raystack / frontier / 29900406738

46%

main: 47%

Build Type

Pull #1790

github

Committed by whoAbhishekSah

Commit Message

fix(auth): return 4xx for bad OIDC authorization codes

AuthCallback returned a 500 (internal) whenever the OIDC token
exchange failed with an oauth2 error like invalid_grant. That error
means the authorization code was bad (expired, already used, or the
redirect did not match) which is a client problem, not a server fault.
It fired a critical alert for normal background noise such as retries,
double submits, and link prefetching.

Detect the oauth2.RetrieveError from the token exchange and wrap it in
a new ErrOIDCTokenExchange sentinel. The handler maps that sentinel to
CodeInvalidArgument so the caller gets a 4xx instead of a 500.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #1790: fix(auth): return 4xx for bad OIDC authorization codes

Coverage Stats

0 of 8 new or added lines in 2 files covered. (0.0%)

54 existing lines in 2 files now uncovered.

17779 of 38469 relevant lines covered (46.22%)

13.36 hits per line