fix: code review comments

Author: cpb8010

packages/auth-server/scripts/copy-snarkjs.mjs

@@ -2,14 +2,23 @@
 import { copyFileSync, existsSync, mkdirSync, readdirSync, statSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
 
 function main() {
   // Resolve the path to snarkjs browser bundle
   // Resolve snarkjs package base
   let baseDir;
   try {
-    const pkgJson = require.resolve("snarkjs/package.json");
-    baseDir = dirname(pkgJson);
+    // Prefer import.meta.resolve for pure ESM; fallback to createRequire for older Node versions
+    let pkgJsonPath;
+    if (typeof import.meta.resolve === "function") {
+      const resolvedUrl = import.meta.resolve("snarkjs/package.json");
+      pkgJsonPath = fileURLToPath(resolvedUrl);
+    } else {
+      const require = createRequire(import.meta.url);
+      pkgJsonPath = require.resolve("snarkjs/package.json");
+    }
+    baseDir = dirname(pkgJsonPath);
   } catch (e) {
     console.warn("[copy-snarkjs] snarkjs not installed yet; skipping copy", e);
     return; // don't fail install, maybe another step will install it

packages/oidc-server/src/salt-service.ts

@@ -45,6 +45,32 @@ const app = express();
 // Collect default metrics (Node.js process metrics, etc.)
 client.collectDefaultMetrics();
 
+// Normalize a path to reduce metrics label cardinality. Any dynamic-looking
+// segment (numbers, long hex/base64-ish tokens, UUIDs) is replaced with a
+// placeholder. If Express matched a route we prefer route.path which is
+// already a pattern (e.g. "/user/:id").
+function normalizePath(req: express.Request): string {
+  // If Express has a route pattern, use it (lowest cardinality already)
+  const routePath = (req as any).route?.path; // eslint-disable-line @typescript-eslint/no-explicit-any
+  if (routePath) return routePath;
+
+  const raw = req.path || "/";
+  const uuidRe = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+  const hexRe = /^[0-9a-fA-F]{8,}$/; // long-ish hex
+  const base64ishRe = /^[0-9a-zA-Z_-]{10,}$/; // tokens
+  return raw
+    .split("/")
+    .map((seg) => {
+      if (!seg) return seg;
+      if (/^[0-9]+$/.test(seg)) return ":int";
+      if (uuidRe.test(seg)) return ":uuid";
+      if (hexRe.test(seg)) return ":hex";
+      if (base64ishRe.test(seg) && seg.length > 16) return ":tok";
+      return seg;
+    })
+    .join("/") || "/";
+}
+
 // Custom metrics
 const requestCounter = new client.Counter({
   name: "salt_service_requests_total",
@@ -62,7 +88,7 @@ const requestDuration = new client.Histogram({
 app.use((req, res, next) => {
   const end = requestDuration.startTimer();
   res.on("finish", () => {
-    const labels = { method: req.method, path: req.route?.path || req.path, status: res.statusCode.toString() };
+    const labels = { method: req.method, path: normalizePath(req), status: res.statusCode.toString() };
     requestCounter.inc(labels);
     end(labels);
   });
@@ -121,7 +147,7 @@ app.listen(mainPort, () => {
 });
 
 // Separate metrics server on port 9090
-const METRICS_PORT = 9090;
+const METRICS_PORT = process.env.METRICS_PORT || 9090;
 const metricsApp = express();
 metricsApp.get("/metrics", async (_req, res) => {
   try {