@hubspot/app-connect-sdk 1.0.0-alpha.1

package/src/server/api-client-core/plugins/fetch-transport.ts

@@ -0,0 +1,115 @@
+import { isBinaryData } from '../binary-data.ts';
+import type { Plugin } from '../types.ts';
+
+const BASE_URL = 'https://api.hubapi.com';
+
+export interface FetchTransportPluginOptions {
+  getAccessToken: () => string;
+}
+
+function appendRecordToUrlSearchParams(
+  params: URLSearchParams,
+  record: Record<string, unknown>
+): void {
+  for (const [key, value] of Object.entries(record)) {
+    if (value == null) continue;
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        params.append(key, String(item as string));
+      }
+    } else {
+      params.append(key, String(value));
+    }
+  }
+}
+
+/**
+ * Transport plugin that executes HTTP requests using the Fetch API.
+ *
+ * This is the terminal middleware in the chain — it builds the actual HTTP
+ * request from the operation descriptor and returns a normalized response.
+ * It handles path-parameter interpolation, query-string serialization,
+ * Bearer-token auth, and content-type negotiation (JSON, form-urlencoded, multipart).
+ */
+export function fetchTransportPlugin(
+  options: FetchTransportPluginOptions
+): Plugin {
+  return {
+    activate(api) {
+      api.addMiddleware(async (ctx) => {
+        const { operation } = ctx;
+
+        // Interpolate path parameters (e.g. "/contacts/{contactId}" → "/contacts/123")
+        let url = `${BASE_URL}${operation.path}`;
+        if (operation.pathParams) {
+          for (const [key, value] of Object.entries(operation.pathParams)) {
+            url = url.replace(`{${key}}`, encodeURIComponent(String(value)));
+          }
+        }
+
+        // Serialize query parameters, supporting repeated keys for array values
+        if (operation.queryParams) {
+          const params = new URLSearchParams();
+          appendRecordToUrlSearchParams(params, operation.queryParams);
+          const qs = params.toString();
+          if (qs) url += `?${qs}`;
+        }
+
+        const headers: Record<string, string> = {
+          ...(operation.headers ?? {}),
+          Authorization: `Bearer ${options.getAccessToken()}`,
+        };
+
+        const init: RequestInit = {
+          method: operation.method.toUpperCase(),
+          headers,
+        };
+
+        // For file uploads the API expects multipart/form-data; BinaryData
+        // values are appended as Blobs while everything else is stringified.
+        // Form bodies use application/x-www-form-urlencoded. Otherwise JSON.
+        if (operation.contentType === 'multipart/form-data' && operation.body) {
+          const formData = new FormData();
+          for (const [key, value] of Object.entries(
+            operation.body as Record<string, unknown>
+          )) {
+            if (value == null) continue;
+            if (isBinaryData(value)) {
+              formData.append(key, value.source as Blob);
+            } else {
+              formData.append(key, String(value));
+            }
+          }
+          init.body = formData;
+        } else if (
+          operation.contentType === 'application/x-www-form-urlencoded'
+        ) {
+          headers['Content-Type'] = 'application/x-www-form-urlencoded';
+          if (operation.body) {
+            const params = new URLSearchParams();
+            appendRecordToUrlSearchParams(
+              params,
+              operation.body as Record<string, unknown>
+            );
+            const encoded = params.toString();
+            if (encoded) init.body = encoded;
+          }
+        } else {
+          headers['Content-Type'] = 'application/json';
+          if (operation.body) {
+            init.body = JSON.stringify(operation.body);
+          }
+        }
+        const response = await fetch(url, init);
+
+        return {
+          status: response.status,
+          statusText: response.statusText,
+          headers: Object.fromEntries(response.headers.entries()),
+          // 204 No Content responses have no body to parse
+          bodyJson: response.status === 204 ? undefined : await response.json(),
+        };
+      });
+    },
+  };
+}

package/src/server/api-client-core/plugins/index.ts

@@ -0,0 +1,10 @@
+/**
+ * Built-in plugins for the HubSpot API client.
+ *
+ * Import from `@hubspot/api-client-core/plugins` to access transport and
+ * middleware plugins that can be passed to {@link createHubSpotClient}.
+ */
+export {
+  type FetchTransportPluginOptions,
+  fetchTransportPlugin,
+} from './fetch-transport.ts';

