@opengeni/api-router 2.5.0 → 2.6.4-canary.0

package/src/app.ts

@@ -44,6 +44,7 @@ import {
   withSessionRlsActorContext,
 } from "@opengeni/db";
 import { requireSessionEventDurableFanoutCapability } from "@opengeni/events";
+import { githubAppBotIdentityWarnings } from "@opengeni/github";
 import { createObservability } from "@opengeni/observability";
 import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
@@ -65,19 +66,35 @@ import {
   requireLiveAgentAttemptAuthorization,
   requirePermission,
   releaseManagedAuthRequestActorLease,
+  resolveCatalogSettings,
+  resolveWorkspaceCatalogSettings,
   validateManagedAuthRequestActorLease,
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
   SessionAuthorizationUnavailableError,
 } from "@opengeni/core";
-import { createManagedAuth } from "./auth/managed-auth";
 import {
+  createManagedAuth,
+  isolatedManagedAuthOAuthCallbackRequest,
+  managedAuthOAuthReturnMatches,
+  resolveManagedAuthOAuthAttempt,
+} from "./auth/managed-auth";
+import {
+  adoptManagedAuthSession,
   MANAGED_AUTH_SESSION_SET_COOKIE,
   ManagedAuthActorChangeError,
+  managedAuthCsrfHash,
+  managedAuthDerivedUuid,
+  managedAuthSecretRequestDigest,
   managedAuthSha256,
 } from "@opengeni/core/managed-auth-session-sets";
 import { createBetterAuthSessionAdapter } from "./auth/managed-auth-session-adapter";
-import { runManagedAuthDiscardedProviderSession } from "./auth/managed-auth-attempt-context";
+import {
+  currentManagedAuthCreatedSessionId,
+  runManagedAuthAttempt,
+  runManagedAuthDiscardedProviderSession,
+  runManagedAuthProvider,
+} from "./auth/managed-auth-attempt-context";
 import { createManagedEmailTransport } from "./auth/managed-email";
 import { assertManagedEmailTransportMetadata } from "./auth/organization-user-setup";
 import { createApiSandboxClient, makeResumeBoxById } from "./sandbox/access";
@@ -207,6 +224,22 @@ export function createApp(deps: AppDependencies): Hono {
   return createAppComposition(deps).app;
 }
 
