@assistant-ui/react-mcp 0.1.14 → 0.1.16

package/src/auth/createOAuthProvider.test.ts

@@ -1,8 +1,11 @@
 import type { OAuthDiscoveryState } from "@modelcontextprotocol/client";
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import type { MCPStorage } from "../resources/storage/types";
 import type { MCPPersistedAuthState } from "./types";
-import { createOAuthProvider } from "./createOAuthProvider";
+import {
+  clearOAuthProviderAuthState,
+  createOAuthProvider,
+} from "./createOAuthProvider";
 
 const discoveryState: OAuthDiscoveryState = {
   authorizationServerUrl: "https://auth.example.com",
@@ -36,6 +39,23 @@ const createStorage = (initial: MCPPersistedAuthState | null = null) => {
   return { storage, getState: () => state };
 };
 
+const createSharedStorages = (scopeId: string) => {
+  let state: MCPPersistedAuthState | null = null;
+  const create = (): MCPStorage => ({
+    scopeId,
+    loadCustomServers: async () => [],
+    saveCustomServers: async () => {},
+    loadAuthState: async () => state,
+    saveAuthState: async (_serverId, next) => {
+      state = next;
+    },
+    clearAuthState: async () => {
+      state = null;
+    },
+  });
+  return { create, getState: () => state };
+};
+
 const createProvider = (storage: MCPStorage) =>
   createOAuthProvider({
     serverId: "docs",
@@ -45,6 +65,55 @@ const createProvider = (storage: MCPStorage) =>
     onAuthorizationUrl: () => {},
   });
 
