fix(oauth): redirect on associate-callback errors instead of rendering JSON - #46
Merged
Merged
Conversation
…g JSON
When the provider redirects the browser directly to /auth/<provider>/associate/callback
(prod) and the handler raises HTTPException, FastAPI surfaces the raw JSON
to the user — most visibly oauth_account_already_linked, which a tester hit
when re-linking a Steam account already attached to another user.
Wrap the handler so any HTTPException whose detail carries a `code` becomes
a 302 to {frontend_url}/profile?associate_error=<code>&associate_provider=<provider>.
The SPA renders the message as a proper alert from there (separate PR).
Exceptions without a structured code re-raise so we don't accidentally
swallow unrelated errors.
Updated the state-validation and conflict tests to assert the redirect
shape instead of JSON.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/auth/<provider>/associate/callbackso anyHTTPExceptionwhose detail carries acodebecomes a302to{frontend_url}/profile?associate_error=<code>&associate_provider=<provider>instead of raw JSON.oauth_account_already_linkedand got the raw JSON detail rendered as the entire page — because in prod Steam/Google redirect the browser directly to this endpoint (no SPA layer in front of it).Companion PR
The SPA-side rendering of the alert lives in ag-tech-group/criticalbit-auth-web#TBD — should land together. This PR alone makes the URL stop showing JSON; both together make it look like a proper alert.
Test plan
uv run pytest— 130 passed, 1 skippedtest_provider_associate.pyupdated to assert the new redirect shape (/profile?associate_error=<code>&associate_provider=steam) for:oauth_state_missing,oauth_state_wrong_purpose,oauth_state_user_mismatch,oauth_csrf_mismatch, and the 409oauth_account_already_linkedconflict path./profile?associate_error=oauth_account_already_linked&associate_provider=steam(the SPA PR handles the alert from there).