Add detailed debug logging for the login flow

The login flow was near-silent: three info lines with no way to see why a
session was considered expired or what happened to the cookies. Debugging
a failing login meant guessing.

Every login step now logs on debug level with a `phase` field: the login
page fetch, the extracted nonce, the POST to /login/api/login.php, the
session check, and any request retried after a re-login. Each of those
requests is bracketed by a cookie snapshot taken before it is sent and one
taken after, plus a delta of added/changed/removed cookies. The "before"
snapshot is logged prior to sending, so it survives a hanging request.

isLoginRequiredResponse() is split so the criterion that matched
(status-401, login-markup, ...) can be reported instead of just a boolean.

Secrets stay out of the log: the password is replaced by ***, and cookie
values - including those in the raw Set-Cookie header - are truncated to
their first four characters plus length. That still shows whether a
session id changed without putting the session itself in the log.

Detail logging is strictly debug-level via logLoginDetail(); the existing
logDebug() falls back to info, which would flood a plain info logger. When
no debug logger is attached, no snapshot is taken and nothing is
serialized.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/AgrarmonitorConnector.ts

@@ -30,6 +30,22 @@ type RetryableAxiosRequestConfig = AxiosRequestConfig & {
   _agrarmonitorLoginRequest?: boolean;
 };
 
+type CookieRecord = {
+  name: string;
+  value: string;
+  domain: string | null;
+  path: string | null;
+  expires: string;
+  httpOnly: boolean;
+  secure: boolean;
+};
+
+type CookieChanges = {
+  added: string[];
+  changed: string[];
+  removed: string[];
+};
+
 type AgrarmonitorCustomerPage = {
   data?: unknown;
   meta?: {
@@ -661,6 +677,14 @@ export class AgrarmonitorConnector implements AgrarmonitorConnectorResult {
     }
 
     this.logger?.info?.('Fuehre Agrarmonitor-Login durch');
+    this.logLoginDetail('Login gestartet', {
+      phase: 'login-start',
+      baseUrl: this.baseUrl,
+      username: this.options.username,
+      loginStrategy: this.loginStrategy,
+      autoRetry: this.autoRetry,
+      cookies: this.formatCookies(this.snapshotCookies()),
+    });
 
     if (this.loginStrategy === 'auto') {
       this.logger?.warn?.('loginStrategy "auto" ist veraltet; verwende Redirect-Login');
@@ -674,17 +698,33 @@ export class AgrarmonitorConnector implements AgrarmonitorConnectorResult {
 
     await this.options.cookieStore.save(this.cookieJar);
     this.logger?.info?.('Agrarmonitor-Login erfolgreich');
+    this.logLoginDetail('Login abgeschlossen', {
+      phase: 'login-done',
+      cookies: this.formatCookies(this.snapshotCookies()),
+    });
   }
 
   private async performRedirectLogin(): Promise<void> {
-    const loginPageResponse = await this.http.get('/', this.loginRequestConfig());
+    const loginPageResponse = await this.loggedRequest('Loginseite', 'GET', '/', () =>
+      this.http.get('/', this.loginRequestConfig())
+    );
     const loginPageText = typeof loginPageResponse.data === 'string' ? loginPageResponse.data : '';
 
     if (!this.isLoginPageText(loginPageText)) {
+      this.logLoginDetail('Keine Loginseite erhalten, Session ist bereits gueltig', {
+        phase: 'login-skip',
+        url: '/',
+      });
       return;
     }
 
     const nonce = this.extractNonce(loginPageText, 'input[name="nonce"]');
+    this.logLoginDetail('Nonce aus Loginseite gelesen', {
+      phase: 'nonce',
+      url: '/',
+      nonce: this.maskNonce(nonce),
+    });
+
     const loginData = {
       username: this.options.username,
       passwort: this.options.password,
@@ -700,7 +740,16 @@ export class AgrarmonitorConnector implements AgrarmonitorConnectorResult {
       _agrarmonitorLoginRequest: true,
     };
 
-    const response = await this.http.post('/login/api/login.php', loginData, loginPostConfig);
+    const response = await this.loggedRequest(
+      'Login-POST',
+      'POST',
+      '/login/api/login.php',
+      () => this.http.post('/login/api/login.php', loginData, loginPostConfig),
+      {
+        contentType: 'application/json',
+        body: { ...loginData, passwort: '***', nonce: this.maskNonce(nonce) },
+      }
+    );
 
     const responseText = typeof response.data === 'string' ? response.data : '';
 
