github-starred/pangolin
2
0
Fork 0
mirror of https://github.com/fosrl/pangolin.git synced 2026-07-17 07:04:36 -05:00
Code Issues 1.6k Packages Projects Releases 79 Wiki Activity

[PR #2033] [MERGED] Add OIDC authentication error response support #5719

New Issue
Closed
opened 2026-04-23 02:44:51 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-23 02:44:51 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/fosrl/pangolin/pull/2033
Author: @buggystick
Created: 12/10/2025
Status: ✅ Merged
Merged: 12/17/2025
Merged by: @miloschwartz

Base: dev ← Head: feature/oidc-email-error

📝 Commits (3)

  • 78369b6 Add OIDC authentication error response support
  • 0f79826 fix useEffect re-render too many times
  • 553fda2 Merge branch 'dev' into feature/oidc-email-error

📊 Changes

3 files changed (+180 additions, -30 deletions)

View changed files

📝 server/routers/idp/validateOidcCallback.ts (+65 -5)
📝 src/app/auth/idp/[idpId]/oidc/callback/page.tsx (+14 -2)
📝 src/components/ValidateOidcToken.tsx (+101 -23)

📄 Description

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description

  • Surface any OIDC provider errors returned via query parameters (error, error_description, error_uri) by passing them to ValidateOidcToken, skipping the backend call, and rendering the provider’s own message
    as the primary alert so users immediately see why the login stopped.
  • Tidy the callback UI so provider-supplied errors fully replace the generic “problem connecting” copy, while retaining the fallback text for errors we generate ourselves.
  • Wrap /api/v1/auth/idp/:id/oidc/validate-callback in targeted error handling for OAuth2RequestError, UnexpectedResponseError, UnexpectedErrorResponseBodyError, and ArcticFetchError, logging structured details
    and returning meaningful HTTP codes/messages instead of a generic 500.
  • Add guardrails for missing authorization code or state so we display actionable guidance when the IdP doesn’t return the expected parameters.

How to test?

  1. npm install
  2. npm run set:oss && npm run set:sqlite
  3. Configure config/config.yml (e.g., dashboard URL http://localhost:3002), then run npm run db:sqlite:generate and npm run db:sqlite:push.
  4. Start the stack with npm run dev.
  5. Configure an OIDC identity provider (tested with Auth0: authorization URL https://.auth0.com/authorize, token URL https://.auth0.com/oauth/token, redirect http://localhost:3002/auth/idp//
    oidc/callback).
  6. From the dashboard login, authenticate with an account that the IdP blocks (e.g., email not verified). The callback page should display the provider’s error description verbatim, with no extra generic text,
    and the browser should remain on the callback page.
  7. Authenticate with an allowed account. The standard code exchange path should complete, creating a session and redirecting to your requested resource.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/fosrl/pangolin/pull/2033 **Author:** [@buggystick](https://github.com/buggystick) **Created:** 12/10/2025 **Status:** ✅ Merged **Merged:** 12/17/2025 **Merged by:** [@miloschwartz](https://github.com/miloschwartz) **Base:** `dev` ← **Head:** `feature/oidc-email-error` --- ### 📝 Commits (3) - [`78369b6`](https://github.com/fosrl/pangolin/commit/78369b6f6adfda90aed1d91b525970973c82a700) Add OIDC authentication error response support - [`0f79826`](https://github.com/fosrl/pangolin/commit/0f798265350b4c3cf4633df21cf2d80d3b7b67cb) fix useEffect re-render too many times - [`553fda2`](https://github.com/fosrl/pangolin/commit/553fda265cb3f3d937501cc15af4048601334bc8) Merge branch 'dev' into feature/oidc-email-error ### 📊 Changes **3 files changed** (+180 additions, -30 deletions) <details> <summary>View changed files</summary> 📝 `server/routers/idp/validateOidcCallback.ts` (+65 -5) 📝 `src/app/auth/idp/[idpId]/oidc/callback/page.tsx` (+14 -2) 📝 `src/components/ValidateOidcToken.tsx` (+101 -23) </details> ### 📄 Description ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description - Surface any OIDC provider errors returned via query parameters (error, error_description, error_uri) by passing them to ValidateOidcToken, skipping the backend call, and rendering the provider’s own message as the primary alert so users immediately see why the login stopped. - Tidy the callback UI so provider-supplied errors fully replace the generic “problem connecting” copy, while retaining the fallback text for errors we generate ourselves. - Wrap /api/v1/auth/idp/:id/oidc/validate-callback in targeted error handling for OAuth2RequestError, UnexpectedResponseError, UnexpectedErrorResponseBodyError, and ArcticFetchError, logging structured details and returning meaningful HTTP codes/messages instead of a generic 500. - Add guardrails for missing authorization code or state so we display actionable guidance when the IdP doesn’t return the expected parameters. ## How to test? 1. npm install 2. npm run set:oss && npm run set:sqlite 3. Configure config/config.yml (e.g., dashboard URL http://localhost:3002), then run npm run db:sqlite:generate and npm run db:sqlite:push. 4. Start the stack with npm run dev. 5. Configure an OIDC identity provider (tested with Auth0: authorization URL https://<tenant>.auth0.com/authorize, token URL https://<tenant>.auth0.com/oauth/token, redirect http://localhost:3002/auth/idp/<id>/ oidc/callback). 6. From the dashboard login, authenticate with an account that the IdP blocks (e.g., email not verified). The callback page should display the provider’s error description verbatim, with no extra generic text, and the browser should remain on the callback page. 7. Authenticate with an allowed account. The standard code exchange path should complete, creating a session and redirecting to your requested resource. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-23 02:44:51 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
api
authentication
bug
config
dependencies
docker
documentation
enhancement
good first issue
help wanted
Improvement
Look Into
needs investigating
networking
new feature
non-critical bug
potential bug
pull-request
Mirrored from GitHub Pull Request
 question
reverse proxy
Security
stale
ui
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/pangolin#5719
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?