Add Error logging and hclog.Logger debug logging throughout the daemon (#4384) (#4439)

* Save and assign hclogger throughout the client cache daemon

* Don't event for errors happening outside of the handlers or tickers.

* Hide and ignore -store-debug and expose the -log-level flag

internal/clientcache/internal/cache/refresh.go

@@ -14,10 +14,13 @@ import (
 	"github.com/hashicorp/boundary/internal/errors"
 	"github.com/hashicorp/boundary/internal/event"
 	"github.com/hashicorp/boundary/internal/util"
+	"github.com/hashicorp/go-hclog"
 )
 
 type RefreshService struct {
 	repo *Repository
+
+	logger hclog.Logger
 	// the amount of time that should have passed since the last refresh for a
 	// call to RefreshForSearch will cause a refresh request to be sent to a
 	// boundary controller.
@@ -26,16 +29,19 @@ type RefreshService struct {
 	maxSearchRefreshTimeout time.Duration
 }
 
-func NewRefreshService(ctx context.Context, r *Repository, maxSearchStaleness, maxSearchRefreshTimeout time.Duration) (*RefreshService, error) {
+func NewRefreshService(ctx context.Context, r *Repository, logger hclog.Logger, maxSearchStaleness, maxSearchRefreshTimeout time.Duration) (*RefreshService, error) {
 	const op = "cache.NewRefreshService"
 	switch {
 	case util.IsNil(r):
 		return nil, errors.New(ctx, errors.InvalidParameter, op, "repository is nil")
+	case util.IsNil(logger):
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "logger is nil")
 	case maxSearchStaleness < 0:
 		return nil, errors.New(ctx, errors.InvalidParameter, op, "max search staleness is negative")
 	}
 	return &RefreshService{
 		repo:                    r,
+		logger:                  logger,
 		maxSearchStaleness:      maxSearchStaleness,
 		maxSearchRefreshTimeout: maxSearchRefreshTimeout,
 	}, nil
@@ -66,10 +72,11 @@ func (r *RefreshService) cleanAndPickAuthTokens(ctx context.Context, u *user) (m
 			at := r.repo.tokenKeyringFn(kt.KeyringType, kt.TokenName)
 			switch {
 			case at == nil, at.Id != kt.AuthTokenId, at.UserId != t.UserId:
+				event.WriteSysEvent(ctx, op, "Removed keyring token since the keyring contents have changed since being cached", "keyring", kt.KeyringType, "token name", kt.TokenName, "old auth token id", kt.AuthTokenId)
 				// delete the keyring token if the auth token in the keyring
 				// has changed since it was stored in the cache.
 				if err := r.repo.deleteKeyringToken(ctx, *kt); err != nil {
-					return nil, errors.Wrap(ctx, err, op)
+					return nil, errors.Wrap(ctx, err, op, errors.WithMsg("for user %q, auth token %q", u.Id, t.Id))
 				}
 			case at != nil:
 				_, err := r.repo.tokenReadFromBoundaryFn(ctx, u.Address, at.Token)
@@ -77,7 +84,7 @@ func (r *RefreshService) cleanAndPickAuthTokens(ctx context.Context, u *user) (m
 				switch {
 				case err != nil && (api.ErrUnauthorized.Is(err) || api.ErrNotFound.Is(err)):
 					if err := r.repo.deleteKeyringToken(ctx, *kt); err != nil {
-						return nil, errors.Wrap(ctx, err, op)
+						return nil, errors.Wrap(ctx, err, op, errors.WithMsg("for user %q, auth token %q", u.Id, t.Id))
 					}
 					event.WriteSysEvent(ctx, op, "Removed auth token from cache because it was not found to be valid in boundary", "auth token id", at.Id)
 					continue
@@ -119,7 +126,7 @@ func (r *RefreshService) cacheSupportedUsers(ctx context.Context, in []*user) ([
 	for _, u := range in {
 		cs, err := r.repo.cacheSupportState(ctx, u)
 		if err != nil {
-			return nil, errors.Wrap(ctx, err, op)
+			return nil, errors.Wrap(ctx, err, op, errors.WithMsg("for user %q", u.Id))
 		}
 		if cs.supported != NotSupportedCacheSupport {
 			ret = append(ret, u)
@@ -152,21 +159,21 @@ func (r *RefreshService) RefreshForSearch(ctx context.Context, authTokenid strin
 	}
 	at, err := r.repo.LookupToken(ctx, authTokenid)
 	if err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 	if at == nil {
-		return errors.New(ctx, errors.NotFound, op, "auth token not found")
+		return errors.New(ctx, errors.NotFound, op, "auth token not found", errors.WithoutEvent())
 	}
 	u, err := r.repo.lookupUser(ctx, at.UserId)
 	if err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 	if u == nil {
-		return errors.New(ctx, errors.NotFound, op, "user not found")
+		return errors.New(ctx, errors.NotFound, op, "user not found", errors.WithoutEvent())
 	}
 	us, err := r.cacheSupportedUsers(ctx, []*user{u})
 	if err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 
 	switch len(us) {
@@ -176,28 +183,29 @@ func (r *RefreshService) RefreshForSearch(ctx context.Context, authTokenid strin
 	case 1:
 		u = us[0]
 	default:
-		return errors.New(ctx, errors.Internal, op, "unexpected number of refreshable users")
+		return errors.New(ctx, errors.Internal, op, "unexpected number of refreshable users", errors.WithoutEvent())
 	}
 
