use the logger

Author: bcpeinhardt

jail/jail.go

@@ -34,4 +34,4 @@ func DefaultOS(config Config) (Jailer, error) {
 	default:
 		return nil, fmt.Errorf("unsupported operating system: %s", runtime.GOOS)
 	}
-}
+}

jail/linux_stub.go

@@ -9,4 +9,4 @@ import (
 // NewLinuxJail is not available on non-Linux platforms
 func NewLinuxJail(_ Config) (Jailer, error) {
 	return nil, fmt.Errorf("linux jail not supported on this platform")
-}
+}

jail/macos_stub.go

@@ -7,4 +7,4 @@ import "fmt"
 // NewMacOSJail is not available on non-macOS platforms
 func NewMacOSJail(_ Config) (Jailer, error) {
 	return nil, fmt.Errorf("macOS jail not supported on this platform")
-}
+}

rules/rules.go

@@ -429,12 +429,14 @@ func (re *Engine) matches(r Rule, method, url string) bool {
 			}
 		}
 		if !methodMatches {
+			re.logger.Info("rule does not match", "reason", "method pattern mismatch", "rule", r.Raw, "method", method, "url", url)
 			return false
 		}
 	}
 
 	parsedUrl, err := neturl.Parse(url)
 	if err != nil {
+		re.logger.Info("rule does not match", "reason", "invalid URL", "rule", r.Raw, "method", method, "url", url, "error", err)
 		return false
 	}
 
@@ -448,13 +450,15 @@ func (re *Engine) matches(r Rule, method, url string) bool {
 
 		// If the host pattern is longer than the actual host, it's definitely not a match
 		if len(r.HostPattern) > len(labels) {
+			re.logger.Info("rule does not match", "reason", "host pattern too long", "rule", r.Raw, "method", method, "url", url, "pattern_length", len(r.HostPattern), "hostname_labels", len(labels))
 			return false
 		}
 
 		// Compare pattern with the end of labels (allowing subdomains)
 		for i, lp := range r.HostPattern {
 			labelIndex := len(labels) - len(r.HostPattern) + i
 			if string(lp) != labels[labelIndex] && lp != "*" {
+				re.logger.Info("rule does not match", "reason", "host pattern label mismatch", "rule", r.Raw, "method", method, "url", url, "expected", string(lp), "actual", labels[labelIndex])
 				return false
 			}
 		}
@@ -465,16 +469,19 @@ func (re *Engine) matches(r Rule, method, url string) bool {
 
 		// If the path pattern is longer than the actual path, definitely not a match
 		if len(r.PathPattern) > len(segments) {
+			re.logger.Info("rule does not match", "reason", "path pattern too long", "rule", r.Raw, "method", method, "url", url, "pattern_length", len(r.PathPattern), "path_segments", len(segments))
 			return false
 		}
 
 		// Each segment in the pattern must be either as asterisk or match the actual path segment
 		for i, sp := range r.PathPattern {
 			if string(sp) != segments[i] && sp != "*" {
+				re.logger.Info("rule does not match", "reason", "path pattern segment mismatch", "rule", r.Raw, "method", method, "url", url, "expected", string(sp), "actual", segments[i])
 				return false
 			}
 		}
 	}
 
+	re.logger.Info("rule matches", "reason", "all patterns matched", "rule", r.Raw, "method", method, "url", url)
 	return true
 }

rules/rules_test.go

@@ -1063,7 +1063,7 @@ func TestParseAllowRule(t *testing.T) {
 }
 
 func TestEngineMatches(t *testing.T) {
-	logger := &slog.Logger{}
+	logger := slog.Default()
 	engine := NewRuleEngine(nil, logger)
 
 	tests := []struct {
@@ -1282,8 +1282,8 @@ func TestEngineMatches(t *testing.T) {
 
 		// Edge cases
 		{
-			name: "empty rule matches everything",
-			rule: Rule{},
+			name:     "empty rule matches everything",
+			rule:     Rule{},
 			method:   "GET",
 			url:      "https://example.com/api/users",
 			expected: true,