mirror of
https://github.com/langgenius/dify.git
synced 2026-07-14 17:07:03 +08:00
All failure paths in sso_complete now return 302 redirects to /device?sso_error=... instead of raw werkzeug error pages. Adds _device_error_redirect helper that clamps codes to the two allowed values, an outer catch-all try/except that logs + redirects on unhandled exceptions, and relays any inbound sso_error from Go enterprise straight through. user_code is now extracted before the nonce is consumed so replay redirects can still carry it.