add function name to logger + sec fixes

[manasag]

I want to add function name to logs wherever possible. We will show the connector logs filtered by function names to users who are managing these functions via Admin Studio.

Previous logs:

{"level":30,"time":1769041078215,"pid":50513,"hostname":"Manass-MacBook-Pro.local","reqId":"req-1","req":{"method":"POST","url":"/query","hostname":"localhost:8080","remoteAddress":"::1","remotePort":49535},"msg":"incoming request"}
{"level":30,"time":1769041078220,"pid":50513,"hostname":"Manass-MacBook-Pro.local","reqId":"req-1","res":{"statusCode":400},"responseTime":4.539542198181152,"msg":"request completed"}

Updated logs:

Added "function":"hello" in the log

{"level":30,"time":1769042713674,"pid":55464,"hostname":"Manass-MacBook-Pro.local","reqId":"req-1","function":"hello","req":{"method":"POST","url":"/query","hostname":"localhost:8080","remoteAddress":"::1","remotePort":51075},"msg":"incoming request"}
{"level":30,"time":1769042713677,"pid":55464,"hostname":"Manass-MacBook-Pro.local","reqId":"req-1","function":"hello","req":{"method":"POST","url":"/query","hostname":"localhost:8080","remoteAddress":"::1","remotePort":51075},"res":{"statusCode":200},"responseTime":6.366458892822266,"msg":"request completed"}

Security update

Added package updates as per npm audit

# npm audit report

js-yaml  4.0.0 - 4.1.0
Severity: moderate
js-yaml has prototype pollution in merge (<<) - https://github.com/advisories/GHSA-mh29-5h37-fv8m
fix available via `npm audit fix`
node_modules/js-yaml

1 moderate severity vulnerability

Documentation

Also added a Claude.md file for future use

[daniel-chambers]

Logging the entire request seems pretty dangerous, you could log something sensitive by accident. This seems like a bit of a footgun. What problem are we trying to solve with this particular bit of logging?

[manasag]

I didn't realize its logging entire request. My testing (See sample log in description) shows it doesn't seem to log the request body. but let me ratify the implementation.

[manasag]

I have add explicit logging for method and url fields for a request.

[daniel-chambers]

This is also going to log sensitive information (whatever is in the request and response), that doesn't seem like a good idea.

[manasag]

Btw we already log each request and response without body and headers (See previous logs in description). Aim is to redo the same implementation, but with added function name.

[daniel-chambers]

That's fine... headers and body is where the sensitive stuff is, so we don't want to log those IMHO. I'm just suspicious here because we're deliberately assigning the entire request and response objects into the log... so if body/headers are not being logged, how and why is that happening?

[manasag]

Yeah, the red flags raised makes sense. will investigate. or will log explicit fields.

[manasag]

I have add explicit logging for method and url fields for a request.
There's a chance that framework's serializer do not log body and headers by default for safety reasons, but its prudent not to rely on this implicit behavior

[daniel-chambers]

Please no anys in this codebase, we don't want to disable typechecking. If you want to dynamically find the function name, you should check the actual types at runtime as you descend through the runtime values, not just yolo try to access them. If they aren't the shape you expect here (after disabling typechecking), this will crash.

You (or someone!) will thank me later 😀

(The unknown type is the safe choice when you don't know what the type of a value is. any disables typechecking, unknown says "you need to do type tests at runtime to discover what this is and work with it".)

[manasag]

Thanks, I'll improve this. will add this instruction in Claude.md too; or maybe a lint rule

[daniel-chambers]

So long as the lint rule can be disabled on a per case basis. Sometime (rarely) any is appropriate when the programmer is careful and knows what he/she is doing and just needs the typechecker to stfu. 😉 But one should definitely avoid using it on untrusted input like the http request body.

[manasag]

not using any anymore