Merge branch 'feat/use-oauth-state' into feat/oauth-scope-verification

2025-06-09 16:06:12 +05:30
parent f7e3c2a19a 9b3148e16d
commit 60d7da9488
1 changed files with 5 additions and 2 deletions
@@ -95,9 +95,12 @@ class OauthCallbackController < ApplicationController
  end

  def account_from_signed_id
-    raise 'Missing state variable' if params[:state].blank?
+    raise ActionController::BadRequest, 'Missing state variable' if params[:state].blank?

-    GlobalID::Locator.locate_signed(params[:state])
+    account = GlobalID::Locator.locate_signed(params[:state])
+    raise 'Invalid or expired state' if account.nil?
+
+    account
  end

  def account