From 022609191fa4d2c4992fe398932dcf6ab1f8eba3 Mon Sep 17 00:00:00 2001
From: Codex <codex@local>
Date: Fri, 24 Apr 2026 09:52:29 -0500
Subject: [PATCH] Log TeamSnap token exchange failures

---
 backend/app/auth.py | 70 ++++++++++++++++++++++++++++++---------------
 1 file changed, 47 insertions(+), 23 deletions(-)

diff --git a/backend/app/auth.py b/backend/app/auth.py
index 36055bd..bc7f582 100644
--- a/backend/app/auth.py
+++ b/backend/app/auth.py
@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import logging
 import secrets
 from datetime import datetime, timedelta, timezone
 from urllib.parse import urlencode
@@ -13,6 +14,8 @@ from .config import settings
 from .database import get_db
 from .models import UserSession
 
+logger = logging.getLogger(__name__)
+
 
 def utcnow() -> datetime:
     return datetime.now(timezone.utc)
@@ -119,36 +122,57 @@ async def fetch_teamsnap_user_id(access_token: str) -> str | None:
 
 
 async def exchange_code_for_token(code: str) -> dict:
-    async with httpx.AsyncClient(timeout=15.0) as client:
-        response = await client.post(
-            settings.teamsnap_token_url,
-            data={
-                "grant_type": "authorization_code",
-                "code": code,
-                "redirect_uri": settings.teamsnap_redirect_uri,
-                "client_id": settings.teamsnap_client_id,
-                "client_secret": settings.teamsnap_client_secret,
-            },
-            headers={"Accept": "application/json"},
-        )
+    try:
+        async with httpx.AsyncClient(timeout=15.0) as client:
+            response = await client.post(
+                settings.teamsnap_token_url,
+                data={
+                    "grant_type": "authorization_code",
+                    "code": code,
+                    "redirect_uri": settings.teamsnap_redirect_uri,
+                    "client_id": settings.teamsnap_client_id,
+                    "client_secret": settings.teamsnap_client_secret,
+                },
+                headers={"Accept": "application/json"},
+            )
+    except httpx.HTTPError as exc:
+        logger.exception("TeamSnap token exchange request failed")
+        raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail="TeamSnap token exchange failed") from exc
     if response.status_code >= 400:
+        logger.error(
+            "TeamSnap token exchange rejected: status=%s body=%s redirect_uri=%s client_id_suffix=%s",
+            response.status_code,
+            response.text,
+            settings.teamsnap_redirect_uri,
+            settings.teamsnap_client_id[-6:] if settings.teamsnap_client_id else "",
+        )
         raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail="TeamSnap token exchange failed")
     return response.json()
 
 
 async def refresh_access_token(refresh_token: str) -> dict:
-    async with httpx.AsyncClient(timeout=15.0) as client:
-        response = await client.post(
-            settings.teamsnap_token_url,
-            data={
-                "grant_type": "refresh_token",
-                "refresh_token": refresh_token,
-                "client_id": settings.teamsnap_client_id,
-                "client_secret": settings.teamsnap_client_secret,
-            },
-            headers={"Accept": "application/json"},
-        )
+    try:
+        async with httpx.AsyncClient(timeout=15.0) as client:
+            response = await client.post(
+                settings.teamsnap_token_url,
+                data={
+                    "grant_type": "refresh_token",
+                    "refresh_token": refresh_token,
+                    "client_id": settings.teamsnap_client_id,
+                    "client_secret": settings.teamsnap_client_secret,
+                },
+                headers={"Accept": "application/json"},
+            )
+    except httpx.HTTPError as exc:
+        logger.exception("TeamSnap token refresh request failed")
+        raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail="TeamSnap token refresh failed") from exc
     if response.status_code >= 400:
+        logger.error(
+            "TeamSnap token refresh rejected: status=%s body=%s client_id_suffix=%s",
+            response.status_code,
+            response.text,
+            settings.teamsnap_client_id[-6:] if settings.teamsnap_client_id else "",
+        )
         raise HTTPException(status_code=status.HTTP_502_BAD_GATEWAY, detail="TeamSnap token refresh failed")
     return response.json()