decolua/9router · error · Error

url.searchParams.get("error_description") || errorParam

Error message

url.searchParams.get("error_description") || errorParam

What it means

After parsing the pasted callback URL, handleManualSubmit checks for an `error` query parameter; if the OAuth provider redirected back with an error (e.g. access_denied), the modal throws an Error whose message is the `error_description` param when present, otherwise the bare `error` code. This is the provider's own OAuth error being surfaced to the user rather than a client-side bug.

Source

Thrown at src/shared/components/KiroSocialOAuthModal.js:78

  const handleManualSubmit = async () => {
    try {
      setError(null);
      
      // Parse callback URL - can be either kiro:// or http://localhost format
      let url;
      try {
        url = new URL(callbackUrl);
      } catch (e) {
        // If URL parsing fails, might be malformed
        throw new Error("Invalid callback URL format");
      }

      const code = url.searchParams.get("code");
      const state = url.searchParams.get("state");
      const errorParam = url.searchParams.get("error");

      if (errorParam) {
        throw new Error(url.searchParams.get("error_description") || errorParam);
      }

      if (!code) {
        throw new Error("No authorization code found in URL");
      }

      // Exchange code for tokens
      const res = await fetch("/api/oauth/kiro/social-exchange", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
          code,
          codeVerifier: authData.codeVerifier,
          provider,
        }),
      });

      const data = await res.json();

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Read the thrown message: it is the provider's error_description — address what it says (e.g. access_denied → approve consent; redirect_uri_mismatch → fix registered redirect URI).
2. Restart the flow with initAuth to get a fresh authorization URL and retry the consent screen.
3. If redirect_uri_mismatch, verify the callback URL registered with the provider matches exactly (scheme, host, port, path).
4. Check requested scopes against what the account/tenant permits.

// inspect the URL before submitting
const u = new URL(callbackUrl.trim());
if (u.searchParams.has("error")) {
  setError(`Provider returned: ${u.searchParams.get("error_description") || u.searchParams.get("error")} — restart the auth flow`);
  return;
}

try {
  await handleManualSubmit(callbackUrl);
} catch (err) {
  if (err.message.includes("access_denied")) {
    setError("You denied the consent request. Restart sign-in and approve.");
  } else {
    setError(err.message); // provider error_description surfaced verbatim
  }
}

When it happens

Trigger: The URL pasted into the manual callback input contains `?...&error=<code>` (optionally `&error_description=...`) — i.e. the Kiro social IdP redirected to the callback with an OAuth error instead of a code: user denied consent, scopes rejected, redirect_uri mismatch, or IdP-side failure.

Common situations: User clicked 'Cancel'/'Deny' on the provider consent screen; the app's registered redirect URI doesn't match so the IdP returns redirect_uri_mismatch; the account lacks required scopes; provider outage surfaces as server_error in the callback.

Related errors

• No authorization code found in URL
• scope is required for external_idp refresh
• No authorization code received
• No authorization code received
• No authorization code received

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/ba09cc581d9d1273. Report an issue: GitHub.