Skip to content

Commit 1f432dd

Browse files
babsbabs
committed
refactor: rename log events to snake_case
Switch to conventional event naming (noun_verb_state) so logs can be queried by event type in structured log tooling.
1 parent 528e89c commit 1f432dd

7 files changed

Lines changed: 33 additions & 33 deletions

File tree

‎handlers/authorize.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ func Authorize(tm *token.Manager, logger *zap.Logger, baseURL string, oauth2Cfg
114114

115115
internalState, err := tm.SealJSON(session)
116116
if err != nil {
117-
logger.Error("failed to seal session", zap.Error(err))
117+
logger.Error("session_seal_failed", zap.Error(err))
118118
writeOAuthError(w, http.StatusInternalServerError, "server_error", "internal error")
119119
return
120120
}
@@ -124,7 +124,7 @@ func Authorize(tm *token.Manager, logger *zap.Logger, baseURL string, oauth2Cfg
124124
oauth2.SetAuthURLParam("response_mode", "query"),
125125
)
126126

127-
logger.Debug("redirecting to IdP", zap.String("internal_client_id", client.ID))
127+
logger.Debug("idp_redirect", zap.String("internal_client_id", client.ID))
128128
http.Redirect(w, r, authURL, http.StatusFound)
129129
}
130130
}

‎handlers/callback.go‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ func callbackHandler(tm *token.Manager, logger *zap.Logger, audience string, oau
8282

8383
oauth2Token, err := oauth2Cfg.Exchange(exchangeCtx, upstreamCode)
8484
if err != nil {
85-
logger.Error("upstream token exchange failed", zap.Error(err))
85+
logger.Error("upstream_token_exchange_failed", zap.Error(err))
8686
writeOAuthError(w, http.StatusBadGateway, "server_error", "upstream authentication failed")
8787
return
8888
}
@@ -95,8 +95,8 @@ func callbackHandler(tm *token.Manager, logger *zap.Logger, audience string, oau
9595

9696
idToken, err := verify(r.Context(), rawIDToken)
9797
if err != nil {
98-
logger.Error("id_token verification failed", zap.Error(err))
99-
writeOAuthError(w, http.StatusBadGateway, "server_error", "id_token verification failed")
98+
logger.Error("id_token_verification_failed", zap.Error(err))
99+
writeOAuthError(w, http.StatusBadGateway, "server_error", "id_token_verification_failed")
100100
return
101101
}
102102

@@ -106,7 +106,7 @@ func callbackHandler(tm *token.Manager, logger *zap.Logger, audience string, oau
106106
Name string `json:"name"`
107107
}
108108
if err := idToken.Claims(&claims); err != nil {
109-
logger.Error("failed to parse id_token claims", zap.Error(err))
109+
logger.Error("id_token_claims_parse_failed", zap.Error(err))
110110
writeOAuthError(w, http.StatusInternalServerError, "server_error", "failed to parse claims")
111111
return
112112
}
@@ -124,7 +124,7 @@ func callbackHandler(tm *token.Manager, logger *zap.Logger, audience string, oau
124124

125125
// Enforce group allowlist if configured
126126
if len(cbCfg.AllowedGroups) > 0 && !hasOverlap(groups, cbCfg.AllowedGroups) {
127-
logger.Warn("access denied: user not in allowed groups",
127+
logger.Warn("access_denied_group",
128128
zap.String("subject", claims.Sub),
129129
zap.Strings("user_groups", groups),
130130
zap.Strings("allowed_groups", cbCfg.AllowedGroups),
@@ -147,7 +147,7 @@ func callbackHandler(tm *token.Manager, logger *zap.Logger, audience string, oau
147147

148148
code, err := tm.SealJSON(sc)
149149
if err != nil {
150-
logger.Error("failed to seal authorization code", zap.Error(err))
150+
logger.Error("authorization_code_seal_failed", zap.Error(err))
151151
writeOAuthError(w, http.StatusInternalServerError, "server_error", "internal error")
152152
return
153153
}
@@ -166,7 +166,7 @@ func callbackHandler(tm *token.Manager, logger *zap.Logger, audience string, oau
166166
redirectParsed.RawQuery = q2.Encode()
167167
redirectURL := redirectParsed.String()
168168

169-
logger.Info("callback successful", zap.String("subject", claims.Sub))
169+
logger.Info("callback_success", zap.String("subject", claims.Sub))
170170
http.Redirect(w, r, redirectURL, http.StatusFound)
171171
}
172172
}

‎handlers/register.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,12 +73,12 @@ func Register(tm *token.Manager, logger *zap.Logger, audience string) http.Handl
7373

