Guard OAuth callbacks against non-JSON GitHub responses

[ionfwsrijan]

Problem

Both GitHub OAuth callbacks call .json() without checking HTTP status or content type. When GitHub returns an HTML error page, a 502, or an empty body, the token/authorize responses cannot be parsed as JSON and the unhandled ValueError/JSONDecodeError produces an HTTP 500 instead of the intended graceful auth-error redirect.

Fix

src/routes/github_routes.py (token exchange in callback):

• Return 302 to /?github_auth=error when the token response is not 200 or cannot be parsed as JSON.

src/routes/auth_routes.py (Authlib authorize flow):

• Return the existing failure redirect when github.get('user') is not ok or the profile cannot be parsed as JSON.

Files changed

• src/routes/github_routes.py
• src/routes/auth_routes.py
• tests/test_oauth_json_guard.py (new)

Testing

• New tests test_oauth_json_guard.py (5 tests): HTML error page, empty body, and 429 text responses all redirect to /?github_auth=error instead of 500; authorize flow redirects to / on a non-ok user response and to /profile on a valid one.
• Full suite: 522 passed, 19 pre-existing unrelated failures, 3 skipped.

Closes #1863

[vercel]

@ionfwsrijan is attempting to deploy a commit to the komalsony234-1530's projects Team on Vercel.

A member of the Team first needs to authorize it.