fix(oauth): log rejected authorization and token steps
Before: when an MCP client such as Claude finishes the Recoup sign-in but its token exchange or authorization is rejected, the server logs nothing. A failed bearer check caused by a storage error on /mcp is also swallowed silently. So when the Claude connector reports "sign in failed", the logs can't show which step failed.
After: each rejected authorization or token request logs OAuth request rejected with { event: "oauth_request_rejected", step: "authorization" | "grant", error: <standard OAuth error code or "other"> }. A storage failure while checking an OAuth bearer on /mcp logs oauth_bearer_verification_unavailable. No codes, tokens, client IDs or account IDs are logged.
How: createRecoupOAuthProvider listens to oidc-provider's authorization.error and grant.error events and reduces each error to an allow-listed code with the new getOAuthErrorCode. Registration denials stay unlogged, as the existing diagnostics test expects. verifyBearerToken logs a fixed event in its existing catch. A new test in providerDiagnostics.test.ts checks that a rejected token exchange logs only the step and code.
Context: locally, Claude's real client metadata document (CIMD) and a Claude-style DCR registration both complete authorize, consent, callback, token, bearer check and refresh against this code, including the full OAuth suite on the real SQL migrations (320 tests). So the Claude connector failure only shows up in production, and this logging is meant to name the failing step after one reconnect.
Tests: pnpm test:mcp-oauth passes, as do vitest run app/mcp lib/mcp/oauth and tsc -p tsconfig.build.json.
Generated by Claude Code
Summary by cubic
Adds diagnostics logging so OAuth authorization and token rejections, plus bearer-check storage failures, no longer fail silently during MCP sign-in.
A rejected authorization or token request now logs OAuth request rejected with the failing step (authorization or grant) and a standard, nonsecret OAuth error code. A storage failure while verifying an OAuth bearer on /mcp logs oauth_bearer_verification_unavailable. No codes, tokens, client IDs, or account IDs are logged. Registration denials remain unlogged.