debug(meta-ads): add OAuth exchange logging for debugging

[JonasJesus42]

Summary by cubic

Add detailed logging to the Meta Ads OAuth code exchange to make debugging easier. Logs incoming params, presence of META_APP_SECRET (without exposing it), masked token URL, and success/failure responses.

^{Written for commit a25112c. Summary will update automatically on new commits.}

[github-actions]

🚀 Preview Deployments Ready!

Your changes have been deployed to preview environments:

📦 meta-ads

🔗 View Preview

These previews will be automatically updated with new commits to this PR.

---

_{Deployed from commit: 96d1420}

[cubic-dev-ai]

2 issues found across 1 file

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="meta-ads/server/main.ts">

<violation number="1" location="meta-ads/server/main.ts:102">
P1: Logging OAuth parameters exposes sensitive credentials (authorization code and code_verifier) to logs. Even for debugging, avoid logging the full `code` and `code_verifier` values as they could be captured in log aggregation systems.</violation>

<violation number="2" location="meta-ads/server/main.ts:134">
P1: Token URL redaction is incomplete - only `appSecret` is replaced, but the URL also contains the sensitive authorization `code` and `code_verifier` in query params. The comment &quot;without secret&quot; is misleading.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Token URL redaction is incomplete - only appSecret is replaced, but the URL also contains the sensitive authorization code and code_verifier in query params. The comment "without secret" is misleading.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At meta-ads/server/main.ts, line 134:

<comment>Token URL redaction is incomplete - only `appSecret` is replaced, but the URL also contains the sensitive authorization `code` and `code_verifier` in query params. The comment &quot;without secret&quot; is misleading.</comment>

<file context>
@@ -122,16 +129,26 @@ const runtime = withRuntime&lt;Env&gt;({
-        { method: &quot;GET&quot; },
+      const tokenUrl = `https://graph.facebook.com/${META_API_VERSION}/oauth/access_token?${params.toString()}`;
+      console.log(
+        &quot;[Meta OAuth] Token URL (without secret):&quot;,
+        tokenUrl.replace(appSecret, &quot;***&quot;),
       );
</file context>

[cubic-dev-ai]

P1: Logging OAuth parameters exposes sensitive credentials (authorization code and code_verifier) to logs. Even for debugging, avoid logging the full code and code_verifier values as they could be captured in log aggregation systems.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At meta-ads/server/main.ts, line 102:

<comment>Logging OAuth parameters exposes sensitive credentials (authorization code and code_verifier) to logs. Even for debugging, avoid logging the full `code` and `code_verifier` values as they could be captured in log aggregation systems.</comment>

<file context>
@@ -98,7 +98,14 @@ const runtime = withRuntime&lt;Env&gt;({
       redirectUri?: string;
     }) =&gt; {
+      console.log(&quot;[Meta OAuth] exchangeCode called&quot;);
+      console.log(&quot;[Meta OAuth] oauthParams:&quot;, JSON.stringify(oauthParams));
+
       const appSecret = getEnv(&quot;META_APP_SECRET&quot;);
</file context>

Suggested change

	console.log("[Meta OAuth] oauthParams:", JSON.stringify(oauthParams));
	console.log("[Meta OAuth] oauthParams:", JSON.stringify({
	...oauthParams,
	code: oauthParams.code ? "[REDACTED]" : undefined,
	code_verifier: oauthParams.code_verifier ? "[REDACTED]" : undefined,
	}));