@mastra/auth-workos 1.5.4 → 1.6.0-alpha.0

package/dist/index.js

@@ -414,28 +414,51 @@ var MastraAuthWorkos = class extends MastraAuthProvider {
   /**
    * Handle the OAuth callback from WorkOS.
    *
-   * Uses AuthKit's handleCallback for proper session creation.
+   * Uses WorkOS SDK's authenticateWithCode directly instead of AuthKit's handleCallback.
+   * AuthKit's handleCallback requires PKCE cookies that must be set during getLoginUrl()
+   * and read during handleCallback(), but our ISSOProvider interface separates these
+   * calls across different requests without cookie propagation.
+   *
+   * This approach was the original implementation before commit 6e4d4f5cf3 introduced
+   * a regression by switching to AuthKit's handleCallback with dummy Request/Response
+   * objects that couldn't provide the required PKCE cookies.
    */
   async handleCallback(code, _state) {
-    const result = await this.authService.handleCallback(
-      new Request("http://localhost"),
-      // Dummy request, not used
-      new Response(),
-      // Dummy response to get headers
-      { code, state: _state }
-    );
+    const authResponse = await this.workos.userManagement.authenticateWithCode({
+      clientId: this.clientId,
+      code
+    });
     const user = {
-      ...mapWorkOSUserToEEUser(result.authResponse.user),
-      workosId: result.authResponse.user.id,
-      organizationId: result.authResponse.organizationId
+      ...mapWorkOSUserToEEUser(authResponse.user),
+      workosId: authResponse.user.id,
+      organizationId: authResponse.organizationId
+    };
+    const sessionData = {
+      accessToken: authResponse.accessToken,
+      refreshToken: authResponse.refreshToken,
+      user: authResponse.user,
+      organizationId: authResponse.organizationId,
+      impersonator: authResponse.impersonator
     };
-    const sessionCookie = result.headers?.["Set-Cookie"];
-    const cookies = sessionCookie ? Array.isArray(sessionCookie) ? sessionCookie : [sessionCookie] : void 0;
+    const cookiePassword = this.config.cookiePassword;
+    const cookieName = this.config.cookieName ?? "wos_session";
+    let cookies;
+    if (cookiePassword) {
+      const encryptedSession = await sessionEncryption.sealData(sessionData, { password: cookiePassword });
+      const cookieOptions = [
+        `${cookieName}=${encryptedSession}`,
+        "Path=/",
+        "HttpOnly",
+        `SameSite=${this.config.cookieSameSite ?? "Lax"}`,
+        process.env["NODE_ENV"] === "production" ? "Secure" : ""
+      ].filter(Boolean).join("; ");
+      cookies = [cookieOptions];
+    }
     return {
       user,
       tokens: {
-        accessToken: result.authResponse.accessToken,
-        refreshToken: result.authResponse.refreshToken
+        accessToken: authResponse.accessToken,
+        refreshToken: authResponse.refreshToken
       },
       cookies
     };