+describe("createOAuthProvider callback state", () => {
+  it("persists the generated state with the PKCE verifier", async () => {
+    const { storage, getState } = createStorage();
+    const provider = createProvider(storage);
+
+    const state = await provider.state?.();
+    await provider.saveCodeVerifier("pkce-verifier");
+
+    expect(state).toMatch(/^aui-mcp:ZG9jcw\./);
+    expect(getState()).toEqual({
+      codeVerifier: "pkce-verifier",
+      state,
+    });
+  });
+
+  it("consumes callback state when tokens are saved", async () => {
+    const { storage, getState } = createStorage({
+      codeVerifier: "pkce-verifier",
+      state: "aui-mcp:ZG9jcw.nonce",
+    });
+    const provider = createProvider(storage);
+
+    await provider.saveTokens({
+      access_token: "access-token",
+      token_type: "bearer",
+    });
+
+    expect(getState()).toEqual({
+      tokens: { access_token: "access-token", token_type: "bearer" },
+      codeVerifier: "pkce-verifier",
+    });
+  });
+
+  it.each(["verifier", "all"] as const)(
+    "clears callback state through the %s invalidation scope",
+    async (scope) => {
+      const { storage, getState } = createStorage({
+        codeVerifier: "pkce-verifier",
+        state: "aui-mcp:ZG9jcw.nonce",
+      });
+      const provider = createProvider(storage);
+
+      await provider.invalidateCredentials?.(scope);
+
+      expect(getState()).toEqual({});
+    },
+  );
+});
+
 describe("createOAuthProvider discovery state", () => {
   it("persists discovery state alongside the PKCE verifier", async () => {
     const { storage, getState } = createStorage({
@@ -84,3 +153,339 @@ describe("createOAuthProvider discovery state", () => {
     },
   );
 });
+
+describe("createOAuthProvider persistence", () => {
+  it("loads persisted auth state once for concurrent reads", async () => {
+    let resolveLoad!: (value: MCPPersistedAuthState | null) => void;
+    const loadAuthState = vi.fn(
+      () =>
+        new Promise<MCPPersistedAuthState | null>((resolve) => {
+          resolveLoad = resolve;
+        }),
+    );
+    const { storage } = createStorage();
+    storage.loadAuthState = loadAuthState;
+    const provider = createProvider(storage);
+
+    const tokens = provider.tokens();
+    const clientInformation = provider.clientInformation();
+
+    expect(loadAuthState).toHaveBeenCalledTimes(1);
+    resolveLoad(null);
+    await Promise.all([tokens, clientInformation]);
+  });
+
+  it("retries loading persisted auth state after a failure", async () => {
+    const failure = new Error("storage unavailable");
+    const loadAuthState = vi
+      .fn<() => Promise<MCPPersistedAuthState | null>>()
+      .mockRejectedValueOnce(failure)
+      .mockResolvedValueOnce({ codeVerifier: "pkce-verifier" });
+    const { storage } = createStorage();
+    storage.loadAuthState = loadAuthState;
+    const provider = createProvider(storage);
+
+    const tokens = provider.tokens();
+    const clientInformation = provider.clientInformation();
+
+    await expect(tokens).rejects.toBe(failure);
+    await expect(clientInformation).rejects.toBe(failure);
+    expect(loadAuthState).toHaveBeenCalledTimes(1);
+
+    await expect(provider.codeVerifier()).resolves.toBe("pkce-verifier");
+    expect(loadAuthState).toHaveBeenCalledTimes(2);
+  });
+
+  it("serializes writes so newer auth state is not overwritten", async () => {
+    const { storage } = createStorage();
+    const pendingWrites: Array<() => void> = [];
+    let persisted: MCPPersistedAuthState | null = null;
+    storage.saveAuthState = async (_serverId, next) => {
+      await new Promise<void>((resolve) => pendingWrites.push(resolve));
+      persisted = next;
+    };
+    const provider = createProvider(storage);
+    await provider.tokens();
+
+    const tokenSave = provider.saveTokens({
+      access_token: "access-token",
+      token_type: "bearer",
+    });
+    await vi.waitFor(() => expect(pendingWrites).toHaveLength(1));
+
+    const verifierSave = provider.saveCodeVerifier("pkce-verifier");
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+    expect(pendingWrites).toHaveLength(1);
+
+    pendingWrites.shift()!();
+    await vi.waitFor(() => expect(pendingWrites).toHaveLength(1));
+    pendingWrites.shift()!();
+    await Promise.all([tokenSave, verifierSave]);
+
+    expect(persisted).toEqual({
+      tokens: { access_token: "access-token", token_type: "bearer" },
+      codeVerifier: "pkce-verifier",
+    });
+  });
+
+  it("continues persisting after a failed auth state write", async () => {
+    const { storage } = createStorage();
+    const failure = new Error("storage unavailable");
+    let saveCount = 0;
