{"record":{"id":"bd9a1749ecc54df1","repo":"medusajs/medusa","slug":"resolveprovisionerror-error-t","errorCode":null,"errorMessage":"resolveProvisionError(error, t)","messagePattern":"resolveProvisionError\\(error, t\\)","errorType":"exception","errorClass":"AuthCallbackError","httpStatus":null,"severity":"error","filePath":"packages/admin/dashboard/src/routes/login/components/sso-login.tsx","lineNumber":235,"sourceCode":"              navigate(\"/login\")\n            }\n          })\n          return\n        }\n\n        if (typeof result === \"object\" && \"verification_required\" in result) {\n          throw new Error(\"Verification required but not implemented yet\")\n        }\n\n        token = result\n      } catch (error) {\n        throw new AuthCallbackError(t(\"auth.login.authenticationFailed\"))\n      }\n\n      try {\n        await ensureUser(token)\n      } catch (error) {\n        throw new AuthCallbackError(resolveProvisionError(error, t))\n      }\n\n      navigate(\"/\")\n    } catch (error) {\n      toast.error(\n        error instanceof AuthCallbackError\n          ? error.message\n          : t(\"auth.login.authenticationFailed\")\n      )\n      // Navigate to /login without the query string, otherwise a failed\n      // callback would get stuck on the spinner. There's no point in keeping the\n      // query string anyway because the callback would just fail again.\n      navigate(\"/login\")\n    }\n\n    setIsPending(false)\n  }, [providerId, searchParams, t, onMfaChallenge, ensureUser, navigate])\n","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/medusajs/medusa/blob/5e06e544a296b9033f20f71f11c559f81a0e5739/packages/admin/dashboard/src/routes/login/components/sso-login.tsx#L217-L253","documentation":"When a user authenticates via SSO in the admin dashboard, a JWT token is exchanged and then used to provision (find or create) the local admin user. If the provisioning step (ensureUser) fails for any reason — expired token, missing invite, invalid role, or a backend rejection — the raw error is passed through resolveProvisionError(error, t) which maps it to a translated, user-friendly message and rethrows it as an AuthCallbackError to be shown as a toast on the login screen.","triggerScenarios":"Completing an SSO/OIDC callback in the admin dashboard where the auth provider returns a token but the subsequent ensureUser(token) call fails: e.g. the token is rejected by the /auth/user/me or user-creation endpoint, the user is not invited/created in Medusa, or the provider token lacks required claims.","commonSituations":"First-time SSO login before an admin invite has been accepted; the identity provider's token expired between redirect and callback; misconfigured auth provider (wrong client id/secret/redirect URI); a user authenticates successfully upstream but is not provisioned as an admin user in Medusa.","solutions":["Check the browser network tab for the failing request following the token exchange (typically a call to /auth/user/me or the user create endpoint) and read its response body for the underlying cause","If the user does not yet exist in Medusa, create an invite (POST /admin/invites) and have the user log in again, or provision the user via the provider first","Verify the auth provider configuration (client ID, secret, redirect/callback URL) in medusa-config and that the token is still valid when the callback fires","Retry the login from the sign-in screen; if it persists, inspect server logs for the exception thrown by ensureUser"],"exampleFix":"// before\ntry {\n  await ensureUser(token)\n} catch (error) {\n  throw new AuthCallbackError(resolveProvisionError(error, t))\n}\n\n// after (ensure the user is invited/provisioned first)\n// POST /admin/invites { email: \"user@example.com\", role: \"member\" }\n// then retry the SSO login so ensureUser(token) succeeds","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"try {\n  await handleCallback()\n} catch (error) {\n  if (error instanceof AuthCallbackError) {\n    // already translated user-facing message from resolveProvisionError\n    toast.error(error.message)\n  } else {\n    toast.error(\"Unexpected error during SSO login\")\n    console.error(error)\n  }\n}","preventionTips":["Ensure admin users are invited (POST /admin/invites) before their first SSO login","Keep the auth provider's client ID/secret and callback URL in sync with medusa-config","Handle the callback promptly so provider tokens don't expire mid-flow"],"tags":["sso","authentication","admin-dashboard","user-provisioning"],"backgroundTag":"sso-login-callback-failed","analyzedSha":"5e06e544a296b9033f20f71f11c559f81a0e5739","analyzedAt":"2026-08-27T07:24:39.599Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}