Handles the OAuth redirect callback: validates state, surfaces error
responses, exchanges the authorization code for tokens, persists them, and
transitions to LOGGED_IN.
Returns the URL for the caller to history.replaceState to when a callback
was processed: on success, the same-origin location the user was on when
the flow started (if any), otherwise the callback URL cleaned of OAuth
params. Returns false when there was nothing to handle (no code, or an
exchange already in progress). A callback that fails validation while a
session is already LOGGED_IN (e.g. a remount before the params were
stripped) is ignored with a warning and still returns the cleaned URL, so a
string result does not imply an exchange ran.
Handles the OAuth redirect callback: validates
state, surfaceserrorresponses, exchanges the authorizationcodefor tokens, persists them, and transitions toLOGGED_IN.Returns the URL for the caller to
history.replaceStateto when a callback was processed: on success, the same-origin location the user was on when the flow started (if any), otherwise the callback URL cleaned of OAuth params. Returnsfalsewhen there was nothing to handle (no code, or an exchange already in progress). A callback that fails validation while a session is alreadyLOGGED_IN(e.g. a remount before the params were stripped) is ignored with a warning and still returns the cleaned URL, so a string result does not imply an exchange ran.