package/src/server/api-client-core/types.ts

@@ -0,0 +1,148 @@
+/**
+ * Describes an HTTP operation to be sent through the client middleware pipeline.
+ *
+ * @typeParam TOutput - The expected response body type. Used via the phantom
+ *   `_outputType` field so {@link HubSpotClient["send"]} can infer the return type.
+ */
+export interface Operation<TOutput = unknown> {
+  /** HTTP method for the request. */
+  method: 'get' | 'post' | 'put' | 'delete' | 'patch';
+  /** URL path template (e.g. `/crm/v3/objects/contacts/{contactId}`). */
+  path: string;
+  /** Values to substitute into path template placeholders. */
+  pathParams?: Record<string, unknown>;
+  /** Query-string parameters appended to the URL. */
+  queryParams?: Record<string, unknown>;
+  /** Request body payload. */
+  body?: unknown;
+  /** Media type for the request body (e.g. `"multipart/form-data"`, `"application/json"`). */
+  contentType: string;
+  /**
+   * Extra HTTP request headers. Merged into the outbound request by the transport;
+   * `Authorization` and the transport-chosen `Content-Type` are set after this map and take precedence.
+   */
+  headers?: Record<string, string>;
+  /** Phantom field used for compile-time output type inference; not sent at runtime. */
+  _outputType?: TOutput;
+}
+
+/** Raw HTTP response returned by the middleware chain. */
+export interface ApiResponse {
+  /** HTTP status code. */
+  status: number;
+  /** HTTP status text (e.g. "OK"). */
+  statusText: string;
+  /** Response headers as key-value pairs. */
+  headers: Record<string, string>;
+  /** Parsed JSON response body. */
+  bodyJson: unknown;
+}
+
+/**
+ * A typed API response that includes both the parsed response body and HTTP
+ * metadata such as status code, status text, and headers.
+ *
+ * @typeParam TOutput - The parsed response body type.
+ */
+export interface HubSpotApiResponse<TOutput> {
+  /** HTTP status code. */
+  status: number;
+  /** HTTP status text (e.g. "OK"). */
+  statusText: string;
+  /** Response headers as key-value pairs. */
+  headers: Record<string, string>;
+  /** Parsed response body, typed according to the operation. */
+  data: TOutput;
+}
+
+/** Context object threaded through the middleware pipeline, carrying the current operation. */
+export interface MiddlewareContext {
+  /** The operation being executed through the pipeline. */
+  operation: Operation;
+}
+
+/** Callback that invokes the next middleware in the chain. */
+export type Next = () => Promise<ApiResponse>;
+
+/**
+ * A function that intercepts an operation as it passes through the middleware
+ * pipeline. Call `next` to delegate to the next middleware.
+ */
+export type Middleware = (
+  ctx: MiddlewareContext,
+  next: Next
+) => Promise<ApiResponse>;
+
+/** API surface exposed to plugins during activation, allowing them to register middleware. */
+export interface PluginAPI {
+  /** Registers a middleware function into the pipeline. */
+  addMiddleware(middleware: Middleware): void;
+}
+
+/** A plugin that configures client behavior by registering middleware during activation. */
+export interface Plugin {
+  /** Called once during client creation to let the plugin register its middleware. */
+  activate(api: PluginAPI): void;
+}
+
+/** Context provided to synthetic operations, giving them access to the executing client. */
+export interface SyntheticOperationContext {
+  client: HubSpotClient;
+}
+
+/**
+ * A synthetic operation backed by an async generator. When passed to
+ * {@link HubSpotClient.send}, the generator is invoked and the result is
+ * returned as an `AsyncIterable`.
+ *
+ * @typeParam TYield - The type of each yielded value.
+ */
+export interface SyntheticStreamingOperation<TYield> {
+  _kind: 'syntheticStreaming';
+  run(ctx: SyntheticOperationContext): AsyncGenerator<TYield>;
+}
+
+/**
+ * A synthetic operation backed by an async function. When passed to
+ * {@link HubSpotClient.send}, the function is invoked and the resulting
+ * `Promise` is returned.
+ *
+ * @typeParam TOutput - The resolved output type.
+ */
+export interface SyntheticOperation<TOutput> {
+  _kind: 'synthetic';
+  run(ctx: SyntheticOperationContext): Promise<TOutput>;
+}
+
+/** Shape of a standard HubSpot paginated API response. */
+export interface PaginatedResponse {
+  results: unknown[];
+  paging?: { next?: { after: string } };
+}
+
+/** Extracts the item type from a {@link PaginatedResponse}. */
+export type PaginatedItem<T> = T extends { results: (infer TItem)[] }
+  ? TItem
+  : never;
+
+/** The HubSpot API client, providing type-safe methods for executing operations. */
+export interface HubSpotClient {
+  /** Sends a streaming synthetic operation and returns an async iterable of yielded values. */
+  send<TYield>(
+    operation: SyntheticStreamingOperation<TYield>
+  ): AsyncIterable<TYield>;
+  /** Sends a synthetic operation and returns the resolved output. */
+  send<TOutput>(operation: SyntheticOperation<TOutput>): Promise<TOutput>;
+  /** Sends an operation through the middleware pipeline and returns the typed response body. */
+  send<TOutput>(operation: Operation<TOutput>): Promise<TOutput>;
+  /** Sends an operation through the middleware pipeline and returns the full typed response including HTTP metadata. */
+  sendWithResponse<TOutput>(
+    operation: Operation<TOutput>
+  ): Promise<HubSpotApiResponse<TOutput>>;
+}
+
+/** Options for {@link createHubSpotClient}. */
+export interface CreateHubSpotClientOptions {
+  /** Plugins to activate when creating the client. */
+  plugins: Plugin[];
+}