@@ -712,8 +761,27 @@ export class AgrarmonitorConnector implements AgrarmonitorConnectorResult {
   private async isSessionValid(options: { skipAutoRetry?: boolean } = {}): Promise<boolean> {
     try {
       const response = await this.http.get('/', options.skipAutoRetry ? this.loginRequestConfig() : undefined);
-      return !this.isLoginRequiredResponse(response);
-    } catch {
+      const grund = this.loginRequiredReason(response);
+
+      this.logLoginDetail(`Session-Pruefung: ${grund ? 'ungueltig' : 'gueltig'}`, {
+        phase: 'session-check',
+        url: '/',
+        status: response.status,
+        gueltig: grund === null,
+        grund,
+        cookies: this.formatCookies(this.snapshotCookies()),
+      });
+
+      return grund === null;
+    } catch (error) {
+      this.logLoginDetail('Session-Pruefung fehlgeschlagen', {
+        phase: 'session-check',
+        url: '/',
+        gueltig: false,
+        grund: 'request-fehler',
+        fehler: error instanceof Error ? error.message : String(error),
+      });
+
       return false;
     }
   }
@@ -725,14 +793,25 @@ export class AgrarmonitorConnector implements AgrarmonitorConnectorResult {
   }
 
   private isLoginRequiredResponse(response: AxiosResponse): boolean {
-    const responseUrl = this.getResponseUrl(response);
+    return this.loginRequiredReason(response) !== null;
+  }
+
+  /**
+   * Liefert das Kriterium, an dem eine abgelaufene Session erkannt wurde,
+   * oder null fuer eine gueltige Session.
+   */
+  private loginRequiredReason(response: AxiosResponse): string | null {
     const responseText = typeof response.data === 'string' ? response.data : '';
 
-    return (
-      response.status === 401 ||
-      response.status === 403 ||
-      this.isLoginPageText(responseText)
-    );
+    if (response.status === 401 || response.status === 403) {
+      return `status-${response.status}`;
+    }
+
+    if (this.isLoginPageText(responseText)) {
+      return 'login-markup';
+    }
+
+    return null;
   }
 
   private async retryAfterLogin(config: RetryableAxiosRequestConfig): Promise<AxiosResponse> {
@@ -742,10 +821,27 @@ export class AgrarmonitorConnector implements AgrarmonitorConnectorResult {
 
     config._agrarmonitorRetry = true;
 
+    const method = (config.method ?? 'get').toUpperCase();
+    const url = config.url ?? '/';
+
     this.logger?.info?.('Agrarmonitor-Session abgelaufen, erneuter Login wird ausgefuehrt');
+    this.logLoginDetail(`Session abgelaufen, wiederhole ${method} ${url} nach erneutem Login`, {
+      phase: 'session-expired',
+      method,
+      url,
+      cookies: this.formatCookies(this.snapshotCookies()),
+    });
+
     await this.login();
 
-    return this.http.request(config);
+    return this.loggedRequest(
+      'Wiederholung nach Login',
+      method,
+      url,
+      () => this.http.request(config),
+      {},
+      'retry'
+    );
   }
 
   private createDateienLivesearchParams(suchstring: string): Record<string, string | number> {
@@ -991,4 +1087,148 @@ export class AgrarmonitorConnector implements AgrarmonitorConnectorResult {
   private maskNonce(nonce: string): string {
     return nonce.length <= 10 ? nonce : `${nonce.slice(0, 10)}...`;
   }
+
+  private get debugLogging(): boolean {
+    return typeof this.logger?.debug === 'function';
+  }
+
+  /**
+   * Detail-Logging des Login-Flows. Anders als logDebug faellt das bewusst
+   * NICHT auf info zurueck - ohne debug-Logger bleiben die Details still.
+   */
+  private logLoginDetail(message: string, meta: Record<string, unknown>): void {
+    this.logger?.debug?.(message, meta);
+  }
+
+  private maskValue(value: string): string {
+    if (!value) {
+      return '(leer)';
+    }
+
+    return value.length <= 8 ? `\u2026(len=${value.length})` : `${value.slice(0, 4)}\u2026(len=${value.length})`;
+  }
+
+  /**
+   * Liest die Cookies des Jars fuer eine URL aus. Liefert eine leere Liste,
+   * solange kein debug-Logger haengt - dann wird gar nicht erst serialisiert.
+   */
+  private snapshotCookies(url = this.baseUrl): CookieRecord[] {
+    if (!this.debugLogging) {
+      return [];
+    }
+
+    try {
+      return this.cookieJar.getCookiesSync(url).map(cookie => ({
+        name: cookie.key,
+        value: cookie.value,
+        domain: cookie.domain ?? null,
+        path: cookie.path ?? null,
+        expires: cookie.expires instanceof Date ? cookie.expires.toISOString() : 'Session',
+        httpOnly: Boolean(cookie.httpOnly),
+        secure: Boolean(cookie.secure),
+      }));
+    } catch {
+      return [];
+    }
+  }
+
+  /**
+   * Maskiert die Werte im rohen Set-Cookie-Header - sonst stuende die neue
+   * Session-ID im Klartext im Log, obwohl der Jar-Snapshot sie maskiert.
+   */
+  private formatSetCookieHeader(header: unknown): string[] | null {
+    if (!Array.isArray(header)) {
+      return null;
+    }
+
+    return header.map(entry => {
+      const [pair, ...attributes] = String(entry).split(';');
+      const separator = pair.indexOf('=');
+
+      if (separator === -1) {
+        return [pair, ...attributes].join(';');
+      }
+
+      const name = pair.slice(0, separator);
+      const value = pair.slice(separator + 1);
+
+      return [`${name}=${this.maskValue(value)}`, ...attributes].join(';');
+    });
+  }
+
+  /** Wie snapshotCookies, aber mit maskierten Werten - nur das geht ins Log. */
+  private formatCookies(cookies: CookieRecord[]): CookieRecord[] {
+    return cookies.map(cookie => ({ ...cookie, value: this.maskValue(cookie.value) }));
+  }
+
+  private diffCookies(before: CookieRecord[], after: CookieRecord[]): CookieChanges {
+    const beforeByName = new Map(before.map(cookie => [cookie.name, cookie.value]));
+    const afterByName = new Map(after.map(cookie => [cookie.name, cookie.value]));
+
+    return {
+      added: [...afterByName.keys()].filter(name => !beforeByName.has(name)),
+      changed: [...afterByName.entries()]
+        .filter(([name, value]) => beforeByName.has(name) && beforeByName.get(name) !== value)
+        .map(([name]) => name),
+      removed: [...beforeByName.keys()].filter(name => !afterByName.has(name)),
+    };
+  }
+
+  /**
+   * Klammert einen Request mit je einem Cookie-Snapshot davor und danach.
+   * Der Snapshot davor wird vor dem Absenden geloggt, damit er auch dann
+   * im Log steht, wenn der Request haengt oder wirft.
+   */
+  private async loggedRequest(
+    label: string,
+    method: string,
+    url: string,
+    exec: () => Promise<AxiosResponse>,
+    details: Record<string, unknown> = {},
+    phase: 'request' | 'retry' = 'request'
+  ): Promise<AxiosResponse> {
+    const before = this.snapshotCookies();
+
+    this.logLoginDetail(`${label}: ${method} ${url}`, {
+      phase,
+      method,
+      url,
+      cookies: this.formatCookies(before),
+      ...details,
+    });
+
+    try {
+      const response = await exec();
+      const after = this.snapshotCookies();
+      const responseText = typeof response.data === 'string' ? response.data : '';
+
+      this.logLoginDetail(`${label}: ${method} ${url} -> ${response.status}`, {
+        phase: 'response',
+        method,
+        url,
+        status: response.status,
+        responseUrl: this.getResponseUrl(response) || null,
+        contentType: this.getHeader(response, 'content-type'),
+        setCookie: this.formatSetCookieHeader(response.headers['set-cookie']),
+        istLoginSeite: this.isLoginPageText(responseText),
+        cookies: this.formatCookies(after),
+        cookieChanges: this.diffCookies(before, after),
+      });
+
+      return response;
+    } catch (error) {
+      const after = this.snapshotCookies();
+
+      this.logLoginDetail(`${label}: ${method} ${url} -> Fehler`, {
+        phase: 'error',
+        method,
+        url,
+        fehler: error instanceof Error ? error.message : String(error),
+        cookies: this.formatCookies(after),
+        cookieChanges: this.diffCookies(before, after),
+      });
+
+      throw error;
+    }
+  }
 }