2 Commits

Author	SHA1	Message	Date
can1357	8a17eb1216	fix(ai): surface state-authenticated provider denials instead of timing out ... An error redirect carrying the expected state nonce comes from the genuine authorization flow (e.g. the user denied the consent screen); leaving it unsettled stalled loopback logins for the full 5-minute timeout. Reject the callback promise for those, while still ignoring forgeable errors without the expected state (#4106).	2026-07-23 22:15:22 +02:00
roboomp	6835325085	fix(ai): prevented invalid callbacks from aborting oauth ... Kept the callback promise pending after malformed, denied, or state-mismatched requests so a legitimate browser redirect can still complete login. Bound localhost callback servers explicitly to 127.0.0.1 instead of Bun's all-interface default. Fixes #4106	2026-07-23 19:37:56 +00:00