Method loadExternalStateFromUUID

internal/api/external.go:538–584

loadExternalStateFromUUID loads OAuth state from a flow_state record (new UUID format)

(ctx context.Context, db *storage.Connection, stateID uuid.UUID)

// loadExternalStateFromUUID loads OAuth state from a flow_state record (new UUID format)
func (a *API) loadExternalStateFromUUID(ctx context.Context, db *storage.Connection, stateID uuid.UUID) (context.Context, error) {
	config := a.config

	flowState, err := models.FindFlowStateByID(db, stateID.String())
	if models.IsNotFoundError(err) {
		return ctx, apierrors.NewBadRequestError(apierrors.ErrorCodeBadOAuthState, "OAuth state not found or expired")
	} else if err != nil {
		return ctx, apierrors.NewInternalServerError("Error loading flow state").WithInternalError(err)
	}

	// Check expiration
	if flowState.IsExpired(config.External.FlowStateExpiryDuration) {
		return ctx, apierrors.NewBadRequestError(apierrors.ErrorCodeBadOAuthState, "OAuth state has expired")
	}

	// UserID is nil at creation and set during callback, so non-nil means already consumed.
	if flowState.IsPKCE() && flowState.UserID != nil {
		return ctx, apierrors.NewBadRequestError(apierrors.ErrorCodeFlowStateAlreadyUsed, "State has already been used")
	}

	ctx = withExternalProviderType(ctx, flowState.ProviderType, flowState.EmailOptional)

	if flowState.InviteToken != nil && *flowState.InviteToken != "" {
		ctx = withInviteToken(ctx, *flowState.InviteToken)
	}
	if flowState.Referrer != nil && *flowState.Referrer != "" {
		ctx = withExternalReferrer(ctx, *flowState.Referrer)
	}
	if flowState.OAuthClientStateID != nil {
		ctx = withOAuthClientStateID(ctx, *flowState.OAuthClientStateID)
	}
	if flowState.LinkingTargetID != nil {
		u, err := models.FindUserByID(db, *flowState.LinkingTargetID)
		if err != nil {
			if models.IsNotFoundError(err) {
				return nil, apierrors.NewUnprocessableEntityError(apierrors.ErrorCodeUserNotFound, "Linking target user not found")
			}
			return nil, apierrors.NewInternalServerError("Database error loading user").WithInternalError(err)
		}
		ctx = withTargetUser(ctx, u)
	}

	// Store the entire flow state in context for later use
	ctx = withFlowState(ctx, flowState)

	return withSignature(ctx, stateID.String()), nil
}

// Provider returns a Provider interface for the given name.
func (a *API) Provider(ctx context.Context, name string, scopes string) (provider.Provider, conf.OAuthProviderConfiguration, error) {