From 948dd8f89bf4ec34ea7ba283a1fee29256bab99f Mon Sep 17 00:00:00 2001
From: alfep <alfep@users.noreply.github.com>
Date: Wed, 5 Aug 2026 11:40:51 +0700
Subject: [PATCH] fix(oauth): declare searchParams in register-session POST
 handler

Missing declaration caused a ReferenceError -> 500 HTML response instead
of JSON when clients called POST .../register-session.
---
 src/app/api/oauth/[provider]/[action]/route.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/app/api/oauth/[provider]/[action]/route.js b/src/app/api/oauth/[provider]/[action]/route.js
index f85bbfa1..824cad8b 100644
--- a/src/app/api/oauth/[provider]/[action]/route.js
+++ b/src/app/api/oauth/[provider]/[action]/route.js
@@ -254,6 +254,7 @@ export async function POST(request, { params }) {
     if (action === "register-session") {
       // Register proxy session out of URL query (state) + body (codeVerifier).
       // Zed's codeVerifier encodes the RSA private key — must stay out of URL/logs.
+      const searchParams = new URL(request.url).searchParams;
       const state = searchParams.get("state") || body?.state;
       if (!state) return NextResponse.json({ error: "Missing state" }, { status: 400 });
       let ok = false;