+    let persisted: MCPPersistedAuthState | null = null;
+    let rejectFirstSave!: (reason: unknown) => void;
+    storage.saveAuthState = async (_serverId, next) => {
+      saveCount += 1;
+      if (saveCount === 1) {
+        await new Promise<void>((_resolve, reject) => {
+          rejectFirstSave = reject;
+        });
+      }
+      persisted = next;
+    };
+    const provider = createProvider(storage);
+    await provider.tokens();
+
+    const tokenSave = provider.saveTokens({
+      access_token: "access-token",
+      token_type: "bearer",
+    });
+    const verifierSave = provider.saveCodeVerifier("pkce-verifier");
+
+    await vi.waitFor(() => expect(saveCount).toBe(1));
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+    expect(saveCount).toBe(1);
+
+    const tokenSaveResult = expect(tokenSave).rejects.toBe(failure);
+    rejectFirstSave(failure);
+    await tokenSaveResult;
+    await expect(verifierSave).resolves.toBeUndefined();
+    expect(saveCount).toBe(2);
+    expect(persisted).toEqual({
+      tokens: { access_token: "access-token", token_type: "bearer" },
+      codeVerifier: "pkce-verifier",
+    });
+  });
+});
+
+describe("createOAuthProvider persistence across provider instances", () => {
+  it("shares one auth state load across provider instances", async () => {
+    let resolveLoad!: (value: MCPPersistedAuthState | null) => void;
+    const loadAuthState = vi.fn(
+      () =>
+        new Promise<MCPPersistedAuthState | null>((resolve) => {
+          resolveLoad = resolve;
+        }),
+    );
+    const { storage } = createStorage();
+    storage.loadAuthState = loadAuthState;
+    const provider = createProvider(storage);
+    const replacementProvider = createProvider(storage);
+
+    const tokens = provider.tokens();
+    const clientInformation = replacementProvider.clientInformation();
+
+    expect(loadAuthState).toHaveBeenCalledTimes(1);
+    resolveLoad(null);
+    await Promise.all([tokens, clientInformation]);
+  });
+
+  it("serializes writes across provider instances", async () => {
+    const { storage } = createStorage();
+    const pendingWrites: Array<() => void> = [];
+    let persisted: MCPPersistedAuthState | null = null;
+    storage.saveAuthState = async (_serverId, next) => {
+      await new Promise<void>((resolve) => pendingWrites.push(resolve));
+      persisted = next;
+    };
+    const provider = createProvider(storage);
+    const replacementProvider = createProvider(storage);
+    await Promise.all([provider.tokens(), replacementProvider.tokens()]);
+
+    const tokenSave = provider.saveTokens({
+      access_token: "access-token",
+      token_type: "bearer",
+    });
+    await vi.waitFor(() => expect(pendingWrites).toHaveLength(1));
+
+    const verifierSave = replacementProvider.saveCodeVerifier("pkce-verifier");
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+    expect(pendingWrites).toHaveLength(1);
+
+    pendingWrites.shift()!();
+    await vi.waitFor(() => expect(pendingWrites).toHaveLength(1));
+    pendingWrites.shift()!();
+    await Promise.all([tokenSave, verifierSave]);
+
+    expect(persisted).toEqual({
+      tokens: { access_token: "access-token", token_type: "bearer" },
+      codeVerifier: "pkce-verifier",
+    });
+  });
+
+  it("clears after a pending write and fences the discarded provider", async () => {
+    const { storage, getState } = createStorage();
+    const pendingWrites: Array<() => void> = [];
+    const saveAuthState = storage.saveAuthState;
+    storage.saveAuthState = async (serverId, next) => {
+      await new Promise<void>((resolve) => pendingWrites.push(resolve));
+      await saveAuthState(serverId, next);
+    };
+    const clearAuthState = vi.spyOn(storage, "clearAuthState");
+    const provider = createProvider(storage);
+    await provider.tokens();
+
+    const save = provider.saveTokens({
+      access_token: "access-token",
+      token_type: "bearer",
+    });
+    await vi.waitFor(() => expect(pendingWrites).toHaveLength(1));
+
+    const clear = clearOAuthProviderAuthState(storage, "docs");
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+    expect(clearAuthState).not.toHaveBeenCalled();
+
+    pendingWrites.shift()!();
+    await expect(save).resolves.toBeUndefined();
+    await clear;
+    expect(clearAuthState).toHaveBeenCalledTimes(1);
+    expect(getState()).toBeNull();
+
+    storage.saveAuthState = saveAuthState;
+    await provider.saveCodeVerifier("late-verifier");
+    expect(getState()).toBeNull();
+  });
+
+  it("fences a queued write when clearing through a same-scope storage", async () => {
+    const { create, getState } = createSharedStorages("same-scope-clear");
+    const storage = create();
