@agent-native/core 0.12.27 → 0.12.29

package/dist/server/auth.js

@@ -82,6 +82,37 @@ function getOAuthStateAppId() {
         .replace(/^-+|-+$/g, "");
     return slug || undefined;
 }
+function oauthDebugFlowId(flowId) {
+    return typeof flowId === "string" && flowId ? flowId.slice(-10) : undefined;
+}
+function oauthDebugUrlPath(value) {
+    if (typeof value !== "string" || !value)
+        return undefined;
+    try {
+        const url = new URL(value);
+        return url.pathname;
+    }
+    catch {
+        return undefined;
+    }
+}
+function logGoogleOAuthDebug(event, phase, details = {}) {
+    const { flowId, ...rest } = details;
+    const reqUrl = event.node?.req?.url ?? event.path ?? "";
+    const path = reqUrl.split("?")[0] || undefined;
+    const userAgent = getHeader(event, "user-agent") || "";
+    const referer = getHeader(event, "referer") || "";
+    console.info("[agent-native][google-oauth]", {
+        phase,
+        app: getOAuthStateAppId(),
+        path,
+        flow: oauthDebugFlowId(flowId),
+        electron: /Electron/i.test(userAgent),
+        agentNativeDesktop: /AgentNativeDesktop/i.test(userAgent),
+        builderReferrer: /builder\.(io|my)|builderio\.xyz/i.test(referer),
+        ...rest,
+    });
+}
 const DEFAULT_MAX_AGE = 60 * 60 * 24 * 30; // 30 days
 // ---------------------------------------------------------------------------
 // Environment helpers
@@ -1332,6 +1363,15 @@ async function mountBetterAuthRoutes(app, options) {
                 returnUrl,
                 flowId,
             });
+            logGoogleOAuthDebug(event, "auth-url", {
+                flowId,
+                desktop,
+                redirectPath: oauthDebugUrlPath(redirectUri),
+                returnUrl,
+                redirect: q.redirect === "1",
+                workspace: process.env.AGENT_NATIVE_WORKSPACE === "1" ||
+                    process.env.VITE_AGENT_NATIVE_WORKSPACE === "1",
+            });
             const params = new URLSearchParams({
                 client_id: process.env.GOOGLE_CLIENT_ID,
                 redirect_uri: redirectUri,
@@ -1357,6 +1397,8 @@ async function mountBetterAuthRoutes(app, options) {
             const callbackRelay = workspaceOAuthCallbackRelayResponse(event);
             if (callbackRelay)
                 return callbackRelay;
+            let callbackFlowId;
+            let callbackDesktop = false;
             try {
                 const query = getQuery(event);
                 const code = query.code;
@@ -1365,6 +1407,15 @@ async function mountBetterAuthRoutes(app, options) {
                     return { error: "Missing authorization code" };
                 }
                 const { redirectUri, desktop, returnUrl, flowId } = decodeOAuthState(query.state, getAppUrl(event, "/_agent-native/google/callback"));
+                callbackFlowId = flowId;
+                callbackDesktop = desktop;
+                logGoogleOAuthDebug(event, "callback-start", {
+                    flowId,
+                    desktop,
+                    redirectPath: oauthDebugUrlPath(redirectUri),
+                    hasCode: !!code,
+                    returnUrl,
+                });
                 // Defence in depth: the state is HMAC-signed, but if the signing
                 // key ever leaked an attacker could mint state with their own
                 // redirect_uri. Re-validate against the same allowlist used at
@@ -1413,6 +1464,12 @@ async function mountBetterAuthRoutes(app, options) {
                     hasProductionSession: false,
                     desktop,
                 });
+                logGoogleOAuthDebug(event, "callback-session-created", {
+                    flowId,
+                    desktop,
+                    hasSessionToken: !!sessionToken,
+                    emailDomain: email.split("@")[1] || "",
+                });
                 if (flowId && sessionToken) {
                     _desktopExchanges.set(flowId, {
                         token: sessionToken,
@@ -1423,6 +1480,10 @@ async function mountBetterAuthRoutes(app, options) {
                     // Workers, multi-region). Fire-and-forget — in-memory Map is
                     // still the primary fast path for same-instance requests.
                     void persistDesktopExchangeToDB(flowId, sessionToken, email);
+                    logGoogleOAuthDebug(event, "callback-exchange-stored", {
+                        flowId,
+                        desktop,
+                    });
                 }
                 return oauthCallbackResponse(event, email, {
                     sessionToken,
@@ -1433,6 +1494,11 @@ async function mountBetterAuthRoutes(app, options) {
             }
             catch (error) {
                 const msg = error.message || "Unknown error";
+                logGoogleOAuthDebug(event, "callback-error", {
+                    flowId: callbackFlowId,
+                    desktop: callbackDesktop,
+                    message: msg,
+                });
                 return oauthErrorPage(`Connection failed: ${msg}`);
             }
         }));
@@ -1445,7 +1511,8 @@ async function mountBetterAuthRoutes(app, options) {
             setResponseStatus(event, 405);
             return { error: "Method not allowed" };
         }
-        const flowId = getQuery(event).flow_id;
+        const query = getQuery(event);
+        const flowId = query.flow_id;
         if (!flowId) {
             setResponseStatus(event, 400);
             return { error: "Missing flow_id" };
@@ -1457,7 +1524,12 @@ async function mountBetterAuthRoutes(app, options) {
             // OAuth callback and the polling request may hit different isolates.
             const fromDb = await consumeDesktopExchangeFromDB(flowId);
             if (!fromDb) {
-                return { pending: true };
+                // Don't log on the pending path — clients poll every second for up
+                // to 5 minutes, so logging here floods telemetry. The auth-url,
+                // callback-start, callback-session-created, exchange-success, and
+                // exchange-error breadcrumbs already cover every meaningful state
+                // transition.
+                return { pending: true, flow: oauthDebugFlowId(flowId) };
             }
             entry =
                 "error" in fromDb
@@ -1473,6 +1545,11 @@ async function mountBetterAuthRoutes(app, options) {
         // DB fallback path after in-memory consumption.
         void removeSession(`dex:${flowId}`);
         if ("error" in entry) {
+            logGoogleOAuthDebug(event, "exchange-error", {
+                flowId,
+                message: entry.error.message,
+                code: entry.error.code,
+            });
             return { error: entry.error.message, ...entry.error };
         }
         // Make the exchange itself establish the app session. Older clients
@@ -1480,6 +1557,10 @@ async function mountBetterAuthRoutes(app, options) {
         // OAuth handoff should not depend on that second request succeeding.
         setFrameworkSessionCookie(event, entry.token);
         setResponseHeader(event, "Referrer-Policy", "no-referrer");
+        logGoogleOAuthDebug(event, "exchange-success", {
+            flowId,
+            emailDomain: entry.email.split("@")[1] || "",
+        });
         return { token: entry.token, email: entry.email };
     }));
     const accessTokens = getAccessTokens();