Add structured logging and better error handling

internal/server/auth_handlers.go

@@ -1,6 +1,8 @@
 package server
 
 import (
+	"fmt"
+	"log/slog"
 	"net"
 	"net/http"
 	"strings"
@@ -20,17 +22,18 @@ type sessionResponse struct {
 func (server *Server) handleLogin(writer http.ResponseWriter, request *http.Request) {
 	client := server.clientAddress(request)
 	if !server.limiter.Allowed(client) {
+		slog.Warn("login blocked after too many failures", "client", client, "request_id", requestIDFrom(request))
 		writeError(writer, http.StatusTooManyRequests, "too many failed attempts, try again later")
 		return
 	}
 
 	var body loginRequest
-	if err := decodeJSON(request, &body); err != nil {
-		writeError(writer, http.StatusBadRequest, "invalid request body")
+	if !decodeBody(writer, request, &body) {
 		return
 	}
 	if !auth.CredentialsMatch(server.settings.Username, server.settings.Password, body.Username, body.Password) {
 		server.limiter.RecordFailure(client)
+		slog.Warn("login failed", "client", client, "username", body.Username, "request_id", requestIDFrom(request))
 		writeError(writer, http.StatusUnauthorized, "invalid username or password")
 		return
 	}
@@ -38,9 +41,10 @@ func (server *Server) handleLogin(writer http.ResponseWriter, request *http.Requ
 	server.limiter.Reset(client)
 	token, err := server.sessions.Create()
 	if err != nil {
-		writeError(writer, http.StatusInternalServerError, "could not create session")
+		writeFailure(writer, request, fmt.Errorf("could not create session: %w", err))
 		return
 	}
+	slog.Info("login succeeded", "client", client, "request_id", requestIDFrom(request))
 	http.SetCookie(writer, server.sessionCookie(token, int(server.settings.SessionTTL.Seconds())))
 	writeJSON(writer, http.StatusOK, sessionResponse{Authenticated: true})
 }