OAuth - better log messages

3 files changed, 39 insertions, 21 deletions

diff --git a/actions/apioauthaccesstoken.php b/actions/apioauthaccesstoken.php
index 663a7a2bb..6b36d1919 100644
--- a/actions/apioauthaccesstoken.php
+++ b/actions/apioauthaccesstoken.php
@@ -67,7 +67,7 @@ class ApiOauthAccessTokenAction extends ApiOauthAction
 
         $server->add_signature_method($hmac_method);
 
-        $atok = null;
+        $atok = $app = null;
 
         // XXX: Insist that oauth_token and oauth_verifier be populated?
         // Spec doesn't say they MUST be.
@@ -78,7 +78,7 @@ class ApiOauthAccessTokenAction extends ApiOauthAction
 
             $this->reqToken = $req->get_parameter('oauth_token');
             $this->verifier = $req->get_parameter('oauth_verifier');
-
+            $app = $datastore->getAppByRequestToken($this->reqToken);
             $atok = $server->fetch_access_token($req);
 
         } catch (OAuthException $e) {
@@ -92,22 +92,26 @@ class ApiOauthAccessTokenAction extends ApiOauthAction
 
             // Token exchange failed -- log it
 
-            list($proxy, $ip) = common_client_ip();
-
             $msg = sprintf(
-                'API OAuth - Failure exchanging request token for access token, '
-                    . 'request token = %s, verifier = %s, IP = %s, proxy = %s',
+                'API OAuth - Failure exchanging OAuth request token for access token, '
+                    . 'request token = %s, verifier = %s',
                 $this->reqToken,
-                $this->verifier,
-                $ip,
-                $proxy
+                $this->verifier
             );
 
-            common_log(LOG_WARNING, $msg);
-
+            common_log(LOG_WARNIGN, $msg);
             $this->clientError(_("Invalid request token or verifier.", 400, 'text'));
 
         } else {
+            common_log(
+                LOG_INFO,
+                sprintf(
+                    "Issued now access token '%s' for application %d (%s).",
+                    $atok->key,
+                    $app->id,
+                    $app->name
+                )
+            );
             $this->showAccessToken($atok);
         }
     }
diff --git a/actions/apioauthauthorize.php b/actions/apioauthauthorize.php
index ea5c30c2a..eb1000e25 100644
--- a/actions/apioauthauthorize.php
+++ b/actions/apioauthauthorize.php
@@ -113,14 +113,12 @@ class ApiOauthAuthorizeAction extends Action
                 $this->reqToken = $this->store->getTokenByKey($this->oauthTokenParam);
 
                 if (empty($this->reqToken)) {
-                    $this->serverError(
-                        _('Invalid request token.')
-                    );
+                    $this->clientError(_('Invalid request token.'));
                 } else {
 
                     // Check to make sure we haven't already authorized the token
                     if ($this->reqToken->state != 0) {
-                        $this->clientError("Invalid request token.");
+                        $this->clientError(_("Invalid request token."));
                     }
                 }
             }
@@ -240,15 +238,31 @@ class ApiOauthAuthorizeAction extends Action
                 // Redirect the user to the provided OAuth callback
                 common_redirect($targetUrl, 303);
 
-            } else {
+            } elseif ($this->app->type == 2) {
+
+                // Strangely, a web application seems to want to do the OOB
+                // workflow. Because no callback was specified anywhere.
                 common_log(
-                    LOG_INFO,
-                    "No oauth_callback parameter provided for application ID "
-                    . $this->app->id
-                    . " when authorizing request token."
+                    LOG_WARNING,
+                    sprintf(
+                        "API OAuth - No callback provided for OAuth web client ID %s (%s) "
+                         . "during authorization step. Falling back to OOB workflow.",
+                        $this->app->id,
+                        $this->app->name
+                    )
                 );
             }
 
+            common_log(
+                LOG_INFO,
+                sprintf(
+                    "The request token '%s' for OAuth application %s (%s) has been authorized.",
+                    $this->oauthTokenParam,
+                    $this->app->id,
+                    $this->app->name
+                )
+            );
+
             // Otherwise, inform the user that the rt was authorized
             $this->showAuthorized();
 
diff --git a/actions/apioauthrequesttoken.php b/actions/apioauthrequesttoken.php
index 478d2dbfc..7def1aa95 100644
--- a/actions/apioauthrequesttoken.php
+++ b/actions/apioauthrequesttoken.php
@@ -146,7 +146,7 @@ class ApiOauthRequestTokenAction extends ApiOauthAction
     function verifyCallback($callback)
     {
         if ($callback == "oob") {
-            common_debug("OAuth request token requested for out of bounds client.");
+            common_debug("OAuth request token requested for out of band client.");
 
             // XXX: Should we throw an error if a client is registered as a
             // web application but requests the pin based workflow? For now I'm