From 70341c78e5aaa93d81eb2e32d6aa8f2ac675ed01 Mon Sep 17 00:00:00 2001
From: cnbugs <cnbugs@cnbugs.com>
Date: Sun, 9 Aug 2026 23:21:05 +0800
Subject: [PATCH] Fix VPN verify script: add debug logging, remove set -e

The verify.sh had 'set -e' which could cause premature exit in
edge cases. Replaced with explicit logging to /tmp/openvpn-verify.log
so we can diagnose AUTH_FAILED on production servers.

Log shows: timestamp, username, HTTP code, response body, ALLOW/DENY.
Also redirected curl stderr to log file instead of /dev/null so
connection errors are visible for debugging.
---
 backend/pkg/openvpn/manager.go | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/backend/pkg/openvpn/manager.go b/backend/pkg/openvpn/manager.go
index bc1858a..28e2ffd 100644
--- a/backend/pkg/openvpn/manager.go
+++ b/backend/pkg/openvpn/manager.go
@@ -510,26 +510,34 @@ func (m *Manager) WriteVerifyScriptWithPort(instanceName, scriptPath string, por
 # OpenVPN auth-user-pass-verify script (via-env).
 # Generated by openvpn-manager — do NOT edit manually.
 # Calls manager API to verify bcrypt password. Exit 0=allow, 1=deny.
-set -e
+LOG="/tmp/openvpn-verify.log"
 PORT=%d
 INSTANCE="%s"
 
 user="${username:-}"
 pass="${password:-}"
+echo "$(date '+%%Y-%%m-%%d %%H:%%M:%%S') VERIFY user=$user instance=$INSTANCE" >> "$LOG"
+
 if [ -z "$user" ] || [ -z "$pass" ]; then
+  echo "$(date '+%%Y-%%m-%%d %%H:%%M:%%S') DENY empty credentials" >> "$LOG"
   exit 1
 fi
 
-CODE=$(curl -sf -o /dev/null -w "%%{http_code}" \
+CODE=$(curl -s -o /tmp/ovpn-verify-resp.txt -w "%%{http_code}" \
   --connect-timeout 3 --max-time 5 \
   -X POST "http://127.0.0.1:${PORT}/api/vpn/verify" \
   -H "Content-Type: application/json" \
   -d "{\"instance\":\"${INSTANCE}\",\"username\":\"${user}\",\"password\":\"${pass}\"}" \
-  2>/dev/null || echo "000")
+  2>>"$LOG" || echo "000")
+BODY=$(cat /tmp/ovpn-verify-resp.txt 2>/dev/null)
+
+echo "$(date '+%%Y-%%m-%%d %%H:%%M:%%S') HTTP_CODE=$CODE BODY=$BODY" >> "$LOG"
 
 if [ "$CODE" = "200" ]; then
+  echo "$(date '+%%Y-%%m-%%d %%H:%%M:%%S') ALLOW" >> "$LOG"
   exit 0
 else
+  echo "$(date '+%%Y-%%m-%%d %%H:%%M:%%S') DENY" >> "$LOG"
   exit 1
 fi
 `, port, instanceName)