{"record":{"id":"30251f20f79da7fa","repo":"Hmbown/CodeWhale","slug":"xai-oidc-discovery-returned-unsupported-field-sc","errorCode":null,"errorMessage":"xAI OIDC discovery returned unsupported {field} scheme","messagePattern":"xAI OIDC discovery returned unsupported (.+?) scheme","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/xai_oauth.rs","lineNumber":1081,"sourceCode":"        bail!(\"xAI OIDC discovery issuer does not match the requested issuer\");\n    }\n    Ok(())\n}\n\nfn validate_discovered_oauth_endpoint(\n    endpoint: Option<String>,\n    field: &str,\n    issuer: &str,\n) -> Result<String> {\n    let endpoint = endpoint\n        .as_deref()\n        .map(str::trim)\n        .filter(|endpoint| !endpoint.is_empty())\n        .with_context(|| format!(\"xAI OIDC discovery missing {field}\"))?;\n    let parsed = reqwest::Url::parse(endpoint)\n        .with_context(|| format!(\"xAI OIDC discovery returned an invalid {field}\"))?;\n    if !matches!(parsed.scheme(), \"http\" | \"https\") {\n        bail!(\"xAI OIDC discovery returned unsupported {field} scheme\");\n    }\n    let issuer = reqwest::Url::parse(issuer).context(\"xAI OIDC issuer is not a valid URL\")?;\n    if issuer.scheme() == \"https\" && parsed.scheme() != \"https\" {\n        bail!(\"xAI OIDC discovery attempted to downgrade {field} from HTTPS\");\n    }\n    if !parsed.username().is_empty() || parsed.password().is_some() {\n        bail!(\"xAI OIDC discovery returned credentials in {field}\");\n    }\n    if parsed.origin() != issuer.origin() {\n        bail!(\"xAI OIDC discovery returned {field} on a different origin than the issuer\");\n    }\n    Ok(endpoint.to_string())\n}\n\nfn parse_oauth_json_response<T: DeserializeOwned>(\n    response: reqwest::blocking::Response,\n    operation: &str,\n) -> Result<(reqwest::StatusCode, T)> {","sourceCodeStart":1063,"sourceCodeEnd":1099,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/xai_oauth.rs#L1063-L1099","documentation":"Guard inside validate_discovered_oauth_endpoint: after parsing a discovered endpoint (e.g. token_endpoint or device_authorization_endpoint), its URL scheme must be http or https. Any other scheme (ftp:, file:, data:, javascript:, etc.) is rejected because the endpoint would be unusable for OAuth HTTP traffic or could smuggle non-HTTP semantics. The named {field} in the discovery document is the faulty input.","triggerScenarios":"Thrown at crates/tui/src/xai_oauth.rs:1081 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry discovery to rule out a transient corrupted response","Inspect the xAI discovery document and confirm the listed endpoints use https URLs","Check for proxies or middleboxes that could rewrite the discovery response; bypass them and retry","If xAI genuinely advertises a bad endpoint, report it and use XAI_API_KEY in the meantime"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}