feat: enhance logging with request input

* fix: prevent invalid calls to fetch label by publicId

* fix: ensure query only runs when isEdit is true

apps/docs/api-reference/introduction.mdx

@@ -11,10 +11,10 @@ https://kan.bn/api/v1
 
 ## Authentication
 
-Most endpoints require authentication using your API key. You can create one in the [settings page](https://kan.bn/settings) of your account. Include this key in the `x-api-key` header of each request.
+Most endpoints require authentication using your API key. You can create one in the [settings page](https://kan.bn/settings) of your account. Include this key as a Bearer token in the `Authorization` header of each request.
 
 ```
-'x-api-key': kan_123456789
+'Authorization': 'Bearer kan_123456789'
 ```
 
 ## Response codes

apps/web/next.config.js

@@ -28,6 +28,7 @@ const config = {
     ],
   },
 
+
   /** Enables hot reloading for local packages without a build step */
   transpilePackages: [
     "@kan/api",
@@ -65,6 +66,8 @@ const config = {
       },
     },
   },
+  serverExternalPackages: ["pino"],
+
   experimental: {
     // instrumentationHook: true,
     swcPlugins: [["@lingui/swc-plugin", {}]],

apps/web/src/components/LabelForm.tsx

@@ -39,7 +39,7 @@ export function LabelForm({
       labelPublicId: entityId,
     },
     {
-      enabled: isEdit && !!entityId,
+      enabled: !!isEdit && entityId.length >= 12,
     },
   );
 

cloud/docker-compose.yml

@@ -39,6 +39,8 @@ services:
 
       # Logging (optional - debug, info, warn, error; defaults to debug in dev, info in prod)
       - LOG_LEVEL=${LOG_LEVEL}
+      - AXIOM_TOKEN=${AXIOM_TOKEN}
+      - AXIOM_DATASET=${AXIOM_DATASET}
 
       # Stripe
       - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY}

packages/api/src/routers/board.ts

@@ -227,7 +227,7 @@ export const boardRouter = createTRPCRouter({
         boardSlug: z
           .string()
           .min(3)
-          .max(24)
+          .max(60)
           .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/),
         members: z.array(z.string().min(12)).optional(),
         labels: z.array(z.string().min(12)).optional(),
@@ -657,7 +657,7 @@ export const boardRouter = createTRPCRouter({
         boardSlug: z
           .string()
           .min(3)
-          .max(24)
+          .max(60)
           .regex(/^(?![-]+$)[a-zA-Z0-9-]+$/),
         boardPublicId: z.string().min(12),
       }),

packages/api/src/routers/integration.ts

@@ -19,6 +19,7 @@ import { encryptToken } from "../utils/encryption";
 export const integrationRouter = createTRPCRouter({
   saveGitHubToken: protectedProcedure
     .input(z.object({ token: z.string() }))
+    .output(z.object({ success: z.boolean() }))
     .mutation(async ({ ctx, input }) => {
       const user = ctx.user;
 
@@ -43,7 +44,9 @@ export const integrationRouter = createTRPCRouter({
       return { success: true };
     }),
 
-  disconnectGitHub: protectedProcedure.mutation(async ({ ctx }) => {
+  disconnectGitHub: protectedProcedure
+    .output(z.object({ success: z.boolean() }))
+    .mutation(async ({ ctx }) => {
     const user = ctx.user;
 
     if (!user)
@@ -56,7 +59,9 @@ export const integrationRouter = createTRPCRouter({
     return { success: true };
   }),
 
-  getGitHubStatus: protectedProcedure.query(async ({ ctx }) => {
+  getGitHubStatus: protectedProcedure
+    .output(z.object({ connected: z.boolean() }))
+    .query(async ({ ctx }) => {
     const user = ctx.user;
 
     if (!user)

packages/api/src/trpc.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from "crypto";
 import type { CreateNextContextOptions } from "@trpc/server/adapters/next";
 import type { NextApiRequest } from "next";
 import type { OpenApiMeta } from "trpc-to-openapi";
@@ -11,7 +12,28 @@ import { initAuth } from "@kan/auth/server";
 import { createDrizzleClient } from "@kan/db/client";
 import { createLogger } from "@kan/logger";
 
-const log = createLogger("trpc");
+const log = createLogger("api");
+
+const TRPC_STATUS_MAP: Partial<Record<TRPCError["code"], number>> = {
+  PARSE_ERROR: 400,
+  BAD_REQUEST: 400,
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  METHOD_NOT_SUPPORTED: 405,
+  TIMEOUT: 408,
+  CONFLICT: 409,
+  PRECONDITION_FAILED: 412,
+  PAYLOAD_TOO_LARGE: 413,
+  UNPROCESSABLE_CONTENT: 422,
+  TOO_MANY_REQUESTS: 429,
+  CLIENT_CLOSED_REQUEST: 499,
+  INTERNAL_SERVER_ERROR: 500,
+  NOT_IMPLEMENTED: 501,
+  BAD_GATEWAY: 502,
+  SERVICE_UNAVAILABLE: 503,
+  GATEWAY_TIMEOUT: 504,
+};
 
 export interface User {
   id: string;
@@ -50,6 +72,7 @@ interface CreateContextOptions {
   db: dbClient;
   auth: ReturnType<typeof createAuthWithHeaders>;
   headers: Headers;
+  transport?: "trpc" | "rest";
 }
 
 export const createInnerTRPCContext = (opts: CreateContextOptions) => {
@@ -58,6 +81,8 @@ export const createInnerTRPCContext = (opts: CreateContextOptions) => {
     db: opts.db,
     auth: opts.auth,
     headers: opts.headers,
+    transport: opts.transport ?? "trpc",
+    requestId: randomUUID(),
   };
 };
 