+    const replacement = create();
+    const pendingWrites: Array<() => void> = [];
+    const saveAuthState = storage.saveAuthState;
+    storage.saveAuthState = async (serverId, next) => {
+      await new Promise<void>((resolve) => pendingWrites.push(resolve));
+      await saveAuthState(serverId, next);
+    };
+    const clearAuthState = vi.spyOn(replacement, "clearAuthState");
+    const provider = createProvider(storage);
+    await provider.tokens();
+
+    const save = provider.saveTokens({
+      access_token: "access-token",
+      token_type: "bearer",
+    });
+    await vi.waitFor(() => expect(pendingWrites).toHaveLength(1));
+
+    const clear = clearOAuthProviderAuthState(replacement, "docs");
+    for (let i = 0; i < 10; i++) await Promise.resolve();
+    expect(clearAuthState).not.toHaveBeenCalled();
+
+    pendingWrites.shift()!();
+    await expect(save).resolves.toBeUndefined();
+    await clear;
+    expect(clearAuthState).toHaveBeenCalledTimes(1);
+    expect(getState()).toBeNull();
+
+    storage.saveAuthState = saveAuthState;
+    await provider.saveCodeVerifier("late-verifier");
+    expect(getState()).toBeNull();
+  });
+
+  it("keeps differently-scoped storages on separate persistence", async () => {
+    const first = createSharedStorages("scope-a");
+    const second = createSharedStorages("scope-b");
+    const firstProvider = createProvider(first.create());
+    const secondProvider = createProvider(second.create());
+
+    await firstProvider.saveTokens({
+      access_token: "first-token",
+      token_type: "bearer",
+    });
+    await secondProvider.saveTokens({
+      access_token: "second-token",
+      token_type: "bearer",
+    });
+    await clearOAuthProviderAuthState(second.create(), "docs");
+    await firstProvider.saveCodeVerifier("first-verifier");
+
+    expect(first.getState()).toEqual({
+      tokens: { access_token: "first-token", token_type: "bearer" },
+      codeVerifier: "first-verifier",
+    });
+    expect(second.getState()).toBeNull();
+  });
+
+  it("re-derives static client information for a replacement provider", async () => {
+    const { storage } = createStorage();
+    const provider = createOAuthProvider({
+      serverId: "docs",
+      config: { type: "oauth", clientId: "client-a" },
+      storage,
+      redirectUri: "http://localhost/callback",
+      onAuthorizationUrl: () => {},
+    });
+    await expect(provider.clientInformation()).resolves.toEqual({
+      client_id: "client-a",
+      redirect_uris: ["http://localhost/callback"],
+    });
+
+    const replacementProvider = createOAuthProvider({
+      serverId: "docs",
+      config: { type: "oauth", clientId: "client-b", clientSecret: "secret-b" },
+      storage,
+      redirectUri: "http://localhost/callback-2",
+      onAuthorizationUrl: () => {},
+    });
+    await expect(replacementProvider.clientInformation()).resolves.toEqual({
+      client_id: "client-b",
+      client_secret: "secret-b",
+      redirect_uris: ["http://localhost/callback-2"],
+    });
+  });
+
+  it("does not leak static client information to a dynamic provider", async () => {
+    const { storage } = createStorage();
+    const staticProvider = createOAuthProvider({
+      serverId: "docs",
+      config: { type: "oauth", clientId: "client-a" },
+      storage,
+      redirectUri: "http://localhost/callback",
+      onAuthorizationUrl: () => {},
+    });
+    await expect(staticProvider.clientInformation()).resolves.toEqual({
+      client_id: "client-a",
+      redirect_uris: ["http://localhost/callback"],
+    });
+
+    const dynamicProvider = createProvider(storage);
+    await expect(dynamicProvider.clientInformation()).resolves.toBeUndefined();
+  });
+
+  it("keeps a provider built while the clear is in flight usable", async () => {
+    const { storage, getState } = createStorage();
+    let releaseClear: (() => void) | undefined;
+    const clearAuthState = storage.clearAuthState;
+    storage.clearAuthState = async (serverId) => {
+      await new Promise<void>((resolve) => {
+        releaseClear = resolve;
+      });
+      await clearAuthState(serverId);
+    };
+    const provider = createProvider(storage);
+    await provider.saveTokens({
+      access_token: "access-token",
+      token_type: "bearer",
+    });
+
+    const clear = clearOAuthProviderAuthState(storage, "docs");
+    await vi.waitFor(() => expect(releaseClear).toBeTypeOf("function"));
+
+    const replacementProvider = createProvider(storage);
+    releaseClear!();
+    await clear;
+    expect(getState()).toBeNull();
+
+    await replacementProvider.saveCodeVerifier("new-verifier");
+    expect(getState()).toEqual({ codeVerifier: "new-verifier" });
+  });
+});

