soajs.controller 4.3.10 → 4.3.12

package/lib/logOnce.js

@@ -0,0 +1,45 @@
+'use strict';
+
+/**
+ * @license
+ * Copyright SOAJS All Rights Reserved.
+ *
+ * Use of this source code is governed by an Apache license that can be
+ * found in the LICENSE file at the root of this repository
+ */
+
+const reported = new Set();
+
+/**
+ * Log a message once per distinct key.
+ *
+ * Static misconfiguration is discovered inside the request path, so reporting it
+ * normally would repeat on every request for the lifetime of the process. The
+ * condition cannot resolve itself without a registry change, so the first report
+ * carries all the information the rest would.
+ *
+ * @param log    the soajs logger
+ * @param level  one of the logger levels, ex: error
+ * @param key    identifies the condition, repeats with the same key are dropped
+ * @param message
+ */
+function logOnce(log, level, key, message) {
+	if (reported.has(key)) {
+		return false;
+	}
+	if (!log || typeof log[level] !== "function") {
+		return false;
+	}
+	reported.add(key);
+	log[level](message);
+	return true;
+}
+
+/**
+ * Forget what has been reported. Used by the unit tests.
+ */
+function resetLogOnce() {
+	reported.clear();
+}
+
+module.exports = { logOnce, resetLogOnce };

package/mw/awareness/custom.js

@@ -145,7 +145,7 @@ let awareness_healthCheck = function (core, log) {
 
 					let stopLoggingAfter = registry.serviceConfig.awareness.maxLogCount;
 					if (statusObj.downCount <= stopLoggingAfter) {
-						log.warn("Self Awareness health check for service [" + sObj.name + "] for host [" + sObj.host + "] is NOT healthy");
+						log.error("Self Awareness health check for service [" + sObj.name + "] for host [" + sObj.host + "] is NOT healthy");
 					}
 					if (serviceAwarenessObj[sObj.name].healthy[sObj.version].indexOf(sObj.host) !== -1) {
 						//TODO: if we guarantee uniqueness we will not need the for loop
@@ -192,7 +192,7 @@ let awareness_healthCheck = function (core, log) {
 			}
 		}, function (err) {
 			if (err) {
-				log.warn('Unable to build awareness structure for services: ' + err);
+				log.error('Unable to build awareness structure for services: ' + err);
 			}
 		});
 	setTimeout(() => {

package/mw/awareness/ha.js

@@ -176,7 +176,9 @@ let lib = {
 				}, function () {
 					awarenessCache = myCache;
 					param.log.debug("Awareness cache rebuilt successfully");
-					param.log.debug(JSON.stringify(awarenessCache));
+					if (param.log.debug()) {
+						param.log.debug(JSON.stringify(awarenessCache));
+					}
 
 					let cacheTTL = registryModule.get().serviceConfig.awareness.cacheTTL;
 					if (cacheTTL) {

package/mw/awarenessEnv/custom.js

@@ -26,7 +26,7 @@ let fetchControllerHosts = function (core, log, next) {
 	registry = registryModule.get();
 	registryModule.loadOtherEnvControllerHosts(gatewayServiceName, function (error, hosts) {
 		if (error) {
-			log.warn("Failed to load controller hosts. reusing from previous load. Reason: " + error.message);
+			log.error("Failed to load controller hosts. reusing from previous load. Reason: " + error.message);
 		} else {
 			controllerHosts = hosts;
 		}
@@ -107,7 +107,7 @@ let awareness_healthCheck = function (core, log) {
 					// });
 				}, function (err) {
 					if (err) {
-						log.warn('Unable to build awareness ENV structure for controllers: ' + err);
+						log.error('Unable to build awareness ENV structure for controllers: ' + err);
 					}
 				});
 		}

package/mw/cache/index.js

@@ -12,6 +12,7 @@ const crypto = require('crypto');
 const get = (p, o) => p.reduce((xs, x) => (xs && xs[x]) ? xs[x] : null, o);
 const memory = require('./model/memory.js');
 const mongo = require('./model/mongo.js');
+const { logOnce } = require('../../lib/logOnce.js');
 
 let model = { memory, mongo };
 
