fix: demote non-gRPC auth error log from Error to Debug

CHANGELOG.md

@@ -20,6 +20,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 * Added `x-sf-meta` header to pass arbitrary metadata as trusted headers.
 
+### Changed
+
+* Demote the `non-gRPC error` auth-middleware log from `Error` to `Debug` in both `middleware/connect` and `middleware/grpc` — a client failing to authenticate is not a server error, and at `Error` it flooded logs and error-rate alerts. Genuine auth-service failures (`Internal`, `Unavailable`, `Unknown`) still log at `Error`.
+
 ## 2020-03-21
 
 ### Changed

middleware/connect/middleware.go

@@ -78,7 +78,10 @@ func obfuscateErrorMessage(ctx context.Context, err error, logger *zap.Logger) e
 		}
 		return connect.NewError(connect.Code(st.Code()), errors.New(msg))
 	} else {
-		logger.Check(level, "authentication service via Connect-Web middleware non-gRPC error").Write(zap.Error(err))
+		// A non-gRPC error here means the authenticator rejected the request itself (missing/malformed
+		// credentials, expired token, unknown API key). That's a client-side condition, not a server
+		// fault, so it must not pollute error logs nor error-rate alerting.
+		logger.Debug("authentication service via Connect-Web middleware non-gRPC error", zap.Error(err))
 
 		if v := (*dauth.ErrInvalidAuthentication)(nil); errors.As(err, &v) {
 			return connect.NewError(connect.Code(codes.Unauthenticated), errors.New(v.Error()))

middleware/grpc/middleware.go

@@ -43,7 +43,10 @@ func obfuscateErrorMessage(err error, logger *zap.Logger) error {
 		}
 		return status.Error(st.Code(), msg)
 	} else {
-		logger.Error("authentication service via gRPC middleware non-gRPC error", zap.Error(err))
+		// A non-gRPC error here means the authenticator rejected the request itself (missing/malformed
+		// credentials, expired token, unknown API key). That's a client-side condition, not a server
+		// fault, so it must not pollute error logs nor error-rate alerting.
+		logger.Debug("authentication service via gRPC middleware non-gRPC error", zap.Error(err))
 	}
 
 	return status.Errorf(codes.Unauthenticated, "authentication: %s", err.Error())