Return 401 for auth failures and log verify

src/main/kotlin/com/android/trisolarisserver/controller/Auth.kt

@@ -80,10 +80,12 @@ class Auth(
         val decoded = try {
             FirebaseAuth.getInstance().verifyIdToken(token)
         } catch (ex: Exception) {
+            logger.warn("Auth verify failed: {}", ex.message)
             throw ResponseStatusException(HttpStatus.UNAUTHORIZED, "Invalid token")
         }
         val user = appUserRepo.findByFirebaseUid(decoded.uid)
             ?: throw ResponseStatusException(HttpStatus.UNAUTHORIZED, "User not found")
+        logger.info("Auth verify resolved uid={}, userId={}", decoded.uid, user.id)
         return MyPrincipal(
             userId = user.id ?: throw ResponseStatusException(HttpStatus.UNAUTHORIZED, "User id missing"),
             firebaseUid = decoded.uid

src/main/kotlin/com/android/trisolarisserver/security/SecurityConfig.kt

@@ -7,6 +7,8 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.http.SessionCreationPolicy
 import org.springframework.security.web.SecurityFilterChain
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
+import org.springframework.security.web.authentication.HttpStatusEntryPoint
+import org.springframework.http.HttpStatus
 
 @Configuration(proxyBeanMethods = false)
 @EnableMethodSecurity
@@ -22,6 +24,12 @@ class SecurityConfig(
                 it.requestMatchers("/", "/health", "/auth/**").permitAll()
                 it.anyRequest().authenticated()
             }
+            .exceptionHandling {
+                it.authenticationEntryPoint(HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
+                it.accessDeniedHandler { _, response, _ ->
+                    response.sendError(HttpStatus.UNAUTHORIZED.value(), "Unauthorized")
+                }
+            }
             .httpBasic { it.disable() }
             .formLogin { it.disable() }
             .addFilterBefore(firebaseAuthFilter, UsernamePasswordAuthenticationFilter::class.java)