@@ -102,7 +103,8 @@ module.exports = function (configuration) {
 
 		const modelType = cacheConfig.model || 'memory';
 		if (!model[modelType]) {
-			configuration.log.warn('Cache: Unknown model [' + modelType + ']. It can only be [memory || mongo]');
+			logOnce(configuration.log, "error", "cache_model_" + modelType,
+				'Cache: Unknown model [' + modelType + ']. It can only be [memory || mongo]. Caching is off.');
 			return next();
 		}
 
@@ -119,7 +121,8 @@ module.exports = function (configuration) {
 		let scope = apiConfig.scope;
 		if (scope !== 'tenant' && scope !== 'tenant_user') {
 			if (scope) {
-				configuration.log.warn('Cache: Unknown scope [' + scope + '] for API [' + method + ' ' + apiPath + ']. It can only be [tenant || tenant_user]. Falling back to default.');
+				logOnce(configuration.log, "error", "cache_scope_" + scope + "_" + method + "_" + apiPath,
+					'Cache: Unknown scope [' + scope + '] for API [' + method + ' ' + apiPath + ']. It can only be [tenant || tenant_user]. Falling back to default.');
 			}
 			scope = isAPIPublic ? 'tenant' : 'tenant_user';
 		}

package/mw/cache/model/mongo.js

@@ -22,10 +22,18 @@ let model = {
 		if (!model.mongo) {
 			model.mongo = new Mongo(dbConfiguration);
 			model.mongo.createIndex(cache_store, { 'l1': 1, 'l2': 1 }, { unique: true }, (err, index) => {
-				log.debug("Cache index: " + index + " created with error: " + err);
+				if (err) {
+					log.error("Cache index creation failed: " + err.message);
+				} else {
+					log.debug("Cache index created: " + index);
+				}
 			});
 			model.mongo.createIndex(cache_store, { 'expiresAt': 1 }, { expireAfterSeconds: 0 }, (err, index) => {
-				log.debug("Cache TTL index: " + index + " created with error: " + err);
+				if (err) {
+					log.error("Cache TTL index creation failed: " + err.message);
+				} else {
+					log.debug("Cache TTL index created: " + index);
+				}
 			});
 		}
 	},

package/mw/gotoService/index.js

@@ -50,7 +50,7 @@ module.exports = (configuration) => {
 			//create proxy info object before calling extractbuildparams
 			let proxy = false;
 			if (serviceInfo[1] === 'proxy' && serviceInfo[2] === 'redirect') {
-				req.soajs.log.error("Route: [/proxy/redirect] is deprecated. You should use [/soajs/proxy].");
+				req.soajs.log.info("Route: [/proxy/redirect] is deprecated. You should use [/soajs/proxy].");
 				proxy = true;
 			} else if (serviceInfo[1] === 'soajs' && serviceInfo[2] === 'proxy') {
 				proxy = true;
@@ -82,7 +82,9 @@ module.exports = (configuration) => {
 						req.soajs.registry.services[service_n]) {
 						req.soajs.log.debug(req.soajs.registry.services[service_n]);
 					}
-					req.soajs.log.warn(JSON.stringify({ "url": req.url, "headers": req.headers }));
+					if (req.soajs.log.warn()) {
+						req.soajs.log.warn(JSON.stringify({ "url": req.url, "headers": req.headers }));
+					}
 					return req.soajs.controllerResponse(core.error.getError(130));
 				}
 

package/mw/gotoService/lib/preRedirect.js

@@ -28,14 +28,16 @@ module.exports = (req, res, core, cb) => {
 		return req.soajs.controllerResponse(core.error.getError(131));
 	}
 	let nextStep = function (host, port, fullURI) {
-		req.soajs.log.info(JSON.stringify({
-			"serviceName": restServiceParams.name,
-			"host": host,
-			"version": restServiceParams.version,
-			"url": restServiceParams.url,
-			"port": restServiceParams.registry.port,
-			"header": req.headers
-		}));
+		if (req.soajs.log.info()) {
+			req.soajs.log.info(JSON.stringify({
+				"serviceName": restServiceParams.name,
+				"host": host,
+				"version": restServiceParams.version,
+				"url": restServiceParams.url,
+				"port": restServiceParams.registry.port,
+				"header": req.headers
+			}));
+		}
 
 		let requestTOR = restServiceParams.registry.requestTimeoutRenewal || config.requestTimeoutRenewal;
 		let requestTO = restServiceParams.registry.requestTimeout || config.requestTimeout;

