{"record":{"id":"1da430e7656eb79b","repo":"xai-org/grok-build","slug":"oidcerror-callbacktimeout","errorCode":null,"errorMessage":"OidcError::CallbackTimeout","messagePattern":"OidcError::CallbackTimeout","errorType":"exception","errorClass":"OidcError","httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/oidc/login.rs","lineNumber":285,"sourceCode":"        while let Some(code) = code_rx.recv().await {\n            match parse_pasted_input(&code) {\n                Ok(result) => {\n                    tracing::debug!(\"OIDC: received code via client paste\");\n                    let _ = client_tx.send(Ok(result)).await;\n                    return;\n                }\n                Err(e) => {\n                    tracing::debug!(error = %e, \"OIDC: invalid client paste input\");\n                }\n            }\n        }\n    };\n\n    drop(tx);\n\n    let result = tokio::select! {\n        r = tokio::time::timeout(AUTH_CALLBACK_TIMEOUT, rx.recv()) => {\n            r.map_err(|_| anyhow::Error::new(OidcError::CallbackTimeout))?\n                .ok_or_else(|| anyhow::Error::new(OidcError::CallbackChannelClosed))?\n        }\n        _ = client_bridge => {\n            rx.recv().await\n                .ok_or_else(|| anyhow::Error::new(OidcError::CallbackChannelClosed))?\n        }\n    };\n\n    let _ = shutdown_tx.send(());\n    let _ = server.await;\n\n    result.map_err(|e| anyhow::Error::new(OidcError::CallbackAuthFailed(e)))\n}\n\n/// Race loopback callback against stdin paste.\nasync fn race_callback_and_stdin(\n    listener: TcpListener,\n    enable_stdin: bool,","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/oidc/login.rs#L267-L303","documentation":"The OIDC loopback login flow waits for the browser/IDP to redirect to the local callback server with an authorization code. This error is thrown by `race_callback_and_client_ui` when the `tokio::time::timeout(AUTH_CALLBACK_TIMEOUT, ...)` wrapper expires (~10 minutes, per AUTH_CALLBACK_TIMEOUT) without any code arriving on the callback channel. It means the user never completed the browser authorization in the allotted window.","triggerScenarios":"tokio::time::timeout(AUTH_CALLBACK_TIMEOUT, rx.recv()) returns Err(Elapsed) while racing the loopback HTTP callback server against the client UI bridge in race_callback_and_client_ui, i.e. rx.recv() did not yield an authorization code within AUTH_CALLBACK_TIMEOUT.","commonSituations":"User opened the authorize URL but never finished login at the IDP; browser tab was closed; corporate SSO page hung; machine was suspended mid-login; user walked away from an interactive `login` command.","solutions":["Re-run the login command and complete the browser authorization promptly (within ~10 minutes).","Verify the redirect_uri (http://127.0.0.1:<port>/callback) was not blocked and the browser actually opened; if not, copy the printed URL manually.","Check IDP availability/SSO latency; if 10 minutes is too short for your SSO flow, increase AUTH_CALLBACK_TIMEOUT and rebuild.","Ensure the loopback port (56121 or ephemeral) is not firewalled so the callback can reach the local server."],"exampleFix":"// before (timeout elapses with default)\nconst AUTH_CALLBACK_TIMEOUT: Duration = Duration::from_secs(600);\n// after: allow more time for slow SSO flows\nconst AUTH_CALLBACK_TIMEOUT: Duration = Duration::from_secs(1800);","handlingStrategy":"try-catch","validationCode":"let cfg = config.oidc.as_ref().ok_or(\"oidc not configured\")?;\n// preflight: check the authorize URL is reachable before starting the flow\nreqwest::get(&format!(\"{}/.well-known/openid-configuration\", cfg.issuer)).await?;","typeGuard":"fn is_callback_timeout(err: &anyhow::Error) -> bool {\n    err.downcast_ref::<OidcError>()\n        .map_or(false, |e| matches!(e, OidcError::CallbackTimeout))\n}","tryCatchPattern":"match run_login_flow(config, auth_manager, channels).await {\n    Ok((auth, created)) => /* ... */,\n    Err(e) if is_callback_timeout(&e) => {\n        eprintln!(\"Login timed out; re-run and complete browser auth within 10 minutes\");\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Run login interactively and start the browser flow when you can finish it immediately","Warn users up front that the login window is ~10 minutes","Avoid suspending the machine mid-login","Keep AUTH_CALLBACK_TIMEOUT generous relative to your SSO latency"],"tags":["oidc","timeout","auth-flow"],"backgroundTag":"oauth-callback-timeout","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}