There's been some discussions in various forums recently about logging OAuth interactions. This was originally brought up with respect to WikiAuthBot (which is used by various wikipedia-adjacent Discord servers to authenticate users against their WMF credentials using OAuth), but I think we should address the more general OAuth question. WikiAuthBot does some logging of its own, which is visible on the Discord side, but it would be useful for the OAuth code on the server side to also log both successful and unsuccessful authentications.
There's a lot of issues related to this that need to be sorted out. Some of these might be worth breaking out into their own tasks, but I'll just dump them all here to get things started.
Its not clear to me what privacy policies even apply here. If the OAuth client is running in the WMF cloud environment, then Wikitech:Cloud Services Terms of use certainly applies.
If the client is running in some other environment, I'm inclined to think the global privacy policy still has some sway, since we're dealing with WMF accounts. As external services such as Discord become more widely used in close proximity to WMF projects (sometimes called mash-ups), it becomes less and less clear to the end user (especially a technologically unsophisticated one) what entity is running what service. It would be unfortunate if a user believed they were using a WMF service and thus entitled to the protections afforded by the various WMF privacy-related policies, only to discover that more logging was going on then they thought. So regardless of what we end up doing on the CU/OAuth logging front, updating our policies and guidance to third-party developers would be useful.
On the technical side, it's not even clear what data is available to the OAuth extension. CU gets its IP/UA/CH data from the incoming HTTP headers. For an OAuth request, those fields will probably reflect the OAuth client software rather than the end user. Possibly what we want to do is encourage client developers to pass along the original end user data in XFF headers or some similar mechanism?