package/mw/gotoService/redirectToService.js

@@ -81,7 +81,8 @@ function flushMonitorBuffer() {
 				}
 			})
 			.catch((error) => {
-				req.soajs.log.debug('Monitor buffer flush failed: ' + error.message);
+				//NOTE: the buffer was already cleared, these items are lost
+				req.soajs.log.error('Monitor buffer flush failed, ' + itemsToSend.length + ' items lost: ' + error.message);
 			});
 	});
 }
@@ -225,7 +226,7 @@ module.exports = (configuration) => {
 			if (monitor && !monitor_service_blacklist && monitor.req_info) {
 				monitoObj.port = req.soajs.controller.serviceParams.registry.port;
 				monitoObj.url = req.soajs.controller.serviceParams.url;
-				monitoObj.host = req.host;
+				monitoObj.host = obj.host;
 			}
 			if (monitor && !monitor_service_blacklist && monitor.req_header) {
 				monitoObj.headers = req.headers;

package/mw/idempotency/index.js

@@ -11,6 +11,7 @@
 const get = (p, o) => p.reduce((xs, x) => (xs && xs[x]) ? xs[x] : null, o);
 const memory = require('./model/memory.js');
 const mongo = require('./model/mongo.js');
+const { logOnce } = require('../../lib/logOnce.js');
 
 let model = { memory, mongo };
 
@@ -119,7 +120,8 @@ module.exports = function (configuration) {
 
 		const modelType = idempotencyConfig.model || 'memory';
 		if (!model[modelType]) {
-			configuration.log.warn('Idempotency: Unknown model [' + modelType + ']. It can only be [memory || mongo]');
+			logOnce(configuration.log, "error", "idempotency_model_" + modelType,
+				'Idempotency: Unknown model [' + modelType + ']. It can only be [memory || mongo]. Idempotency is off.');
 			return next();
 		}
 

package/mw/idempotency/model/mongo.js

@@ -22,10 +22,18 @@ let model = {
 		if (!model.mongo) {
 			model.mongo = new Mongo(dbConfiguration);
 			model.mongo.createIndex(idempotency_store, { 'l1': 1, 'l2': 1 }, { unique: true }, (err, index) => {
-				log.debug("Idempotency index: " + index + " created with error: " + err);
+				if (err) {
+					log.error("Idempotency index creation failed: " + err.message);
+				} else {
+					log.debug("Idempotency index created: " + index);
+				}
 			});
 			model.mongo.createIndex(idempotency_store, { 'expiresAt': 1 }, { expireAfterSeconds: 0 }, (err, index) => {
-				log.debug("Idempotency TTL index: " + index + " created with error: " + err);
+				if (err) {
+					log.error("Idempotency TTL index creation failed: " + err.message);
+				} else {
+					log.debug("Idempotency TTL index created: " + index);
+				}
 			});
 		}
 	},

package/mw/mt/index.js

@@ -330,7 +330,9 @@ module.exports = (configuration) => {
 															return callback();
 														});
 													} else {
-														req.soajs.log.debug(serviceName + " interConnect failed for [" + item.name + "@" + item.version + "]");
+														//NOTE: the peer is dropped from the injected address book, the calling
+														//		service will behave as if it was never configured
+														req.soajs.log.error(serviceName + " interConnect failed for [" + item.name + "@" + item.version + "], peer dropped from awareness");
 														return callback();
 													}
 												});

package/mw/mt/utils.js

@@ -190,8 +190,7 @@ let utils = {
 						let block = getCachedNetmask(addr);
 						return block && block.contains(ip);
 					} catch (err) {
-						obj.req.soajs.log.error('IP whitelist security configuration failed: ', addr);
-						obj.req.soajs.log.error(err);
+						obj.req.soajs.log.error('IP whitelist security configuration failed for [' + addr + ']: ' + (err.message || err));
 					}
 					return false;
 				}));
@@ -320,8 +319,7 @@ let utils = {
 					let block = getCachedNetmask(addr);
 					return block && block.contains(ip);
 				} catch (err) {
-					obj.req.soajs.log.error('Geographic security configuration failed: ', addr);
-					obj.req.soajs.log.error(err.message);
+					obj.req.soajs.log.error('Geographic security configuration failed for [' + addr + ']: ' + (err.message || err));
 				}
 				return false;
 			}));

package/mw/traffic/index.js

@@ -12,6 +12,7 @@
 const get = (p, o) => p.reduce((xs, x) => (xs && xs[x]) ? xs[x] : null, o);
 const memory = require('./model/memory.js');
 const mongo = require('./model/mongo.js');
+const { logOnce } = require('../../lib/logOnce.js');
 
