rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Route OIDC failures through shared auth error page

Browse Source 
A dedicated personal-account page does not scale as more refusal
reasons appear. Redirect the OIDC callback to /auth/error with an
error code query parameter so the frontend can map codes to clear
user-facing messages.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>
This commit is contained in:
Bryan Frimin
2026-07-24 21:19:33 +00:00
committed by Cursor Agent
parent d1814d7051
commit 6c4a67d3f7
5 changed files with 126 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
pkg/server/api/connect/v1/oidc_handler.go
View File

@@ -116,7 +116,7 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) {
log.String("error", errParam),
log.String("error_description", r.URL.Query().Get("error_description")),
)
httpserver.RenderError(w, http.StatusUnauthorized, errors.New("authentication failed"))
redirectAuthError(w, r, authErrorAuthenticationFailed)
return
}
@@ -133,13 +133,13 @@ func (h *OIDCHandler) CallbackHandler(w http.ResponseWriter, r *http.Request) {
if err != nil {
if _, ok := errors.AsType[*oidc.ErrPersonalAccountNotAllowed](err); ok {
h.logger.WarnCtx(ctx, "OIDC login rejected: personal account not allowed")
http.Redirect(w, r, "/auth/personal-account-not-allowed", http.StatusFound)
redirectAuthError(w, r, authErrorPersonalAccountNotAllowed)
return
}
h.logger.ErrorCtx(ctx, "cannot handle OIDC callback", log.Error(err))
httpserver.RenderError(w, http.StatusUnauthorized, errors.New("authentication failed"))
redirectAuthError(w, r, authErrorAuthenticationFailed)
return
}