From 0e8b04de82f3a27a472f9e07b1c2cb4ee2adef3d Mon Sep 17 00:00:00 2001
From: pmdrs <79358408+pmdrs@users.noreply.github.com>
Date: Tue, 23 Jun 2026 13:52:18 +0300
Subject: [PATCH] auth-oauth2: log callback failures to system logs

OAuth2AuthenticationTrait::callback() had a TODO comment and a bare
catch (Exception $ex) { return false; } that silently swallowed all
authentication errors. Admins had zero visibility when an IdP returned
invalid_client/invalid_grant, when the OAuth2 state did not match, or
when sign-in/auto-registration failed after a successful token
exchange.

Add $ost->logWarning()/logError() calls on each failure path. No
behavior change - the method still returns the same values; it now
also records a diagnostic entry in the System Logs (ost_syslog).
---
 auth-oauth2/oauth2.php | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/auth-oauth2/oauth2.php b/auth-oauth2/oauth2.php
index 441ab6b..2d0af31 100644
--- a/auth-oauth2/oauth2.php
+++ b/auth-oauth2/oauth2.php
@@ -84,7 +84,7 @@ function __construct($config, $provider=null) {
     }
 
     function callback($resp, $ref=null) {
-        //TODO: Log any errors to system logs
+        global $ost;
         try {
             if ($this->getState() == $resp['state']
                 && ($token=$this->provider->getToken($resp['code']))
@@ -97,9 +97,26 @@ function callback($resp, $ref=null) {
                     // desired panel
                     if ($this->login($result, $this))
                         $this->onSignIn();
+                } elseif ($ost) {
+                    $ost->logWarning(sprintf('%s: Sign In Failed',
+                        $this->getServiceName()),
+                        'The identity provider returned valid attributes, '
+                        .'but no local account could be matched or '
+                        .'auto-registered for them.', false);
                 }
+            } elseif ($ost) {
+                $ost->logWarning(sprintf('%s: OAuth2 Callback Failed',
+                    $this->getServiceName()),
+                    'The OAuth2 callback did not complete: the state '
+                    .'parameter did not match, or the identity provider '
+                    .'did not return a usable access token / owner '
+                    .'attributes (e.g. invalid_client, invalid_grant, or '
+                    .'an expired authorization code).', false);
             }
         } catch (Exception $ex) {
+            if ($ost)
+                $ost->logError(sprintf('%s: OAuth2 Authentication Error',
+                    $this->getServiceName()), $ex->getMessage(), false);
             return false;
         }
     }