1 files changed, 28 insertions, 0 deletions

diff --git a/app/controllers/oauth2_device.go b/app/controllers/oauth2_device.go
index 0ddf653..c431495 100644
--- a/app/controllers/oauth2_device.go
+++ b/app/controllers/oauth2_device.go
@@ -9,7 +9,23 @@ import (
 
         "code.crute.us/mcrute/ssh-proxy/app"
         "code.crute.us/mcrute/ssh-proxy/app/models"
+
         "github.com/labstack/echo/v4"
+        "github.com/prometheus/client_golang/prometheus"
+        "github.com/prometheus/client_golang/prometheus/promauto"
+)
+
+var (
+        oauth2DeviceError = promauto.NewCounterVec(prometheus.CounterOpts{
+                Namespace: "ssh_proxy",
+                Name:      "oauth2_device_error",
+                Help:      "Total number of errors during oauth2 device operations",
+        }, []string{"type"})
+        oauth2DeviceSuccess = promauto.NewCounter(prometheus.CounterOpts{
+                Namespace: "ssh_proxy",
+                Name:      "oauth2_device_success",
+                Help:      "Total number of successful oauth2 device auths",
+        })
 )
 
 func badRequest(c echo.Context, e models.AuthorizationError, d string) error {
@@ -40,15 +56,18 @@ func (a *OAuth2DeviceController[T]) HandleStart(c echo.Context) error {
         client, err := a.OauthClients.Get(ctx, form.ClientId)
         if err != nil {
                 a.Logger.Errorf("Unable to find client ID '%s': %s", form.ClientId, err)
+                oauth2DeviceError.With(prometheus.Labels{"type": "invalid_client_id"}).Inc()
                 return badRequest(c, models.ErrUnauthorizedClient, "")
         }
 
         if len(form.Challenge) <= 16 {
+                oauth2DeviceError.With(prometheus.Labels{"type": "challenge_length"}).Inc()
                 return badRequest(c, models.ErrInvalidRequest,
                         "code_challenge is too short, minimum length is 16 bytes")
         }
 
         if form.ChallengeMethod != models.ChallengeS256 {
+                oauth2DeviceError.With(prometheus.Labels{"type": "challenge_type"}).Inc()
                 return badRequest(c, models.ErrInvalidRequest,
                         "code_challenge_method invalid, only S256 supported")
         }
@@ -58,11 +77,13 @@ func (a *OAuth2DeviceController[T]) HandleStart(c echo.Context) error {
         session.SetScopeString(form.Scope)
 
         if !session.HasAnyScopes() {
+                oauth2DeviceError.With(prometheus.Labels{"type": "no_scopes"}).Inc()
                 return badRequest(c, models.ErrInvalidRequest, "one or more scopes required")
         }
 
         for _, s := range session.Scope {
                 if s != "ssh:proxy" && s != "ca:issue" {
+                        oauth2DeviceError.With(prometheus.Labels{"type": "invalid_scope"}).Inc()
                         return badRequest(c, models.ErrInvalidScope, fmt.Sprintf("scope %s is not recognized", s))
                 }
         }
@@ -93,27 +114,33 @@ func (a *OAuth2DeviceController[T]) HandleToken(c echo.Context) error {
 
         session, err := a.AuthSessions.Get(ctx, form.DeviceCode)
         if err != nil {
+                oauth2DeviceError.With(prometheus.Labels{"type": "no_auth_session"}).Inc()
                 return c.NoContent(http.StatusNotFound)
         }
 
         if form.GrantType != models.DEVICE_CODE_GRANT_TYPE {
+                oauth2DeviceError.With(prometheus.Labels{"type": "invalid_grant_type"}).Inc()
                 return badRequest(c, models.ErrUnsupportedGrantType, "")
         }
 
         if subtle.ConstantTimeCompare([]byte(session.ClientId), []byte(form.ClientId)) != 1 {
+                oauth2DeviceError.With(prometheus.Labels{"type": "client_id_mismatch"}).Inc()
                 return badRequest(c, models.ErrUnauthorizedClient, "")
         }
 
         if time.Now().After(session.Expires) {
+                oauth2DeviceError.With(prometheus.Labels{"type": "expired_session"}).Inc()
                 return badRequest(c, models.ErrExpiredToken, "")
         }
 
         verifier := &models.PKCEChallenge{Verifier: form.CodeVerifier}
         if verifier.EqualString(session.Challenge) {
+                oauth2DeviceError.With(prometheus.Labels{"type": "pkce_mismatch"}).Inc()
                 return badRequest(c, models.ErrInvalidGrant, "") // Per RFC7636 4.6
         }
 
         if session.IsRegistration {
+                oauth2DeviceError.With(prometheus.Labels{"type": "is_registration_session"}).Inc()
                 return badRequest(c, models.ErrInvalidGrant, "")
         }
 
@@ -121,6 +148,7 @@ func (a *OAuth2DeviceController[T]) HandleToken(c echo.Context) error {
                 return badRequest(c, models.ErrAuthorizationPending, "")
         }
 
+        oauth2DeviceSuccess.Inc()
         return c.JSON(http.StatusOK, models.AccessTokenResponse{
                 AccessToken: session.AccessCode,
                 TokenType:   "Bearer",