v0.3.0-prod

internal/web/tokens.go

@@ -60,8 +60,14 @@ func (m *tokenManager) verify(tok, kind, ip string) (tokenPayload, error) {
 	if err = json.Unmarshal(raw, &p); err != nil {
 		return p, err
 	}
-	if p.Kind != kind || p.IP != ip || time.Now().Unix() > p.Exp {
-		return p, errors.New("expired or mismatched token")
+	if p.Kind != kind {
+		return p, fmt.Errorf("token kind mismatch: got %q want %q", p.Kind, kind)
+	}
+	if p.IP != ip {
+		return p, fmt.Errorf("token ip mismatch: token_ip=%q request_ip=%q", p.IP, ip)
+	}
+	if now := time.Now().Unix(); now > p.Exp {
+		return p, fmt.Errorf("token expired %ds ago", now-p.Exp)
 	}
 	return p, nil
 }