Function decodeOAuthState

server/api/auth/atproto.get.ts:185–219

* This function ensures that an oauth state was indeed encoded for the browser * session performing the oauth callback. * * @param event The H3 event object, used to read and delete the cookie * @param state The JSON string containing the original state and id * @returns The original OAuth stat

(event: H3Event, state: string | null)

 * @throws An error if the id is missing or invalid, indicating a potential issue with cookies or expired state
 */
function decodeOAuthState(event: H3Event, state: string | null): OAuthStateData {
  if (!state) {
    // May happen during transition period (if a user initiated auth flow before
    // the release with the new state handling, then tries to complete it after
    // the release).
    throw createError({
      statusCode: 400,
      message: 'Missing state parameter',
    })
  }

  // The state sting was encoded using encodeOAuthState. No need to protect
  // against JSON parsing since the StateStore should ensure it's integrity.
  const decoded = JSON.parse(state) as { data: OAuthStateData; id: string }
  const requestCookieName = `${OAUTH_REQUEST_COOKIE_PREFIX}_${decoded.id}`

  if (getCookie(event, requestCookieName) != null) {
    // The cookie will never be used again since the state store ensure unique
    // nonces, but we delete it to clean up any remnants of the authentication
    // flow.
    deleteCookie(event, requestCookieName, {
      httpOnly: true,
      secure: !import.meta.dev,
      sameSite: 'lax',
      path: event.path.split('?', 1)[0],
    })
  } else {
    throw createError({
      statusCode: 400,
      message: 'Missing authentication state. Please enable cookies and try again.',
    })
  }

  return decoded.data
}

/**
 * Fetches the mini profile for the authenticated user, including their avatar if available.