@frockbot/plugin-composio 0.3.6 → 0.3.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/plugin-composio",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "private": false,
   "type": "module",
   "exports": {
@@ -22,11 +22,11 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@frockbot/configuration-core": "0.3.6",
-    "@frockbot/connection-core": "0.3.6",
-    "@frockbot/kernel-contracts": "0.3.6",
-    "@frockbot/plugin-settings": "0.3.6",
-    "@frockbot/plugin-tools": "0.3.6",
+    "@frockbot/configuration-core": "0.3.7",
+    "@frockbot/connection-core": "0.3.7",
+    "@frockbot/kernel-contracts": "0.3.7",
+    "@frockbot/plugin-settings": "0.3.7",
+    "@frockbot/plugin-tools": "0.3.7",
     "cordis": "4.0.0-rc.8"
   },
   "devDependencies": {

package/src/backend.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from "bun:test";
 import type { ConnectionView } from "@frockbot/configuration-core";
 import {
+  callbackFailureResponse,
   connectionCompletionResponse,
   createComposioBackendContribution,
   createConfiguredComposioBackendContribution,
@@ -130,6 +131,37 @@ describe("Composio authorization return handoff", () => {
   });
 });
 
+describe("Composio callback failures", () => {
+  test("returns the browser to the app with the reason instead of raw JSON", () => {
+    const response = callbackFailureResponse(
+      new URL("https://bot.frockbot.com/api/plugins/composio/callback"),
+      "authorization state has expired",
+    );
+
+    expect(response.status).toBe(303);
+    const location = new URL(response.headers.get("location") ?? "");
+    expect(location.origin).toBe("https://bot.frockbot.com");
+    expect(location.pathname).toBe("/");
+    expect(location.searchParams.get("connection")).toBe("composio-failed");
+    expect(location.searchParams.get("connection_reason")).toBe(
+      "authorization state has expired",
+    );
+  });
+
+  test("keeps a JSON body for the desktop target", async () => {
+    const response = callbackFailureResponse(
+      new URL("https://bot.frockbot.com/api/plugins/composio/callback"),
+      "authorization state has expired",
+      "desktop",
+    );
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toMatchObject({
+      error: "authorization state has expired",
+    });
+  });
+});
+
 describe("Composio revoke route", () => {
   test("rejects invalid Connection identifiers before resolving storage", async () => {
     let storeLookups = 0;

package/src/backend.ts

@@ -151,6 +151,29 @@ function coordinator(
   });
 }
 
+/**
+ * Answer a failed *browser* callback by returning the User to the app with the
+ * reason attached, not with a JSON body rendered as a page.
+ *
+ * The callback is a top-level navigation, so `{"error":"..."}` is what the User
+ * sees, on a URL with no way back into the app. A slow consent screen is enough
+ * to land here — the authorization state is only valid for ten minutes.
+ */
+export function callbackFailureResponse(
+  url: URL,
+  message: string,
+  target: "browser" | "desktop" = "browser",
+): Response {
+  if (target === "desktop") return jsonError(400, message);
+  const destination = new URL("/", url.origin);
+  destination.searchParams.set("connection", "composio-failed");
+  destination.searchParams.set("connection_reason", message.slice(0, 300));
+  return new Response(null, {
+    status: 303,
+    headers: { location: destination.toString() },
+  });
+}
+
 export function connectionCompletionResponse(
   url: URL,
   target: "browser" | "desktop",
@@ -194,17 +217,23 @@ export function createComposioBackendContribution(
       let callbackState: AuthorizationState | undefined;
       if (isCallback) {
         const encodedState = url.searchParams.get("state");
-        if (!encodedState)
-          return jsonError(400, "Composio callback state is required");
+        if (!encodedState) {
+          return callbackFailureResponse(
+            url,
+            "This connection link is missing its authorization state. Start the connection again.",
+          );
+        }
         try {
           callbackState = await decodeAuthorizationState(
             encodedState,
             config.authorizationStateSecret,
           );
         } catch (error) {
-          return jsonError(
-            400,
-            error instanceof Error ? error.message : "Connection failed",
+          return callbackFailureResponse(
+            url,
+            error instanceof Error
+              ? error.message
+              : "This connection link is no longer valid. Start the connection again.",
           );
         }
       }
@@ -332,14 +361,19 @@ export function createComposioBackendContribution(
             result.nativeReturnNonce,
           );
         } catch (error) {
-          return jsonError(
-            500,
+          return callbackFailureResponse(
+            url,
             error instanceof Error ? error.message : "Connection failed",
+            callbackState?.returnTarget === "desktop" ? "desktop" : "browser",
           );
         }
       }
       if (!connectionId || !connectedAccountId) {
-        return jsonError(400, "Composio callback is incomplete");
+        return callbackFailureResponse(
+          url,
+          "The provider did not return a connected account. Start the connection again.",
+          callbackState?.returnTarget === "desktop" ? "desktop" : "browser",
+        );
       }
       try {
         const result = await connections.complete(user, {
@@ -354,9 +388,10 @@ export function createComposioBackendContribution(
           result.nativeReturnNonce,
         );
       } catch (error) {
-        return jsonError(
-          400,
+        return callbackFailureResponse(
+          url,
           error instanceof Error ? error.message : "Connection failed",
+          callbackState?.returnTarget === "desktop" ? "desktop" : "browser",
         );
       }
     },