package/src/server/api-client.ts

@@ -0,0 +1 @@
+export * from './api-client-core/index.ts';

package/src/server/constants.ts

@@ -0,0 +1,53 @@
+/**
+ * Cookie name carrying the DPoP-bound access token. Uses the
+ * `__Host-` prefix so the browser only accepts it from a `Secure`
+ * response with `Path=/` — a defense-in-depth against subdomain
+ * cookie injection.
+ */
+export const HUBSPOT_ACCESS_TOKEN_COOKIE_NAME = '__Host-hs_access_token';
+
+/**
+ * Cookie carrying the opaque app-session ID. Hashed before being put
+ * on the wire as a DPoP `sid` claim.
+ */
+export const HUBSPOT_APP_SID_COOKIE_NAME = '__Host-hs_app_sid';
+
+/**
+ * Prefix used for refresh-token cookies. Each session gets its own
+ * cookie name (`hs_refresh_<sidHash>`) so multiple devices/tabs can
+ * coexist without overwriting each other's refresh tokens.
+ */
+export const HUBSPOT_REFRESH_COOKIE_PREFIX = 'hs_refresh_';
+
+const PROTECTED_COOKIE_NAMES = new Set([
+  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+  HUBSPOT_APP_SID_COOKIE_NAME,
+]);
+
+/**
+ * Returns `true` for cookies the SDK manages internally
+ * (access token, session ID, any refresh-token cookie). The
+ * `sanitizeRequest` helper uses this to strip these cookies from the
+ * request before user code sees it, ensuring user route handlers
+ * cannot accidentally leak them in logs or proxy them upstream.
+ */
+export function isProtectedCookieName(cookieName: string): boolean {
+  return (
+    PROTECTED_COOKIE_NAMES.has(cookieName) ||
+    cookieName.startsWith(HUBSPOT_REFRESH_COOKIE_PREFIX)
+  );
+}
+
+/**
+ * Cookie carrying the PKCE code verifier between `init-session` and
+ * `callback`. `Lax` SameSite so it accompanies the redirect back from
+ * HubSpot.
+ */
+export const TEMP_COOKIE_PKCE_VERIFIER = '__hs_pkce_verifier';
+
+/**
+ * Cookie carrying the OAuth `state` value between `init-session` and
+ * `callback`. Compared against the `state` query parameter as the
+ * primary CSRF defense.
+ */
+export const TEMP_COOKIE_OAUTH_STATE = '__hs_oauth_state';

package/src/server/deno/index.ts

@@ -0,0 +1 @@
+export * from './start.ts';

package/src/server/deno/start.ts

@@ -0,0 +1,25 @@
+import {
+  runSecureStart,
+  type SecureStartAdapter,
+  type SecureStartContext,
+  type SecureStartLoader,
+} from '../secure-start-core.ts';
+
+export type { SecureStartContext, SecureStartLoader };
+
+const denoSecureStartAdapter: SecureStartAdapter = {
+  readEnv: (key) => Deno.env.get(key),
+  deleteEnv: (key) => {
+    Deno.env.delete(key);
+  },
+  exit: (code) => Deno.exit(code),
+};
+
+/**
+ * Deno entrypoint helper. Reads `HUBSPOT_APP_PRIVATE_KEY` from `Deno.env`
+ * when CIMD or DPoP is enabled, imports the supplied loader, and invokes
+ * `start` with `AppKeys` or `null`.
+ */
+export function secureStart(loader: SecureStartLoader): Promise<void> {
+  return runSecureStart(loader, denoSecureStartAdapter);
+}

