Merge remote-tracking branch 'origin/main' into feature/thirty-day-sessions

1 files changed, 15 insertions, 0 deletions

diff --git a/apps/api-tests/AccountEndpointTests.cs b/apps/api-tests/AccountEndpointTests.cs
index 9459081..c5c305e 100644
--- a/apps/api-tests/AccountEndpointTests.cs
+++ b/apps/api-tests/AccountEndpointTests.cs
@@ -33,6 +33,21 @@ public sealed class AccountEndpointTests
         Assert.Contains("state=", location.Query, StringComparison.Ordinal);
     }
 
+    [Theory]
+    [InlineData("/api/v1/accounts/oauth/google/callback")]
+    [InlineData("/api/v1/accounts/oauth/google/callback?error=access_denied&state=declined")]
+    [InlineData("/api/v1/accounts/oauth/google/callback?code=forged&state=forged")]
+    public async Task GoogleCallbackThatCannotFinishReturnsToTheSignInPage(string callback)
+    {
+        await using AccountApiFactory factory = new();
+        using HttpClient client = factory.CreateAccountClient(handleCookies: false);
+
+        HttpResponseMessage response = await client.GetAsync(callback, TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Redirect, response.StatusCode);
+        Assert.Equal("/login?google=failed", response.Headers.Location?.OriginalString);
+    }
+
     [Fact]
     public async Task GoogleStartRejectsInvalidAccountNameBeforeLeavingTheSite()
     {