From 2444071596aeef385a75a031812105463a0e937a Mon Sep 17 00:00:00 2001
From: William Huba <william@jumpwire.io>
Date: Thu, 18 Jul 2024 05:05:28 -0400
Subject: [PATCH] Fix error handling for OAuth responses

---
 lib/ueberauth/strategy/workos.ex        |  4 ++--
 test/ueberauth/strategy/workos_test.exs | 11 ++++++++++-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/lib/ueberauth/strategy/workos.ex b/lib/ueberauth/strategy/workos.ex
index 67f3140..4fc5e36 100644
--- a/lib/ueberauth/strategy/workos.ex
+++ b/lib/ueberauth/strategy/workos.ex
@@ -105,10 +105,10 @@ defmodule Ueberauth.Strategy.WorkOS do
         |> put_private(:workos_token, token)
 
       {:error, %OAuth2.Response{body: %{"error" => error, "error_description" => description}}} ->
-        {:error, {error, description}}
+        set_errors!(conn, [error(error, description)])
 
       {:error, %OAuth2.Error{reason: reason}} ->
-        {:error, {"error", to_string(reason)}}
+        set_errors!(conn, [error("error", to_string(reason))])
     end
   end
 
diff --git a/test/ueberauth/strategy/workos_test.exs b/test/ueberauth/strategy/workos_test.exs
index a6f4dc7..125e616 100644
--- a/test/ueberauth/strategy/workos_test.exs
+++ b/test/ueberauth/strategy/workos_test.exs
@@ -8,7 +8,10 @@ defmodule Ueberauth.Strategy.WorkOSTest do
   setup_with_mocks([
     {OAuth2.Client, [:passthrough],
      [
-       get_token: fn _client, _params ->
+       get_token: fn
+       _client, [code: "broken-code"] ->
+         {:error, %OAuth2.Response{body: %{"error" => "invalid_code", "error_description" => "unable to exchange invalid code"}}}
+       _client, _params ->
          {:ok,
           %OAuth2.Client{
             token: %OAuth2.AccessToken{
@@ -157,6 +160,12 @@ defmodule Ueberauth.Strategy.WorkOSTest do
       assert conn.assigns[:ueberauth_failure]
     end
 
+    test "handles an error exchanging oauth code", %{conn: conn} do
+      conn = %{conn | params: %{"code" => "broken-code"}}
+      conn = WorkOS.handle_callback!(conn)
+      assert conn.assigns[:ueberauth_failure]
+    end
+
     test "retrieves WorkOS user and token", %{conn: conn} do
       conn = WorkOS.handle_callback!(conn)
       assert %{"id" => "prof_01DMC79VCBZ0NY2099737PSVF1"} = conn.private[:workos_profile]