = SignOptions['expiresIn'];
 const OPERATION_TOKEN_TIMEOUT: StringValue = env.get(CONFIG_PARAMS.AUTHENTICATION_OPERATIONTOKENTIMEOUT) || '1d';
 const REFRESH_TOKEN_TIMEOUT: StringValue = env.get(CONFIG_PARAMS.AUTHENTICATION_REFRESHTOKENTIMEOUT) || '30d';
+// Default lifetime of a login-purpose token (see TOKEN_TYPE.LOGIN below). It only exists to be
+// exchanged for a session cookie, so it defaults far shorter than an operation token; callers can
+// still override via expires_in.
+const LOGIN_TOKEN_TIMEOUT: StringValue = '1m';
 const RSA_ALGORITHM: Algorithm = 'RS256';
 
 const TOKEN_TYPE = {
 	OPERATION: 'operation',
 	REFRESH: 'refresh',
+	// Purpose-scoped exchange token minted by createTokens({ purpose: 'login' }) and accepted only
+	// by validateLoginToken (the `login` operation). Its `sub` claim differs from
+	// TOKEN_TYPE.OPERATION, so validateOperationToken's Bearer-API path rejects it automatically —
+	// it can't be replayed as a general API credential the way a full operation token could.
+	LOGIN: 'login',
 };
 
 interface JWTRSAKeys {
@@ -45,6 +54,9 @@ interface AuthObject {
 	expires_in?: string | number;
 	bypass_auth?: boolean;
 	hdb_user?: User;
+	// 'login' mints a single short-lived, login-scoped token instead of an operation/refresh pair —
+	// see TOKEN_TYPE.LOGIN.
+	purpose?: 'login';
 }
 
 interface TokenObject {
@@ -52,6 +64,8 @@ interface TokenObject {
 }
 
 interface JWTTokens {
+	// Always the mint result: an operation JWT normally, or (purpose: 'login') the login-scoped
+	// exchange JWT — same field, same response shape, callers don't need to branch on purpose.
 	operation_token: string;
 	refresh_token?: string;
 }
@@ -99,7 +113,8 @@ export function clearJWTRSAKeysCache(): void {
 }
 
 /**
- * Creates a new operation token and refresh token.
+ * Creates a new operation token and refresh token (or, with `purpose: 'login'`, a single
+ * login-scoped token — see TOKEN_TYPE.LOGIN).
  * If there is no username and password, the hdb_user making the request is used in the token.
  * An optional role can be provided which will be saved in the token payload.
  * The token expires in the time specified in the expires_in field or the default time.
@@ -113,6 +128,7 @@ export async function createTokens(authObj: AuthObject): Promise<JWTTokens> {
 			password: Joi.string().optional(),
 			role: Joi.string().optional(),
 			expires_in: Joi.alternatives(Joi.string(), Joi.number()).optional(),
+			purpose: Joi.string().valid('login').optional(),
 		})
 	);
 	if (validation) throw new ClientError(validation.message);
@@ -147,6 +163,22 @@ export async function createTokens(authObj: AuthObject): Promise<JWTTokens> {
 	if (authObj.role) payload.role = authObj.role;
 
 	const keys: JWTRSAKeys = await getJWTRSAKeys();
+
+	if (authObj.purpose === 'login') {
+		// Login-scoped exchange token: no refresh token, no user record update — it's a one-shot
+		// ticket for the `login` operation to trade for a session cookie, not a standing credential.
+		const loginToken = jwt.sign(
+			{ username: authObj.username },
+			{ key: keys.privateKey, passphrase: keys.passphrase } satisfies Secret,
+			{
+				expiresIn: (authObj.expires_in ?? LOGIN_TOKEN_TIMEOUT) as StringValue,
+				algorithm: RSA_ALGORITHM,
+				subject: TOKEN_TYPE.LOGIN,
+			} satisfies SignOptions
+		);
+		return { operation_token: loginToken };
+	}
+
 	const operationToken = jwt.sign(
 		payload,
 		{ key: keys.privateKey, passphrase: keys.passphrase } satisfies Secret,
@@ -219,6 +251,15 @@ export async function validateRefreshToken(token: string): Promise<any> {
 	return validateToken(token, TOKEN_TYPE.REFRESH);
 }
 
+/**
+ * Validates a login-purpose token minted via createTokens({ purpose: 'login' }). Used solely by
+ * the `login` operation to exchange the token for an httpOnly session cookie — this is the only
+ * place a `sub: 'login'` token is accepted.
+ */
+export async function validateLoginToken(token: string): Promise<any> {
+	return validateToken(token, TOKEN_TYPE.LOGIN);
+}
+
 async function validateToken(token: string, tokenType: string): Promise<any> {
 	try {
 		const keys: JWTRSAKeys = await getJWTRSAKeys();

package/server/DESIGN.md

@@ -120,6 +120,16 @@ The default WebSocket upgrade handler is registered automatically inside `onWebS
 
 `REST.ts → http(request, nextHandler)` is the chief integration point: it takes a `Request`, asks the `Resources` registry for a match, builds a `RequestTarget`, and dispatches into the Resource class's static method. Cache headers are translated to `request.expiresAt` / `onlyIfCached` / `noCache` flags within the same function.
 
