feat: Add structured request/response logging with redaction (#590)

stellar-payment-platform/server.js

@@ -1,5 +1,6 @@
 require('./config/envCheck');
 const express = require('express');
+const pinoHttp = require('pino-http');
 const cors = require('cors');
 const { securityMiddleware } = require('./src/middleware/security');
 const crypto = require('crypto');
@@ -18,8 +19,7 @@ const timeout = require('connect-timeout');
 const compression = require('compression');
 const { verifyMultiSignerThreshold } = require('./src/multisigner-verifier');
 const { poolGet, poolRun, poolAll } = require('./src/db');
-const { logger } = require('./src/logger');
-const pinoHttp = require('pino-http');
+const { logger, httpLogger } = require('./src/logger');
 const xss = require('xss');
 const { Keypair, StrKey } = require('@stellar/stellar-sdk');
 const {

stellar-payment-platform/src/logger.js

@@ -1,4 +1,5 @@
 const pino = require('pino');
+const pinoHttp = require('pino-http');
 
 const LOG_LEVEL = process.env.LOG_LEVEL || (process.env.NODE_ENV === 'production' ? 'info' : 'debug');
 const IS_TEST = process.env.NODE_ENV === 'test';
@@ -12,4 +13,48 @@ const logger = pino({
   },
 });
 
-module.exports = { logger };
+const redactSensitive = (obj) => {
+  if (!obj || typeof obj !== 'object') return obj;
+  if (Array.isArray(obj)) return obj.map(redactSensitive);
+  const clone = { ...obj };
+  const sensitiveFields = ['signature', 'secret', 'x-api-key', 'authorization'];
+
+  for (const key of Object.keys(clone)) {
+    if (sensitiveFields.includes(key.toLowerCase())) {
+      clone[key] = '[REDACTED]';
+    } else if (typeof clone[key] === 'object' && clone[key] !== null) {
+      clone[key] = redactSensitive(clone[key]);
+    }
+  }
+  return clone;
+};
+
+const httpLogger = pinoHttp({
+  logger,
+  autoLogging: true,
+  serializers: {
+    req: (req) => {
+      const serialized = {
+        method: req.method,
+        path: req.url,
+      };
+
+      if (req.raw && req.raw.headers) {
+        serialized.headers = redactSensitive(req.raw.headers);
+      } else if (req.headers) {
+        serialized.headers = redactSensitive(req.headers);
+      }
+
+      if (req.raw && req.raw.body) {
+        serialized.body = redactSensitive(req.raw.body);
+      }
+
+      return serialized;
+    },
+    res: (res) => ({
+      status: res.statusCode,
+    })
+  }
+});
+
+module.exports = { logger, httpLogger };

stellar-payment-platform/tests/db-pool-monitor.test.js

@@ -11,6 +11,7 @@ const mockLogger = {
 // Mock the logger before the module is loaded
 jest.mock('../src/logger', () => ({
   logger: mockLogger,
+  httpLogger: (req, res, next) => next(),
 }));
 
 describe('DB Pool Monitor', () => {

stellar-payment-platform/tests/helmet.test.js

@@ -29,7 +29,7 @@ jest.mock('pg', () => ({
 }));
 jest.mock('../src/multisigner-verifier', () => ({}));
 jest.mock('../src/db', () => ({}));
-jest.mock('../src/logger', () => ({ logger: require('pino')({ level: 'silent' }) }));
+jest.mock('../src/logger', () => ({ logger: require('pino')({ level: 'silent' }), httpLogger: (req, res, next) => next() }));
 jest.mock('../src/metrics', () => ({ metricsMiddleware: (req, res, next) => next(), getMetrics: jest.fn(), getContentType: jest.fn(), setMetricsSources: jest.fn() }));
 jest.mock('@sentry/node', () => ({ init: jest.fn(), setupExpressErrorHandler: jest.fn() }));
 jest.mock('../src/cache', () => ({}));

stellar-payment-platform/tests/metrics-connections.test.js

@@ -2,6 +2,7 @@ const client = require('prom-client');
 
 jest.mock('../src/logger', () => ({
   logger: { warn: jest.fn(), info: jest.fn(), error: jest.fn() },
+  httpLogger: (req, res, next) => next(),
 }));
 
 const { getMetrics, setMetricsSources } = require('../src/metrics');

stellar-payment-platform/tests/stellarService.test.js

@@ -48,6 +48,7 @@ jest.mock('../src/logger', () => ({
     error: jest.fn(),
     debug: jest.fn(),
   },
+  httpLogger: (req, res, next) => next(),
 }));
 
 const { __mockServer, __mockCallFn, __mockTransactionCall } = require('@stellar/stellar-sdk');