Function verifyOAuthState

apps/web/src/lib/integrations/oauth-state.ts:82–126

(state: string | null)

export type OAuthStateVerificationFailureReason =
  | 'state_missing'
  | 'state_malformed'
  | 'signature_invalid'
  | 'state_expired'
  | 'state_from_future';

export type OAuthStateVerificationResult =
  | { status: 'valid'; state: VerifiedOAuthState }
  | { status: 'invalid'; reason: OAuthStateVerificationFailureReason };

const OAuthStatePayloadSchema = z.object({
  owner: z.string(),
  uid: z.string(),
  iat: z.number().finite(),
  nonce: z.string().min(1),
  returnTo: z.unknown().optional(),
  purpose: z.enum(['provider_install']).optional(),
});

export function verifyOAuthStateDetailed(state: string | null): OAuthStateVerificationResult {
  const result = verifySignedTokenDetailed(state, {
    ttlSeconds: OAUTH_STATE_TTL_SECONDS,
    parse: payload => {
      const parsed = OAuthStatePayloadSchema.safeParse(payload);
      if (!parsed.success) return null;

      const returnTo =
        typeof parsed.data.returnTo === 'string' ? validateReturnPath(parsed.data.returnTo) : null;

      return {
        owner: parsed.data.owner,
        userId: parsed.data.uid,
        issuedAt: parsed.data.iat,
        ...(returnTo ? { returnTo } : {}),
        ...(parsed.data.purpose ? { purpose: parsed.data.purpose } : {}),
      };
    },
  });

  if (result.status === 'valid') return { status: 'valid', state: result.value };

  switch (result.reason) {
    case 'token_missing':
      return { status: 'invalid', reason: 'state_missing' };
    case 'token_malformed':
    case 'payload_invalid':
      return { status: 'invalid', reason: 'state_malformed' };
    case 'signature_invalid':
      return { status: 'invalid', reason: 'signature_invalid' };