+### Response Cache-Control / Vary policy (#1518, #1565)
+
+Three tiers, applied in two places:
+
+1. **App/resource explicit** — a `Cache-Control` set by the resource (or `@table(cacheControl: "...")` for anonymous reads, emitted in `REST.ts → http()`) always wins. The declaration is required: anonymous readability alone never emits shared-cache headers, because a request-attribute-gated `allowRead` (IP, headers) would make inferred `public` unsound.
+2. **Identity floor** — `security/auth.ts → applyResponseHeaders` stamps `Cache-Control: private, no-cache` + `Vary: Authorization` (+ `Cookie` when sessions are on) on any response where a principal was resolved or credentials were rejected (401), _unless_ the app opted into shared caching with `public`/`s-maxage` (the RFC 9111 opt-in).
+3. **CORS partitioning** — when CORS is enabled, every response gets `Vary: Origin` (the ACAO header is reflected per-origin, and its absence on no-Origin requests is origin-dependent too).
+
+The `@table(cacheControl:)` value is persisted on the primary-key attribute (like `expiration`), so all threads and future boots see it; `resources/databases.ts → table()` treats `null` as "schema explicitly has none" (clears on reload) and `undefined` as "caller is not schema-defining" (no clobber from `add_attribute`/cluster schema events).
+
 ---
 
 ## "Where is X" cheat sheet

package/server/DurableSubscriptionsSession.ts

@@ -126,7 +126,11 @@ export async function getSession({
 	if (will) {
 		will.id = sessionId;
 		will.user = { username: user?.username };
-		getLastWill().put(will);
+		// Must be durably persisted before CONNACK is sent (getSession() resolving is what lets
+		// mqtt.ts send CONNACK). Otherwise a client that connects and then disconnects abruptly
+		// (no DISCONNECT packet) can race ahead of this write: SubscriptionsSession.disconnect()
+		// reads this same record back to publish the will, finds nothing, and silently drops it.
+		await getLastWill().put(will);
 	}
 	if (keepalive) {
 		// keep alive is the interval in seconds that the client will send a ping to the server
@@ -480,8 +484,8 @@ export class DurableSubscriptionsSession extends SubscriptionsSession {
 							}
 							subscription.acks.push(update.timestamp);
 							trace('Received ack', topic, update.timestamp);
-							getDurableSession().put(this.sessionRecord, { source: true }); // add source: true context to bypass any overloaded checks, as skipping this can lead to increased load
-							return;
+							// add source: true context to bypass any overloaded checks, as skipping this can lead to increased load
+							return getDurableSession().put(this.sessionRecord, { source: true });
 						}
 					}
 				}
@@ -493,7 +497,7 @@ export class DurableSubscriptionsSession extends SubscriptionsSession {
 				subscription.startTime = update.timestamp;
 			}
 		}
-		getDurableSession().put(this.sessionRecord, { source: true });
+		return getDurableSession().put(this.sessionRecord, { source: true });
 		// TODO: Increment the timestamp for the corresponding subscription, possibly recording any interim unacked messages
 	}
 

package/server/REST.ts

@@ -13,7 +13,7 @@ import { Request } from '../server/serverHelpers/Request.ts';
 import { RequestTarget } from '../resources/RequestTarget';
 import { entryMap } from '../resources/RecordEncoder.ts';
 
-const { errorToString } = harperLogger;
+const { errorToString, errorForLog } = harperLogger;
 const etagBytes = new Uint8Array(8);
 const etagFloat = new Float64Array(etagBytes.buffer, 0, 1);
 let httpOptions = {};
@@ -254,6 +254,20 @@ async function http(request: Request, nextHandler) {
 			headers,
 			body: undefined,
 		};
+		// #1565 converse: a declared `@table(cacheControl: "...")`/static cacheControl is emitted on
+		// anonymous reads so a shared cache/CDN can store public responses. Emission requires the
+		// explicit declaration — "the anonymous request succeeded" alone doesn't establish that the
+		// content is uniformly public (an allowRead gated on IP or headers would leak across a
+		// URL-keyed cache). Authenticated responses are excluded here — the auth layer applies a
+		// `private` floor to them instead.
+		if (!request.user && (method === 'GET' || method === 'HEAD')) {
+			const responseStatus = responseObject.status;
+			if (responseStatus === 200 || responseStatus === 304) {
+				const cacheControl = (resource as any)?.cacheControl;
+				// setIfNone: a resource-set Cache-Control (including a full no-store opt-out) always wins
+				if (cacheControl) headers.setIfNone('Cache-Control', cacheControl);
+			}
+		}
 		const loadedFromSource = target.loadedFromSource;
 		if (loadedFromSource !== undefined) {
 			// this appears to be a caching table with a source
@@ -270,10 +284,13 @@ async function http(request: Request, nextHandler) {
 		return responseObject;
 	} catch (error) {
 		error ??= new Error('Unknown error occurred');
-		let statusCode = error.statusCode ?? request.response.status;
+		// a thrown Response short-circuits as the response, the same as returning one
+		if (error instanceof Response) return finalizeResponse(error, headers, request.response.status, request);
+		// the HTTP status may be carried as `statusCode` (our error classes) or `status` (e.g. a thrown plain object)
+		let statusCode = error.statusCode ?? error.status ?? request.response.status;
 		if (statusCode) {
-			if (statusCode === 500) harperLogger.warn(error);
-			else harperLogger.info(error);
+			if (statusCode === 500) harperLogger.warn(errorForLog(error));
+			else harperLogger.info(errorForLog(error));
 			if (statusCode === 405) {
 				if (error.method) error.message += ` to handle HTTP method ${error.method.toUpperCase() || ''}`;
 				if (error.allow) {
@@ -281,7 +298,7 @@ async function http(request: Request, nextHandler) {
 					headers.setIfNone('Allow', error.allow.map((method) => method.toUpperCase()).join(', '));
 				}
 			}
-		} else harperLogger.error(error);
+		} else harperLogger.error(errorForLog(error));
 
