Marc-André Bombeck 192b6593a4 fix(oauth): claim a signed callback only once its code can be exchanged ...

The signed-state callbacks (Oura, Polar, Strava) claimed the state before
the session, code and issuer checks. A denied consent comes back without a
code, so it spent the claim on a `nocode` error page, and allowing on the
same authorize URL afterwards never exchanged the valid code: the browser
was sent to the stored error page instead. Every check that refuses a
callback without touching the code now runs first; the claim still sits
strictly before the exchange.

Expired claims were swept only when a callback completed, so a quiet
instance kept its last rows. The daily OAuth-state cleanup at 03:20 now
sweeps them as well.

2026-10-21 01:17:20 +02:00

..

__tests__

style: apply prettier across the tree

2026-06-19 22:20:31 +02:00

callback-claim.ts

fix(oauth): claim a signed callback only once its code can be exchanged

2026-10-21 01:17:20 +02:00

signed-state.ts

fix(oura): request the stress scope and exchange a repeated callback once

2026-10-21 00:05:22 +02:00