package/src/auth/createOAuthProvider.ts

@@ -57,6 +57,108 @@ export type CreateOAuthProviderOptions = {
   onAuthorizationUrl: (url: URL) => void;
 };
 
+type OAuthProviderCache = {
+  tokens?: OAuthTokens | undefined;
+  clientInformation?: OAuthClientInformationFull | undefined;
+  codeVerifier?: string | undefined;
+  state?: string | undefined;
+  discoveryState?: OAuthDiscoveryState | undefined;
+};
+
+type OAuthProviderPersistence = {
+  cached: OAuthProviderCache | null;
+  cachePromise: Promise<OAuthProviderCache> | null;
+  queue: Promise<void>;
+  invalidated: boolean;
+};
+
+// scopeId, not object identity, is what addresses the same persisted data, so
+// storages sharing one share an anchor and an unscoped storage is its own
+// identity. Every storage declaring a scope holds that scope's anchor, so the
+// coordination state below is collected once the last of them is gone.
+const anchorByStorage = new WeakMap<MCPStorage, object>();
+const anchorByScope = new Map<string, WeakRef<object>>();
+const anchorRegistry = new FinalizationRegistry<string>((scopeId) => {
+  if (!anchorByScope.get(scopeId)?.deref()) anchorByScope.delete(scopeId);
+});
+
+const getStorageIdentity = (storage: MCPStorage): object => {
+  const existing = anchorByStorage.get(storage);
+  if (existing) return existing;
+
+  const { scopeId } = storage;
+  if (scopeId === undefined) return storage;
+
+  let anchor = anchorByScope.get(scopeId)?.deref();
+  if (!anchor) {
+    anchor = {};
+    anchorByScope.set(scopeId, new WeakRef(anchor));
+    anchorRegistry.register(anchor, scopeId);
+  }
+  anchorByStorage.set(storage, anchor);
+  return anchor;
+};
+
+// McpServerResource builds a fresh provider for every transport, so the cache,
+// the in-flight load, and the write queue have to outlive any one provider.
+// saveAuthState replaces the whole record, so two providers writing their own
+// snapshots concurrently would drop whichever field the loser had added.
+const persistenceByIdentity = new WeakMap<
+  object,
+  Map<string, OAuthProviderPersistence>
+>();
+
+const getPersistence = (
+  storage: MCPStorage,
+  serverId: string,
+): OAuthProviderPersistence => {
+  const identity = getStorageIdentity(storage);
+  let byServerId = persistenceByIdentity.get(identity);
+  if (!byServerId) {
+    byServerId = new Map();
+    persistenceByIdentity.set(identity, byServerId);
+  }
+
+  let persistence = byServerId.get(serverId);
+  if (!persistence) {
+    persistence = {
+      cached: null,
+      cachePromise: null,
+      queue: Promise.resolve(),
+      invalidated: false,
+    };
+    byServerId.set(serverId, persistence);
+  }
+  return persistence;
+};
+
+/**
+ * Clears persisted OAuth state after the in-flight load and every queued write
+ * for that server have settled, so a discarded provider cannot recreate the
+ * record it was mid-save on.
+ */
+export const clearOAuthProviderAuthState = async (
+  storage: MCPStorage,
+  serverId: string,
+): Promise<void> => {
+  const identity = getStorageIdentity(storage);
+  const byServerId = persistenceByIdentity.get(identity);
+  const persistence = byServerId?.get(serverId);
+  if (!byServerId || !persistence) {
+    await storage.clearAuthState(serverId);
+    return;
+  }
+
+  // Detaching the entry before awaiting keeps a provider built during the clear
+  // on a fresh generation instead of inheriting the fenced one.
+  persistence.invalidated = true;
+  byServerId.delete(serverId);
+  if (byServerId.size === 0) persistenceByIdentity.delete(identity);
+
+  await Promise.allSettled([persistence.cachePromise, persistence.queue]);
+  await storage.clearAuthState(serverId);
+};
+
 /**
  * Builds an OAuthClientProvider for the MCP SDK, backed by MCPStorage.
  * Token refresh and DCR are handled by the SDK; this provider only mediates
@@ -66,46 +168,66 @@ export function createOAuthProvider(
   opts: CreateOAuthProviderOptions,
 ): OAuthClientProvider {
   const { serverId, config, storage, redirectUri, onAuthorizationUrl } = opts;
+  const persistence = getPersistence(storage, serverId);
+  let pendingState: string | undefined;
 
-  type Cache = {
-    tokens?: OAuthTokens | undefined;
-    clientInformation?: OAuthClientInformationFull | undefined;
-    codeVerifier?: string | undefined;
-    discoveryState?: OAuthDiscoveryState | undefined;
-  };
-  let cached: Cache | null = null;
-
-  const loadCache = async (): Promise<Cache> => {
-    if (cached) return cached;
-    const persisted = await storage.loadAuthState(serverId);
-    const initial: Cache = {};
-    if (persisted?.tokens) initial.tokens = persisted.tokens;
-    if (config.clientId) {
-      const ci: OAuthClientInformationFull = {
-        client_id: config.clientId,
-        redirect_uris: [redirectUri],
-      };
-      if (config.clientSecret) ci.client_secret = config.clientSecret;
-      initial.clientInformation = ci;
-    } else if (persisted?.clientInformation) {
-      initial.clientInformation = persisted.clientInformation;
-    }
-    if (persisted?.codeVerifier) initial.codeVerifier = persisted.codeVerifier;
-    if (persisted?.discoveryState)
-      initial.discoveryState = persisted.discoveryState;
-    cached = initial;
-    return cached;
+  // The cache is shared with every other provider for this (storage, serverId),
+  // so a statically configured client stays a read-time overlay owned by this
+  // provider. Writing it into the cache would leak this provider's registration
+  // to a replacement built for a different, or absent, clientId.
+  const staticClientInformation = (():
+    | OAuthClientInformationFull
+    | undefined => {
+    if (!config.clientId) return undefined;
+    const ci: OAuthClientInformationFull = {
+      client_id: config.clientId,
+      redirect_uris: [redirectUri],
+    };
+    if (config.clientSecret) ci.client_secret = config.clientSecret;
+    return ci;
+  })();
+
+  const loadCache = (): Promise<OAuthProviderCache> => {
+    if (persistence.cached) return Promise.resolve(persistence.cached);
+    if (persistence.cachePromise) return persistence.cachePromise;
+
+    persistence.cachePromise = storage.loadAuthState(serverId).then(
+      (persisted) => {
+        const initial: OAuthProviderCache = {};
+        if (persisted?.tokens) initial.tokens = persisted.tokens;
+        if (persisted?.clientInformation)
+          initial.clientInformation = persisted.clientInformation;
+        if (persisted?.codeVerifier)
+          initial.codeVerifier = persisted.codeVerifier;
+        if (persisted?.state) initial.state = persisted.state;
+        if (persisted?.discoveryState)
+          initial.discoveryState = persisted.discoveryState;
+        persistence.cached = initial;
+        return initial;
+      },
+      (error) => {
+        persistence.cachePromise = null;
+        throw error;
+      },
+    );
+    return persistence.cachePromise;
   };
 
