Fix OAuth error propagation

[ThumulaPerera]

Purpose

Currently, errors that occur during flow execution are not propagated back to the client in OAuth / CIBA initiated flows. This PR onboard the changes needed on the gate app to fix it.

Approach

• Refer Fix OAuth error propagation thunderid#4604

Related Issues

• Propagate flow execution errors to the OAuth client thunderid#4386
• Propagate flow execution failures to the CIBA session so the auth request fails immediately thunderid#3211

Related PRs

• Fix OAuth error propagation thunderid#4604

Checklist

• Followed the contribution guidelines.
• Manual test round performed and verified.
• Documentation provided. (Add links if there are any)
• Tests provided. (Add links if there are any)
  • Unit Tests
  • Integration Tests
• Breaking changes. (Fill if applicable)
  • Breaking changes section filled.
  • breaking change label added.

Security checks

• Followed secure coding standards.
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets.

Summary by CodeRabbit

• Bug Fixes
  • Improved embedded sign-in error handling by relaying OAuth callback failures and preserving relevant error details.
  • Completed sign-in flows now handle callback failures consistently and provide standardized OAuth errors.
  • Error responses with redirect information now correctly redirect the browser and clear sign-in flow state.
  • Added support for error assertions returned during failed sign-in flows, improving recovery and troubleshooting.

[coderabbitai]

Warning

Review limit reached

@ThumulaPerera, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 52 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: f3b6cb97-e2f5-4d30-8d7f-2308c7dc5498

📥 Commits

Reviewing files that changed from the base of the PR and between 30c4c81 and 417a769.

📒 Files selected for processing (4)

• packages/javascript/src/api/__tests__/executeEmbeddedSignInFlow.test.ts
• packages/javascript/src/api/executeEmbeddedSignInFlow.ts
• packages/javascript/src/models/embedded-signin-flow.ts
• packages/react/src/components/presentation/auth/SignIn/SignIn.tsx

📝 Walkthrough

Walkthrough

The JavaScript API now relays OAuth2 error assertions and returns callback redirect data. Shared callback handling logs failures and standardizes errors. The React sign-in component consumes redirect responses and clears related state.

Changes

OAuth2 callback relay

Layer / File(s)	Summary
Callback contract and shared helpers packages/javascript/src/models/embedded-signin-flow.ts, packages/javascript/src/api/executeEmbeddedSignInFlow.ts	EmbeddedSignInFlowResponse now supports errorAssertion. Shared helpers post callback data, log callback failures, and standardize callback errors.
Flow response relay and validation packages/javascript/src/api/executeEmbeddedSignInFlow.ts, packages/javascript/src/api/__tests__/executeEmbeddedSignInFlow.test.ts	Failed, error-status, and completed flows use OAuth2 callback handling when applicable. Tests cover redirects, missing prerequisites, response errors, and logging.
Redirect response handling packages/react/src/components/presentation/auth/SignIn/SignIn.tsx	Error responses with redirectUrl clear sign-in state, remove OAuth parameters, and redirect the browser.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• thunder-id/javascript-sdks#4: Also changes shared SignIn.tsx terminal-response redirect handling.
• thunder-id/javascript-sdks#50: Also changes SignIn.tsx flow-state and terminal-response handling.

Suggested reviewers: brionmario, senthalan

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the primary change: fixing OAuth error propagation.
Description check	✅ Passed	The description covers the purpose, approach, related work, checklist, and security checks; missing documentation and integration tests are non-critical.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/javascript/src/api/executeEmbeddedSignInFlow.ts`:
- Around line 36-45: Narrow the headers parameters of postAuthCallback and
relayFailure to Record<string, string> | undefined instead of HeadersInit, so
their object spreads reliably preserve caller-provided headers. Keep the
callback request construction and existing header merging behavior unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 003e6f98-1dc9-4194-a0d9-333487da5000

📥 Commits

Reviewing files that changed from the base of the PR and between 30c4c81 and bba005d.

📒 Files selected for processing (4)

• packages/javascript/src/api/__tests__/executeEmbeddedSignInFlow.test.ts
• packages/javascript/src/api/executeEmbeddedSignInFlow.ts
• packages/javascript/src/models/embedded-signin-flow.ts
• packages/react/src/components/presentation/auth/SignIn/SignIn.tsx

[brionmario]

Lets check if this should go to other SDKs as well. ex:Vue and also check Mobile

[ThumulaPerera]

This is specifically related to our gate app behaviour. In that case it does not need to go to other SDKs AFAIU