@@ -69,7 +94,13 @@ export const createTRPCContext = async ({ req }: CreateNextContextOptions) => {
 
   const session = await auth.api.getSession();
 
-  return createInnerTRPCContext({ db, user: session?.user, auth, headers });
+  return createInnerTRPCContext({
+    db,
+    user: session?.user,
+    auth,
+    headers,
+    transport: "trpc",
+  });
 };
 
 export const createNextApiContext = async (req: NextApiRequest) => {
@@ -80,7 +111,13 @@ export const createNextApiContext = async (req: NextApiRequest) => {
 
   const session = await auth.api.getSession();
 
-  return createInnerTRPCContext({ db, user: session?.user, auth, headers });
+  return createInnerTRPCContext({
+    db,
+    user: session?.user,
+    auth,
+    headers,
+    transport: "trpc",
+  });
 };
 
 export const createRESTContext = async ({ req }: CreateNextContextOptions) => {
@@ -93,11 +130,16 @@ export const createRESTContext = async ({ req }: CreateNextContextOptions) => {
   try {
     session = await auth.api.getSession();
   } catch (error) {
-    log.error({ err: error }, "Error getting session");
+    log.warn({ err: error }, "Failed to get session, treating as unauthenticated");
-    throw error;
   }
 
-  return createInnerTRPCContext({ db, user: session?.user, auth, headers });
+  return createInnerTRPCContext({
+    db,
+    user: session?.user,
+    auth,
+    headers,
+    transport: "rest",
+  });
 };
 
 const t = initTRPC
@@ -121,25 +163,45 @@ export const createTRPCRouter = t.router;
 
 export const createCallerFactory = t.createCallerFactory;
 
-const loggingMiddleware = t.middleware(async ({ path, type, next, ctx }) => {
+const loggingMiddleware = t.middleware(async ({ path, type, next, ctx, getRawInput }) => {
   const start = Date.now();
-  const result = await next();
+  const [result, input] = await Promise.all([next(), getRawInput().catch(() => undefined)]);
   const duration = Date.now() - start;
 
-  const meta = { procedure: path, type, duration, userId: (ctx as { user?: { id: string } }).user?.id };
+  const { user, transport, requestId } = ctx as {
+    user?: { id: string; email: string };
+    transport?: string;
+    requestId?: string;
+  };
+  const isCloud = process.env.NEXT_PUBLIC_KAN_ENV === "cloud";
+  const meta = {
+    requestId,
+    procedure: path,
+    type,
+    transport,
+    duration,
+    userId: user?.id,
+    ...(isCloud && { email: user?.email }),
+    input,
+  };
+
+  const label = transport === "rest" ? "REST" : "tRPC";
 
   if (result.ok) {
-    log.info(meta, "tRPC OK");
+    log.info({ ...meta, status: 200 }, `${label} OK`);
   } else {
-    log.error({ ...meta, err: result.error }, "tRPC error");
+    const status = TRPC_STATUS_MAP[result.error.code] ?? 500;
+    const errorCode = result.error.code;
+    log.error(
+      { ...meta, status, errorCode, err: result.error },
+      `${label} error`,
+    );
   }
 
   return result;
 });
 
-export const publicProcedure = t.procedure.use(loggingMiddleware).meta({
+export const publicProcedure = t.procedure.use(loggingMiddleware);
-  openapi: { method: "GET", path: "/public" },
-});
 
 const enforceUserIsAuthed = t.middleware(async ({ ctx, next }) => {
   if (!ctx.user) {
@@ -163,13 +225,7 @@ const enforceUserIsAdmin = t.middleware(async ({ ctx, next }) => {
 
 export const protectedProcedure = t.procedure
   .use(loggingMiddleware)
-  .use(enforceUserIsAuthed)
+  .use(enforceUserIsAuthed);
-  .meta({
-    openapi: {
-      method: "GET",
-      path: "/protected",
-    },
-  });
 
 export const adminProtectedProcedure = t.procedure
   .use(loggingMiddleware)

packages/auth/src/plugins.ts

@@ -165,6 +165,13 @@ export function createPlugins(db: dbClient) {
       : []),
     apiKey({
       enableSessionForAPIKeys: true,
+      customAPIKeyGetter: (ctx) => {
+        const authorization = ctx.headers?.get("authorization");
+        if (authorization?.startsWith("Bearer ")) {
+          return authorization.slice(7);
+        }
+        return ctx.headers?.get("x-api-key") ?? undefined;
+      },
       rateLimit: {
         enabled: true,
         timeWindow: 1000 * 60, // 1 minute