 	tokens, err := r.cleanAndPickAuthTokens(ctx, u)
 	if err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 
 	opts, err := getOpts(opt...)
 	if err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 
 	switch resourceType {
 	case Targets:
 		rtv, err := r.repo.lookupRefreshToken(ctx, u, targetResourceType)
 		if err != nil {
-			return errors.Wrap(ctx, err, op)
+			return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 		}
 		if opts.withIgnoreSearchStaleness || rtv != nil && time.Since(rtv.UpdateTime) > r.maxSearchStaleness {
+			r.logger.Debug("refreshing targets before performing search", "user", u.Id, "force refresh", opts.withIgnoreSearchStaleness, "sessions age", time.Since(rtv.UpdateTime))
 			if err := r.repo.refreshTargets(ctx, u, tokens, opt...); err != nil {
-				return errors.Wrap(ctx, err, op)
+				return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 			}
 		}
 	case Sessions:
@@ -206,12 +214,13 @@ func (r *RefreshService) RefreshForSearch(ctx context.Context, authTokenid strin
 			return errors.Wrap(ctx, err, op)
 		}
 		if opts.withIgnoreSearchStaleness || rtv != nil && time.Since(rtv.UpdateTime) > r.maxSearchStaleness {
+			r.logger.Debug("refreshing sessions before performing search", "user", u.Id, "force refresh", opts.withIgnoreSearchStaleness, "sessions age", time.Since(rtv.UpdateTime))
 			if err := r.repo.refreshSessions(ctx, u, tokens, opt...); err != nil {
-				return errors.Wrap(ctx, err, op)
+				return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 			}
 		}
 	default:
-		return errors.New(ctx, errors.InvalidParameter, op, "unrecognized resource type")
+		return errors.New(ctx, errors.InvalidParameter, op, "unrecognized resource type", errors.WithoutEvent())
 	}
 
 	return nil
@@ -226,27 +235,28 @@ func (r *RefreshService) RefreshForSearch(ctx context.Context, authTokenid strin
 func (r *RefreshService) Refresh(ctx context.Context, opt ...Option) error {
 	const op = "cache.(RefreshService).Refresh"
 	if err := r.repo.cleanExpiredOrOrphanedAuthTokens(ctx); err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 	if err := r.repo.syncKeyringlessTokensWithDb(ctx); err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 
 	us, err := r.repo.listUsers(ctx)
 	if err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 
 	us, err = r.cacheSupportedUsers(ctx, us)
 	if err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 
 	var retErr error
 	for _, u := range us {
+		r.logger.Debug("refreshing user", "user", u.Id)
 		tokens, err := r.cleanAndPickAuthTokens(ctx, u)
 		if err != nil {
-			retErr = stderrors.Join(retErr, errors.Wrap(ctx, err, op))
+			retErr = stderrors.Join(retErr, errors.Wrap(ctx, err, op, errors.WithoutEvent()))
 			continue
 		}
 
@@ -270,20 +280,20 @@ func (r *RefreshService) Refresh(ctx context.Context, opt ...Option) error {
 func (r *RefreshService) RecheckCachingSupport(ctx context.Context, opt ...Option) error {
 	const op = "cache.(RefreshService).RecheckCachingSupport"
 	if err := r.repo.cleanExpiredOrOrphanedAuthTokens(ctx); err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 	if err := r.repo.syncKeyringlessTokensWithDb(ctx); err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 
 	us, err := r.repo.listUsers(ctx)
 	if err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 
 	removeUsers, err := r.cacheSupportedUsers(ctx, us)
 	if err != nil {
-		return errors.Wrap(ctx, err, op)
+		return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 	removedUserIds := make(map[string]struct{}, len(removeUsers))
 	for _, ru := range removeUsers {
@@ -295,6 +305,7 @@ func (r *RefreshService) RecheckCachingSupport(ctx context.Context, opt ...Optio
 		if _, ok := removedUserIds[u.Id]; ok {
 			continue
 		}
+		r.logger.Debug("rechecking caching support for user", "user", u.Id)
 
