Function handleAuthCallback

src/services/zoo-code-auth.ts:163–200

(token: string)

}

export async function handleAuthCallback(token: string): Promise<boolean> {
	if (!token || !token.startsWith("zoo_ext_")) {
		vscode.window.showErrorMessage(t("common:zooAuth.errors.invalid_token_received"))
		return false
	}

	// Verify token with backend before storing
	const baseUrl = getZooCodeBaseUrl()
	try {
		const response = await fetch(`${baseUrl}/api/extension/auth/verify`, {
			headers: { Authorization: `Bearer ${token}` },
			signal: AbortSignal.timeout(10_000),
		})
		if (!response.ok) {
			// Treat 5xx as a transient backend issue (e.g. DB unreachable) so the
			// user can retry sign-in instead of being told the token is bad.
			if (response.status >= 500) {
				vscode.window.showErrorMessage(t("common:zooAuth.errors.could_not_verify_token"))
			} else {
				vscode.window.showErrorMessage(t("common:zooAuth.errors.token_verification_failed"))
			}
			return false
		}
		const data = (await response.json()) as { valid?: boolean }
		if (!data.valid) {
			vscode.window.showErrorMessage(t("common:zooAuth.errors.invalid_token"))
			return false
		}
	} catch {
		vscode.window.showErrorMessage(t("common:zooAuth.errors.could_not_verify_token"))
		return false
	}

	await setZooCodeToken(token)

	vscode.window.showInformationMessage(t("common:zooAuth.info.connected"))
	return true
}

/**
 * Verify the stored token against the backend.