Function handleRequest

packages/cli/src/auth/loopback.ts:112–163

(
  req: IncomingMessage,
  res: ServerResponse,
  expectedState: string,
  redirectUri: string,
  resolveResult: (value: LoopbackResult) => void,
  rejectResult: (err: Error) => void,
)

// fallow-ignore-next-line complexity
function handleRequest(
  req: IncomingMessage,
  res: ServerResponse,
  expectedState: string,
  redirectUri: string,
  resolveResult: (value: LoopbackResult) => void,
  rejectResult: (err: Error) => void,
): void {
  // Only GET is part of the OAuth redirect contract. Anything else is
  // probe-traffic on the ephemeral port; reject without leaking that a
  // CLI is listening there.
  if (req.method !== "GET") {
    res.writeHead(405, { "content-type": "text/plain" }).end("Method Not Allowed");
    return;
  }

  const url = new URL(req.url ?? "/", "http://127.0.0.1");
  if (url.pathname !== CALLBACK_PATH) {
    res.writeHead(404, { "content-type": "text/plain" }).end("Not Found");
    return;
  }

  const params = url.searchParams;
  const error = params.get("error");
  if (error) {
    const desc = params.get("error_description") ?? "";
    respond(res, 400, errorPage(error, desc));
    rejectResult(new Error(`OAuth authorize returned error: ${error}${desc ? ` — ${desc}` : ""}`));
    return;
  }

  const state = params.get("state");
  if (!state || !stateMatches(state, expectedState)) {
    respond(res, 400, errorPage("invalid_state", "State parameter did not match."));
    rejectResult(new Error("OAuth state mismatch — possible CSRF, aborting."));
    return;
  }

  const code = params.get("code");
  if (!code) {
    respond(
      res,
      400,
      errorPage("missing_code", "Authorization code is missing from the redirect."),
    );
    rejectResult(new Error("OAuth redirect did not include `code`."));
    return;
  }

  respond(res, 200, successPage());
  resolveResult({ code, redirectUri });
}

/**
 * Constant-time comparison for the OAuth `state` parameter. Real