improve logging

Author: dillonstreator

src/app/api/auth/account/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { deviceLinkStatus } from "@/lib/account-link";
+import { logApiReject } from "@/lib/api-log";
 
 export const runtime = "nodejs";
 
@@ -9,11 +10,13 @@ const COOKIE = "wh_lid";
 export async function GET(req: NextRequest) {
   const localId = req.cookies.get(COOKIE)?.value;
   if (!localId) {
+    logApiReject("auth/account", "no_device", { hasCookie: false });
     return NextResponse.json({ error: "no_device" }, { status: 401 });
   }
 
   const status = await deviceLinkStatus(localId);
   if (!status) {
+    logApiReject("auth/account", "device_missing");
     return NextResponse.json({ error: "device_missing" }, { status: 404 });
   }
 

src/app/api/auth/link/accept/route.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { sql } from "drizzle-orm";
 import { db } from "@/db";
 import { linkDevices } from "@/lib/account-link";
+import { logApiReject, zodIssueSummary } from "@/lib/api-log";
 import { admitLinkAccept } from "@/lib/ratelimit";
 
 export const runtime = "nodejs";
@@ -22,11 +23,17 @@ export async function POST(req: NextRequest) {
   const targetLocalId = req.cookies.get(COOKIE)?.value;
 
   if (!parsed.success || !targetLocalId) {
+    logApiReject("auth/link/accept", "bad_request", {
+      bodyValid: parsed.success,
+      hasCookie: !!targetLocalId,
+      ...(parsed.success ? {} : zodIssueSummary(parsed.error.issues)),
+    });
     return NextResponse.json({ error: "bad_request" }, { status: 400 });
   }
 
   const verdict = await admitLinkAccept(targetLocalId);
   if (!verdict.ok) {
+    logApiReject("auth/link/accept", "rate_limited", { reason: verdict.reason });
     return NextResponse.json({ error: "rate_limited" }, { status: 429 });
   }
 
@@ -39,13 +46,18 @@ export async function POST(req: NextRequest) {
 
   const row = consumed.rows?.[0];
   if (!row) {
+    logApiReject("auth/link/accept", "invalid_code", { codeLen: code.length });
     return NextResponse.json({ error: "invalid_code" }, { status: 400 });
   }
 
   const result = await linkDevices(row.sourceLocalId, targetLocalId);
   if (!result.ok) {
     const status =
       result.reason === "same_device" ? 409 : result.reason === "target_missing" ? 404 : 400;
+    logApiReject("auth/link/accept", result.reason, {
+      sourcePresent: result.reason !== "source_missing",
+      targetPresent: result.reason !== "target_missing",
+    });
     return NextResponse.json({ error: result.reason }, { status });
   }
 

src/app/api/auth/link/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { db } from "@/db";
 import { linkTokens } from "@/db/schema";
 import { newLinkCode } from "@/lib/codes";
+import { logApiError, logApiReject } from "@/lib/api-log";
 import { LINK_TTL_MS } from "@/lib/token";
 import { admitLinkCreate } from "@/lib/ratelimit";
 
@@ -13,11 +14,13 @@ const COOKIE = "wh_lid";
 export async function POST(req: NextRequest) {
   const localId = req.cookies.get(COOKIE)?.value;
   if (!localId) {
+    logApiReject("auth/link", "no_device", { hasCookie: false });
     return NextResponse.json({ error: "no_device" }, { status: 401 });
   }
 
   const verdict = await admitLinkCreate(localId);
   if (!verdict.ok) {
+    logApiReject("auth/link", "rate_limited", { reason: verdict.reason });
     return NextResponse.json({ error: "rate_limited" }, { status: 429 });
   }
 
@@ -33,9 +36,10 @@ export async function POST(req: NextRequest) {
         expiresAt,
       });
       break;
-    } catch {
+    } catch (err) {
       code = newLinkCode();
       if (i === 3) {
+        logApiError("auth/link", "code insert failed after retries", err);
         return NextResponse.json({ error: "unavailable" }, { status: 503 });
       }
     }

src/app/api/auth/magic/route.ts

@@ -5,6 +5,7 @@ import { magicTokens } from "@/db/schema";
 import { newNonce, signNonce, MAGIC_TTL_MS } from "@/lib/token";
 import { emailHash, hashKeyed } from "@/lib/crypto";
 import { sendMail } from "@/lib/mailer";
+import { logApiReject } from "@/lib/api-log";
 import { admitMagic } from "@/lib/ratelimit";
 import { clientIp } from "@/lib/geo";
 