packages/logger/package.json

@@ -19,6 +19,7 @@
     "typecheck": "tsc --noEmit --emitDeclarationOnly false"
   },
   "dependencies": {
+    "@axiomhq/js": "^1.4.0",
     "pino": "^9.14.0",
     "pino-pretty": "^13.1.3"
   },

packages/logger/src/index.ts

@@ -1,20 +1,43 @@
+import { Axiom } from "@axiomhq/js";
 import pino from "pino";
 
 const isDev = process.env.NODE_ENV !== "production";
+const isCloud = process.env.NEXT_PUBLIC_KAN_ENV === "cloud";
 const level = process.env.LOG_LEVEL || (isDev ? "debug" : "info");
 
-export const logger = pino({
+const axiomToken = process.env.AXIOM_TOKEN;
-  level,
+const axiomDataset = process.env.AXIOM_DATASET;
-  ...(isDev && {
+const useAxiom = isCloud && !!axiomToken && !!axiomDataset;
-    transport: {
+
-      target: "pino-pretty",
+function createAxiomStream(token: string, dataset: string): pino.DestinationStream {
-      options: {
+  const client = new Axiom({ token });
-        colorize: true,
+  return {
-        ignore: "pid,hostname",
+    write(msg: string) {
-        translateTime: "HH:MM:ss",
+      try {
-      },
+        client.ingest(dataset, [JSON.parse(msg) as Record<string, unknown>]);
+      } catch {
+        // ignore malformed log lines
+      }
     },
-  }),
+  };
-});
+}
+
+export const logger = useAxiom
+  ? pino(
+      { level },
+      pino.multistream([
+        { stream: process.stdout, level },
+        { stream: createAxiomStream(axiomToken, axiomDataset), level },
+      ]),
+    )
+  : pino({
+      level,
+      ...(isDev && {
+        transport: {
+          target: "pino-pretty",
+          options: { colorize: true, ignore: "pid,hostname", translateTime: "HH:MM:ss" },
+        },
+      }),
+    });
 
 export const createLogger = (module: string) => logger.child({ module });

pnpm-lock.yaml

@@ -504,6 +504,9 @@ importers:
 
   packages/logger:
     dependencies:
+      '@axiomhq/js':
+        specifier: ^1.4.0
+        version: 1.4.0
       pino:
         specifier: ^9.14.0
         version: 9.14.0
@@ -891,6 +894,10 @@ packages:
     resolution: {integrity: sha512-kLO7k7cGJ6KaHiExSJWojZurF7SnGMDHXRuQunFnEoD0n1yB6Lqy/S/zHiQ7oJnBhPr9q0TW9qFkrsZb1Uc54w==}
     engines: {node: '>=18.0.0'}
 
+  '@axiomhq/js@1.4.0':
+    resolution: {integrity: sha512-wC5x1ud/QJMstrjpicATkyY8+ZVWEl4WlXMtA5EZf7hkj0+b191yv4yynLxLEfr/MveXora9m6CWdJq4DsbcAg==}
+    engines: {node: '>=20'}
+
   '@babel/code-frame@7.27.1':
     resolution: {integrity: sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==}
     engines: {node: '>=6.9.0'}
@@ -5628,6 +5635,9 @@ packages:
       picomatch:
         optional: true
 
+  fetch-retry@6.0.0:
+    resolution: {integrity: sha512-BUFj1aMubgib37I3v4q78fYo63Po7t4HUPTpQ6/QE6yK6cIQrP+W43FYToeTEyg5m2Y7eFUtijUuAv/PDlWuag==}
+
   fflate@0.4.8:
     resolution: {integrity: sha512-FJqqoDBR00Mdj9ppamLa/Y7vxm+PRmNWA67N846RvsoYVMKB4q3y/de5PA7gUmRMYK/8CMz2GDZQmCRN1wBcWA==}
 
@@ -9384,6 +9394,10 @@ snapshots:
       '@smithy/types': 4.3.2
       tslib: 2.8.1
 
+  '@axiomhq/js@1.4.0':
+    dependencies:
+      fetch-retry: 6.0.0
+
   '@babel/code-frame@7.27.1':
     dependencies:
       '@babel/helper-validator-identifier': 7.27.1
@@ -14403,6 +14417,8 @@ snapshots:
     optionalDependencies:
       picomatch: 4.0.3
 
+  fetch-retry@6.0.0: {}
+
   fflate@0.4.8: {}
 
   figures@3.2.0:

turbo.json

@@ -130,7 +130,9 @@
     "NOVU_API_KEY",
     "EMAIL_UNSUBSCRIBE_SECRET",
     "REDIS_URL",
-    "LOG_LEVEL"
+    "LOG_LEVEL",
+    "AXIOM_TOKEN",
+    "AXIOM_DATASET"
   ],
   "globalPassThroughEnv": [
     "NODE_ENV",