Repository: oauthlib/oauthlib

Issue:
`parse_authorization_code_response` has no error checking
Over at https://github.com/gratipay/gratipay.com/issues/2870 we're finding that [`parse_authorization_code_response`](https://github.com/idan/oauthlib/blob/04631866c058defb480462db1ec13cb7f88780a9/oauthlib/oauth2/rfc6749/parameters.py#L179-L229) sometimes receives an error response that it's [not prepared to handle](https://github.com/idan/oauthlib/blob/04631866c058defb480462db1ec13cb7f88780a9/oauthlib/oauth2/rfc6749/parameters.py#L221-L223). Here's a couple examples of the querystrings we're seeing from different providers:

```
Google:   error=access_denied&state=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Facebook: error=access_denied&error_code=200&error_description=Permissions+error&error_reason=user_denied&state=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
```

Should a check for `error` be added, with a call to [`raise_from_error`](https://github.com/idan/oauthlib/blob/04631866c058defb480462db1ec13cb7f88780a9/oauthlib/oauth2/rfc6749/errors.py#L249-L259) (but cf. #2869)?


Discussion:

Patch:
diff --git a/oauthlib/oauth2/rfc6749/parameters.py b/oauthlib/oauth2/rfc6749/parameters.py
index 6b9d630..df724ee 100644
--- a/oauthlib/oauth2/rfc6749/parameters.py
+++ b/oauthlib/oauth2/rfc6749/parameters.py
@@ -264,12 +264,15 @@ def parse_authorization_code_response(uri, state=None):
     query = urlparse.urlparse(uri).query
     params = dict(urlparse.parse_qsl(query))
 
-    if not 'code' in params:
-        raise MissingCodeError("Missing code parameter in response.")
-
     if state and params.get('state', None) != state:
         raise MismatchingStateError()
 
+    if 'error' in params:
+        raise_from_error(params.get('error'), params)
+
+    if not 'code' in params:
+        raise MissingCodeError("Missing code parameter in response.")
+
     return params
 
 


Test patch:
diff --git a/tests/oauth2/rfc6749/test_parameters.py b/tests/oauth2/rfc6749/test_parameters.py
index c42f516..0d293cc 100644
--- a/tests/oauth2/rfc6749/test_parameters.py
+++ b/tests/oauth2/rfc6749/test_parameters.py
@@ -73,7 +73,8 @@ class ParameterTests(TestCase):
     error_nocode = 'https://client.example.com/cb?state=xyz'
     error_nostate = 'https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA'
     error_wrongstate = 'https://client.example.com/cb?code=SplxlOBeZQQYbYS6WxSbIA&state=abc'
-    error_response = 'https://client.example.com/cb?error=access_denied&state=xyz'
+    error_denied = 'https://client.example.com/cb?error=access_denied&state=xyz'
+    error_invalid = 'https://client.example.com/cb?error=invalid_request&state=xyz'
 
     implicit_base = 'https://example.com/cb#access_token=2YotnFZFEjr1zCsicMWpAA&scope=abc&'
     implicit_response = implicit_base + 'state={0}&token_type=example&expires_in=3600'.format(state)
@@ -180,8 +181,10 @@ class ParameterTests(TestCase):
 
         self.assertRaises(MissingCodeError, parse_authorization_code_response,
                 self.error_nocode)
-        self.assertRaises(MissingCodeError, parse_authorization_code_response,
-                self.error_response)
+        self.assertRaises(AccessDeniedError, parse_authorization_code_response,
+                self.error_denied)
+        self.assertRaises(InvalidRequestFatalError, parse_authorization_code_response,
+                self.error_invalid)
         self.assertRaises(MismatchingStateError, parse_authorization_code_response,
                 self.error_nostate, state=self.state)
         self.assertRaises(MismatchingStateError, parse_authorization_code_response,