Clarify agent and server log context labeling

Data/Server/Modules/auth/device_auth.py

@@ -13,6 +13,17 @@ from flask import g, jsonify, request
 from Modules.auth.dpop import DPoPValidator, DPoPVerificationError, DPoPReplayError
 from Modules.auth.rate_limit import SlidingWindowRateLimiter
 
+AGENT_CONTEXT_HEADER = "X-Borealis-Agent-Context"
+
+
+def _canonical_context(value: Optional[str]) -> Optional[str]:
+    if not value:
+        return None
+    cleaned = "".join(ch for ch in str(value) if ch.isalnum() or ch in ("_", "-"))
+    if not cleaned:
+        return None
+    return cleaned.upper()
+
 
 @dataclass
 class DeviceAuthContext:
@@ -23,6 +34,7 @@ class DeviceAuthContext:
     claims: Dict[str, Any]
     dpop_jkt: Optional[str]
     status: str
+    service_mode: Optional[str]
 
 
 class DeviceAuthError(Exception):
@@ -50,7 +62,7 @@ class DeviceAuthManager:
         db_conn_factory: Callable[[], Any],
         jwt_service,
         dpop_validator: Optional[DPoPValidator],
-        log: Callable[[str, str], None],
+        log: Callable[[str, str, Optional[str]], None],
         rate_limiter: Optional[SlidingWindowRateLimiter] = None,
     ) -> None:
         self._db_conn_factory = db_conn_factory
@@ -89,6 +101,8 @@ class DeviceAuthManager:
                     retry_after=decision.retry_after,
                 )
 
+        context_label = _canonical_context(request.headers.get(AGENT_CONTEXT_HEADER))
+
         conn = self._db_conn_factory()
         try:
             cur = conn.cursor()
@@ -100,10 +114,10 @@ class DeviceAuthManager:
                 """,
                 (guid,),
             )
-            row = cur.fetchone()
+        row = cur.fetchone()
 
-            if not row:
-                row = self._recover_device_record(conn, guid, fingerprint, token_version)
+        if not row:
+            row = self._recover_device_record(conn, guid, fingerprint, token_version, context_label)
         finally:
             conn.close()
 
@@ -127,7 +141,11 @@ class DeviceAuthManager:
         if status_normalized not in allowed_statuses:
             raise DeviceAuthError("device_revoked", status_code=403)
         if status_normalized == "quarantined":
-            self._log("server", f"device {guid} is quarantined; limited access for {request.path}")
+            self._log(
+                "server",
+                f"device {guid} is quarantined; limited access for {request.path}",
+                context_label,
+            )
 
         dpop_jkt: Optional[str] = None
         dpop_proof = request.headers.get("DPoP")
@@ -150,6 +168,7 @@ class DeviceAuthManager:
             claims=claims,
             dpop_jkt=dpop_jkt,
             status=status_normalized,
+            service_mode=context_label,
         )
         return ctx
 
@@ -159,6 +178,7 @@ class DeviceAuthManager:
         guid: str,
         fingerprint: str,
         token_version: int,
+        context_label: Optional[str],
     ) -> Optional[tuple]:
         """Attempt to recreate a missing device row for an authenticated token."""
 
@@ -211,6 +231,7 @@ class DeviceAuthManager:
                 self._log(
                     "server",
                     f"device auth failed to recover guid={guid} due to integrity error: {exc}",
+                    context_label,
                 )
                 conn.rollback()
                 return None
@@ -218,6 +239,7 @@ class DeviceAuthManager:
                 self._log(
                     "server",
                     f"device auth unexpected error recovering guid={guid}: {exc}",
+                    context_label,
                 )
                 conn.rollback()
                 return None
@@ -229,6 +251,7 @@ class DeviceAuthManager:
             self._log(
                 "server",
                 f"device auth could not recover guid={guid}; hostname collisions persisted",
+                context_label,
             )
             conn.rollback()
             return None
@@ -246,6 +269,7 @@ class DeviceAuthManager:
             self._log(
                 "server",
                 f"device auth recovery for guid={guid} committed but row still missing",
+                context_label,
             )
         return row