fix: POST API requests with JSON body no longer time out

src/node/hooks/express/openapi.ts

@@ -612,17 +612,30 @@ exports.expressPreSession = async (hookName:string, {app}:any) => {
 
           // read form data if method was POST
           let formData:MapArrayType<any> = {};
-          if (c.request.method === 'post') {
-            const form = new IncomingForm();
-            formData = (await form.parse(req))[0];
-            for (const k of Object.keys(formData)) {
-              if (formData[k] instanceof Array) {
-                formData[k] = formData[k][0];
+          if ((c.request.method || '').toLowerCase() === 'post') {
+            // If express.json() already parsed the body (application/json),
+            // use req.body directly. Formidable would hang waiting for an
+            // already-consumed stream, causing the request to time out.
+            if (req.body && typeof req.body === 'object') {
+              formData = req.body;
+            } else {
+              const form = new IncomingForm();
+              formData = (await form.parse(req))[0];
+              for (const k of Object.keys(formData)) {
+                if (formData[k] instanceof Array) {
+                  formData[k] = formData[k][0];
+                }
               }
             }
           }
 
-          const fields = Object.assign({}, headers, params, query, formData);
+          // Merge parameters with clear precedence: body > query > path params.
+          // Only pass the authorization header explicitly — don't merge all headers
+          // into fields to prevent parameter pollution.
+          const fields = Object.assign({}, params, query, formData);
+          if (headers.authorization) {
+            fields.authorization = fields.authorization || headers.authorization;
+          }
           if (logger.isDebugEnabled()) {
             logger.debug(`REQUEST, v${version}:${funcName}, ${JSON.stringify(fields)}`);
           }