package/src/server/hono/hono-request-handler.ts

@@ -0,0 +1,106 @@
+import { Hono } from 'hono';
+
+import { noopLogger, type Logger } from '../../shared/logger.ts';
+import { createHubSpotClient } from '../api-client-core/client.ts';
+import { fetchTransportPlugin } from '../api-client-core/plugins/fetch-transport.ts';
+import {
+  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+  HUBSPOT_APP_SID_COOKIE_NAME,
+} from '../constants.ts';
+import { createHubSpotProxy } from '../proxy.ts';
+import { sanitizeRequest } from '../sanitize-request.ts';
+import type { AppKeys, UserCredentials } from '../types.ts';
+import { parseCookies } from '../utils/cookie-utils.ts';
+import type { AppConnectHonoBindings, AppConnectHonoEnv } from './types.ts';
+
+/**
+ * Web-standard fetch handler signature returned by
+ * {@link createAppConnectRequestHandler}.
+ */
+export type AppConnectFetchHandler = (
+  request: Request
+) => Response | Promise<Response>;
+
+/**
+ * Callback used to attach application routes to the SDK-owned Hono
+ * app instance.
+ */
+export type RegisterAppConnectRoutesFunction = (
+  app: Hono<AppConnectHonoEnv>
+) => void;
+
+/**
+ * Options accepted by {@link createAppConnectRequestHandler}.
+ */
+export interface CreateAppConnectRequestHandlerOptions {
+  /** Registers application routes on the SDK-owned Hono app. */
+  registerRoutes: RegisterAppConnectRoutesFunction;
+  /**
+   * Imported app keys from `secureStart`, or `null` when CIMD and DPoP
+   * are both disabled.
+   */
+  appKeys: AppKeys | null;
+  /**
+   * Optional logger. When omitted the SDK uses a no-op logger so
+   * server-side state never leaks into the host application's
+   * console.
+   */
+  logger?: Logger;
+}
+
+/**
+ * Wraps a Hono app so its `fetch` handler additionally:
+ *
+ * - Strips SDK-managed cookies (access token, refresh, sid) from the
+ *   request before the app sees them, via `sanitizeRequest`.
+ * - Exposes a `hubSpotProxy` on the Hono context so route handlers
+ *   can issue authenticated calls to HubSpot's API on behalf of the
+ *   browser session.
+ */
+export function createAppConnectRequestHandler(
+  options: CreateAppConnectRequestHandlerOptions
+): AppConnectFetchHandler {
+  const { registerRoutes, appKeys, logger = noopLogger } = options;
+  const app = new Hono<AppConnectHonoEnv>();
+  registerRoutes(app);
+
+  return (request: Request) => {
+    const cookie = request.headers.get('Cookie');
+    if (!cookie) {
+      throw new Error('Missing auth cookies');
+    }
+    const cookies = parseCookies(cookie);
+    const accessToken = cookies[HUBSPOT_ACCESS_TOKEN_COOKIE_NAME];
+    const sessionId = cookies[HUBSPOT_APP_SID_COOKIE_NAME];
+    if (!accessToken || !sessionId) {
+      // Return 401 Unauthorized
+      return new Response(null, {
+        status: 401,
+        statusText: 'Unauthorized',
+        headers: {
+          'Content-Type': 'application/json',
+        },
+      });
+    }
+    const userCredentials: UserCredentials = { accessToken, sessionId };
+
+    const hubSpotProxy = createHubSpotProxy({
+      userCredentials,
+      appKeys,
+      logger,
+    });
+
+    const hubSpotClient = createHubSpotClient({
+      plugins: [fetchTransportPlugin({ getAccessToken: () => accessToken })],
+    });
+
+    const sanitizedRequest = sanitizeRequest(request);
+
+    const honoBindings: AppConnectHonoBindings = {
+      hubSpotProxy,
+      hubSpotClient,
+    };
+
+    return app.fetch(sanitizedRequest, honoBindings);
+  };
+}

