[kmcginnes]

Summary

A request body the parser rejects no longer reaches the logs or the response, since request bodies can hold database queries that the logging docs say are only logged at debug and trace.

User-facing: a request the server rejects now fails with its real status (400, 413, or 415) instead of a 500, and a request over the 50 MB limit shows "Request Too Large".

 app.use(
-  bodyParser.json(...)
+  rejectUnreadableBody(bodyParser.json(...))
 )
 // same for urlencoded

 rejectUnreadableBody(parser)
+  on parser error -> RejectedRequestBodyError(status, type, safe message)

Body-parser attaches the raw body to parse errors, and the JSON parse message quotes part of it. The wrapper converts any error from a body parser into a RejectedRequestBodyError that carries only the status, type, and a message. Parse failures get a fixed message, and the other parser messages are fixed text. The error handler is unchanged, so every other error logs as before. Detection is by origin, not by error shape.

Evidence

Before: a malformed /gremlin body wrote the raw body to the error log and returned a 500.
After: request bodies the parser rejects in packages/graph-explorer-proxy-server/src/app.test.ts sends malformed JSON, a bad charset, an oversized body, and an oversized form body containing a marker. Each asserts the marker is absent from every logger call at every level and from the response, with the expected status. createDisplayError.test.ts covers the 413 message.

Merge Danger

Door: two-way

Impact: error responses for rejected bodies change status and gain type. The Graph Explorer client is the only consumer, and it already shows the server message for these statuses.

---

_{🤖 Written by an AI agent on my behalf.}

[kmcginnes]

Approved