{"record":{"id":"1272ce023bcf4d83","repo":"diegosouzapw/OmniRoute","slug":"gitlab-duo-token-exchange-failed-error","errorCode":null,"errorMessage":"GitLab Duo token exchange failed: ${error}","messagePattern":"GitLab Duo token exchange failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/providers/gitlab-duo.ts","lineNumber":72,"sourceCode":"      code_verifier: codeVerifier,\n    });\n\n    if (config.clientSecret) {\n      body.set(\"client_secret\", config.clientSecret);\n    }\n\n    const response = await fetch(config.tokenUrl, {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/x-www-form-urlencoded\",\n        Accept: \"application/json\",\n      },\n      body,\n    });\n\n    if (!response.ok) {\n      const error = await response.text();\n      throw new Error(`GitLab Duo token exchange failed: ${error}`);\n    }\n\n    return await response.json();\n  },\n  postExchange: async (tokens) => {\n    const endpoints = buildGitLabOAuthEndpoints(GITLAB_DUO_CONFIG.baseUrl);\n    const headers = {\n      Authorization: `Bearer ${tokens.access_token}`,\n      Accept: \"application/json\",\n    };\n\n    const userRes = await fetch(endpoints.userUrl, { headers });\n    const userInfo = userRes.ok ? ((await userRes.json()) as Record<string, unknown>) : {};\n\n    let directAccess = null;\n    try {\n      const directRes = await fetch(endpoints.directAccessUrl, {\n        method: \"POST\",","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/diegosouzapw/OmniRoute/blob/a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d/src/lib/oauth/providers/gitlab-duo.ts#L54-L90","documentation":"Thrown when GitLab Duo's OAuth token endpoint answers the authorization-code exchange with a non-2xx status; the raw response body text is embedded so operators can see GitLab's OAuth error (invalid_grant, redirect_uri mismatch, expired code, revoked app). Fires when the PKCE exchange POST fails upstream, not on network errors (those reject the fetch itself).","triggerScenarios":"Thrown at src/lib/oauth/providers/gitlab-duo.ts:72 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restart the flow if the code expired","Confirm client id/secret and redirect_uri against the GitLab app"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"a179ffed5bb2e0b883b9ae7214ce8717b2a94c4d","analyzedAt":"2026-08-25T18:35:09.898Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}