 		// RFC 9457 Problem Details
 		const status = statusCode || 500;
@@ -348,7 +365,7 @@ export function handleApplication(scope: import('../components/Scope.ts').Scope)
 			let hasError;
 			(ws as any).on('error', (error) => {
 				hasError = true;
-				harperLogger.warn(error);
+				harperLogger.warn(errorForLog(error));
 			});
 			let deserializer;
 			(ws as any).on('message', function message(body) {
@@ -411,9 +428,9 @@ export function handleApplication(scope: import('../components/Scope.ts').Scope)
 				}
 			} catch (error) {
 				if (error.statusCode) {
-					if (error.statusCode === 500) harperLogger.warn(error);
-					else harperLogger.info(error);
-				} else harperLogger.error(error);
+					if (error.statusCode === 500) harperLogger.warn(errorForLog(error));
+					else harperLogger.info(errorForLog(error));
+				} else harperLogger.error(errorForLog(error));
 				ws.close(
 					HTTP_TO_WEBSOCKET_CLOSE_CODES[error.statusCode] || // try to return a helpful code
 						1011, // otherwise generic internal error

package/server/fastifyRoutes.ts

@@ -17,6 +17,7 @@ import getHeaderTimeoutConfig from './fastifyRoutes/helpers/getHeaderTimeoutConf
 import { serverErrorHandler } from '../server/serverHelpers/serverHandlers.js';
 import { registerContentHandlers } from '../server/serverHelpers/contentTypes.ts';
 import { server } from './Server.ts';
+import { registerFastifyInstance } from './http.ts';
 
 let fastifyServer;
 const routeFolders = new Set();
@@ -44,7 +45,15 @@ export function handleApplication(scope: import('../components/Scope.ts').Scope)
 		}
 		if (!fastifyServer) {
 			fastifyServer = buildServer(isHttps);
-			server.http((await fastifyServer).server);
+			const built = await fastifyServer;
+			server.http(built.server);
+			// Register the Fastify app for the http port(s). On plain Node the http.Server above
+			// cascades unhandled requests via the 'unhandled' event, but the Bun and uWS backends bind
+			// those ports themselves and have no Node http.Server to hand off to — they delegate to
+			// these legacy routes via inject() and look the instance up by port (see injectToFastify).
+			for (const port of [env.get(CONFIG_PARAMS.HTTP_PORT), env.get(CONFIG_PARAMS.HTTP_SECUREPORT)]) {
+				if (port != null) registerFastifyInstance(port, built);
+			}
 		}
 		const resolvedServer = await fastifyServer;
 		const routeFolder = dirname(entry.absolutePath);

package/server/graphqlQuerying.ts

@@ -559,8 +559,9 @@ async function graphqlQueryingHandler(request: Request) {
 		}
 		case 'POST': {
 			const requestBodyDeserialize = getDeserializer(request.headers.get('content-type'), true);
-			// @ts-expect-error: _nodeRequest is a custom property on request and is the IncomingMessage with is a Readable
-			const requestParams = await requestBodyDeserialize(request._nodeRequest);
+			// Read the body through request.body (as REST.ts does): it is a Readable-compatible
+			// body stream on every adapter, whereas _nodeRequest is null on the Bun/uWS adapters.
+			const requestParams = await requestBodyDeserialize(request.body as any);
 			assertRequestParams(requestParams);
 			return resolver(requestParams, request);
 		}
@@ -582,7 +583,7 @@ export function handleApplication(scope: import('../components/Scope.ts').Scope)
 				// Await the `graphqlHandler` call here so that errors are caught.
 				return await graphqlQueryingHandler(request as any);
 			} catch (error) {
-				logger.error(error);
+				logger.error(logger.errorForLog(error));
 
 				// Error Handling
 				// Based on the GraphQL specification, a GraphQL response (non-http) are a map with a `data` field and an `errors` field.