 let model = {
 	memory, mongo
@@ -175,7 +176,8 @@ module.exports = function (configuration) {
 				if (trafficModel) {
 					throttling.model = trafficModel;
 					if (!model[throttling.model]) {
-						req.soajs.log.warn('Throttling:', 'Unkown model [' + throttling.model + ']. It can only be [memory || mongo]');
+						logOnce(req.soajs.log, "error", "throttling_model_" + throttling.model,
+							'Throttling: Unknown model [' + throttling.model + ']. It can only be [memory || mongo]. Throttling is off.');
 						return next();
 					}
 				}

package/mw/traffic/model/mongo.js

@@ -23,7 +23,11 @@ let model = {
         if (!model.mongo) {
             model.mongo = new Mongo(dbConfiguration);
             model.mongo.createIndex(throttling_monitor, { 'l1': 1, 'l2': 1 }, {}, (err, index) => {
-                log.debug("Index: " + index + " created with error: " + err);
+                if (err) {
+                    log.error("Throttling index creation failed: " + err.message);
+                } else {
+                    log.debug("Throttling index created: " + index);
+                }
             });
         }
     },

package/mw/url/index.js

@@ -64,7 +64,9 @@ module.exports = (configuration) => {
 				!req.soajs.registry.services[req.soajs.controller.serviceParams.service_n]
 			)) {
 			req.soajs.log.fatal("Service [" + req.soajs.controller.serviceParams.service_n + "] URL [" + req.url + "] couldn't be matched to a service or the service entry in registry is missing [port || hosts]");
-			req.soajs.log.warn(JSON.stringify({ "url": req.url, "headers": req.headers }));
+			if (req.soajs.log.warn()) {
+				req.soajs.log.warn(JSON.stringify({ "url": req.url, "headers": req.headers }));
+			}
 			return req.soajs.controllerResponse(core.error.getError(130));
 		}
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "soajs.controller",
   "description": "soajs multi tenant API gateway",
-  "version": "4.3.10",
+  "version": "4.3.12",
   "author": {
     "name": "soajs team",
     "email": "team@soajs.org"

package/server/controller.js

@@ -74,7 +74,7 @@ Controller.prototype.init = function (callback) {
 			let log = core.getLogger(_self.soajs.param.init.serviceName, registry.serviceConfig.logger);
 			if (service.fetched) {
 				if (!service.fetched.result) {
-					log.warn("Unable to find the service host ip. The service will NOT be registered for awareness.");
+					log.error("Unable to find the service host ip. The service will NOT be registered for awareness.");
 					log.info("IPs found: ", service.fetched.extra.ips);
 					log.warn("The default service IP has been used [" + service.ip + "]");
 				} else {
@@ -316,7 +316,7 @@ Controller.prototype.start = function (registry, log, service, server, serverMai
 								});
 							});
 						} else {
-							log.warn("Unable to register host IP [" + service.ip + "] for service [" + _self.soajs.param.init.serviceName + "@" + _self.soajs.param.init.serviceVersion + "]");
+							log.error("Unable to register host IP [" + service.ip + "] for service [" + _self.soajs.param.init.serviceName + "@" + _self.soajs.param.init.serviceVersion + "]");
 						}
 					});
 				}

package/server/maintenance.js

@@ -145,7 +145,7 @@ let reloadRegistry = (parsedUrl, core, log, param, serviceIp, cb) => {
 	}, function (err, reg) {
 		let response = maintenanceResponse(parsedUrl, param);
 		if (err) {
-			log.warn("Failed to load registry. reusing from previous load. Reason: " + err.message);
+			log.error("Failed to load registry. reusing from previous load. Reason: " + err.message);
 		} else {
 			response.result = true;
 			response.data = cloneAndFilterRegistry(reg);
@@ -236,7 +236,7 @@ let Maintenance = (core, log, param, serviceIp, regEnvironment, awareness_mw, so
 							infoObj = body;
 						}
 						if (!soajsLib.version.validate(infoObj.version)) {
-							log.warn("Failed to register service for [" + infoObj.name + "@" + infoObj.version + "] version should be of format [1.1]");
+							log.error("Failed to register service for [" + infoObj.name + "@" + infoObj.version + "] version should be of format [1.1]");
 							// res.writeHead(200, {'Content-Type': 'application/json'});
 							return res.end(JSON.stringify(response));
 						}
@@ -287,7 +287,7 @@ let Maintenance = (core, log, param, serviceIp, regEnvironment, awareness_mw, so
 									response.result = true;
 									response.data = data;
 								} else {
-									log.warn("Failed to register service for [" + infoObj.name + "] " + err.message);
+									log.error("Failed to register service for [" + infoObj.name + "] " + err.message);
 								}
 								return res.end(JSON.stringify(response));
 							});

