fix: add logging to authentication errors in controller and router

Log authentication failures in the controller service (Listen,
GetLease, RequestLease, ReleaseLease, ListLeases) and in the
Auth helpers (AuthClient, AuthExporter) which cover all ClientService
call sites.

Also log passphrase authentication failures in the Python exporter's
PassphraseInterceptor, where the logger was defined but never called.

Additionally fix the router JWT validation error code from
codes.InvalidArgument to codes.Unauthenticated, which is the
semantically correct code for a failed authentication.

Fixes #811

Author: mangelajo

controller/internal/service/auth/auth.go

@@ -11,6 +11,7 @@ import (
 	"google.golang.org/grpc/status"
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 	kclient "sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 )
 
 type Auth struct {
@@ -35,6 +36,8 @@ func NewAuth(
 }
 
 func (s *Auth) AuthClient(ctx context.Context, namespace string) (*jumpstarterdevv1alpha1.Client, error) {
+	logger := log.FromContext(ctx)
+
 	jclient, err := oidc.VerifyClientObjectToken(
 		ctx,
 		s.authn,
@@ -44,17 +47,22 @@ func (s *Auth) AuthClient(ctx context.Context, namespace string) (*jumpstarterde
 	)
 
 	if err != nil {
+		logger.Info("unable to authenticate client", "error", err.Error())
 		return nil, err
 	}
 
 	if namespace != jclient.Namespace {
-		return nil, status.Error(codes.PermissionDenied, "namespace mismatch")
+		err := status.Error(codes.PermissionDenied, "namespace mismatch")
+		logger.Info("unable to authenticate client", "error", err.Error())
+		return nil, err
 	}
 
 	return jclient, nil
 }
 
 func (s *Auth) AuthExporter(ctx context.Context, namespace string) (*jumpstarterdevv1alpha1.Exporter, error) {
+	logger := log.FromContext(ctx)
+
 	jexporter, err := oidc.VerifyExporterObjectToken(
 		ctx,
 		s.authn,
@@ -64,11 +72,14 @@ func (s *Auth) AuthExporter(ctx context.Context, namespace string) (*jumpstarter
 	)
 
 	if err != nil {
+		logger.Info("unable to authenticate exporter", "error", err.Error())
 		return nil, err
 	}
 
 	if namespace != jexporter.Namespace {
-		return nil, status.Error(codes.PermissionDenied, "namespace mismatch")
+		err := status.Error(codes.PermissionDenied, "namespace mismatch")
+		logger.Info("unable to authenticate exporter", "error", err.Error())
+		return nil, err
 	}
 
 	return jexporter, nil

controller/internal/service/controller_service.go

@@ -524,6 +524,7 @@ func (s *ControllerService) Listen(req *pb.ListenRequest, stream pb.ControllerSe
 
 	exporter, err := s.authenticateExporter(ctx)
 	if err != nil {
+		logger.Info("unable to authenticate exporter", "error", err.Error())
 		return err
 	}
 
@@ -898,8 +899,11 @@ func (s *ControllerService) GetLease(
 	ctx context.Context,
 	req *pb.GetLeaseRequest,
 ) (*pb.GetLeaseResponse, error) {
+	logger := log.FromContext(ctx)
+
 	client, err := s.authenticateClient(ctx)
 	if err != nil {
+		logger.Info("unable to authenticate client", "error", err.Error())
 		return nil, err
 	}
 
@@ -977,8 +981,11 @@ func (s *ControllerService) RequestLease(
 	ctx context.Context,
 	req *pb.RequestLeaseRequest,
 ) (*pb.RequestLeaseResponse, error) {
+	logger := log.FromContext(ctx)
+
 	client, err := s.authenticateClient(ctx)
 	if err != nil {
+		logger.Info("unable to authenticate client", "error", err.Error())
 		return nil, err
 	}
 
@@ -1031,8 +1038,11 @@ func (s *ControllerService) ReleaseLease(
 	ctx context.Context,
 	req *pb.ReleaseLeaseRequest,
 ) (*pb.ReleaseLeaseResponse, error) {
+	logger := log.FromContext(ctx)
+
 	jclient, err := s.authenticateClient(ctx)
 	if err != nil {
+		logger.Info("unable to authenticate client", "error", err.Error())
 		return nil, err
 	}
 
@@ -1062,8 +1072,11 @@ func (s *ControllerService) ListLeases(
 	ctx context.Context,
 	req *pb.ListLeasesRequest,
 ) (*pb.ListLeasesResponse, error) {
+	logger := log.FromContext(ctx)
+
 	jclient, err := s.authenticateClient(ctx)
 	if err != nil {
+		logger.Info("unable to authenticate client", "error", err.Error())
 		return nil, err
 	}
 

controller/internal/service/router_service.go

@@ -71,7 +71,7 @@ func (s *RouterService) authenticate(ctx context.Context) (string, error) {
 	)
 
 	if err != nil || !parsed.Valid {
-		return "", status.Errorf(codes.InvalidArgument, "invalid jwt token")
+		return "", status.Errorf(codes.Unauthenticated, "invalid jwt token")
 	}
 
 	return parsed.Claims.GetSubject()

python/packages/jumpstarter/jumpstarter/exporter/auth.py

@@ -25,6 +25,10 @@ async def intercept_service(self, continuation, handler_call_details):
         provided = metadata.get(PASSPHRASE_METADATA_KEY)
 
         if provided is None or not hmac.compare_digest(provided, self._passphrase):
+            logger.warning(
+                "authentication failed: invalid or missing passphrase for method %s",
+                handler_call_details.method,
+            )
             # Resolve the real handler to preserve the RPC type, then reject
             handler = await continuation(handler_call_details)
             if handler is None: