server: unify and improve logging

[mostlygeek]

This commit switches tsidp to slog and collapses HTTP error logging to a single function.

• use WARN/DEBUG level logging depending on http status code
• move tsnet.Server logging to new flag: -debug-tsnet
• move request/response logging to new flag: -debug-all-requests
• unify API error handling logic to writeHTTPError

Updates #25

Log output:

2025/09/23 16:26:06 WARN HTTP error status=401 method=GET path=/ error=access_denied description="not available over funnel"
2025/09/23 16:26:35 WARN HTTP error status=401 method=GET path=/authorize error=access_denied description="not allowed over funnel"
2025/09/23 16:26:44 WARN HTTP error status=401 method=GET path=/authorize error=access_denied description="not allowed over funnel"

• 401, 403 are logged at a WARN level
• 500 logged at an ERR level
• all other HTTP errors logged at DEBUG level

[awly]

Could you also add logging for successful authorizations through tsidp?
I'd like to have an audit log of everyone who used tsidp to successfully login to some remote service.

[mostlygeek]

Hi @awly Thanks for the initial detailed review. I addressed the main issues:

• don't leak error messages
• replace errorCode strings with constants
• cleaned up some nits and legacy messages
• removed some legacy code/conventions

[awly]

please generally avoid bundling multiple unrelated changes in one PR.
it makes it harder to review and slower for you to merge.

[mostlygeek]

Agreed. That is typically my preference too. The README, at this early stage in the project, I think we can be a bit more flexible on.

[awly]

this will flip the global logger level while a line is printed.
instead, create a dedicated slog.Logger to use in tsnet.

[mostlygeek]

This was part of the examples in the slog documentation. I can create a separate logger instead if we prefer to do it that way instead.

[mostlygeek]

I looked into this. I would prefer to keep it this way.

Rationale:

• slog uses an internal, unexported handler to format logging. No way to keep consistency with the rest of the logging.
• it's ugly but less ugly than all the logs being in two different formats
• -debug-tsnet is meant for troubleshooting and is not a hot code path.

[awly]

oh, this actually sets the log level for log.Print* functions, not for slog.Debug. I don't think it matters here at all.

[mostlygeek]

Maybe?

This is a work around for the situation where -log info (default), and -debug-tsnet is used but doesn't print anything because slog filtered out debug level logs.

[awly]

ah, https://pkg.go.dev/log/slog#SetLogLoggerLevel says

Before SetDefault is called, slog top-level logging functions call the default log.Logger. In that mode, SetLogLoggerLevel sets the minimum level for those calls.

so because your code never calls slog.SetDefault, this implicitly sets the slog log level too.