docs: handle OAuth callback access_denied outcomes from stricter provider authz

Update SDK docs and example callback handling to process provider callback errors explicitly. access_denied is now documented and handled as an expected authorization outcome (HTTP 403), including cases where provider membership/scope checks fail at consent submission.
2026-02-26 11:36:17 +00:00
parent 6ddbcaec70
commit f529714f45
3 changed files with 14 additions and 1 deletions
@@ -25,6 +25,15 @@ $auth = new BlackWallAuth([
    'redirectUri' => 'https://test.dixon.cx/callback.php',
 ]);

+if (isset($_GET['error'])) {
+    $error = (string) $_GET['error'];
+    $description = isset($_GET['error_description']) ? (string) $_GET['error_description'] : 'Authorisation was denied.';
+    $status = $error === 'access_denied' ? 403 : 400;
+    http_response_code($status);
+    echo 'Authorisation failed: ' . htmlspecialchars($description, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+    exit;
+}
+
 try {
    $result = $auth->handleCallback($_GET);
    $_SESSION['access_token'] = $result['tokens']['access_token'] ?? null;