From 8201d9977de55238f894106728b68f5d0a207a83 Mon Sep 17 00:00:00 2001
From: Evan Jarrett <evan@evanjarrett.com>
Date: Sat, 25 Oct 2025 08:54:44 -0500
Subject: [PATCH] more logging to troubleshoot crew management

---
 pkg/appview/storage/proxy_blob_store.go | 5 +++++
 pkg/auth/hold_authorizer.go             | 9 +++++++++
 pkg/auth/hold_remote.go                 | 6 ++++++
 3 files changed, 20 insertions(+)

diff --git a/pkg/appview/storage/proxy_blob_store.go b/pkg/appview/storage/proxy_blob_store.go
index f34fa2c..a51d8bd 100644
--- a/pkg/appview/storage/proxy_blob_store.go
+++ b/pkg/appview/storage/proxy_blob_store.go
@@ -97,13 +97,18 @@ func (p *ProxyBlobStore) checkWriteAccess(ctx context.Context) error {
 	if p.ctx.Authorizer == nil {
 		return nil // No authorization check if authorizer not configured
 	}
+
+	fmt.Printf("[checkWriteAccess] Checking write access for userDID=%s to holdDID=%s\n", p.ctx.DID, p.ctx.HoldDID)
 	allowed, err := p.ctx.Authorizer.CheckWriteAccess(ctx, p.ctx.HoldDID, p.ctx.DID)
 	if err != nil {
+		fmt.Printf("[checkWriteAccess] Authorization check error: %v\n", err)
 		return fmt.Errorf("authorization check failed: %w", err)
 	}
 	if !allowed {
+		fmt.Printf("[checkWriteAccess] Write access DENIED for userDID=%s to holdDID=%s\n", p.ctx.DID, p.ctx.HoldDID)
 		return fmt.Errorf("write access denied to hold %s", p.ctx.HoldDID)
 	}
+	fmt.Printf("[checkWriteAccess] Write access ALLOWED for userDID=%s to holdDID=%s\n", p.ctx.DID, p.ctx.HoldDID)
 	return nil
 }
 
diff --git a/pkg/auth/hold_authorizer.go b/pkg/auth/hold_authorizer.go
index 4df460e..3f36075 100644
--- a/pkg/auth/hold_authorizer.go
+++ b/pkg/auth/hold_authorizer.go
@@ -55,18 +55,27 @@ func CheckReadAccessWithCaptain(captain *atproto.CaptainRecord, userDID string)
 // - Must be authenticated
 // - Must be hold owner OR crew member
 func CheckWriteAccessWithCaptain(captain *atproto.CaptainRecord, userDID string, isCrew bool) bool {
+	fmt.Printf("[CheckWriteAccessWithCaptain] userDID=%s captain.Owner=%s isCrew=%v\n", userDID, captain.Owner, isCrew)
+
 	if userDID == "" {
 		// Anonymous writes not allowed
+		fmt.Printf("[CheckWriteAccessWithCaptain] DENIED: Anonymous user\n")
 		return false
 	}
 
 	// Check if DID is the hold owner
 	if userDID == captain.Owner {
 		// Owner always has write access
+		fmt.Printf("[CheckWriteAccessWithCaptain] ALLOWED: User is hold owner\n")
 		return true
 	}
 
 	// Check if DID is a crew member
+	if isCrew {
+		fmt.Printf("[CheckWriteAccessWithCaptain] ALLOWED: User is crew member\n")
+	} else {
+		fmt.Printf("[CheckWriteAccessWithCaptain] DENIED: User is not owner or crew\n")
+	}
 	return isCrew
 }
 
diff --git a/pkg/auth/hold_remote.go b/pkg/auth/hold_remote.go
index ab87c14..f8a79db 100644
--- a/pkg/auth/hold_remote.go
+++ b/pkg/auth/hold_remote.go
@@ -265,27 +265,33 @@ func (a *RemoteHoldAuthorizer) IsCrewMember(ctx context.Context, holdDID, userDI
 
 	// Check approval cache first (15min TTL)
 	if approved, err := a.getCachedApproval(holdDID, userDID); err == nil && approved {
+		fmt.Printf("[IsCrewMember] Using cached APPROVAL: holdDID=%s userDID=%s\n", holdDID, userDID)
 		return true, nil
 	}
 
 	// Check denial cache with backoff
 	if blocked, err := a.isBlockedByDenialBackoff(holdDID, userDID); err == nil && blocked {
 		// Still in backoff period - don't query again
+		fmt.Printf("[IsCrewMember] BLOCKED by denial backoff cache: holdDID=%s userDID=%s\n", holdDID, userDID)
 		return false, nil
 	}
 
 	// Cache miss or expired - query XRPC endpoint
+	fmt.Printf("[IsCrewMember] Cache miss, querying hold: holdDID=%s userDID=%s\n", holdDID, userDID)
 	isCrew, err := a.isCrewMemberNoCache(ctx, holdDID, userDID)
 	if err != nil {
+		fmt.Printf("[IsCrewMember] Query error: %v\n", err)
 		return false, err
 	}
 
 	// Update cache based on result
 	if isCrew {
 		// Cache approval for 15 minutes
+		fmt.Printf("[IsCrewMember] Query result: APPROVED, caching for 15min\n")
 		_ = a.cacheApproval(holdDID, userDID, 15*time.Minute)
 	} else {
 		// Cache denial with exponential backoff
+		fmt.Printf("[IsCrewMember] Query result: DENIED, caching with backoff\n")
 		_ = a.cacheDenial(holdDID, userDID)
 	}