7474
clientID, err := tm.SealJSON(sc)
7575
if err != nil {
76-
logger.Error("failed to seal client", zap.Error(err))
76+
logger.Error("client_seal_failed", zap.Error(err))
7777
writeOAuthError(w, http.StatusInternalServerError, "server_error", "failed to register client")
7878
return
7979
}
8080

81-
logger.Info("client registered", zap.String("internal_id", sc.ID), zap.String("client_name", req.ClientName))
81+
logger.Info("client_registered", zap.String("internal_id", sc.ID), zap.String("client_name", req.ClientName))
8282

8383
writeJSON(w, http.StatusCreated, registerResponse{
8484
ClientID: clientID,

‎handlers/token.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,8 @@ func handleAuthorizationCode(w http.ResponseWriter, r *http.Request, tm *token.M
115115

116116
accessToken, _, err := tm.Issue(audience, code.Subject, code.Email, client.ID, code.Groups, accessTokenTTL)
117117
if err != nil {
118-
logger.Error("failed to issue token", zap.Error(err))
119-
writeOAuthError(w, http.StatusInternalServerError, "server_error", "failed to issue token")
118+
logger.Error("token_issue_failed", zap.Error(err))
119+
writeOAuthError(w, http.StatusInternalServerError, "server_error", "token_issue_failed")
120120
return
121121
}
122122

@@ -132,12 +132,12 @@ func handleAuthorizationCode(w http.ResponseWriter, r *http.Request, tm *token.M
132132
}
133133
refreshToken, err := tm.SealJSON(refresh)
134134
if err != nil {
135-
logger.Error("failed to seal refresh token", zap.Error(err))
135+
logger.Error("refresh_token_seal_failed", zap.Error(err))
136136
writeOAuthError(w, http.StatusInternalServerError, "server_error", "internal error")
137137
return
138138
}
139139

140-
logger.Info("token issued", zap.String("subject", code.Subject), zap.String("client_id", client.ID))
140+
logger.Info("token_issued", zap.String("subject", code.Subject), zap.String("client_id", client.ID))
141141

142142
// RFC 6749 §5.1: token responses must not be cached
143143
w.Header().Set("Cache-Control", "no-store")
@@ -173,7 +173,7 @@ func handleRefreshToken(w http.ResponseWriter, r *http.Request, tm *token.Manage
173173
// Without this check, REVOKE_BEFORE only invalidates access tokens and a
174174
// compromised refresh token would silently mint fresh ones past the cutoff.
175175
if !revokeBefore.IsZero() && refresh.IssuedAt.Before(revokeBefore) {
176-
logger.Debug("refresh token revoked by iat cutoff",
176+
logger.Debug("refresh_token_revoked_iat_cutoff",
177177
zap.Time("issued_at", refresh.IssuedAt),
178178
zap.Time("revoke_before", revokeBefore),
179179
)
@@ -209,8 +209,8 @@ func handleRefreshToken(w http.ResponseWriter, r *http.Request, tm *token.Manage
209209

210210
accessToken, _, err := tm.Issue(audience, refresh.Subject, refresh.Email, client.ID, refresh.Groups, accessTokenTTL)
211211
if err != nil {
212-
logger.Error("failed to issue token on refresh", zap.Error(err))
213-
writeOAuthError(w, http.StatusInternalServerError, "server_error", "failed to issue token")
212+
logger.Error("token_refresh_issue_failed", zap.Error(err))
213+
writeOAuthError(w, http.StatusInternalServerError, "server_error", "token_issue_failed")
214214
return
215215
}
216216

@@ -226,12 +226,12 @@ func handleRefreshToken(w http.ResponseWriter, r *http.Request, tm *token.Manage
226226
}
227227
newRefreshToken, err := tm.SealJSON(newRefresh)
228228
if err != nil {
229-
logger.Error("failed to seal new refresh token", zap.Error(err))
229+
logger.Error("refresh_token_reseal_failed", zap.Error(err))
230230
writeOAuthError(w, http.StatusInternalServerError, "server_error", "internal error")
231231
return
232232
}
233233

234-
logger.Info("token refreshed", zap.String("subject", refresh.Subject), zap.String("client_id", client.ID))
234+
logger.Info("token_refreshed", zap.String("subject", refresh.Subject), zap.String("client_id", client.ID))
235235

236236
// RFC 6749 §5.1: token responses must not be cached
237237
w.Header().Set("Cache-Control", "no-store")

‎main.go‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ func main() {
5454
defer discoveryCancel()
5555
oidcProvider, err := oidc.NewProvider(discoveryCtx, cfg.OIDCIssuerURL)
5656
if err != nil {
57-
logger.Fatal("oidc discovery failed", zap.String("issuer", cfg.OIDCIssuerURL), zap.Error(err))
57+
logger.Fatal("oidc_discovery_failed", zap.String("issuer", cfg.OIDCIssuerURL), zap.Error(err))
5858
}
5959