package/test/unit/index.js

@@ -10,6 +10,7 @@ describe("Starting Gateway Unit test", () => {
         require("./lib/apiPathParam2apiRegExp.js");
         require("./lib/http.js");
         require("./lib/ip.js");
+        require("./lib/logOnce.js");
         require("./lib/param.js");
         require("./lib/parseURL.js");
 

package/test/unit/lib/logOnce.js

@@ -0,0 +1,81 @@
+"use strict";
+
+/**
+ * @license
+ * Copyright SOAJS All Rights Reserved.
+ *
+ * Use of this source code is governed by an Apache license that can be
+ * found in the LICENSE file at the root of this repository
+ */
+
+const assert = require('assert');
+const helper = require("../../helper.js");
+
+let logOnceLib = helper.requireModule('./lib/logOnce.js');
+const { logOnce, resetLogOnce } = logOnceLib;
+
+describe("Unit test for: lib - logOnce", () => {
+
+	let emitted = [];
+	let log = {
+		error: (input) => {
+			emitted.push({ "level": "error", "input": input });
+		},
+		warn: (input) => {
+			emitted.push({ "level": "warn", "input": input });
+		}
+	};
+
+	beforeEach(() => {
+		emitted = [];
+		resetLogOnce();
+	});
+
+	it("emits the first time", (done) => {
+		let did = logOnce(log, "error", "k1", "boom");
+		assert.strictEqual(did, true);
+		assert.strictEqual(emitted.length, 1);
+		assert.strictEqual(emitted[0].level, "error");
+		assert.strictEqual(emitted[0].input, "boom");
+		done();
+	});
+
+	it("drops repeats of the same key", (done) => {
+		for (let i = 0; i < 100; i++) {
+			logOnce(log, "error", "k1", "boom");
+		}
+		assert.strictEqual(emitted.length, 1);
+		done();
+	});
+
+	it("keeps distinct keys separate", (done) => {
+		logOnce(log, "error", "k1", "one");
+		logOnce(log, "error", "k2", "two");
+		logOnce(log, "error", "k1", "one again");
+		assert.strictEqual(emitted.length, 2);
+		assert.strictEqual(emitted[0].input, "one");
+		assert.strictEqual(emitted[1].input, "two");
+		done();
+	});
+
+	it("honours the requested level", (done) => {
+		logOnce(log, "warn", "k3", "careful");
+		assert.strictEqual(emitted[0].level, "warn");
+		done();
+	});
+
+	it("does not throw on a missing logger or unknown level", (done) => {
+		assert.strictEqual(logOnce(null, "error", "k4", "x"), false);
+		assert.strictEqual(logOnce(log, "nosuchlevel", "k5", "x"), false);
+		assert.strictEqual(emitted.length, 0);
+		done();
+	});
+
+	it("does not consume the key when it could not emit", (done) => {
+		logOnce(null, "error", "k6", "x");
+		let did = logOnce(log, "error", "k6", "now it works");
+		assert.strictEqual(did, true);
+		assert.strictEqual(emitted.length, 1);
+		done();
+	});
+});

package/test/unit/utilities/utils.js

@@ -1,10 +1,82 @@
 "use strict"
+const assert = require('assert');
 const helper = require("../../helper.js");
 
 let utils = helper.requireModule('./utilities/utils.js');
 
