{"record":{"id":"99d97b231447bf55","repo":"Kuberwastaken/claurst","slug":"oauth-callback-did-not-contain-an-authorization-co","errorCode":null,"errorMessage":"OAuth callback did not contain an authorization code","messagePattern":"OAuth callback did not contain an authorization code","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src-rust/crates/mcp/src/oauth.rs","lineNumber":299,"sourceCode":"            parsed_url.path()\n        );\n    }\n\n    if let Some(expected_state) = expected_state {\n        let received_state = parsed_url\n            .query_pairs()\n            .find(|(key, _)| key == \"state\")\n            .map(|(_, value)| value.to_string());\n        if received_state.as_deref() != Some(expected_state) {\n            anyhow::bail!(\"OAuth state mismatch — possible CSRF attack\");\n        }\n    }\n\n    parsed_url\n        .query_pairs()\n        .find(|(key, _)| key == \"code\")\n        .map(|(_, value)| value.to_string())\n        .ok_or_else(|| anyhow::anyhow!(\"OAuth callback did not contain an authorization code\"))\n}\n\npub async fn run_mcp_auth_session(session: McpAuthSession) -> anyhow::Result<McpAuthResult> {\n    let (listener, host, callback_path) = bind_callback_listener(&session.redirect_uri).await?;\n    open::that(&session.auth_url)\n        .map_err(|e| anyhow::anyhow!(\"Failed to open browser for OAuth: {}\", e))?;\n\n    let code = wait_for_authorization_code(listener, &host, &callback_path, None).await?;\n    let mut token = exchange_code(\n        &session.metadata.token_endpoint,\n        &code,\n        &session.verifier,\n        &session.redirect_uri,\n    )\n    .await?;\n    token.server_name = session.server_name.clone();\n    store_mcp_token(&token).map_err(|e| {\n        anyhow::anyhow!(","sourceCodeStart":281,"sourceCodeEnd":317,"githubUrl":"https://github.com/Kuberwastaken/claurst/blob/b0637c97ec34144387cbf2f74f65df6d16a6cef1/src-rust/crates/mcp/src/oauth.rs#L281-L317","documentation":"The OAuth callback request arrived and matched the expected path, but its query string contained no `code` parameter. This means the authorization server redirected back without granting a code — typically the user denied consent or the server reported an error (e.g. `error=access_denied`) in the query string instead.","triggerScenarios":"Thrown at src-rust/crates/mcp/src/oauth.rs:299 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Retry the authentication flow and approve the consent prompt in the browser","Check the callback URL query string for an `error` parameter from the authorization server","Verify the MCP server's OAuth client is correctly registered with the authorization server"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b0637c97ec34144387cbf2f74f65df6d16a6cef1","analyzedAt":"2026-09-10T00:24:58.650Z","contentChangedAt":"2026-09-10T00:24:58.650Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}