Method consume

apps/api/src/lib/oauth/oauth.state.ts:76–105

* Read + delete the stored state. Returns `null` if absent (expired, * forged, or already consumed) — and equally if the stored value is * not a JSON object: corrupted state must fail the flow, not pass as * a valid state with no extras. Read-and-delete makes replay * impossible.

(state: string)

   * impossible.
   */
  async consume(state: string): Promise<IStoredState | null> {
    const key = `${OAUTH_STATE_PREFIX}${state}`;
    const raw = await this.getClient().getdel(key);

    if (raw === null) {
      return null;
    }

    try {
      const parsed: unknown = JSON.parse(raw);

      if (parsed === null || typeof parsed !== "object") {
        return null;
      }

      const result: IStoredState = {};

      if ("codeVerifier" in parsed && typeof parsed.codeVerifier === "string") {
        result.codeVerifier = parsed.codeVerifier;
      }

      if ("linkUserId" in parsed && typeof parsed.linkUserId === "string") {
        result.linkUserId = parsed.linkUserId;
      }

      return result;
    } catch {
      return null;
    }
  }
}

export const oauthStateStore = new OAuthStateStore();