Merge remote-tracking branch 'origin/main' into feature/thirty-day-sessions

2 files changed, 23 insertions, 0 deletions

diff --git a/apps/api-tests/AccountEndpointTests.cs b/apps/api-tests/AccountEndpointTests.cs
index 9459081..c5c305e 100644
--- a/apps/api-tests/AccountEndpointTests.cs
+++ b/apps/api-tests/AccountEndpointTests.cs
@@ -33,6 +33,21 @@ public sealed class AccountEndpointTests
         Assert.Contains("state=", location.Query, StringComparison.Ordinal);
     }
 
+    [Theory]
+    [InlineData("/api/v1/accounts/oauth/google/callback")]
+    [InlineData("/api/v1/accounts/oauth/google/callback?error=access_denied&state=declined")]
+    [InlineData("/api/v1/accounts/oauth/google/callback?code=forged&state=forged")]
+    public async Task GoogleCallbackThatCannotFinishReturnsToTheSignInPage(string callback)
+    {
+        await using AccountApiFactory factory = new();
+        using HttpClient client = factory.CreateAccountClient(handleCookies: false);
+
+        HttpResponseMessage response = await client.GetAsync(callback, TestContext.Current.CancellationToken);
+
+        Assert.Equal(HttpStatusCode.Redirect, response.StatusCode);
+        Assert.Equal("/login?google=failed", response.Headers.Location?.OriginalString);
+    }
+
     [Fact]
     public async Task GoogleStartRejectsInvalidAccountNameBeforeLeavingTheSite()
     {
diff --git a/apps/api/Program.cs b/apps/api/Program.cs
index 3eb96c9..688fe7d 100644
--- a/apps/api/Program.cs
+++ b/apps/api/Program.cs
@@ -44,6 +44,14 @@ if (!string.IsNullOrWhiteSpace(googleClientId) && !string.IsNullOrWhiteSpace(goo
         options.CallbackPath = "/api/v1/accounts/oauth/google/callback";
         options.SignInScheme = AccountEndpoints.ExternalCookieScheme;
         options.SaveTokens = false;
+        // A callback that cannot finish (the visitor declined on Google, or the state cookie is missing or
+        // expired) would otherwise end in an unhandled 500. The sign-in page explains a failed Google sign-in.
+        options.Events.OnRemoteFailure = context =>
+        {
+            context.Response.Redirect("/login?google=failed");
+            context.HandleResponse();
+            return Task.CompletedTask;
+        };
     });
 }
 builder.Services.AddProblemDetails();