[PR #127] [MERGED] fix: add missing return after error in OAuth callback redirect #176

New Issue

2026-06-06T22:09:34-04:00

yindo commented

2026-06-06 22:09:34 -04:00

📋 Pull Request Information

Original PR: https://github.com/vxcontrol/pentagi/pull/127
Author: @mason5052
Created: 2/22/2026
Status: ✅ Merged
Merged: 2/23/2026
Merged by: @asdek

Base: feature/project_improvements ← Head: fix/oauth-callback-missing-return

📝 Commits (1)

cb654ce fix: add missing return after error in OAuth callback redirect

📊 Changes

1 file changed (+1 additions, -0 deletions)

View changed files

📝 backend/pkg/server/services/auth.go (+1 -0)

📄 Description

Description of the Change

Problem

In authLoginCallback(), when url.Parse(returnURI) fails, response.Success(c, http.StatusOK, nil) writes a 200 OK response but execution falls through to line 592-595 which calls http.Redirect(), attempting to write a second response (303 See Other). This causes a "superfluous response.WriteHeader call" warning and undefined behavior from the double response write.

Solution

Add the missing return statement after response.Success() in the error branch to prevent execution from falling through to the redirect logic.

Ref: #101

Type of Change

🐛 Bug fix (non-breaking change which fixes an issue)

Areas Affected

Core Services (Frontend UI/Backend API)

Testing and Verification

Test Steps

Build the backend: cd backend && go build ./...
Trigger OAuth login with a malformed return_uri in state data
Verify only one response is written (no "superfluous response.WriteHeader" in logs)

Security Considerations

Without the return, a malformed return_uri could cause unpredictable HTTP response behavior. The fix ensures clean error handling in the OAuth callback flow.

Checklist

Code Quality

My code follows the project's coding standards
All new and existing tests pass
I have run go fmt and go vet (for Go code)

Security

I have considered security implications
Changes maintain or improve the security model

Compatibility

Changes are backward compatible

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/vxcontrol/pentagi/pull/127 **Author:** [@mason5052](https://github.com/mason5052) **Created:** 2/22/2026 **Status:** ✅ Merged **Merged:** 2/23/2026 **Merged by:** [@asdek](https://github.com/asdek) **Base:** `feature/project_improvements` ← **Head:** `fix/oauth-callback-missing-return` --- ### 📝 Commits (1) - [`cb654ce`](https://github.com/vxcontrol/pentagi/commit/cb654ce52c537cfdc332ce7f77187e3e32f897a7) fix: add missing return after error in OAuth callback redirect ### 📊 Changes **1 file changed** (+1 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `backend/pkg/server/services/auth.go` (+1 -0) </details> ### 📄 Description ### Description of the Change #### Problem In `authLoginCallback()`, when `url.Parse(returnURI)` fails, `response.Success(c, http.StatusOK, nil)` writes a 200 OK response but execution falls through to line 592-595 which calls `http.Redirect()`, attempting to write a second response (303 See Other). This causes a "superfluous response.WriteHeader call" warning and undefined behavior from the double response write. #### Solution Add the missing `return` statement after `response.Success()` in the error branch to prevent execution from falling through to the redirect logic. Ref: #101 ### Type of Change - [x] 🐛 Bug fix (non-breaking change which fixes an issue) ### Areas Affected - [x] Core Services (Frontend UI/Backend API) ### Testing and Verification #### Test Steps 1. Build the backend: `cd backend && go build ./...` 2. Trigger OAuth login with a malformed `return_uri` in state data 3. Verify only one response is written (no "superfluous response.WriteHeader" in logs) ### Security Considerations Without the `return`, a malformed `return_uri` could cause unpredictable HTTP response behavior. The fix ensures clean error handling in the OAuth callback flow. ### Checklist #### Code Quality - [x] My code follows the project's coding standards - [x] All new and existing tests pass - [x] I have run `go fmt` and `go vet` (for Go code) #### Security - [x] I have considered security implications - [x] Changes maintain or improve the security model #### Compatibility - [x] Changes are backward compatible --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-06-06 22:09:34 -04:00

yindo closed this issue

2026-06-06 22:09:34 -04:00

yindo referenced this issue

2026-06-06 22:09:44 -04:00

[PR #179] [MERGED] fix: isolate detached command context from parent cancellation #216

yindo referenced this issue

2026-06-06 22:09:45 -04:00

[PR #181] [CLOSED] test: add unit tests for terminal ExecCommand detach behavior #218

yindo referenced this issue

2026-06-06 22:09:46 -04:00

[PR #195] [CLOSED] fix(terminal): use context.WithoutCancel for detached commands #224