package/src/server/hono/hubspot-connect-routes/auth-callback.test.ts

@@ -0,0 +1,225 @@
+import { Hono } from 'hono';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { EXPIRES_AT_URL_PARAM } from '../../../shared/constants.ts';
+import {
+  HUBSPOT_ACCESS_TOKEN_COOKIE_NAME,
+  HUBSPOT_REFRESH_COOKIE_PREFIX,
+  TEMP_COOKIE_OAUTH_STATE,
+  TEMP_COOKIE_PKCE_VERIFIER,
+} from '../../constants.ts';
+import { handleAuthCallback } from './auth-callback.ts';
+import type { HubSpotConnectRoutesEnvClientSecret } from './load-hubspot-connect-routes-env.ts';
+import type { HubSpotConnectOAuthRouteOptions } from './types.ts';
+
+const hubspotConnectEnv = {
+  hubspotAuthorizationEndpoint: 'https://auth.example.test/oauth/authorize',
+  hubspotOAuthApiOrigin: 'https://auth.example.test',
+  isCimdEnabled: false,
+  isDpopEnabled: false,
+  isAppPrivateKeyRequired: false,
+  hubspotClientId: 'test-client-id',
+  hubspotClientSecret: 'test-client-secret',
+} satisfies HubSpotConnectRoutesEnvClientSecret;
+
+const BASE_PATH = '/functions/v1/hubspot-connect';
+
+function buildOAuthRouteOptions(): HubSpotConnectOAuthRouteOptions {
+  return {
+    appKeys: null,
+    refreshCookiePath: `${BASE_PATH}/auth`,
+    logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() },
+    basePath: BASE_PATH,
+    hubspotConnectEnv,
+    cimdClientMetadata: { scope: { required: ['crm.objects.contacts.read'] } },
+  };
+}
+
+function base64urlEncode(input: string): string {
+  let binary = '';
+  const bytes = new TextEncoder().encode(input);
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+}
+
+function buildCallbackFixture(
+  returnPath: string,
+  sid = 'test-session-id-hash'
+): { stateValue: string; cookieHeader: string } {
+  const stateValue = base64urlEncode(
+    JSON.stringify({ return_path: returnPath, sid })
+  );
+  const cookieHeader = [
+    `${TEMP_COOKIE_OAUTH_STATE}=${encodeURIComponent(stateValue)}`,
+    `${TEMP_COOKIE_PKCE_VERIFIER}=${encodeURIComponent('test-pkce-verifier')}`,
+  ].join('; ');
+  return { stateValue, cookieHeader };
+}
+
+function buildCallbackUrl(stateValue: string, code = 'test-auth-code'): string {
+  const url = new URL(`http://localhost${BASE_PATH}/auth/callback`);
+  url.searchParams.set('code', code);
+  url.searchParams.set('state', stateValue);
+  return url.toString();
+}
+
+describe('handleAuthCallback', () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it('returns 400 when code is missing', async () => {
+    const app = new Hono();
+    app.get('/auth/callback', (c) =>
+      handleAuthCallback(c, buildOAuthRouteOptions())
+    );
+    const res = await app.request(`http://localhost/auth/callback?state=abc`, {
+      method: 'GET',
+    });
+    expect(res.status).toBe(400);
+    expect(await res.text()).toContain('Missing code or state');
+  });
+
+  it('returns 400 when state is missing', async () => {
+    const app = new Hono();
+    app.get('/auth/callback', (c) =>
+      handleAuthCallback(c, buildOAuthRouteOptions())
+    );
+    const res = await app.request(`http://localhost/auth/callback?code=abc`, {
+      method: 'GET',
+    });
+    expect(res.status).toBe(400);
+    expect(await res.text()).toContain('Missing code or state');
+  });
+
+  it('returns 403 when state cookie is missing', async () => {
+    const app = new Hono();
+    app.get(`${BASE_PATH}/auth/callback`, (c) =>
+      handleAuthCallback(c, buildOAuthRouteOptions())
+    );
+    const { stateValue } = buildCallbackFixture('/dashboard');
+    const res = await app.request(buildCallbackUrl(stateValue), {
+      method: 'GET',
+    });
+    expect(res.status).toBe(403);
+    expect(await res.text()).toContain('State mismatch');
+  });
+
+  it('returns 403 when state does not match cookie', async () => {
+    const app = new Hono();
+    app.get(`${BASE_PATH}/auth/callback`, (c) =>
