From 5d716ad78fdcd92cafa0a7765580ef290cc842fc Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 10 Mar 2026 00:27:07 +0000
Subject: [PATCH] fix(auth): address code review feedback - sanitize error
 messages, remove unused import

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 app/auth.py                | 5 +++--
 tests/test_social_login.py | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/app/auth.py b/app/auth.py
index 6e3c364e..aba42fb5 100644
--- a/app/auth.py
+++ b/app/auth.py
@@ -305,7 +305,8 @@ def _normalize_social_userinfo(provider: str, token: dict, raw_userinfo: dict |
 
     Args:
         provider: The social provider key (google, microsoft, apple, dropbox).
-        token: The OAuth token response from the provider.
+        token: The OAuth token response from the provider. Included for future
+            provider-specific claim extraction (e.g. ``id_token`` claims).
         raw_userinfo: The raw userinfo dict (may be None for providers without standard OIDC userinfo).
 
     Returns:
@@ -415,7 +416,7 @@ async def social_callback(request: Request, provider: str, db: Session = Depends
     except Exception as e:
         logger.warning("[SECURITY] SOCIAL_LOGIN_FAILURE provider=%s error=%s", provider, type(e).__name__)
         return RedirectResponse(
-            url=f"/login?error=Social+login+failed:+{type(e).__name__}", status_code=status.HTTP_302_FOUND
+            url="/login?error=Social+login+failed.+Please+try+again.", status_code=status.HTTP_302_FOUND
         )
 
 
diff --git a/tests/test_social_login.py b/tests/test_social_login.py
index 1879096f..54c81931 100644
--- a/tests/test_social_login.py
+++ b/tests/test_social_login.py
@@ -6,8 +6,6 @@ import pytest
 from fastapi import Request, status
 from starlette.responses import RedirectResponse
 
-_TEST_SECRET = "test-secret-value"  # noqa: S105
-
 
 @pytest.mark.unit
 class TestSocialProviders:
@@ -311,6 +309,8 @@ class TestSocialCallback:
 
             assert isinstance(result, RedirectResponse)
             assert "/login?error=Social+login+failed" in result.headers["location"]
+            # Ensure internal exception details are not exposed to the user
+            assert "Exception" not in result.headers["location"]
 
 
 @pytest.mark.unit