6060
oauth2Cfg := &oauth2.Config{
@@ -69,12 +69,12 @@ func main() {
6969

7070
tm, err := token.NewManager(cfg.TokenSigningSecret)
7171
if err != nil {
72-
logger.Fatal("token manager init failed", zap.Error(err))
72+
logger.Fatal("token_manager_init_failed", zap.Error(err))
7373
}
7474

7575
proxyHandler, err := proxy.Handler(cfg.UpstreamMCPURL, logger)
7676
if err != nil {
77-
logger.Fatal("proxy handler init failed", zap.Error(err))
77+
logger.Fatal("proxy_handler_init_failed", zap.Error(err))
7878
}
7979

8080
authMW := middleware.NewAuth(tm, logger, cfg.ProxyBaseURL, cfg.RevokeBefore)
@@ -128,30 +128,30 @@ func main() {
128128
defer stop()
129129

130130
go func() {
131-
logger.Info("metrics listening", zap.String("addr", cfg.MetricsAddr))
131+
logger.Info("metrics_listening", zap.String("addr", cfg.MetricsAddr))
132132
if err := metricsSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
133-
logger.Error("metrics listen error", zap.Error(err))
133+
logger.Error("metrics_listen_error", zap.Error(err))
134134
}
135135
}()
136136

137137
go func() {
138138
logger.Info("listening", zap.String("addr", cfg.ListenAddr))
139139
if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
140-
logger.Fatal("listen error", zap.Error(err))
140+
logger.Fatal("listen_error", zap.Error(err))
141141
}
142142
}()
143143

144144
<-ctx.Done()
145-
logger.Info("shutting down", zap.Duration("timeout", cfg.ShutdownTimeout))
145+
logger.Info("shutting_down", zap.Duration("timeout", cfg.ShutdownTimeout))
146146

147147
shutdownCtx, cancel := context.WithTimeout(context.Background(), cfg.ShutdownTimeout)
148148
defer cancel()
149149

150150
if err := srv.Shutdown(shutdownCtx); err != nil {
151-
logger.Error("shutdown error", zap.Error(err))
151+
logger.Error("shutdown_error", zap.Error(err))
152152
}
153153
if err := metricsSrv.Shutdown(shutdownCtx); err != nil {
154-
logger.Error("metrics shutdown error", zap.Error(err))
154+
logger.Error("metrics_shutdown_error", zap.Error(err))
155155
}
156156
}
157157

‎middleware/auth.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ func (a *Auth) Validate(next http.Handler) http.Handler {
4545

4646
claims, err := a.tokenManager.Validate(tokenStr)
4747
if err != nil {
48-
a.logger.Debug("token validation failed", zap.Error(err))
48+
a.logger.Debug("token_validation_failed", zap.Error(err))
4949
a.writeAuthError(w, "invalid_token")
5050
return
5151
}
@@ -54,7 +54,7 @@ func (a *Auth) Validate(next http.Handler) http.Handler {
5454
// proxy base URL that issued it. Two deployments accidentally sharing
5555
// the same TOKEN_SIGNING_SECRET would otherwise be a confused deputy.
5656
if claims.Audience != a.baseURL {
57-
a.logger.Debug("token audience mismatch",
57+
a.logger.Debug("token_audience_mismatch",
5858
zap.String("got", claims.Audience),
5959
zap.String("want", a.baseURL),
6060
)
@@ -64,7 +64,7 @@ func (a *Auth) Validate(next http.Handler) http.Handler {
6464

6565
// Bulk revocation: reject tokens issued before the cutoff
6666
if !a.revokeBefore.IsZero() && claims.IssuedAt.Before(a.revokeBefore) {
67-
a.logger.Debug("token revoked by iat cutoff",
67+
a.logger.Debug("token_revoked_iat_cutoff",
6868
zap.Time("issued_at", claims.IssuedAt),
6969
zap.Time("revoke_before", a.revokeBefore),
7070
)

‎proxy/proxy.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ func Handler(upstreamURL string, logger *zap.Logger) (http.Handler, error) {
119119
Transport: &redirectFollowingTransport{base: http.DefaultTransport},
120120
FlushInterval: -1, // Immediate flush for SSE/streaming
121121
ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
122-
logger.Error("proxy error", zap.Error(err))
122+
logger.Error("proxy_error", zap.Error(err))
123123
http.Error(w, "Bad Gateway", http.StatusBadGateway)
124124
},
125125
}

0 commit comments

Comments
 (0)