{"record":{"id":"d38e6b9b5681410c","repo":"QuantumNous/new-api","slug":"missing-code","errorCode":null,"errorMessage":"Missing code","messagePattern":"Missing code","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"web/src/features/profile/components/tabs/account-bindings-tab.tsx","lineNumber":241,"sourceCode":"      const message = event.data as Partial<OAuthBindingCallback> | null\n      const pending = pendingOAuthBinding.current\n      if (\n        !message ||\n        message.type !== OAUTH_BIND_CALLBACK_MESSAGE ||\n        !pending ||\n        message.provider !== pending.provider ||\n        message.state !== pending.state ||\n        event.source !== pending.popup\n      ) {\n        return\n      }\n\n      clearPendingOAuthBinding(pending)\n      let success = false\n      let resultMessage = t('OAuth failed')\n      try {\n        if (!message.code && !message.error) {\n          throw new Error(t('Missing code'))\n        }\n        const params: Record<string, string> = { state: message.state }\n        if (message.code) params.code = message.code\n        if (message.error) params.error = message.error\n        if (message.errorDescription) {\n          params.error_description = message.errorDescription\n        }\n        const response = await api.get(`/api/oauth/${message.provider}`, {\n          params,\n          skipBusinessError: true,\n        })\n        success = Boolean(response.data?.success)\n        resultMessage = response.data?.message || resultMessage\n        if (success) {\n          toast.success(t('Binding successful!'))\n          onUpdate()\n          await fetchCustomBindings()\n        } else {","sourceCodeStart":223,"sourceCodeEnd":259,"githubUrl":"https://github.com/QuantumNous/new-api/blob/e2c7aa7b102c2075eae2377df3508658d45e88dc/web/src/features/profile/components/tabs/account-bindings-tab.tsx#L223-L259","documentation":"Thrown in the OAuth account-binding popup message handler when a postMessage from the provider popup contains neither code nor error. The handler has already matched provider, state, and window.source against the stored pending binding, so this is a well-formed OAuth redirect callback that simply lacks both payload fields.","triggerScenarios":"Provider redirects back with only state (e.g. user closed an intermediate consent step, provider SPA bug), popup posts an initial handshake message without code/error that happens to match state, provider returns an empty success redirect, or a misconfigured callback URL drops the query string.","commonSituations":"OAuth app callback URL misconfigured so authorization code is lost; provider-side changes to the redirect format; popup blockers or browser privacy extensions stripping query params; third-party provider (Discord/GitHub/OIDC) returning an unusual response.","solutions":["In the popup's final URL, verify the query string contains code or error; if not, fix the OAuth app's callback/redirect URI configuration.","Confirm the backend OAuth URL builder appends the correct redirect_uri and that state round-trips with the code attached.","Check provider docs for changed response modes (query vs form_post); form_post payloads will not arrive via query params.","Test with the provider's default flow in a clean browser profile to rule out extensions stripping params."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// before acting on any postMessage, require a usable payload\nfunction isUsableOAuthMessage(message: unknown): boolean {\n  if (typeof message !== 'object' || message === null) return false\n  const m = message as Record<string, unknown>\n  return typeof m.code === 'string' && m.code.length > 0 ||\n         typeof m.error === 'string' && m.error.length > 0\n}\n// in the handler:\nif (!isUsableOAuthMessage(message)) { /* ignore or show provider error */ return }","typeGuard":"function isOAuthCallbackMessage(m: unknown): m is { code?: string; error?: string; errorDescription?: string; state: string; provider: string } {\n  if (typeof m !== 'object' || m === null) return false\n  const o = m as Record<string, unknown>\n  return typeof o.state === 'string' && typeof o.provider === 'string' &&\n    (typeof o.code === 'undefined' || typeof o.code === 'string') &&\n    (typeof o.error === 'undefined' || typeof o.error === 'string')\n}","tryCatchPattern":null,"preventionTips":["Always verify event.origin against the expected popup origin before reading message fields.","Match state/provider/source (already done) AND require code or error before consuming the message.","Set an explicit redirect_uri in the OAuth authorize URL and test the popup's final URL contains the expected query params."],"tags":["oauth","popup","postmessage","account-binding"],"backgroundTag":null,"analyzedSha":"e2c7aa7b102c2075eae2377df3508658d45e88dc","analyzedAt":"2026-08-15T10:35:18.111Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}