refactor: migrate to Pino logging and harden server infrastructure#207
Merged
refactor: migrate to Pino logging and harden server infrastructure#207
Conversation
Signed-off-by: Jeremy Ho <jujaga@gmail.com>
Increases available database connections to improve handling of spike and sustained loads. While baseline throughput remains unchanged, this utilizes existing database overhead to provide greater architectural headroom. Signed-off-by: Jeremy Ho <jujaga@gmail.com>
Configures Express to trust the 'X-Forwarded-For' header. This ensures the logger captures the original client IP rather than the load balancer address in containerized environments. Signed-off-by: Jeremy Ho <jujaga@gmail.com>
Coverage Report
|
qhanson55
reviewed
Mar 19, 2026
Replaces Winston with Pino to improve application performance and standardize on a nested JSON format for HTTP request/response metadata. - Implements pino-http middleware with custom serializers for req/res. - Configures pino-pretty for human-readable local development output. - Adds sensitive data redaction for authorization headers and passwords. - Integrates a child logger pattern (getLogger) for module-level context. Signed-off-by: Jeremy Ho <jujaga@gmail.com>
Implements a more robust shutdown sequence to prevent hanging processes and ensures logs are flushed before exit. - Add a 8-second safety timeout to force exit if cleanup hangs. - Prevent multiple shutdown triggers by checking state.shutdown. - Switch from process.once to process.on for signal handling to capture subsequent signals during teardown. - Refactor shutdownDatabase to properly chain the destruction promise. - Ensure log buffers are flushed before the final process exit. Signed-off-by: Jeremy Ho <jujaga@gmail.com>
Signed-off-by: Jeremy Ho <jujaga@gmail.com>
Signed-off-by: Jeremy Ho <jujaga@gmail.com>
Signed-off-by: Jeremy Ho <jujaga@gmail.com>
|
qhanson55
approved these changes
Mar 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR focuses on improving application observability, performance, and reliability. The primary change is the migration from Winston to Pino for structured logging, supplemented by significant hardening of the server's graceful shutdown sequence and various infrastructure optimizations.
Core Changes
Observability & Performance
pino-httpwith custom serializers.pino-prettyfor development and redaction for sensitive fields (passwords, auth headers).trust proxyin Express to ensure accurate client IP logging when running behind a load balancer.Reliability & Infrastructure
process.onfor signals to ensure subsequent signals are captured.Maintenance & Refactoring
flatteddependency to address vulnerability GHSA-25h7-pfq9-p65f..d.tsfile imports and moved thegetSpechelper out of the route layer for better architectural separation.Related Issues/Tickets
PADS-750
Type of Change
Checklist
Instance Deployment
Note
To request for a cloud deployment for testing purposes, add the
deploylabel to this PR.Deployments will be removed when the PR is closed, merged, or the
deploylabel is removed.Additional Notes