fix(#210): replayed or cookie-less OAuth callbacks redirect home instead of 500

[sspickle]

Fixes #210.

What

/google/auth catches OAuthError (the base of MismatchingStateError, also covering a replayed code's invalid_grant) and redirects to / — the only place a user whose callback can never succeed can actually do something useful. The no-state branch ("Yikes!") now redirects too instead of falling through to a guaranteed crash.

Why redirect rather than an error page

The state is single-use by design (CSRF protection — untouched here). Once it's consumed or the cookie never existed, retrying the same URL cannot work; the only recovery is starting a fresh sign-in from the landing page. A bare 500 invites exactly the wrong response — refresh — which is how one classroom machine produced 68 consecutive failures on 2026-09-01.

Testing

tests/test_auth_callback.py reproduces the exact production exception (RED on master: MismatchingStateError: mismatching_state: CSRF Warning!) and pins the redirect for both the replay shape and the bare-URL shape.

Suite run under python:3.12 (matching the GAE runtime, since a 3.13 venv can no longer import the app — cgi was removed): 21 passed, 2 failed — both failures pre-exist on master in test_plotusers and are unrelated (verified by running master in the same container).

Production data

Steady 1–2% of sign-ins have failed this way for as far back as retention reaches, across a July-15 deploy boundary and a 6× traffic change — full numbers in #210.

---

Update 2026-09-06: a third failure population, reported by a user

Bruce forwarded two Error Reporting alerts from the production glowscript project. They are one event: http.client.RemoteDisconnected and urllib3.exceptions.ProtocolError: ('Connection aborted.', RemoteDisconnected(...)) — the second is requests wrapping the first, and Error Reporting groups by stack signature. The live request hung 13.2s before the far end dropped it.

That failure escaped the fix above. When the outbound token exchange to Google fails at the network level, requests raises RequestException, which is not an authlib OAuthError — so it propagated and rendered the same bare 500 this PR was written to remove.

1ebdc67 catches it, immediately before the OAuthError handler. Same reasoning applies unchanged: the single-use state is spent whether or not the exchange completed, so retrying that URL can never succeed.

Current production breakdown

24 hours of glowscript request logs, every 5xx on /google/auth:

cause	count	covered by
MismatchingStateError (subclasses OAuthError)	5	f991582
OAuthError — user clicked Cancel on the consent screen	3	f991582
RequestException / RemoteDisconnected	2	1ebdc67

All ten now redirect instead of 500ing. /google/auth 500s go back to at least 2026-08-25.

Testing

Third case added to tests/test_auth_callback.py; all 3 pass.

Mutation-checked, both directions: removing the RequestException handler fails the network test; removing the OAuthError handler fails the replay test. Each is independently necessary, so neither passes vacuously.

Rest of the suite unchanged — 22 passed, with test_plotusers's 2 failures and test_e2e.py's missing playwright both confirmed pre-existing on master by stashing this branch.

One more repo note

pytest-mock is missing from requirements.txt even though conftest.py requires the mocker fixture. Without it these tests error at setup rather than fail, which reads like a broken test rather than an absent dependency. Not fixed here.