observe-node 1.0.5 → 1.0.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "observe-node",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Structured logs + Prometheus metrics SDK for Node.js (Loki/Grafana ready)",
   "main": "src/index.js",
   "type": "commonjs",

package/src/http/express.js

@@ -18,6 +18,16 @@ function redact(obj, keys = ["password","token","authorization","jwt","otp","sec
   return out;
 }
 
+function pickRequestBody(body, maxBytes = 20_000) {
+  if (!body || typeof body !== "object") return undefined;
+
+  const redacted = redact(body);
+  const bytes = safeJsonSizeBytes(redacted);
+  if (bytes == null) return { truncated: true, bytes: null };
+  if (bytes > maxBytes) return { truncated: true, bytes };
+  return { body: redacted, truncated: false, bytes };
+}
+
 function pickResponseBody(body, maxBytes = 20_000) {
   // limit response size (avoid huge payloads / images)
   const redacted = redact(body);
@@ -29,10 +39,13 @@ function pickResponseBody(body, maxBytes = 20_000) {
 
 function expressMiddleware(observe, opts = {}) {
   const maxResponseBytes = Number(opts.maxResponseBytes || 20_000);
+  const maxRequestBytes = Number(opts.maxRequestBytes || 20_000);
 
   return function (req, res, next) {
     const start = Date.now();
 
+    const capturedRequest = pickRequestBody(req.body, maxRequestBytes);
+
     // ✅ capture response body
     let capturedResponse;
     const _json = res.json.bind(res);
@@ -101,8 +114,6 @@ res.send = (body) => {
   // ✅ auth info (don’t log token)
   const hasAuth = !!req.headers.authorization;
 
-  // ✅ body (only if parsed)
-  const requestBody = req.body ? redact(req.body) : undefined;
 
   observe.emit({
     event_name: "http.response",
@@ -125,7 +136,7 @@ res.send = (body) => {
       query: req.query,                // parsed query object
       query_string: queryString,       // raw query string
       params: req.params,              // may be empty (see note)
-      body: requestBody,               // parsed body (if express.json ran before)
+     body: capturedRequest
     },
 
     response: {