{"record":{"id":"ba09cc581d9d1273","repo":"decolua/9router","slug":"url-searchparams-get-error-description-error-ba09cc","errorCode":null,"errorMessage":"url.searchParams.get(\"error_description\") || errorParam","messagePattern":"url\\.searchParams\\.get\\(\"error_description\"\\) \\|\\| errorParam","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/shared/components/KiroSocialOAuthModal.js","lineNumber":78,"sourceCode":"  const handleManualSubmit = async () => {\n    try {\n      setError(null);\n      \n      // Parse callback URL - can be either kiro:// or http://localhost format\n      let url;\n      try {\n        url = new URL(callbackUrl);\n      } catch (e) {\n        // If URL parsing fails, might be malformed\n        throw new Error(\"Invalid callback URL format\");\n      }\n\n      const code = url.searchParams.get(\"code\");\n      const state = url.searchParams.get(\"state\");\n      const errorParam = url.searchParams.get(\"error\");\n\n      if (errorParam) {\n        throw new Error(url.searchParams.get(\"error_description\") || errorParam);\n      }\n\n      if (!code) {\n        throw new Error(\"No authorization code found in URL\");\n      }\n\n      // Exchange code for tokens\n      const res = await fetch(\"/api/oauth/kiro/social-exchange\", {\n        method: \"POST\",\n        headers: { \"Content-Type\": \"application/json\" },\n        body: JSON.stringify({\n          code,\n          codeVerifier: authData.codeVerifier,\n          provider,\n        }),\n      });\n\n      const data = await res.json();","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/decolua/9router/blob/90b52e06ffd666b7929554211474d01588f6b1f8/src/shared/components/KiroSocialOAuthModal.js#L60-L96","documentation":"After parsing the pasted callback URL, handleManualSubmit checks for an `error` query parameter; if the OAuth provider redirected back with an error (e.g. access_denied), the modal throws an Error whose message is the `error_description` param when present, otherwise the bare `error` code. This is the provider's own OAuth error being surfaced to the user rather than a client-side bug.","triggerScenarios":"The URL pasted into the manual callback input contains `?...&error=<code>` (optionally `&error_description=...`) — i.e. the Kiro social IdP redirected to the callback with an OAuth error instead of a code: user denied consent, scopes rejected, redirect_uri mismatch, or IdP-side failure.","commonSituations":"User clicked 'Cancel'/'Deny' on the provider consent screen; the app's registered redirect URI doesn't match so the IdP returns redirect_uri_mismatch; the account lacks required scopes; provider outage surfaces as server_error in the callback.","solutions":["Read the thrown message: it is the provider's error_description — address what it says (e.g. access_denied → approve consent; redirect_uri_mismatch → fix registered redirect URI).","Restart the flow with initAuth to get a fresh authorization URL and retry the consent screen.","If redirect_uri_mismatch, verify the callback URL registered with the provider matches exactly (scheme, host, port, path).","Check requested scopes against what the account/tenant permits."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// inspect the URL before submitting\nconst u = new URL(callbackUrl.trim());\nif (u.searchParams.has(\"error\")) {\n  setError(`Provider returned: ${u.searchParams.get(\"error_description\") || u.searchParams.get(\"error\")} — restart the auth flow`);\n  return;\n}","typeGuard":null,"tryCatchPattern":"try {\n  await handleManualSubmit(callbackUrl);\n} catch (err) {\n  if (err.message.includes(\"access_denied\")) {\n    setError(\"You denied the consent request. Restart sign-in and approve.\");\n  } else {\n    setError(err.message); // provider error_description surfaced verbatim\n  }\n}","preventionTips":["Approve the provider consent screen instead of cancelling.","Keep the registered redirect_uri in sync with the app config to avoid redirect_uri_mismatch.","Restart the flow whenever an OAuth error redirect appears — error redirects are terminal.","Check org/SSO policies if denial happens without user action."],"tags":["oauth","access-denied","kiro","callback"],"backgroundTag":"oauth-error-callback","analyzedSha":"90b52e06ffd666b7929554211474d01588f6b1f8","analyzedAt":"2026-08-30T21:05:45.952Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}