{"record":{"id":"753e0f7b3c3b1761","repo":"multica-ai/multica","slug":"composio-state-expired","errorCode":null,"errorMessage":"composio: state expired","messagePattern":"composio: state expired","errorType":"http","errorClass":"ErrStateExpired","httpStatus":302,"severity":"error","filePath":"server/internal/integrations/composio/state.go","lineNumber":24,"sourceCode":"\t\"encoding/base64\"\n\t\"encoding/json\"\n\t\"errors\"\n\t\"strings\"\n\t\"time\"\n)\n\n// Signed-state errors. The handler maps all of them to a generic\n// \"connect failed\" redirect so a tampered/expired state never leaks which\n// check failed.\nvar (\n\t// ErrStateMalformed is returned when the state token is not the expected\n\t// \"<payload>.<sig>\" base64url shape.\n\tErrStateMalformed = errors.New(\"composio: state malformed\")\n\t// ErrStateSignature is returned when the HMAC signature does not match —\n\t// the state was tampered with or signed by a different secret.\n\tErrStateSignature = errors.New(\"composio: state signature mismatch\")\n\t// ErrStateExpired is returned when the state's exp claim is in the past.\n\tErrStateExpired = errors.New(\"composio: state expired\")\n)\n\n// stateClaims is the payload embedded in the signed connect-state. It carries\n// exactly what CompleteCallback needs to attribute the callback to a user and\n// toolkit without a server-side session table — the signature is what makes it\n// trustworthy, the short exp is what bounds replay.\n//\n// Field names are single letters to keep the encoded token compact; they are\n// an internal wire format, never exposed to clients.\ntype stateClaims struct {\n\tUserID      string `json:\"u\"`\n\tToolkitSlug string `json:\"t\"`\n\t// AuthConfigID is the exact Composio auth_config_id resolved at BeginConnect\n\t// and used to create the connect link. Signing it into the state lets\n\t// CompleteCallback verify the returned account was created under THIS\n\t// toolkit's auth config without re-resolving (which could fail-open). It is\n\t// an opaque config handle (ac_…), not a credential.\n\tAuthConfigID string `json:\"a\"`","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/internal/integrations/composio/state.go#L6-L42","documentation":"Error \"composio: state expired\" thrown in multica-ai/multica.","triggerScenarios":"Thrown at server/internal/integrations/composio/state.go:24 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restart the OAuth flow; the state token has expired."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}