fix: protect method names from token registration collisions

[baima365-web]

Problem

Calling morgan.token('token', fn) overwrites the morgan.token() method itself, breaking all subsequent token registrations. This is because morgan serves as both the module export (with methods token, format, compile) and the token registry.

Example:

var logger = require('morgan');
logger.token('token', function (req, res) { return 'value' });
// morgan.token is now the custom function, not the registration method
logger.token('uuid', function (req, res) { return 'uuid' }); // TypeError: tokens.uuid is not a function

Fix

Make the token, format, and compile methods non-writable using Object.defineProperties. This prevents user token registrations from overwriting the module API while maintaining full backward compatibility.

Test plan

• Existing built-in tokens work correctly
• Custom token registration works
• Compiled format functions resolve tokens correctly
• Middleware logs correctly
• Registering reserved names (token, format, compile) now throws instead of silently breaking

[UlisesGascon]

LGTM! WDYT @jonchurch @bjohansebas ?

[bjohansebas]

LGTM, should we add tests?

[krzysdz]

While this prevents accidentally overwriting important functions, there are still some rather unexpected behaviours:

1. There is completely no information that the given token or format cannot be defined (this will become clear if someone tries to use it, but may be hard to debug).
2. Formats and tokens can overwrite each other. While overwriting a token with a different token with the same name or overwriting a format with a different format using the same name (like I have previously suggested in #303 (comment), so #377 now depends on this behaviour) is something that IMO should be possible, format-token collisions should not happen.

Would it be a breaking change if formats and tokens were not defined directly as morgan properties, but instead lived separately as morgan.tokens and morgan.formats or something similar? This would allow using any names (no conflicts with the morgan functions) and get rid of collisions.

morgan/index.js

Lines 492 to 495 in 51007f9

	function format (name, fmt) {
	morgan[name] = fmt
	return this
	}

morgan/index.js

Lines 579 to 582 in 51007f9

	function token (name, fn) {
	morgan[name] = fn
	return this
	}

[UlisesGascon]

I think that #385 is a more solid approach but does not solve all the concerns from #359 (review). Also I am considering this as semver-minor based on #265 (comment) but maybe that requires a review or split between 1.x and 2.x goals