fix(oauth): add callback error page for google oauth flow

apps/users/tests/test_api_views.py

@@ -7,7 +7,7 @@ from django.core.cache import cache
 from django.core.management import call_command
 from django.db import IntegrityError
 from django.test import override_settings
-from rest_framework import status
+from rest_framework import serializers, status
 from rest_framework.test import APIRequestFactory, APITestCase
 
 from apps.users.api.views import RegisterWithPasswordView
@@ -673,6 +673,41 @@ class GoogleOAuthApiTests(APITestCase):
         self.assertEqual(flow_response.data["resolution"], "new_account")
         self.assertIsNone(flow_response.data["mobile_hint"])
 
+    def test_google_callback_redirects_cancellation_back_to_frontend(self):
+        response = self.client.get(
+            "/api/users/oauth/google/callback/?error=access_denied&error_description=User%20cancelled",
+        )
+
+        self.assertEqual(response.status_code, 302)
+        self.assertIn("/auth/google/callback?error=access_denied", response["Location"])
+        self.assertIn("error_description=User+cancelled", response["Location"])
+
+    @patch("apps.users.api.views.exchange_code_for_google_profile")
+    def test_google_callback_redirects_backend_errors_back_to_frontend(
+        self,
+        exchange_code_for_google_profile,
+    ):
+        exchange_code_for_google_profile.side_effect = serializers.ValidationError(
+            {"detail": "Google token exchange failed."}
+        )
+
+        start_response = self.client.get("/api/users/oauth/google/start/")
+        state = start_response["Location"].split("state=", 1)[1].split("&", 1)[0]
+
+        response = self.client.get(
+            f"/api/users/oauth/google/callback/?state={state}&code=google-code",
+        )
+
+        self.assertEqual(response.status_code, 302)
+        self.assertIn(
+            "/auth/google/callback?error=google_callback_failed",
+            response["Location"],
+        )
+        self.assertIn(
+            "error_description=Google+token+exchange+failed.",
+            response["Location"],
+        )
+
     @patch("apps.users.api.views.exchange_code_for_google_profile")
     def test_google_callback_redirects_with_email_claim_flow_for_matching_email(
         self,