fix(auth): Add OAuth failure observability#1090
Merged
Merged
Conversation
Add bounded OAuth error telemetry to Cloudflare spans and response metrics so invalid-token responses can be attributed by route, client family, and token shape without logging raw tokens or grant IDs. Route the OAuth provider's error callback through LogTape/Sentry Logs to preserve the existing provider error count source after removing console logging capture. Add a low-volume reauthorization log for server-side grant revocations, update the semantic attribute registry and docs, and remove the unused Claude optimizer agent file. Co-Authored-By: GPT-5 Codex <codex@openai.com>
dcramer
force-pushed
the
auth-observability-token-failures
branch
from
cf2a999 to
174681f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This keeps invalid OAuth token responses observable after removing duplicate Cloudflare console capture. The OAuth provider now sends its existing
OAuth error response: ...messages through LogTape/Sentry Logs, response spans and metrics get bounded OAuth error attributes, and server-side grant reauthorization decisions emit a low-volume log with a non-secret grant fingerprint.The change also updates the auth/monitoring playbooks, protects the custom
appsemantic attribute registry from OTel regeneration, replaces a remaining server-sideconsole.errorwithlogError, and removes the unused Claude optimizer agent file as cleanup.Validated with
pnpm --filter @sentry/mcp-cloudflare tsc, targeted Cloudflare auth/logging tests,pnpm --filter @sentry/mcp-core test -- src/internal/agents/tools/otel-semantics.test.ts, andpnpm run lint.