fix(users): trace google oauth redirect mismatches

apps/users/services/google_oauth.py

@@ -1,10 +1,10 @@
 from __future__ import annotations
 
+import logging
 import secrets
 from dataclasses import asdict, dataclass, is_dataclass
 from typing import Any
-from urllib.parse import urlencode
-from urllib.parse import urlparse
+from urllib.parse import urlencode, urlparse
 
 import requests
 from django.conf import settings
@@ -16,7 +16,6 @@ from apps.users.email_identity import mask_mobile, normalize_email_identity
 from apps.users.models import User, UserSocialAccount
 from apps.users.services.auth import generate_and_send_otp, get_tokens_for_user
 
-
 GOOGLE_AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth"
 GOOGLE_TOKEN_URL = "https://oauth2.googleapis.com/token"
 GOOGLE_USERINFO_URL = "https://openidconnect.googleapis.com/v1/userinfo"
@@ -27,6 +26,8 @@ GOOGLE_FLOW_TTL_SECONDS = 900
 GOOGLE_STATE_CACHE_PREFIX = "google_oauth_state"
 GOOGLE_FLOW_CACHE_PREFIX = "google_oauth_flow"
 
+logger = logging.getLogger(__name__)
+
 
 class GoogleOAuthFlowError(APIException):
     status_code = 409
@@ -305,6 +306,16 @@ def exchange_code_for_google_profile(code: str) -> GoogleProfile:
         token_response.raise_for_status()
         token_payload = token_response.json()
     except requests.RequestException as exc:
+        response = getattr(exc, "response", None)
+        logger.warning(
+            "Google token exchange failed",
+            extra={
+                "google_status_code": getattr(response, "status_code", None),
+                "google_response_text": getattr(response, "text", "")[:1000] if response is not None else "",
+                "google_redirect_uri": getattr(settings, "GOOGLE_OAUTH_REDIRECT_URI", ""),
+            },
+            exc_info=True,
+        )
         raise ValidationError({"detail": "Google token exchange failed."}) from exc
 
     access_token = token_payload.get("access_token")
@@ -320,6 +331,15 @@ def exchange_code_for_google_profile(code: str) -> GoogleProfile:
         userinfo_response.raise_for_status()
         userinfo = userinfo_response.json()
     except requests.RequestException as exc:
+        response = getattr(exc, "response", None)
+        logger.warning(
+            "Google user profile lookup failed",
+            extra={
+                "google_status_code": getattr(response, "status_code", None),
+                "google_response_text": getattr(response, "text", "")[:1000] if response is not None else "",
+            },
+            exc_info=True,
+        )
         raise ValidationError({"detail": "Google user profile lookup failed."}) from exc
 
     provider_user_id = userinfo.get("sub", "")
@@ -431,7 +451,10 @@ def complete_google_signup(flow: str, mobile: str) -> dict[str, Any]:
             user=existing_mobile_user,
             mobile=normalized_mobile,
             resolution="existing_mobile_claim",
-            detail="Existing mobile account found. Verify ownership to attach Google and set the verified email address.",
+            detail=(
+                "Existing mobile account found. Verify ownership to attach "
+                "Google and set the verified email address."
+            ),
         )
         update_google_flow(flow, claim_payload)
         return _build_public_google_flow_payload(claim_payload)