From aabdf3af272616bd21dee2f803eba20f1f882b54 Mon Sep 17 00:00:00 2001
From: Bastian Wagner <bastian.wagner@softconcis.de>
Date: Fri, 17 Jul 2026 13:04:49 +0200
Subject: [PATCH] logs

---
 apps/api/src/oidc/oidc-client.service.ts | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/apps/api/src/oidc/oidc-client.service.ts b/apps/api/src/oidc/oidc-client.service.ts
index ebc985e..4e8e6a1 100644
--- a/apps/api/src/oidc/oidc-client.service.ts
+++ b/apps/api/src/oidc/oidc-client.service.ts
@@ -1,7 +1,7 @@
 import { BadRequestException, Injectable, NotFoundException } from '@nestjs/common';
 import { ConfigService } from '@nestjs/config';
 import { InjectRepository } from '@nestjs/typeorm';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { Repository } from 'typeorm';
 import { decryptSecret, encryptSecret, randomToken } from '../common/token.util';
 import { CreateOidcClientDto } from './dto/create-oidc-client.dto';
@@ -131,7 +131,23 @@ export class OidcClientService {
     };
 
     if (client.encryptedClientSecret) {
-      metadata.client_secret = decryptSecret(client.encryptedClientSecret, this.tokenSecret);
+      try {
+        metadata.client_secret = decryptSecret(client.encryptedClientSecret, this.tokenSecret);
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        console.error(
+          '[OIDC_CLIENT_SECRET_DECRYPT_FAILED]',
+          JSON.stringify({
+            clientId: client.clientId,
+            clientName: client.clientName,
+            tokenEndpointAuthMethod: client.tokenEndpointAuthMethod,
+            tokenSecretFingerprint: this.tokenSecretFingerprint,
+            encryptedClientSecretParts: client.encryptedClientSecret.split('.').length,
+            errorMessage,
+          }),
+        );
+        throw error;
+      }
       metadata.client_secret_expires_at = 0;
     }
 
@@ -160,4 +176,8 @@ export class OidcClientService {
   private get tokenSecret(): string {
     return this.config.getOrThrow<string>('TOKEN_SECRET');
   }
+
+  private get tokenSecretFingerprint(): string {
+    return createHash('sha256').update(this.tokenSecret).digest('hex').slice(0, 12);
+  }
 }