{"record":{"id":"9255640d66ae9565","repo":"vxcontrol/pentagi","slug":"notpermitted","errorCode":"NotPermitted","errorMessage":"provider not initialized","messagePattern":"provider not initialized","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"backend/pkg/server/services/auth.go","lineNumber":273,"sourceCode":"\t}\n\n\tqueryReturnURI := c.Query(\"return_uri\")\n\tif queryReturnURI != \"\" {\n\t\treturnURL, err := url.Parse(queryReturnURI)\n\t\tif err != nil {\n\t\t\tlogger.FromContext(c).WithError(err).Errorf(\"failed to parse return url argument '%s'\", queryReturnURI)\n\t\t\tresponse.Error(c, response.ErrAuthInvalidAuthorizeQuery, err)\n\t\t\treturn\n\t\t}\n\t\treturnURL.Path = path.Clean(path.Join(\"/\", returnURL.Path))\n\t\tstateData[\"return_uri\"] = returnURL.RequestURI()\n\t}\n\n\tprovider := c.Query(\"provider\")\n\toauthClient, ok := s.oauth[provider]\n\tif !ok {\n\t\tlogger.FromContext(c).Errorf(\"external OAuth2 provider '%s' is not initialized\", provider)\n\t\terr := fmt.Errorf(\"provider not initialized\")\n\t\tresponse.Error(c, response.ErrNotPermitted, err)\n\t\treturn\n\t}\n\tstateData[\"provider\"] = provider\n\n\tstateUniq, err := randBase64String(16)\n\tif err != nil {\n\t\tlogger.FromContext(c).WithError(err).Errorf(\"failed to generate state random data\")\n\t\tresponse.Error(c, response.ErrInternal, err)\n\t\treturn\n\t}\n\tstateData[\"uniq\"] = stateUniq\n\n\tnonce, err := randBase64String(16)\n\tif err != nil {\n\t\tlogger.FromContext(c).WithError(err).Errorf(\"failed to generate nonce random data\")\n\t\tresponse.Error(c, response.ErrInternal, err)\n\t\treturn","sourceCodeStart":255,"sourceCodeEnd":291,"githubUrl":"https://github.com/vxcontrol/pentagi/blob/ea665308baaff015b226f308438a68d929d0f29b/backend/pkg/server/services/auth.go#L255-L291","documentation":"AuthAuthorize looks up the OAuth2 client for the ?provider= query parameter in the server's initialized oauth map; if no client is registered under that name it responds with ErrNotPermitted and 'provider not initialized'. Providers are only registered at startup when their credentials (client ID/secret) are configured, so an unknown or unconfigured provider name fails here before any redirect happens.","triggerScenarios":"GET /auth/authorize?provider=<name> where <name> is misspelled, not one of google/github, or the provider is valid but its env credentials were not set so the client was never constructed at startup.","commonSituations":"Frontend link with a wrong provider slug; OAUTH_(GOOGLE|GITHUB)_CLIENT_ID/SECRET missing from .env so the provider is disabled; switching provider names after a rename; docker-compose not passing the OAuth env vars through.","solutions":["Check the provider query value is exactly an initialized one (e.g. 'google', 'github').","Set the provider's client ID/secret env vars (see pkg/config/config.go) and restart the backend so the client registers.","If using docker-compose, ensure the OAuth env vars are declared in the compose file / .env and actually reach the container.","Log the available provider keys at startup and compare against the incoming value.","Guard the frontend login buttons to only render providers that the backend advertises as enabled."],"exampleFix":"// before\nGET /auth/authorize?provider=Google   // case/name mismatch\n// after\nGET /auth/authorize?provider=google   // exact registered provider key","handlingStrategy":"validation","validationCode":"// verify the provider is configured before linking the login button (server exposes enabled providers)\nfunc providerEnabled(cfg *config.Config, name string) bool {\n    switch name {\n    case \"google\":\n        return cfg.OAuthGoogleClientID != \"\" && cfg.OAuthGoogleClientSecret != \"\"\n    case \"github\":\n        return cfg.OAuthGithubClientID != \"\" && cfg.OAuthGithubClientSecret != \"\"\n    }\n    return false\n}","typeGuard":"func isKnownProvider(name string) bool {\n    return name == \"google\" || name == \"github\"\n}","tryCatchPattern":"_, err := client.Authorize(ctx, \"google\")\nvar respErr *response.Error\nif errors.As(err, &respErr) && respErr.Code == response.ErrNotPermitted {\n    return fmt.Errorf(\"provider not enabled on this deployment; set its OAUTH client credentials\")\n}\nif err != nil { return err }","preventionTips":["Use exact lowercase provider names in /auth/authorize links","Set client ID/secret env vars for every provider you expose in the UI","Pass OAuth env vars through docker-compose/.env to the container","Only render login buttons for providers the backend advertises as enabled"],"tags":["oauth","configuration","authentication","env"],"backgroundTag":"oauth-provider-not-configured","analyzedSha":"ea665308baaff015b226f308438a68d929d0f29b","analyzedAt":"2026-09-01T14:16:31.421Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}