{"record":{"id":"ed26e75579f9c12e","repo":"sipeed/picoclaw","slug":"no-code-received-s","errorCode":null,"errorMessage":"no code received: %s","messagePattern":"no code received: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/oauth.go","lineNumber":203,"sourceCode":"}\n\nfunc oauthCallbackRedirectURI(port int) string {\n\treturn fmt.Sprintf(\"http://localhost:%d/auth/callback\", port)\n}\n\nfunc oauthCallbackHandler(state string, resultCh chan<- callbackResult) http.Handler {\n\tmux := http.NewServeMux()\n\tmux.HandleFunc(\"/auth/callback\", func(w http.ResponseWriter, r *http.Request) {\n\t\tif r.URL.Query().Get(\"state\") != state {\n\t\t\tresultCh <- callbackResult{err: fmt.Errorf(\"state mismatch\")}\n\t\t\thttp.Error(w, \"State mismatch\", http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\n\t\tcode := r.URL.Query().Get(\"code\")\n\t\tif code == \"\" {\n\t\t\terrMsg := r.URL.Query().Get(\"error\")\n\t\t\tresultCh <- callbackResult{err: fmt.Errorf(\"no code received: %s\", errMsg)}\n\t\t\thttp.Error(w, \"No authorization code received\", http.StatusBadRequest)\n\t\t\treturn\n\t\t}\n\n\t\tw.Header().Set(\"Content-Type\", \"text/html\")\n\t\tfmt.Fprint(w, \"

Authentication successful!

You can close this window.

\")\n\t\tresultCh <- callbackResult{code: code}\n\t})\n\treturn mux\n}\n\nfunc listenOAuthCallback(port int) (net.Listener, int, error) {\n\tlistener, err := net.Listen(\"tcp\", fmt.Sprintf(\"127.0.0.1:%d\", port))\n\tif err != nil {\n\t\treturn nil, 0, err\n\t}\n\n\ttcpAddr, ok := listener.Addr().(*net.TCPAddr)","sourceCodeStart":185,"sourceCodeEnd":221,"githubUrl":"https://github.com/sipeed/picoclaw/blob/49183d7e8daed0dba89ddbb6fcb60089401d9680/pkg/auth/oauth.go#L185-L221","documentation":"The provider redirected to the callback with no code but an error parameter (oauth.go:203); the provider's error text is appended to the message. The user-visible causes are consent denial (access_denied), the app not being approved/published for the account, or the account lacking access to the requested scopes.","triggerScenarios":"User clicks 'Deny'/'Cancel' on the consent screen; OAuth client in testing mode used by users outside the allow-list; admin-disabled app; requested scopes exceeding what the account may grant (admin_consent required).","commonSituations":"Google OAuth client in 'Testing' status with the user not added as a test user; workspace admin blocking third-party apps; user hitting 'cancel' accidentally.","solutions":["Read the appended error text: access_denied means the user/admin declined — approve the app or grant consent","For Google clients in testing mode, add the user as a test user (or publish the app)","Verify client_id matches the one registered with the provider","Re-run the login and complete consent fully"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"no code received\") {\n if strings.Contains(err.Error(), \"access_denied\") {\n fmt.Println(\"consent was denied — approve the app (or add the user as test user) and retry\")\n } else {\n fmt.Printf(\"provider rejected login: %v\\n\", err)\n }\n return err\n}","preventionTips":["For Google clients in testing mode, add users to the test-user list","Verify client_id matches the registered OAuth app","Surface the provider's error text to the user instead of generic failures"],"tags":["oauth","consent","http","login","google"],"backgroundTag":null,"analyzedSha":"49183d7e8daed0dba89ddbb6fcb60089401d9680","analyzedAt":"2026-08-15T21:55:41.315Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}