{"record":{"id":"5e7afbedaa1d06a9","repo":"toeverything/AFFiNE","slug":"unknown-oauth-provider-5e7afb","errorCode":"unknown_oauth_provider","errorMessage":"Unknown authentication provider ${name}.","messagePattern":"Unknown authentication provider (.+?)\\.","errorType":"exception","errorClass":"UnknownOauthProvider","httpStatus":400,"severity":"error","filePath":"packages/backend/server/src/plugins/oauth/service.ts","lineNumber":125,"sourceCode":"      state.client !== 'web'\n    ) {\n      return {\n        type: 'handoff',\n        code: input.code,\n        provider: rawState.provider,\n        state,\n        stateToken: stateStr,\n      };\n    }\n\n    if (!state.provider) {\n      throw new MissingOauthQueryParameter({ name: 'provider' });\n    }\n\n    const provider = this.providerFactory.get(state.provider);\n\n    if (!provider) {\n      throw new UnknownOauthProvider({ name: state.provider ?? 'unknown' });\n    }\n\n    if (\n      state.provider !== OAuthProviderName.Apple &&\n      (!input.clientNonce ||\n        !state.clientNonce ||\n        state.clientNonce !== input.clientNonce)\n    ) {\n      throw new InvalidAuthState();\n    }\n\n    return {\n      type: 'identity',\n      identity: await this.verifyCallbackIdentity(\n        input.code,\n        state,\n        stateStr,\n        input.rawBody","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/b4c8548c09da21b2898443559a5b846f0ccf5dd8/packages/backend/server/src/plugins/oauth/service.ts#L107-L143","documentation":"UnknownOauthProvider thrown at packages/backend/server/src/plugins/oauth/service.ts:125 when the state record names a provider that OAuthProviderFactory.get() cannot find. Providers register themselves at startup only when their config is valid (e.g. the OIDC provider registers after successful discovery), so the lookup fails when the provider disappeared between preflight and callback or was never configured.","triggerScenarios":"User starts OIDC login, the server restarts with oauth.providers.oidc.* env/config removed or invalid (discovery failed, so the provider is unregistered), then the callback arrives; state saved under a provider name string that no longer matches a registered enum; config hot-reload disabling the provider mid-flow.","commonSituations":"Self-hoster changes OAUTH env vars or rotates to a config where the issuer is unreachable (OIDC discovery validation failed and retried, leaving the provider unregistered); typo in provider name in a custom preflight call; mixed-version rolling deploy where a node lacks the provider.","solutions":["Check server startup logs for 'OAuth provider [oidc] registered.' or discovery validation errors ('Failed to validate OIDC configuration').","Restore/fix the provider config (oauth.providers.oidc.clientId/clientSecret/issuer) and restart.","If discovery is failing due to a private-network issuer, set allowPrivateNetwork: true for the issuer origin.","Have the user restart the login flow after the provider is registered again."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Pre-flight the provider before the user starts login\nconst provider = providerFactory.get(stateProviderName);\nif (!provider) {\n  throw new Error(`Provider ${stateProviderName} not registered - check startup config`);\n}","typeGuard":null,"tryCatchPattern":"try {\n  await oauth.verifyCallback(input);\n} catch (err) {\n  if (err instanceof UnknownOauthProvider) {\n    // provider unregistered since login started: check config/startup logs, then restart flow\n  }\n}","preventionTips":["Verify 'OAuth provider [x] registered.' appears in startup logs before exposing login.","Keep OAuth env/config stable across restarts that may straddle a user's login.","Monitor OIDC discovery health so a failing issuer is caught before users hit callbacks."],"tags":["oauth","provider","configuration","startup"],"backgroundTag":"oauth-provider-not-configured","analyzedSha":"b4c8548c09da21b2898443559a5b846f0ccf5dd8","analyzedAt":"2026-08-18T21:16:52.546Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}