@@ -26,7 +27,9 @@ export async function POST(req: NextRequest) {
     const ipHash = hashKeyed(clientIp(req.headers));
 
     const verdict = await admitMagic(ipHash, hashed);
-    if (verdict.ok) {
+    if (!verdict.ok) {
+      logApiReject("auth/magic", "skipped", { reason: verdict.reason });
+    } else {
       const nonce = newNonce();
       const token = signNonce(nonce);
       const expiresAt = new Date(Date.now() + MAGIC_TTL_MS);
@@ -49,6 +52,11 @@ export async function POST(req: NextRequest) {
         console.error("[auth/magic] send failed:", err);
       });
     }
+  } else {
+    logApiReject("auth/magic", "skipped", {
+      bodyValid: parsed.success,
+      hasCookie: !!localId,
+    });
   }
 
   const elapsed = Date.now() - started;

src/app/api/auth/unlink/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { unlinkDevice } from "@/lib/account-link";
+import { logApiReject } from "@/lib/api-log";
 
 export const runtime = "nodejs";
 
@@ -9,12 +10,14 @@ const COOKIE = "wh_lid";
 export async function POST(req: NextRequest) {
   const localId = req.cookies.get(COOKIE)?.value;
   if (!localId) {
+    logApiReject("auth/unlink", "no_device", { hasCookie: false });
     return NextResponse.json({ error: "no_device" }, { status: 401 });
   }
 
   const result = await unlinkDevice(localId);
   if (!result.ok) {
     const status = result.reason === "device_missing" ? 404 : 400;
+    logApiReject("auth/unlink", result.reason);
     return NextResponse.json({ error: result.reason }, { status });
   }
 

src/app/api/auth/verify/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { verifyNonce } from "@/lib/token";
+import { logApiReject } from "@/lib/api-log";
 import { executeMagicVerify, magicTokenStatus } from "@/lib/magic-verify";
 import type { VerifyFailureReason } from "@/lib/verify-feedback";
 
@@ -15,9 +16,13 @@ const COOKIE = "wh_lid";
 export async function GET(req: NextRequest) {
   const token = req.nextUrl.searchParams.get("token");
   const nonce = token ? verifyNonce(token) : null;
-  if (!nonce) return failRedirect(req, "invalid");
+  if (!nonce) {
+    logApiReject("auth/verify", "invalid", { phase: "get", hasToken: !!token });
+    return failRedirect(req, "invalid");
+  }
   const status = await magicTokenStatus(nonce);
   if (status !== "valid") {
+    logApiReject("auth/verify", status === "expired" ? "expired" : "used", { phase: "get" });
     return failRedirect(req, status === "expired" ? "expired" : "used");
   }
 
@@ -64,15 +69,22 @@ export async function POST(req: NextRequest) {
 
   const nonce = token ? verifyNonce(token) : null;
   const deviceLocalId = req.cookies.get(COOKIE)?.value;
-  if (!nonce) return failRedirect(req, "invalid");
-  if (!deviceLocalId) return failRedirect(req, "no_session");
+  if (!nonce) {
+    logApiReject("auth/verify", "invalid", { phase: "post", hasToken: !!token });
+    return failRedirect(req, "invalid");
+  }
+  if (!deviceLocalId) {
+    logApiReject("auth/verify", "no_session", { phase: "post" });
+    return failRedirect(req, "no_session");
+  }
 
   try {
     const result = await executeMagicVerify(nonce, deviceLocalId);
     if (result === "ok") {
       return NextResponse.redirect(new URL("/?verified=1", req.nextUrl.origin));
     }
     if (result === "device_mismatch") {
+      logApiReject("auth/verify", "wrong_device", { phase: "post" });
       return failRedirect(req, "wrong_device");
     }
     if (result === "token_invalid") {
@@ -83,6 +95,7 @@ export async function POST(req: NextRequest) {
     return failRedirect(req, "error");
   }
 
+  logApiReject("auth/verify", "error", { phase: "post", detail: "unexpected_result" });
   return failRedirect(req, "error");
 }
 
