fix: coerce malformed profile JSON to OAuthError; add redirect_uri assertion

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hbd/server/oauth.py

@@ -241,8 +241,11 @@ async def fetch_user(provider: ResolvedProvider, token: str) -> dict:
     except aiohttp.ClientError as exc:
         raise OAuthError(f"User fetch network error: {exc}") from exc
 
-    for key in provider.profile_data_path:
-        data = data.get(key, {})
+    try:
+        for key in provider.profile_data_path:
+            data = data.get(key, {})
+    except AttributeError:
+        raise OAuthError(f"Unexpected profile response structure from {provider.type}")
 
     avatar_field = provider.field_map.get("avatar")
     return {

tests/test_oauth.py

@@ -363,6 +363,7 @@ def test_build_auth_url_gitea():
     assert qs["state"] == ["teststate"]
     assert qs["scope"] == ["user:email"]
     assert qs["response_type"] == ["code"]
+    assert qs["redirect_uri"] == ["https://hbd.example.com/login/oauth/gitea/callback"]
 
 
 def test_build_auth_url_github():