-  const persist = async () => {
-    const c = cached;
-    if (!c) return;
-    const next: Parameters<typeof storage.saveAuthState>[1] = {};
-    if (c.tokens) next.tokens = c.tokens;
-    if (c.clientInformation) next.clientInformation = c.clientInformation;
-    if (c.codeVerifier) next.codeVerifier = c.codeVerifier;
-    if (c.discoveryState) next.discoveryState = c.discoveryState;
-    await storage.saveAuthState(serverId, next);
+  const persist = () => {
+    const task = persistence.queue.then(async () => {
+      if (persistence.invalidated) return;
+      const c = persistence.cached;
+      if (!c) return;
+      const next: Parameters<typeof storage.saveAuthState>[1] = {};
+      if (c.tokens) next.tokens = c.tokens;
+      if (c.clientInformation) next.clientInformation = c.clientInformation;
+      if (c.codeVerifier) next.codeVerifier = c.codeVerifier;
+      if (c.state) next.state = c.state;
+      if (c.discoveryState) next.discoveryState = c.discoveryState;
+      await storage.saveAuthState(serverId, next);
+    });
+    persistence.queue = task.catch(() => {});
+    return task;
   };
 
   const clientMetadata: OAuthClientMetadata = {
@@ -131,11 +253,12 @@ export function createOAuthProvider(
         typeof crypto !== "undefined" && "randomUUID" in crypto
           ? crypto.randomUUID()
           : `${Date.now()}.${Math.random()}`;
-      return `${encodeServerIdInState(serverId)}.${nonce}`;
+      pendingState = `${encodeServerIdInState(serverId)}.${nonce}`;
+      return pendingState;
     },
     async clientInformation() {
       const c = await loadCache();
-      return c.clientInformation;
+      return staticClientInformation ?? c.clientInformation;
     },
     async saveClientInformation(info) {
       const c = await loadCache();
@@ -149,6 +272,7 @@ export function createOAuthProvider(
     async saveTokens(tokens) {
       const c = await loadCache();
       c.tokens = tokens;
+      delete c.state;
       await persist();
     },
     async redirectToAuthorization(url) {
@@ -157,6 +281,10 @@ export function createOAuthProvider(
     async saveCodeVerifier(codeVerifier) {
       const c = await loadCache();
       c.codeVerifier = codeVerifier;
+      if (pendingState) {
+        c.state = pendingState;
+        pendingState = undefined;
+      }
       await persist();
     },
     async codeVerifier() {
@@ -179,7 +307,10 @@ export function createOAuthProvider(
       const c = await loadCache();
       if (scope === "all" || scope === "tokens") delete c.tokens;
       if (scope === "all" || scope === "client") delete c.clientInformation;
-      if (scope === "all" || scope === "verifier") delete c.codeVerifier;
+      if (scope === "all" || scope === "verifier") {
+        delete c.codeVerifier;
+        delete c.state;
+      }
       if (scope === "all" || scope === "discovery") delete c.discoveryState;
       await persist();
     },