 		tokens, err := r.cleanAndPickAuthTokens(ctx, u)
 		if err != nil {

internal/clientcache/internal/cache/refresh_test.go

@@ -17,6 +17,7 @@ import (
 	"github.com/hashicorp/boundary/api/sessions"
 	"github.com/hashicorp/boundary/api/targets"
 	"github.com/hashicorp/boundary/internal/clientcache/internal/db"
+	"github.com/hashicorp/go-hclog"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/exp/maps"
@@ -139,7 +140,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		mapBasedAuthTokenKeyringLookup(atMap),
 		fakeBoundaryLookupFn)
 	require.NoError(t, err)
-	rs, err := NewRefreshService(ctx, r, 0, 0)
+	rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 	require.NoError(t, err)
 
 	t.Run("unknown user", func(t *testing.T) {
@@ -355,7 +356,7 @@ func TestRefreshForSearch(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, time.Millisecond, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), time.Millisecond, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -406,7 +407,7 @@ func TestRefreshForSearch(t *testing.T) {
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
 		// Everything can stay stale for an hour
-		rs, err := NewRefreshService(ctx, r, time.Hour, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), time.Hour, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -460,7 +461,7 @@ func TestRefreshForSearch(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, 0, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -513,7 +514,7 @@ func TestRefreshForSearch(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, 0, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -561,7 +562,7 @@ func TestRefreshForSearch(t *testing.T) {
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
 		// Everything stays fresh for 1 hour
-		rs, err := NewRefreshService(ctx, r, time.Hour, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), time.Hour, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -632,7 +633,7 @@ func TestRefresh(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, 0, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -673,7 +674,7 @@ func TestRefresh(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, 0, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -713,7 +714,7 @@ func TestRefresh(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, 0, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -741,7 +742,7 @@ func TestRefresh(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, 0, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -795,7 +796,7 @@ func TestRecheckCachingSupport(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, 0, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -829,7 +830,7 @@ func TestRecheckCachingSupport(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, 0, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -863,7 +864,7 @@ func TestRecheckCachingSupport(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, 0, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 
@@ -897,7 +898,7 @@ func TestRecheckCachingSupport(t *testing.T) {
 		require.NoError(t, err)
 		r, err := NewRepository(ctx, s, &sync.Map{}, mapBasedAuthTokenKeyringLookup(atMap), sliceBasedAuthTokenBoundaryReader(boundaryAuthTokens))
 		require.NoError(t, err)
-		rs, err := NewRefreshService(ctx, r, 0, 0)
+		rs, err := NewRefreshService(ctx, r, hclog.NewNullLogger(), 0, 0)
 		require.NoError(t, err)
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{KeyringType: "k", TokenName: "t", AuthTokenId: at.Id}))
 

internal/clientcache/internal/cache/repository_token.go

@@ -112,15 +112,15 @@ func (r *Repository) AddRawToken(ctx context.Context, bAddr string, rawToken str
 	const op = "cache.(Repository).AddRawToken"
 	switch {
 	case rawToken == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token is empty")
+		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token is empty", errors.WithoutEvent())
 	case bAddr == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary address is empty")
+		return errors.New(ctx, errors.InvalidParameter, op, "boundary address is empty", errors.WithoutEvent())
 	}
 
 	// rawToken should look something like at_1234567890_someencryptedpayload
 	atIdParts := strings.SplitN(rawToken, "_", 4)
 	if len(atIdParts) != 3 {
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token is is malformed")
+		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token is is malformed", errors.WithoutEvent())
 	}
 	atId := strings.Join(atIdParts[:AuthTokenIdSegmentCount], "_")
 
