From 6a6cd2bb5d0d7d3685484a6182a8fc90c8a2b5ec Mon Sep 17 00:00:00 2001
From: Leon Stringer <leon.stringer@ntlworld.com>
Date: Thu, 28 Jan 2021 10:02:58 +0000
Subject: [PATCH] MDL-70282 oauth: Improve error information

If the request to the OAuth 2 token endpoint fails show the response
body the endpoint returned with its HTTP status (when debug: DEVELOPER).
If no response is available show any error returned by Curl.  Previously
none of this information was available making troubleshooting difficult.

If a token refresh fails in \core\oauth2\refresh_system_tokens_task an
exception is now thrown so that the result is shown as "Fail" on
admin/tasklogs.php?filter=core\oauth2\refresh_system_tokens_task
---
 lang/en/error.php                                 | 3 +++
 lib/classes/oauth2/client.php                     | 3 ++-
 lib/classes/oauth2/refresh_system_tokens_task.php | 7 +++++++
 lib/oauthlib.php                                  | 3 ++-
 4 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/lang/en/error.php b/lang/en/error.php
index 096bc7415df..6631f6203be 100644
--- a/lang/en/error.php
+++ b/lang/en/error.php
@@ -474,6 +474,9 @@ $string['notownerofkey'] = 'You are not owner of this key';
 $string['nousers'] = 'No such user!';
 $string['oauth1accesstoken'] = 'OAuth 1.0 error: We did not obtain the access token.';
 $string['oauth1requesttoken'] = 'OAuth 1.0 error: We did not obtain the request token - the service provider may be temporarily down.';
+$string['oauth2upgradetokenerror'] = 'Could not upgrade OAuth 2 token. HTTP status for remote endpoint: {$a}';
+$string['oauth2refreshtokenerror'] = 'Could not refresh OAuth 2 token. HTTP status for remote endpoint: {$a}';
+$string['oauth2refreshtokentaskerror'] = 'Could not refresh OAuth 2 token for one or more issuers. View task output for details.';
 $string['onlyadmins'] = 'Only administrators can do that';
 $string['onlyeditingteachers'] = 'Only editing teachers can do that';
 $string['onlyeditown'] = 'You can only edit your own information';
diff --git a/lib/classes/oauth2/client.php b/lib/classes/oauth2/client.php
index 6c49aaaa67c..5b637531743 100644
--- a/lib/classes/oauth2/client.php
+++ b/lib/classes/oauth2/client.php
@@ -403,7 +403,8 @@ class client extends \oauth2_client {
         }
 
         if ($this->info['http_code'] !== 200) {
-            throw new moodle_exception('Could not upgrade oauth token');
+            $debuginfo = !empty($this->error) ? $this->error : $response;
+            throw new moodle_exception('oauth2refreshtokenerror', 'core_error', '', $this->info['http_code'], $debuginfo);
         }
 
         $r = json_decode($response);
diff --git a/lib/classes/oauth2/refresh_system_tokens_task.php b/lib/classes/oauth2/refresh_system_tokens_task.php
index 66bb0d70ca9..1249cdf3405 100644
--- a/lib/classes/oauth2/refresh_system_tokens_task.php
+++ b/lib/classes/oauth2/refresh_system_tokens_task.php
@@ -85,6 +85,7 @@ class refresh_system_tokens_task extends scheduled_task {
      */
     public function execute() {
         $issuers = \core\oauth2\api::get_all_issuers();
+        $tasksuccess = true;
         foreach ($issuers as $issuer) {
             if ($issuer->is_system_account_connected()) {
                 try {
@@ -92,13 +93,19 @@ class refresh_system_tokens_task extends scheduled_task {
                     // Returns false or throws a moodle_exception on error.
                     $success = \core\oauth2\api::get_system_oauth_client($issuer);
                 } catch (moodle_exception $e) {
+                    mtrace($e->getMessage());
                     $success = false;
                 }
                 if ($success === false) {
                     $this->notify_admins($issuer);
+                    $tasksuccess = false;
                 }
             }
         }
+
+        if (!$tasksuccess) {
+             throw new moodle_exception('oauth2refreshtokentaskerror', 'core_error');
+        }
     }
 
 }
diff --git a/lib/oauthlib.php b/lib/oauthlib.php
index 30c192f97d2..f91a9f98daa 100644
--- a/lib/oauthlib.php
+++ b/lib/oauthlib.php
@@ -568,7 +568,8 @@ abstract class oauth2_client extends curl {
         }
 
         if ($this->info['http_code'] !== 200) {
-            throw new moodle_exception('Could not upgrade oauth token');
+            $debuginfo = !empty($this->error) ? $this->error : $response;
+            throw new moodle_exception('oauth2upgradetokenerror', 'core_error', '', $this->info['http_code'], $debuginfo);
         }
 
         $r = json_decode($response);