From 3bf9328875537be8dc3ab53792a4596b0ab4e1bf Mon Sep 17 00:00:00 2001
From: clover caruso <git@paperclover.net>
Date: Mon, 5 Oct 2026 11:56:01 -0700
Subject: [PATCH] Match the Astheno OAuth client token request format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Send Basic credentials alongside form credentials and the state field used by Astheno’s OAuth client library. Record only rejected code length and character shape for diagnosis.

Assisted-by: gpt-6
---
 dashboard/src/guest.rs | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/dashboard/src/guest.rs b/dashboard/src/guest.rs
index e99f2c3e7c24e22ceb78be0d09d2827571908fd1..3a4afe262d54be21d7e096c0a116d3d6ea9ee884 100644
--- a/dashboard/src/guest.rs
+++ b/dashboard/src/guest.rs
@@ -325,9 +325,12 @@ async fn exchange(
             })?;
         return Ok((id.to_string(), login.to_owned()));
     }
+    let mut form = form.to_vec();
+    form.push(("state", "none"));
     let token = json_bytes(
         &response_bytes(
             http.post(format!("{ASTHENO}/api/token"))
+                .basic_auth(client, Some(secret))
                 .form(&form)
                 .send()
                 .await?,
@@ -557,8 +560,17 @@ async fn handle(app: &App, request: Request) -> Result<Response> {
                 headers
             })
             .build()?;
-        let (subject, name) =
-            exchange(&http, provider, &client, &secret, code, &callback, &flow).await?;
+        let (subject, name) = exchange(&http, provider, &client, &secret, code, &callback, &flow)
+            .await
+            .map_err(|error| {
+                eprintln!(
+                    "guest rejected code: {provider} length {} whitespace {} dots {}",
+                    code.len(),
+                    code.bytes().any(|c| c.is_ascii_whitespace()),
+                    code.bytes().filter(|c| *c == b'.').count()
+                );
+                error
+            })?;
         let id = account(auth, provider, &subject, &name)?;
         auth.create_session(&id, "dashboard", headers, None)
     }
-- 
2.54.0