{"record":{"id":"70ff004596aa97f5","repo":"decolua/9router","slug":"no-authorization-code-received-70ff00","errorCode":null,"errorMessage":"No authorization code received","messagePattern":"No authorization code received","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/services/xai.js","lineNumber":219,"sourceCode":"      await open(authUrl);\n\n      spinner.start(\"Waiting for xAI authorization...\");\n      await new Promise((resolve, reject) => {\n        const timeout = setTimeout(() => reject(new Error(\"Authentication timeout (5 minutes)\")), 300000);\n        const iv = setInterval(() => {\n          if (callbackParams) {\n            clearInterval(iv);\n            clearTimeout(timeout);\n            resolve();\n          }\n        }, 100);\n      });\n      close();\n\n      if (callbackParams.error) {\n        throw new Error(callbackParams.error_description || callbackParams.error);\n      }\n      if (!callbackParams.code) throw new Error(\"No authorization code received\");\n      if (callbackParams.state !== state) throw new Error(\"Invalid state parameter\");\n\n      spinner.start(\"Exchanging code for tokens...\");\n      const tokens = await this.exchangeXaiCode({\n        tokenUrl,\n        code: callbackParams.code,\n        redirectUri,\n        codeVerifier,\n      });\n\n      const email = decodeIdTokenEmail(tokens.id_token);\n      spinner.succeed(\"xAI connected successfully!\");\n      return { tokens, email };\n    } catch (error) {\n      spinner.fail(`Failed: ${error.message}`);\n      throw error;\n    }\n  }","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/lib/oauth/services/xai.js#L201-L237","documentation":"connect() requires the OAuth redirect to carry an authorization `code` query parameter. The callback arrived without one and without an `error`, so there is nothing to exchange for tokens and the flow aborts. This guards against completing a connect() with an empty/redirected callback that cannot yield tokens.","triggerScenarios":"During xaiOAuthService.connect(), the local server receives a callback at the expected path whose query string is missing `code` entirely (callbackParams.code is falsy) while callbackParams.error is also unset.","commonSituations":"User closed the auth flow early or the browser hit the callback URL directly/manually; a proxy or browser extension stripped query parameters; redirect_uri/path mismatch so a page other than the real xAI callback hit the loopback server (e.g. another app bound to the same port answered first); xAI redirected with a fragment or POST body instead of a code query param.","solutions":["Re-run connect() and complete the full browser authorization so xAI redirects back with ?code=...","Check that nothing else (another dev server, a previous run) is occupying the loopback port and answering the callback first","Verify the redirect_uri used in the authorize URL matches what xAI redirects to (same host/port/path)","Open the printed authUrl in a normal browser window without extensions/ad-blockers that strip query strings","Confirm the xAI authorize endpoint is configured to return response_type=code"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Before treating a callback as complete, confirm the code param exists.\nconst params = new URL(callbackUrl).searchParams;\nif (!params.get('code') && !params.get('error')) {\n  console.log('Callback missing authorization code — restart the flow.');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await xai.connect();\n} catch (err) {\n  if (err.message === 'No authorization code received') {\n    // restart the OAuth flow; callback arrived without ?code=\n  } else {\n    throw err;\n  }\n}","preventionTips":["Don't open or refresh the loopback callback URL manually","Ensure the authorize request uses response_type=code","Confirm redirect_uri host/port/path exactly match the local server","Avoid extensions or proxies that strip query strings","Make sure no other process answers the loopback port first"],"tags":["oauth","xai","missing-parameter","callback"],"backgroundTag":"oauth-missing-auth-code","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}