 describe("Testing utilities", () => {
 
+	const TOKEN = "e2d0ffb0f0e34bd6a8e0a0b4a1d1b6c1f2a3b4c5";
+	const EKEY = "aa39b5490c4a4ed0e56d7ec1232a428f771e8bb83cfcee16de14f735d0f5da58";
+	const IKEY = "38145c67717c73d3febd16df38abf311";
+
+	let logged = {
+		"error": [],
+		"warn": []
+	};
+
+	/**
+	 * bunyan semantics: log.<level>() with no argument returns whether that level is
+	 * enabled, log.<level>(input) writes the record. The gateway relies on the first
+	 * form to skip building log payloads that would be discarded.
+	 */
+	let makeLog = (enabled) => {
+		return {
+			error: (input) => {
+				if (input === undefined) {
+					return enabled;
+				}
+				logged.error.push(input);
+			},
+			warn: (input) => {
+				if (input === undefined) {
+					return enabled;
+				}
+				logged.warn.push(input);
+			}
+		};
+	};
+
+	let makeReq = (enabled) => {
+		return {
+			method: "GET",
+			url: "/urac/user/getprofile?access_token=" + TOKEN + "&key=" + EKEY + "&id=42",
+			headers: {
+				"access_token": TOKEN,
+				"key": EKEY,
+				"authorization": "Bearer " + TOKEN
+			},
+			getClientIP: () => {
+				return "196.218.44.17";
+			},
+			getClientUserAgent: () => {
+				return "mocha-agent";
+			},
+			soajs: {
+				log: makeLog(enabled),
+				controller: {
+					serviceParams: {
+						name: "urac",
+						version: "3",
+						parsedUrl: { pathname: "/urac/user/getprofile" }
+					}
+				},
+				tenant: {
+					id: "5c0e74ba9acc3c5a84a51259",
+					code: "TSTM",
+					key: { iKey: IKEY, eKey: EKEY },
+					application: { product: "TPROD", package: "TPROD_BASIC" }
+				},
+				buildResponse: (input) => {
+					return input;
+				},
+				controllerResponse: (input) => {
+					return input;
+				}
+			}
+		};
+	};
+
 	let res = {
 		status: () => {
 			return {
@@ -18,24 +90,12 @@ describe("Testing utilities", () => {
 		}
 	};
 
-	let req = {
-		soajs: {
-			log: {
-				error: (input) => {
-					// console.error(input);
-				},
-				warn: (input) => {
-					// console.error(input);
-				}
-			},
-			buildResponse: (input) => {
-				return input;
-			},
-			controllerResponse: (input) => {
-				return input;
-			}
-		}
-	};
+	let req = makeReq(true);
+
+	beforeEach(() => {
+		logged.error = [];
+		logged.warn = [];
+	});
 
 	it("logErrors - number error", (done) => {
 		utils.logErrors(123, req, res, (error) => {
@@ -49,6 +109,43 @@ describe("Testing utilities", () => {
 		});
 	});
 
