add configurable logging, bearer token logging

Author: nemozak1

.env.example

@@ -63,3 +63,6 @@ UPDATE_INDEX_ENDPOINT_TYPE="all"
 
 # Periodic refresh interval in minutes (0 to disable)
 REFRESH_INTERVAL_MINUTES="5"
+
+# Options: "DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"
+LOG_LEVEL="INFO" 

src/mcp_server_obp/auth.py

@@ -178,8 +178,14 @@ async def verify_token(self, token: str):
             AccessToken object if valid, None if invalid or expired
         """
         logger.info("🔐 Starting token verification")
-        logger.debug(f"Token (first 20 chars): {token[:20]}...")
-        logger.debug(f"Configured issuers: {list(self._verifiers.keys())}")
+        logger.info(f"Token (first 20 chars): {token[:20]}...")
+        logger.info(f"Configured issuers: {list(self._verifiers.keys())}")
+
+        # Fast-fail on clearly malformed tokens to avoid noisy verifier errors
+        token = token.strip()
+        if token.count(".") < 2:
+            logger.warning("Rejected token without JWT structure (expected header.payload.signature)")
+            return None
 
         # Extract issuer from token
         issuer = self._extract_issuer(token)

src/mcp_server_obp/server.py

@@ -10,11 +10,14 @@
 # Load environment variables from .env file before anything else
 load_dotenv()
 
-# Configure logging
+# Configure logging (allow override via LOG_LEVEL env)
+_log_level = os.getenv("LOG_LEVEL", "INFO").upper()
 logging.basicConfig(
-    level=logging.INFO,
+    level=getattr(logging, _log_level, logging.INFO),
     format='%(asctime)s - %(name)s - %(levelname)s - %(message)s',
 )
+# Ensure our package logger honors the chosen level (basicConfig locks in handlers)
+logging.getLogger("mcp_server_obp").setLevel(getattr(logging, _log_level, logging.INFO))
 
 # Add the src and project root directories to the Python path when running as a script
 _src_dir = Path(__file__).parent.parent
@@ -204,7 +207,7 @@ async def call_obp_api(
         url = f"{base_url}{path}"
 
         # Prepare request
-        method = endpoint.method.value  # HttpMethod enum value
+        method = endpoint.method  # HttpMethod enum value
         request_headers = headers or {}
 
         auth_method = os.getenv("OBP_AUTHORIZATION_VIA", "none").lower()
@@ -224,7 +227,7 @@ async def call_obp_api(
                         "error": "consent_required",
                         "endpoint_id": endpoint_id,
                         "operation_id": endpoint.operation_id,
-                        "method": endpoint.method.value,
+                        "method": endpoint.method,
                         "path": endpoint.path,
                         "required_roles": [role.model_dump() for role in endpoint.roles],
                         "message": f"User consent is required to call {endpoint.operation_id}. "
@@ -263,8 +266,12 @@ async def call_obp_api(
 
         try:
             result["response"] = response.json()
+            logging.info(f"OBP API call successful: {method} {url} - Status: {response.status_code}")
+            logging.info(f"Response: {json.dumps(result['response'], indent=2)[:500]}...")  # Log first 500 chars of response
         except:
             result["response"] = response.text
+            logging.info(f"OBP API call with non-JSON response: {method} {url} - Status: {response.status_code}")
+            logging.info(f"Response: {result['response'][:500]}...")  # Log first 500 chars of response
 
         return json.dumps(result, indent=2)
 

tests/test_auth.py

@@ -207,6 +207,33 @@ async def test_verify_token_unknown_issuer_tries_all(self, keycloak_realm_url, o
             mock_verifier1.verify_token.assert_called_once_with(token)
             mock_verifier2.verify_token.assert_called_once_with(token)
 
+    @pytest.mark.asyncio
+    async def test_verify_token_rejects_non_jwt_without_verifiers(self, keycloak_realm_url):
+        """Ensure malformed tokens fail fast without hitting any verifier."""
+        bad_token = "not-a-jwt"
+
+        with patch("src.mcp_server_obp.auth.JWTVerifier") as MockJWTVerifier:
+            mock_verifier = AsyncMock()
+            mock_verifier.verify_token = AsyncMock(return_value={"sub": "user123"})
+            MockJWTVerifier.return_value = mock_verifier
+
+            verifier = MultiIssuerJWTVerifier(
+                issuers=[
+                    IssuerConfig(
+                        issuer=keycloak_realm_url,
+                        jwks_uri=f"{keycloak_realm_url}/certs",
+                    )
+                ]
+            )
+
+            # Replace the verifier with our mock
+            verifier._verifiers[keycloak_realm_url] = mock_verifier
+
+            result = await verifier.verify_token(bad_token)
+
+            assert result is None
+            mock_verifier.verify_token.assert_not_called()
+
 
 class TestCreateBearerAuth:
     """Tests for create_bearer_auth() function."""