@@ -132,7 +132,7 @@ func (r *Repository) AddRawToken(ctx context.Context, bAddr string, rawToken str
 			var ok bool
 			inMemAuthToken, ok = atV.(*authtokens.AuthToken)
 			if !ok {
-				return errors.New(ctx, errors.Internal, op, "unable to cast in memory auth token to *authtoken.AuthToken")
+				return errors.New(ctx, errors.Internal, op, "unable to cast in memory auth token to *authtoken.AuthToken", errors.WithoutEvent())
 			}
 		}
 		t := &AuthToken{
@@ -148,10 +148,10 @@ func (r *Repository) AddRawToken(ctx context.Context, bAddr string, rawToken str
 			// cache information about this auth token.
 			at, err = r.tokenReadFromBoundaryFn(ctx, bAddr, rawToken)
 			if err != nil {
-				return errors.Wrap(ctx, err, op)
+				return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 			}
 		case t.UserId != inMemAuthToken.UserId:
-			return errors.New(ctx, errors.InvalidParameter, op, "user id doesn't match what is specified in the stored auth token")
+			return errors.New(ctx, errors.InvalidParameter, op, "user id doesn't match what is specified in the stored auth token", errors.WithoutEvent())
 		case inMem:
 			at = inMemAuthToken
 		}
@@ -165,7 +165,7 @@ func (r *Repository) AddRawToken(ctx context.Context, bAddr string, rawToken str
 
 	_, err := r.rw.DoTx(ctx, db.StdRetryCnt, db.ExpBackoff{}, func(reader db.Reader, writer db.Writer) error {
 		if err := upsertUserAndAuthToken(ctx, reader, writer, bAddr, at); err != nil {
-			return errors.Wrap(ctx, err, op)
+			return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 		}
 		r.idToKeyringlessAuthToken.Store(at.Id, at)
 		return nil
@@ -186,21 +186,21 @@ func (r *Repository) AddKeyringToken(ctx context.Context, bAddr string, token Ke
 	const op = "cache.(Repository).AddKeyringToken"
 	switch {
 	case token.TokenName == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "token name is empty")
+		return errors.New(ctx, errors.InvalidParameter, op, "token name is empty", errors.WithoutEvent())
 	case token.KeyringType == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "keyring type is empty")
+		return errors.New(ctx, errors.InvalidParameter, op, "keyring type is empty", errors.WithoutEvent())
 	case token.AuthTokenId == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token id is empty")
+		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token id is empty", errors.WithoutEvent())
 	case bAddr == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary address is empty")
+		return errors.New(ctx, errors.InvalidParameter, op, "boundary address is empty", errors.WithoutEvent())
 	}
 	kt := token.clone()
 	keyringStoredAt := r.tokenKeyringFn(kt.KeyringType, kt.TokenName)
 	if keyringStoredAt == nil {
-		return errors.New(ctx, errors.InvalidParameter, op, "unable to find token in the keyring specified")
+		return errors.New(ctx, errors.InvalidParameter, op, "unable to find token in the keyring specified", errors.WithoutEvent())
 	}
 	if kt.AuthTokenId != keyringStoredAt.Id {
-		return errors.New(ctx, errors.InvalidParameter, op, "provided auth token id doesn't match the one stored")
+		return errors.New(ctx, errors.InvalidParameter, op, "provided auth token id doesn't match the one stored", errors.WithoutEvent())
 	}
 
 	var at *authtokens.AuthToken
@@ -218,21 +218,21 @@ func (r *Repository) AddKeyringToken(ctx context.Context, bAddr string, token Ke
 				return errors.Wrap(ctx, err, op)
 			}
 		case cachedAt.UserId != keyringStoredAt.UserId:
-			return errors.New(ctx, errors.InvalidParameter, op, "user id doesn't match what is specified in the stored auth token")
+			return errors.New(ctx, errors.InvalidParameter, op, "user id doesn't match what is specified in the stored auth token", errors.WithoutEvent())
 		default:
 			at = keyringStoredAt
 		}
 	}
 	_, err := r.rw.DoTx(ctx, db.StdRetryCnt, db.ExpBackoff{}, func(reader db.Reader, writer db.Writer) error {
 		if err := upsertUserAndAuthToken(ctx, reader, writer, bAddr, at); err != nil {
-			return errors.Wrap(ctx, err, op)
+			return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 		}
 		onConflict := &db.OnConflict{
 			Target: db.Columns{"keyring_type", "token_name"},
 			Action: db.SetColumns([]string{"auth_token_id"}),
 		}
 		if err := writer.Create(ctx, kt, db.WithOnConflict(onConflict)); err != nil {
-			return errors.Wrap(ctx, err, op)
+			return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 		}
 		return nil
 	})
@@ -252,7 +252,7 @@ func (r *Repository) LookupToken(ctx context.Context, authTokenId string, opt ..
 	const op = "cache.(Repository).LookupToken"
 	switch {
 	case authTokenId == "":
-		return nil, errors.New(ctx, errors.InvalidParameter, op, "auth token id is empty")
+		return nil, errors.New(ctx, errors.InvalidParameter, op, "auth token id is empty", errors.WithoutEvent())
 	}
 
