Add slow request logging (#754)

src/app.ts

@@ -26,7 +26,7 @@ import { schemaVersionMiddleware } from './middlewares/schema-version.middleware
 import { requestLoggerMiddleware } from './middlewares/request-logger.middleware';
 import { requestContextMiddleware } from './middlewares/request-context.middleware';
 import { requestEntryLoggerMiddleware } from './middlewares/request-entry-logger.middleware';
-import { requestCompletionLoggerMiddleware } from './middlewares/request-completion-logger.middleware';
+import { requestCompletionLoggerMiddleware, slowRequestLoggerMiddleware } from './middlewares/request-completion-logger.middleware';
 import { sessionActivityMiddleware } from './middlewares/session-activity.middleware';
 import { bodyParseErrorMiddleware } from './middlewares/body-parse-error.middleware';
 import { routeBodySizeLimit } from './middlewares/body-size-limit.middleware';
@@ -47,6 +47,7 @@ app.use(apiVersionMiddleware);
 app.use(schemaVersionMiddleware);
 app.use(requestEntryLoggerMiddleware);
 app.use(requestCompletionLoggerMiddleware);
+app.use(slowRequestLoggerMiddleware);
 // Session activity logging (#1035): registers a res.on('finish') listener
 // so it can read req.user after route-level auth guards have run. Mount
 // position only needs to be before the routers.

src/config.schema.ts

@@ -651,6 +651,8 @@ export const envSchema = z
       BADGE_TOP_TRADER_MAX_RANK: z.coerce.number().int().positive().default(10),
       // Max mint attempts before a transient failure is treated as terminal.
       BADGE_MINT_MAX_ATTEMPTS: z.coerce.number().int().positive().default(3),
+      // Slow request threshold (#754): warn-level log for requests exceeding this duration
+      SLOW_REQUEST_THRESHOLD_MS: z.coerce.number().int().positive().default(2000),
    })
    .superRefine((data, ctx) => {
       if (data.MODE === 'production' && data.STELLAR_NETWORK === 'testnet') {

src/middlewares/request-completion-logger.middleware.ts

@@ -1,5 +1,12 @@
 import { Request, Response, NextFunction } from 'express';
 import { logger } from '../utils/logger.utils';
+import { envConfig } from '../config';
+
+interface AuthenticatedRequest extends Request {
+   user?: {
+      wallet: string;
+   };
+}
 
 // Log request outcome after the response has been fully sent.
 //
@@ -72,3 +79,39 @@ export const requestCompletionLoggerMiddleware = (
 
    next();
 };
+
+export const slowRequestLoggerMiddleware = (
+   req: AuthenticatedRequest,
+   res: Response,
+   next: NextFunction
+): void => {
+   const startTime = process.hrtime();
+   let logged = false;
+
+   // Ensure we log once even if multiple events fire.
+   const logOnce = () => {
+      if (logged) return;
+      logged = true;
+
+      const diff = process.hrtime(startTime);
+      const durationMs = diff[0] * 1e3 + diff[1] * 1e-6;
+
+      if (durationMs >= envConfig.SLOW_REQUEST_THRESHOLD_MS) {
+         const wallet = req.user?.wallet;
+         const payload = {
+            method: req.method,
+            path: req.path,
+            status_code: res.statusCode,
+            duration_ms: Math.round(durationMs),
+            ...(wallet ? { wallet } : {}),
+            slow_threshold_ms: envConfig.SLOW_REQUEST_THRESHOLD_MS,
+         };
+         logger.warn(payload, 'Slow request detected');
+      }
+   };
+
+   res.once('finish', logOnce);
+   res.once('close', logOnce);
+
+   next();
+};