+	it("logErrors - no longer duplicates what the error context reports", (done) => {
+		// the full chain: logErrors -> controllerClientErrorHandler -> controllerErrorHandler
+		let r = makeReq(true);
+		let oauthErr = new Error("The access token provided is invalid.");
+		oauthErr.name = "OAuth2Error";
+		oauthErr.code = 401;
+
+		utils.logErrors(oauthErr, r, res, (e1) => {
+			utils.controllerClientErrorHandler(e1, r, res, (e2) => {
+				utils.controllerErrorHandler(e2, r, res, null);
+			});
+		});
+
+		assert.strictEqual(logged.error.length, 1, "expected exactly one error line for one failure");
+		let ctx = JSON.parse(logged.error[0]);
+		assert.strictEqual(ctx.code, 401);
+		assert.strictEqual(ctx.msg, "The access token provided is invalid.");
+		done();
+	});
+
+	it("logErrors - keeps the underlying cause when it becomes a generic 164", (done) => {
+		// an error with neither code nor msg is replaced by 164, so the context line
+		// cannot report the original. logErrors must still record it.
+		let r = makeReq(true);
+		utils.logErrors({ "message": "socket hang up" }, r, res, (e1) => {
+			utils.controllerClientErrorHandler(e1, r, res, (e2) => {
+				utils.controllerErrorHandler(e2, r, res, null);
+			});
+		});
+
+		assert.strictEqual(logged.error.length, 2);
+		assert.strictEqual(logged.error[0], "socket hang up", "underlying cause must survive");
+		let ctx = JSON.parse(logged.error[1]);
+		assert.strictEqual(ctx.code, 164);
+		done();
+	});
+
 	it("logErrors - string error", (done) => {
 		utils.logErrors("error", req, res, (error) => {
 			done();
@@ -76,4 +173,94 @@ describe("Testing utilities", () => {
 		utils.controllerErrorHandler({ "code": 200, "msg": "dummy200" }, req, res, null);
 		done();
 	});
-});
+
+	it("controllerErrorHandler - emits the redacted context at error level", (done) => {
+		let r = makeReq(true);
+		utils.controllerErrorHandler({ "code": 401, "msg": "The access token provided is invalid." }, r, res, null);
+
+		assert.strictEqual(logged.error.length, 1);
+		let ctx = JSON.parse(logged.error[0]);
+		assert.strictEqual(ctx.code, 401);
+		assert.strictEqual(ctx.msg, "The access token provided is invalid.");
+		assert.strictEqual(ctx.method, "GET");
+		assert.strictEqual(ctx.service, "urac");
+		assert.strictEqual(ctx.version, "3");
+		assert.strictEqual(ctx.api, "/urac/user/getprofile");
+		assert.strictEqual(ctx.ip, "196.218.44.17");
+		assert.strictEqual(ctx.ua, "mocha-agent");
+		assert.deepStrictEqual(ctx.tenant, { "id": "5c0e74ba9acc3c5a84a51259", "code": "TSTM" });
+		assert.strictEqual(ctx.iKey, IKEY);
+		assert.deepStrictEqual(ctx.application, { "product": "TPROD", "package": "TPROD_BASIC" });
+		done();
+	});
+
+	it("controllerErrorHandler - masks credentials and never logs headers", (done) => {
+		let r = makeReq(true);
+		utils.controllerErrorHandler({ "code": 401, "msg": "bad token" }, r, res, null);
+
+		let line = logged.error[0];
+		assert.strictEqual(line.indexOf(TOKEN), -1, "access_token leaked into the error context");
+		assert.strictEqual(line.indexOf(EKEY), -1, "eKey leaked into the error context");
+		assert.strictEqual(line.indexOf("authorization"), -1, "headers leaked into the error context");
+
+		let ctx = JSON.parse(line);
+		assert.strictEqual(ctx.url, "/urac/user/getprofile?access_token=***&key=***&id=42");
+		done();
+	});
+
+	it("controllerErrorHandler - numeric error resolves code and message", (done) => {
+		let r = makeReq(true);
+		utils.controllerErrorHandler(143, r, res, null);
+
+		let ctx = JSON.parse(logged.error[0]);
+		assert.strictEqual(ctx.code, 143);
+		assert.strictEqual(ctx.msg, "invalid_request: Malformed auth header");
+		done();
+	});
+
+	it("controllerErrorHandler - includes the resolved username when present", (done) => {
+		let r = makeReq(true);
+		r.soajs.uracDriver = { "username": "owner" };
+		utils.controllerErrorHandler({ "code": 401, "msg": "bad token" }, r, res, null);
+
+		let ctx = JSON.parse(logged.error[0]);
+		assert.strictEqual(ctx.username, "owner");
+		done();
+	});
+
+	it("controllerErrorHandler - degraded request without tenant or serviceParams", (done) => {
+		let r = makeReq(true);
+		r.soajs.controller = {};
+		delete r.soajs.tenant;
+		utils.controllerErrorHandler(130, r, res, null);
+
+		let ctx = JSON.parse(logged.error[0]);
+		assert.strictEqual(ctx.service, null);
+		assert.strictEqual(ctx.version, null);
+		assert.strictEqual(ctx.api, null);
+		assert.strictEqual(ctx.tenant, undefined);
+		assert.strictEqual(ctx.iKey, undefined);
+		assert.strictEqual(ctx.application, undefined);
+		done();
+	});
+
+	it("controllerErrorHandler - skips both payloads when the levels are off", (done) => {
+		let r = makeReq(false);
+		utils.controllerErrorHandler({ "code": 401, "msg": "bad token" }, r, res, null);
+
+		assert.strictEqual(logged.error.length, 0);
+		assert.strictEqual(logged.warn.length, 0);
+		done();
+	});
+
+	it("controllerErrorHandler - the warn dump still carries the raw headers", (done) => {
+		let r = makeReq(true);
+		utils.controllerErrorHandler({ "code": 401, "msg": "bad token" }, r, res, null);
+
+		assert.strictEqual(logged.warn.length, 1);
+		let dump = JSON.parse(logged.warn[0]);
+		assert.strictEqual(dump.headers.access_token, TOKEN);
+		assert.strictEqual(dump.url, r.url);
+		done();
+	});
+});

package/utilities/utils.js

@@ -11,6 +11,72 @@
 const coreModules = require("soajs.core.modules");
 let core = coreModules.core;
 