 	at := &AuthToken{
@@ -262,12 +262,12 @@ func (r *Repository) LookupToken(ctx context.Context, authTokenId string, opt ..
 		if errors.IsNotFoundError(err) {
 			return nil, nil
 		}
-		return nil, errors.Wrap(ctx, err, op)
+		return nil, errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 
 	opts, err := getOpts(opt...)
 	if err != nil {
-		return nil, errors.Wrap(ctx, err, op)
+		return nil, errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 
 	if opts.withUpdateLastAccessedTime {
@@ -276,7 +276,7 @@ func (r *Repository) LookupToken(ctx context.Context, authTokenId string, opt ..
 			LastAccessedTime: time.Now(),
 		}
 		if _, err := r.rw.Update(ctx, updatedT, []string{"LastAccessedTime"}, nil); err != nil {
-			return nil, errors.Wrap(ctx, err, op)
+			return nil, errors.Wrap(ctx, err, op, errors.WithoutEvent())
 		}
 	}
 	return at, nil
@@ -300,19 +300,19 @@ func (r *Repository) deleteKeyringToken(ctx context.Context, kt KeyringToken) er
 		//   query here.
 		n, err := writer.Exec(ctx, "delete from keyring_token where (keyring_type, token_name) = (?, ?)", []any{kt.KeyringType, kt.TokenName})
 		if err != nil {
-			return errors.Wrap(ctx, err, op)
+			return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 		}
 
 		switch n {
 		case 1:
 			if err := cleanExpiredOrOrphanedAuthTokens(ctx, writer, r.idToKeyringlessAuthToken); err != nil {
-				return errors.Wrap(ctx, err, op)
+				return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 			}
 			return nil
 		case 0:
-			return errors.New(ctx, errors.RecordNotFound, op, "token not found when attempting deletion")
+			return errors.New(ctx, errors.RecordNotFound, op, "token not found when attempting deletion", errors.WithoutEvent())
 		default:
-			return errors.New(ctx, errors.MultipleRecords, op, "multiple tokens deleted when one was requested")
+			return errors.New(ctx, errors.MultipleRecords, op, "multiple tokens deleted when one was requested", errors.WithoutEvent())
 		}
 	})
 	if err != nil {
@@ -327,7 +327,7 @@ func (r *Repository) cleanExpiredOrOrphanedAuthTokens(ctx context.Context) error
 	const op = "cache.Repository.cleanExpiredOrOrphanedAuthTokens"
 	_, err := r.rw.DoTx(ctx, db.StdRetryCnt, db.ExpBackoff{}, func(reader db.Reader, writer db.Writer) error {
 		if err := cleanExpiredOrOrphanedAuthTokens(ctx, writer, r.idToKeyringlessAuthToken); err != nil {
-			return errors.Wrap(ctx, err, op)
+			return errors.Wrap(ctx, err, op, errors.WithoutEvent())
 		}
 		return nil
 	})

internal/clientcache/internal/cache/search.go

@@ -99,20 +99,20 @@ func (s *SearchService) Supported(ctx context.Context, t *AuthToken) (bool, erro
 	const op = "cache.(SearchService).Supported"
 	switch {
 	case util.IsNil(t):
-		return false, errors.New(ctx, errors.InvalidParameter, op, "auth token is nil")
+		return false, errors.New(ctx, errors.InvalidParameter, op, "auth token is nil", errors.WithoutEvent())
 	case t.UserId == "":
-		return false, errors.New(ctx, errors.InvalidParameter, op, "auth token's user id is empty")
+		return false, errors.New(ctx, errors.InvalidParameter, op, "auth token's user id is empty", errors.WithoutEvent())
 	}
 	u, err := s.repo.lookupUser(ctx, t.UserId)
 	if err != nil {
-		return false, errors.Wrap(ctx, err, op)
+		return false, errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 	if u == nil {
-		return false, errors.New(ctx, errors.NotFound, op, "user not found for auth token")
+		return false, errors.New(ctx, errors.NotFound, op, "user not found for auth token", errors.WithoutEvent())
 	}
 	cs, err := s.repo.cacheSupportState(ctx, u)
 	if err != nil {
-		return false, errors.Wrap(ctx, err, op)
+		return false, errors.Wrap(ctx, err, op, errors.WithoutEvent())
 	}
 	return cs.supported != NotSupportedCacheSupport, nil
 }