@@ -92,6 +105,8 @@ function failRedirect(req: NextRequest, reason: VerifyFailureReason) {
 
 async function failRedirectForToken(req: NextRequest, nonce: string) {
   const status = await magicTokenStatus(nonce);
+  const reason = status === "expired" ? "expired" : "used";
+  logApiReject("auth/verify", reason, { phase: "post", tokenStatus: status });
   if (status === "expired") return failRedirect(req, "expired");
   return failRedirect(req, "used");
 }

src/app/api/node/route.ts

@@ -14,6 +14,7 @@ import { newCode } from "@/lib/codes";
 import { classify, isHuman } from "@/lib/classify";
 import { geoFromHeaders, clientIp } from "@/lib/geo";
 import { hashKeyed } from "@/lib/crypto";
+import { logApiError, logApiReject, zodIssueSummary } from "@/lib/api-log";
 import { admit } from "@/lib/ratelimit";
 import { riskScore } from "@/lib/risk";
 import { checkBotId } from "botid/server";
@@ -35,11 +36,13 @@ const COOKIE = "wh_lid";
 export async function POST(req: NextRequest) {
   const parsed = Body.safeParse(await req.json().catch(() => null));
   if (!parsed.success) {
+    logApiReject("node", "bad_request", zodIssueSummary(parsed.error.issues));
     return NextResponse.json({ error: "bad_request" }, { status: 400 });
   }
 
   const cookieLocalId = req.cookies.get(COOKIE)?.value;
   if (cookieLocalId && cookieLocalId !== parsed.data.localId) {
+    logApiReject("node", "identity_mismatch", { hasCookie: true });
     return NextResponse.json({ error: "identity_mismatch" }, { status: 403 });
   }
 
@@ -91,6 +94,7 @@ export async function POST(req: NextRequest) {
   // ── Admission control (Redis counters; allow-all if no Redis in dev). ──
   const verdict = await admit({ localId, fingerprint: fpHash, referrerId, ipHash });
   if (!verdict.ok) {
+    logApiReject("node", "rate_limited", { reason: verdict.reason });
     return NextResponse.json({ error: "rate_limited", reason: verdict.reason }, { status: 429 });
   }
 
@@ -114,6 +118,7 @@ export async function POST(req: NextRequest) {
   } catch (e) {
     const msg = (e as Error).message;
     if (msg === "NODE_CREATE_REJECTED") {
+      logApiReject("node", "rejected");
       return NextResponse.json({ error: "rejected" }, { status: 409 });
     }
     // unique(local_id) race → treat as existing
@@ -124,10 +129,9 @@ export async function POST(req: NextRequest) {
       setCookie(res, localId);
       return res;
     }
+    logApiError("node", "create failed", e);
     throw e;
   }
-
-  // ── Metric fan-out: only human nodes count toward ancestors' reach. ──
   if (isHuman(nodeClass)) {
     await bumpAncestors(created, geo.country);
   }

src/lib/api-log.ts

@@ -0,0 +1,34 @@
+/** Structured server-side logging for API rejections and failures. */
+
+export type ApiLogContext = Record<string, unknown>;
+
+function formatContext(ctx?: ApiLogContext): string {
+  if (!ctx || Object.keys(ctx).length === 0) return "";
+  try {
+    return ` ${JSON.stringify(ctx)}`;
+  } catch {
+    return " [context unserializable]";
+  }
+}
+
+/** Log a deliberate 4xx response (client error, rate limit, conflict, etc.). */
+export function logApiReject(tag: string, error: string, ctx?: ApiLogContext): void {
+  console.warn(`[${tag}] ${error}${formatContext(ctx)}`);
+}
+
+/** Log an unexpected server error (5xx, thrown exception). */
+export function logApiError(tag: string, message: string, err?: unknown, ctx?: ApiLogContext): void {
+  const suffix = formatContext(ctx);
+  if (err !== undefined) {
+    console.error(`[${tag}] ${message}${suffix}`, err);
+  } else {
+    console.error(`[${tag}] ${message}${suffix}`);
+  }
+}
+
+/** Zod issue summary safe for logs (no raw user input). */
+export function zodIssueSummary(issues: { path: PropertyKey[]; code: string }[]): ApiLogContext {
+  return {
+    issues: issues.map((i) => ({ path: i.path.join("."), code: i.code })),
+  };
+}