CodeForPhilly / CodeForPhilly/codeforphilly-ng
auth.md: clarify status codes vs redirect for OAuth error modes
- 主要语言
- TypeScript
- 星标
- 1
- 派生
- 1
- 平均合并
- 5 天 3 小时
- 30 天内合并 PR
- 9
描述
The Errors section of [specs/api/auth.md](../specs/api/auth.md) lists \`oauth_state_mismatch\` and \`oauth_session_invalid\` as \`401 unauthenticated\` responses, while \`github_unreachable\` and \`email_unverified\` are documented as \`502\`/\`403\` *with* explicit redirect to \`/login?error=\`.
The github-oauth plan adopts the redirect strategy uniformly: every failure mode in the browser OAuth callback redirects to \`/login?error=\`. That matches [specs/screens/login.md](../specs/screens/login.md) which expects \`?error=\` rendering, and is what makes sense for a callback the browser hits directly.
Should the spec be updated to:
- list every OAuth error as 'redirect with \`?error=\`' (the actual user experience), and
- reserve the bare-status-code shape for non-browser callers (e.g., if the API ever exposes the same flow to a CLI client)?
Filed in the github-oauth closeout — non-blocking for that plan, but worth a small spec edit.
贡献指南
这个仓库没有索引到贡献指南
调研方向
先从 specs/api/auth.md 中的 Errors 部分开始，然后将其 OAuth 失败模式与 github-oauth 计划和 specs/screens/login.md 进行比较。更新规范，使浏览器回调失败统一记录带有 ?error= 的重定向；如果规范明确了这种区别，则仅对非浏览器调用方保留裸状态码。
由索引模型根据 Issue 内容生成。
评估
- 领域
- authentication, documentation
- Issue 类型
- 文档
- 难度
- 1/5
- 预计耗时
- 1 小时以内
- 活跃度
- 冷清
- 描述清晰度
- 描述清楚
- 新手友好度
- 82/100