Handle connector OAuth denial callbacks

Author: ishaanxgupta

src/api/routes/connectors.py

@@ -217,8 +217,9 @@ async def start_connector_oauth(
 @router.get("/{connector_id}/oauth/callback")
 async def connector_oauth_callback(
     connector_id: str,
-    code: str = Query(..., min_length=1),
     state: str = Query(..., min_length=1),
+    code: Optional[str] = Query(None, min_length=1),
+    error: Optional[str] = Query(None, min_length=1),
 ) -> dict:
     connector = _get_connector(connector_id)
     now = _now()
@@ -229,6 +230,11 @@ async def connector_oauth_callback(
             status_code=status.HTTP_400_BAD_REQUEST,
             detail="Invalid or expired connector authorization state",
         )
+    if error or not code:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"Authorization denied: {error or 'no authorization code received'}",
+        )
 
     # Token exchange, encrypted credential storage, and source ingestion are intentionally
     # separate follow-up steps. Do not mark the connector as connected until those exist.

tests/api/test_connectors.py

@@ -7,6 +7,10 @@
 from src.api.routes import connectors
 
 
+def setup_function() -> None:
+    connectors._pending_states.clear()
+
+
 def _user() -> dict:
     return {"id": "user-1", "email": "user@example.com", "username": "user"}
 
@@ -74,3 +78,18 @@ def test_callback_validates_state_without_marking_connected(monkeypatch) -> None
     disconnected = client.post("/api/connectors/notion/disconnect")
     assert disconnected.status_code == 200
     assert disconnected.json() == {"connector_id": "notion", "disconnected": False}
+
+
+def test_callback_handles_provider_denial_and_consumes_state(monkeypatch) -> None:
+    monkeypatch.setenv("NOTION_CLIENT_ID", "notion-client")
+    client = _client()
+
+    started = client.post("/api/connectors/notion/oauth/start")
+    state = started.json()["state"]
+
+    callback = client.get(f"/api/connectors/notion/oauth/callback?error=access_denied&state={state}")
+
+    assert callback.status_code == 400
+    assert "access_denied" in callback.json()["detail"]
+    retry = client.get(f"/api/connectors/notion/oauth/callback?code=abc&state={state}")
+    assert retry.status_code == 400