{"record":{"id":"a366228532530109","repo":"decolua/9router","slug":"no-authorization-code-received-a36622","errorCode":null,"errorMessage":"No authorization code received","messagePattern":"No authorization code received","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/lib/oauth/services/oauth.js","lineNumber":76,"sourceCode":"\n          const checkInterval = setInterval(() => {\n            if (callbackParams) {\n              clearInterval(checkInterval);\n              clearTimeout(timeout);\n              resolve();\n            }\n          }, 100);\n        });\n\n        spinner.stop();\n        close();\n\n        if (callbackParams.error) {\n          throw new Error(callbackParams.error_description || callbackParams.error);\n        }\n\n        if (!callbackParams.code) {\n          throw new Error(\"No authorization code received\");\n        }\n\n        return callbackParams;\n      },\n    };\n  }\n\n  /**\n   * Exchange authorization code for tokens\n   */\n  async exchangeCode(code, redirectUri, codeVerifier, contentType = \"application/x-www-form-urlencoded\") {\n    const body =\n      contentType === \"application/json\"\n        ? JSON.stringify({\n            grant_type: \"authorization_code\",\n            client_id: this.config.clientId,\n            code: code,\n            redirect_uri: redirectUri,","sourceCodeStart":58,"sourceCodeEnd":94,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/lib/oauth/services/oauth.js#L58-L94","documentation":"Thrown by the local callback server's waitForCallback() after the browser redirect lands but the callback query params contain no `code`. The generic OAuthService expects every authorization-code flow redirect to carry `?code=...`; if the provider returned params without a code (and without an `error` param, which is checked first), the flow cannot continue to the token exchange. It signals a malformed or unexpected callback rather than an explicit provider-declared failure.","triggerScenarios":"startAuthFlow() -> waitForCallback(): the local server receives a GET whose query params pass the `!callbackParams.error` check but lack `code` — e.g. the provider redirected with a different param name, or the user pasted a truncated/partial callback URL, or the provider redirected to `/callback` with only `state`/`session_state` after a silent re-auth.","commonSituations":"Provider changed its redirect contract (extra params, renamed code param); user manually copy-pasted only part of the redirect URL into the browser; an identity provider did a soft redirect back with session cookies but no new code; corporate proxies stripping query strings from localhost redirects.","solutions":["Re-run the auth flow and complete the full browser login; make sure you don't stop at an intermediate redirect page.","Check the provider's docs/console for the exact redirect behavior and whether it uses a param other than `code`; add it to extraParams or map it in the callback handler.","If pasting the URL manually, copy the entire redirect URL including all query parameters from the address bar.","Log the full callbackParams before this throw to see exactly which params the provider sent."],"exampleFix":"// before (diagnosing)\nif (!callbackParams.code) {\n  throw new Error(\"No authorization code received\");\n}\n// after (log what actually arrived)\nif (!callbackParams.code) {\n  throw new Error(`No authorization code received; got params: ${JSON.stringify(Object.keys(callbackParams))}`);\n}","handlingStrategy":"validation","validationCode":"// Before starting the flow, know what a valid callback looks like; after redirect, inspect params yourself:\nconst url = new URL(redirectRequestUrl);\nif (!url.searchParams.get(\"code\")) {\n  console.error(\"Callback missing code; params:\", Object.fromEntries(url.searchParams));\n  // surface provider error if present instead of proceeding\n}","typeGuard":"function hasAuthorizationCode(params) {\n  return params != null && typeof params === \"object\" && typeof params.code === \"string\" && params.code.length > 0;\n}","tryCatchPattern":"try {\n  const params = await flow.waitForCallback();\n} catch (err) {\n  if (err.message === \"No authorization code received\") {\n    // restart the flow with a fresh state/PKCE pair\n  } else throw err;\n}","preventionTips":["Always complete the browser login fully; don't stop at intermediate SSO redirect pages.","If pasting a callback URL manually, copy the entire URL with all query parameters.","Log callback query params when debugging a provider whose redirect contract changed.","Keep the CLI updated against provider OAuth contract changes."],"tags":["oauth","authorization-code","callback","cli"],"backgroundTag":"oauth-missing-authorization-code","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}