+      handleAuthCallback(c, buildOAuthRouteOptions())
+    );
+    const { cookieHeader } = buildCallbackFixture('/dashboard');
+    const res = await app.request(buildCallbackUrl('wrong-state-value'), {
+      method: 'GET',
+      headers: { Cookie: cookieHeader },
+    });
+    expect(res.status).toBe(403);
+  });
+
+  it('returns 400 when state payload has invalid return_path', async () => {
+    const app = new Hono();
+    app.get(`${BASE_PATH}/auth/callback`, (c) =>
+      handleAuthCallback(c, buildOAuthRouteOptions())
+    );
+    const { stateValue, cookieHeader } =
+      buildCallbackFixture('//evil.example.com');
+    const res = await app.request(buildCallbackUrl(stateValue), {
+      method: 'GET',
+      headers: { Cookie: cookieHeader },
+    });
+    expect(res.status).toBe(400);
+    expect(await res.text()).toContain('Invalid return path');
+  });
+
+  it('returns 502 when upstream token exchange fails', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response('{"error":"invalid_grant"}', {
+        status: 400,
+        statusText: 'Bad Request',
+      })
+    );
+    const app = new Hono();
+    app.get(`${BASE_PATH}/auth/callback`, (c) =>
+      handleAuthCallback(c, buildOAuthRouteOptions())
+    );
+    const { stateValue, cookieHeader } = buildCallbackFixture('/dashboard');
+    const res = await app.request(buildCallbackUrl(stateValue), {
+      method: 'GET',
+      headers: { Cookie: cookieHeader },
+    });
+    expect(res.status).toBe(502);
+    expect(await res.text()).toContain('Token exchange failed');
+  });
+
+  it('returns 502 when token response is missing refresh_token', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(JSON.stringify({ access_token: 'at', expires_in: 1800 }), {
+        status: 200,
+      })
+    );
+    const app = new Hono();
+    app.get(`${BASE_PATH}/auth/callback`, (c) =>
+      handleAuthCallback(c, buildOAuthRouteOptions())
+    );
+    const { stateValue, cookieHeader } = buildCallbackFixture('/dashboard');
+    const res = await app.request(buildCallbackUrl(stateValue), {
+      method: 'GET',
+      headers: { Cookie: cookieHeader },
+    });
+    expect(res.status).toBe(502);
+    expect(await res.text()).toContain('refresh_token');
+  });
+
+  it('redirects and sets cookies on success', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          access_token: 'new-access-token',
+          refresh_token: 'new-refresh-token',
+          expires_in: 1800,
+        }),
+        { status: 200 }
+      )
+    );
+    const app = new Hono();
+    app.get(`${BASE_PATH}/auth/callback`, (c) =>
+      handleAuthCallback(c, buildOAuthRouteOptions())
+    );
+    const { stateValue, cookieHeader } = buildCallbackFixture(
+      '/dashboard',
+      'abc123sid'
+    );
+    const res = await app.request(buildCallbackUrl(stateValue), {
+      method: 'GET',
+      headers: { Cookie: cookieHeader },
+    });
+
+    expect(res.status).toBe(302);
+    const location = res.headers.get('location') ?? '';
+    expect(location).toContain('/dashboard');
+    expect(location).toContain(EXPIRES_AT_URL_PARAM);
+
+    const setCookies = res.headers.getSetCookie();
+    const accessCookie = setCookies.find((h) =>
+      h.startsWith(`${HUBSPOT_ACCESS_TOKEN_COOKIE_NAME}=`)
+    );
+    expect(accessCookie).toContain('new-access-token');
+
+    const refreshCookie = setCookies.find((h) =>
+      h.startsWith(`${HUBSPOT_REFRESH_COOKIE_PREFIX}`)
+    );
+    expect(refreshCookie).toContain('new-refresh-token');
+
+    const pkceCleared = setCookies.find((h) =>
+      h.startsWith(`${TEMP_COOKIE_PKCE_VERIFIER}=`)
+    );
+    expect(pkceCleared).toContain('Max-Age=0');
+
+    const stateCleared = setCookies.find((h) =>
+      h.startsWith(`${TEMP_COOKIE_OAUTH_STATE}=`)
+    );
+    expect(stateCleared).toContain('Max-Age=0');
+  });
+});