+//NOTE: credentials that must never reach the logs, they are masked in the query string
+const SENSITIVE_QS = /([?&](?:access_token|refresh_token|key)=)[^&]*/gi;
+
+/**
+ * Mask credentials in a url query string
+ *
+ * @param url
+ * @returns {string|null}
+ */
+function redactUrl(url) {
+    return url ? url.replace(SENSITIVE_QS, '$1***') : null;
+}
+
+/**
+ * Build a compact and redacted context for an error response.
+ * NOTE: headers are never included, they carry access_token, key, authorization and soajsinjectobj.
+ *
+ * @param err
+ * @param req
+ * @returns {Object}
+ */
+function errorContext(err, req) {
+    let soajs = req.soajs || {};
+    let serviceParams = (soajs.controller && soajs.controller.serviceParams) || {};
+    let tenant = soajs.tenant || {};
+
+    let code = null;
+    let msg = null;
+    if (typeof err === "number") {
+        code = err;
+        msg = core.error.generate(err).message;
+    } else if (err && typeof err === "object") {
+        code = err.code || err.status || null;
+        msg = err.msg || err.message || null;
+    }
+
+    let context = {
+        "code": code,
+        "msg": msg,
+        "method": req.method,
+        "service": serviceParams.name || serviceParams.service_n || null,
+        "version": serviceParams.version || null,
+        "api": (serviceParams.parsedUrl && serviceParams.parsedUrl.pathname) || null,
+        "url": redactUrl(req.url),
+        "ip": req.getClientIP ? req.getClientIP() : null,
+        "ua": req.getClientUserAgent ? req.getClientUserAgent() : null
+    };
+    if (tenant.id) {
+        context.tenant = { "id": tenant.id, "code": tenant.code };
+    }
+    //NOTE: iKey only, the eKey is the credential the client authenticates with
+    if (tenant.key && tenant.key.iKey) {
+        context.iKey = tenant.key.iKey;
+    }
+    if (tenant.application) {
+        context.application = {
+            "product": tenant.application.product,
+            "package": tenant.application.package
+        };
+    }
+    if (soajs.uracDriver && soajs.uracDriver.username) {
+        context.username = soajs.uracDriver.username;
+    }
+    return context;
+}
+
 //-------------------------- ERROR Handling MW - service & controller
 /**
  *
@@ -20,13 +86,15 @@ let core = coreModules.core;
  * @param next
  */
 function logErrors(err, req, res, next) {
+    //NOTE: every error routed here reaches controllerErrorHandler, which logs a
+    //      structured context carrying the code and the message. The cases below
+    //      only log what that context cannot reproduce, which is the underlying
+    //      cause of an error that gets replaced by the generic 164.
     if (typeof err === "number") {
-        req.soajs.log.error(core.error.generate(err).message);
         return next(err);
     }
     if (typeof err === "object") {
         if (err.code && err.message) {
-            req.soajs.log.error(err.message);
             if (err.name === "OAuth2Error") {
                 return next({ "code": err.code, "status": err.code, "msg": err.message });
             } else {
@@ -34,15 +102,12 @@ function logErrors(err, req, res, next) {
             }
         } else if (err.code && err.msg) {
             err.message = err.msg;
-            req.soajs.log.error(err.message);
             return next(err);
         } else {
             req.soajs.log.error(err.message || err);
-            req.soajs.log.error(core.error.generate(164).message);
         }
     } else {
         req.soajs.log.error(err);
-        req.soajs.log.error(core.error.generate(164).message);
     }
 
     return next(core.error.getError(164));
@@ -77,7 +142,13 @@ function controllerClientErrorHandler(err, req, res, next) {
  */
 function controllerErrorHandler(err, req, res, next) {
 
-    req.soajs.log.warn(JSON.stringify({ "url": req.url, "headers": req.headers }));
+    if (req.soajs.log.error()) {
+        req.soajs.log.error(JSON.stringify(errorContext(err, req)));
+    }
+    //NOTE: the full header dump stays at warn, it is a debugging aid and it is not redacted
+    if (req.soajs.log.warn()) {
+        req.soajs.log.warn(JSON.stringify({ "url": req.url, "headers": req.headers }));
+    }
 
     if (err.code && err.msg) {
         err.status = err.status || 500;