{"record":{"id":"e7a445914e78c033","repo":"Hmbown/CodeWhale","slug":"xai-oidc-discovery-issuer-does-not-match-the-reque","errorCode":null,"errorMessage":"xAI OIDC discovery issuer does not match the requested issuer","messagePattern":"xAI OIDC discovery issuer does not match the requested issuer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/xai_oauth.rs","lineNumber":1063,"sourceCode":"            \"device_authorization_endpoint\",\n            issuer,\n        )?,\n        token_endpoint: validate_discovered_oauth_endpoint(\n            discovery.token_endpoint,\n            \"token_endpoint\",\n            issuer,\n        )?,\n    })\n}\n\nfn validate_discovered_issuer(discovered: Option<String>, expected: &str) -> Result<()> {\n    let discovered = discovered\n        .as_deref()\n        .map(str::trim)\n        .filter(|issuer| !issuer.is_empty())\n        .context(\"xAI OIDC discovery missing issuer\")?;\n    if discovered.trim_end_matches('/') != expected.trim_end_matches('/') {\n        bail!(\"xAI OIDC discovery issuer does not match the requested issuer\");\n    }\n    Ok(())\n}\n\nfn validate_discovered_oauth_endpoint(\n    endpoint: Option<String>,\n    field: &str,\n    issuer: &str,\n) -> Result<String> {\n    let endpoint = endpoint\n        .as_deref()\n        .map(str::trim)\n        .filter(|endpoint| !endpoint.is_empty())\n        .with_context(|| format!(\"xAI OIDC discovery missing {field}\"))?;\n    let parsed = reqwest::Url::parse(endpoint)\n        .with_context(|| format!(\"xAI OIDC discovery returned an invalid {field}\"))?;\n    if !matches!(parsed.scheme(), \"http\" | \"https\") {\n        bail!(\"xAI OIDC discovery returned unsupported {field} scheme\");","sourceCodeStart":1045,"sourceCodeEnd":1081,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/xai_oauth.rs#L1045-L1081","documentation":"Thrown by validate_discovered_issuer when the issuer field returned by xAI's OIDC discovery document, after trimming whitespace and trailing slashes, differs from the issuer the client requested. This is a trust check: discovery responses are untrusted network data, and an issuer mismatch means the document may belong to (or have been substituted for) a different authority than the one authentication is intended for.","triggerScenarios":"Thrown at crates/tui/src/xai_oauth.rs:1063 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the configured xAI issuer URL is correct and has no stray trailing slash, path, or typo","Check network/DNS for interception (corporate proxy, /etc/hosts) that could serve a different discovery document","Retry login; if the mismatch persists, capture the discovery document and confirm its issuer with xAI support","Fall back to XAI_API_KEY authentication instead of OAuth"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}