Remove insecure and bloated module

packages/controller/package.json

@@ -30,7 +30,6 @@
 		"set-blocking": "^2.0.0",
 		"webpack-cli": "^5.1.4",
 		"winston": "^3.10.0",
-		"express-winston": "^4.2.0",
 		"winston-daily-rotate-file": "^4.7.1",
 		"ws": "^8.13.0",
 		"yargs": "^17.7.2"

packages/controller/src/Controller.ts

@@ -3,7 +3,6 @@ import { BlockList, type AddressInfo, isIPv4, isIPv6 } from "net";
 import type { ControllerArgs } from "../controller";
 import express, { type Request, type Response, type NextFunction, type Application } from "express";
 import type { Static } from "@sinclair/typebox";
-import * as expressWinston from "express-winston";
 
 import compression from "compression";
 import events, { EventEmitter } from "events";
@@ -165,10 +164,31 @@ export default class Controller {
 		this.app = express();
 		this.app.locals.controller = this;
 		this.app.locals.streams = new Map();
-		this.app.use(expressWinston.logger({
-			winstonInstance: this.clusterLogger,
-			level: "http",
-		}));
+
+		// Log all requests made to express
+		this.app.use((req, res, next) => {
+			const startNs = process.hrtime.bigint();
+			res.once("finish", () => {
+				const endNs = process.hrtime.bigint();
+				const durationMs = (Number(endNs - startNs) / 1e6);
+				logger.log({
+					level: "http",
+					message: `HTTP ${req.httpVersion} ${req.method} ${req.originalUrl}` +
+						` (Status ${res.statusCode} in ${durationMs}ms)`,
+					meta: {
+						method: req.method,
+						url: req.originalUrl,
+						statusCode: res.statusCode,
+						responseTime: durationMs,
+						httpVersion: req.httpVersion,
+						headers: req.headers,
+						query: req.query,
+					},
+				});
+			});
+
+			next();
+		});
 
 		this.trustedProxies = this.parseTrustedProxies();
 		this.wsServer = new WsServer(this);
@@ -288,9 +308,24 @@ export default class Controller {
 
 		// Load plugins
 		await this.loadPlugins();
-		this.app.use(expressWinston.errorLogger({
-			winstonInstance: this.clusterLogger,
-		}));
+
+		// Log all express errors from middleware or routes (app.use is missing the type overload)
+		this.app.use((err: Error, req: express.Request, res: express.Response, next: express.NextFunction): void => {
+			logger.log({
+				level: "error",
+				message: "Error while handling HTTP" +
+					`${req.httpVersion} ${req.method} ${req.originalUrl}:\n${err.stack}`,
+				meta: {
+					method: req.method,
+					url: req.originalUrl,
+					httpVersion: req.httpVersion,
+					headers: req.headers,
+					query: req.query,
+				},
+			});
+
+			next();
+		});
 
 		this.wsServer = new WsServer(this);
 

packages/lib/src/logging.ts

@@ -8,8 +8,8 @@ export const levels = Object.freeze({
 	warn: 2,
 	audit: 3,
 	info: 4,
-	server: 5,
-	http: 6,
+	http: 5,
+	server: 6,
 	verbose: 7,
 });
 
@@ -19,8 +19,8 @@ export const colors = {
 	warn: "bold brightYellow",
 	audit: "bold brightGreen",
 	info: "bold brightBlue",
+	http: "bold",
 	server: "bold",
-	http: "bold grey",
 	verbose: "bold grey",
 } as const;
 winston.addColors(colors);
@@ -174,8 +174,8 @@ export type Logger = Omit<winston.Logger,
 	warn: winston.LeveledLogMethod,
 	audit: winston.LeveledLogMethod,
 	info: winston.LeveledLogMethod,
-	server: winston.LeveledLogMethod,
 	http: winston.LeveledLogMethod,
+	server: winston.LeveledLogMethod,
 	verbose: winston.LeveledLogMethod,
 	child(options: object): Logger,
 };