+export async function resolveWorkspaceMcpRouteDeps(
+  routeDeps: ApiRouteDeps,
+  grant: AccessGrant,
+): Promise<ApiRouteDeps> {
+  const catalogSourceSettings = routeDeps.catalogSourceSettings ?? routeDeps.settings;
+  const resolvedCatalog = await resolveWorkspaceCatalogSettings(
+    routeDeps.db,
+    catalogSourceSettings,
+    {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+    },
+  );
+  return { ...routeDeps, catalogSourceSettings, settings: resolvedCatalog.settings };
+}
+
 export function createAppComposition(deps: AppDependencies): {
   app: Hono;
   routeDeps: ApiRouteDeps;
@@ -343,6 +376,7 @@ export function createAppComposition(deps: AppDependencies): {
       : deps.transcriptionSegmenter;
   const routeDeps: ApiRouteDeps = {
     ...deps,
+    resolveCatalogSettings: () => resolveCatalogSettings(deps.db, deps.settings),
     observability,
     githubStateSecret:
       deps.githubStateSecret ?? deps.settings.githubAppManifestStateSecret ?? crypto.randomUUID(),
@@ -579,26 +613,111 @@ export function createAppComposition(deps: AppDependencies): {
   registerManagedAuthSessionSetRoutes(app, routeDeps);
   if (managedAuth) {
     app.on(["GET", "POST"], "/v1/auth/*", async (c) => {
+      const pathname = new URL(c.req.url).pathname;
+      const oauthCallbackProvider = managedAuthOAuthCallbackProvider(pathname);
       if (deps.settings.managedAuthSessionSetMode === "legacy") {
-        return await managedAuth.handler(c.req.raw);
+        return oauthCallbackProvider
+          ? await runManagedAuthProvider(
+              oauthCallbackProvider,
+              async () => await managedAuth.handler(c.req.raw),
+            )
+          : await managedAuth.handler(c.req.raw);
       }
-      requireManagedAuthProviderRouteAllowed(c.req.method, new URL(c.req.url).pathname);
+      requireManagedAuthProviderRouteAllowed(c.req.method, pathname);
       // Provider authentication/recovery is isolated from whichever actor the
       // browser currently renders. Selected-session capabilities are all
       // product-owned above this wildcard and generation/epoch fenced.
-      const headers = new Headers(c.req.raw.headers);
-      headers.delete("cookie");
-      headers.delete("authorization");
-      headers.delete("x-forwarded-user");
-      const providerRequest = new Request(c.req.raw, { headers });
       const authority = getCookie(c, MANAGED_AUTH_SESSION_SET_COOKIE);
-      const discardProviderSession =
-        deps.settings.managedAuthSessionSetMode === "broker" || authority !== undefined;
-      const providerResponse = discardProviderSession
-        ? await runManagedAuthDiscardedProviderSession(
-            async () => await managedAuth.handler(providerRequest),
+      let providerResponse: Response;
+      let preserveCookieNames: readonly string[] | undefined;
+      if (oauthCallbackProvider) {
+        const attempt = await resolveManagedAuthOAuthAttempt(
+          managedAuth,
+          c.req.raw,
+          oauthCallbackProvider,
+          deps.settings.publicBaseUrl!,
+        );
+        if (!attempt || !authority || attempt.authorityHash !== managedAuthSha256(authority)) {
+          throw new HTTPException(409, { message: "provider_route_blocked" });
+        }
+        const isolated = await isolatedManagedAuthOAuthCallbackRequest(managedAuth, c.req.raw);
+        preserveCookieNames = [isolated.stateCookieName];
+        const handled = await runManagedAuthAttempt(
+          attempt.transactionId,
+          oauthCallbackProvider,
+          async () => {
+            const response = await managedAuth.handler(isolated.request);
+            return {
+              response,
+              authSessionId: currentManagedAuthCreatedSessionId(),
+            };
+          },
+        );
+        providerResponse = handled.response;
+        if (
+          !handled.authSessionId &&
+          managedAuthOAuthReturnMatches(
+            providerResponse.headers.get("location") ?? "",
+            new URL(deps.settings.publicBaseUrl!).origin,
+            attempt.transactionId,
+            "complete",
           )
-        : await managedAuth.handler(providerRequest);
+        ) {
+          const location = new URL("/account-auth", deps.settings.publicBaseUrl!);
+          location.searchParams.set("transaction", attempt.transactionId);
+          location.searchParams.set("social", "error");
+          providerResponse = Response.redirect(location, 302);
+        } else if (handled.authSessionId) {
+          try {
+            await adoptManagedAuthSession({
+              db: deps.db,
+              adapter: managedAuthSessionAdapter!,
+              authority,
+              authorityHash: attempt.authorityHash,
+              csrfHash: managedAuthCsrfHash(authority),
+              operationId: managedAuthDerivedUuid(
+                "opengeni:managed-auth:social-completion",
+                `${attempt.transactionId}:${attempt.provider}`,
+              ),
+              requestDigest: managedAuthSecretRequestDigest(deps.settings.betterAuthSecret!, {
+                operation: "social_completion",
+                transactionId: attempt.transactionId,
+                provider: attempt.provider,
+                expectedGeneration: attempt.expectedGeneration,
+                expectedActorEpoch: attempt.expectedActorEpoch,
+              }),
+              expectedGeneration: attempt.expectedGeneration,
+              expectedActorEpoch: attempt.expectedActorEpoch,
+              transactionId: attempt.transactionId,
+              transactionSecretHash: attempt.transactionSecretHash,
+              authSessionId: handled.authSessionId,
+              mode: deps.settings.managedAuthSessionSetMode,
+            });
+          } catch {
+            // adoptManagedAuthSession revokes only when durable reconciliation
+            // proves that completion did not commit. An uncertain outcome may
+            // already point the selected slot at this session, so the callback
+            // must not independently revoke it.
+            const location = new URL("/account-auth", deps.settings.publicBaseUrl!);
+            location.searchParams.set("transaction", attempt.transactionId);
+            location.searchParams.set("social", "error");
+            providerResponse = Response.redirect(location, 302);
+          }
+        }
+      } else {
+        const headers = new Headers(c.req.raw.headers);
+        headers.delete("cookie");
+        headers.delete("authorization");
+        headers.delete("x-forwarded-user");
+        const providerRequest = new Request(c.req.raw, { headers });
+        const discardProviderSession =
+          deps.settings.managedAuthSessionSetMode === "broker" || authority !== undefined;
+        providerResponse = discardProviderSession
+          ? await runManagedAuthDiscardedProviderSession(
+              async () => await managedAuth.handler(providerRequest),
+            )
+          : await managedAuth.handler(providerRequest);
+      }
       let replacementCookies: readonly string[] | undefined;
       if (deps.settings.managedAuthSessionSetMode === "broker") {
         replacementCookies = await managedAuthSessionAdapter!.createLegacySelectedSessionCookies(
@@ -628,19 +747,24 @@ export function createAppComposition(deps: AppDependencies): {
           }
         }
       }
-      return await scrubManagedAuthProviderResponse(providerResponse, { replacementCookies });
+      return await scrubManagedAuthProviderResponse(providerResponse, {
+        replacementCookies,
+        preserveCookieNames,
+      });
     });
   }
 
-  app.get("/healthz", (c) =>
-    c.json({
+  app.get("/healthz", (c) => {
+    const warnings = githubAppBotIdentityWarnings(deps.settings);
+    return c.json({
       service: deps.settings.serviceName,
       environment: deps.settings.environment,
       deploymentRevision: deps.settings.deploymentRevision,
       ...(deps.settings.serverVersion ? { serverVersion: deps.settings.serverVersion } : {}),
+      ...(warnings.length > 0 ? { warnings } : {}),
       ok: true,
-    }),
-  );
+    });
+  });
 
   app.get("/readyz", async (c) => {
     const result = await runReadinessChecks(readinessChecks(deps), 2_000);
@@ -661,10 +785,12 @@ export function createAppComposition(deps: AppDependencies): {
 
   app.get("/v1/config/client", async (c) => {
     c.header("cache-control", "no-store");
-    const codexCatalogSettings = deps.settings.codexSubscriptionEnabled
-      ? withCodexCatalogProvider(deps.settings)
-      : deps.settings;
-    const catalogSettings = deps.settings.supergrokSubscriptionEnabled
+    const resolvedCatalog = await resolveCatalogSettings(deps.db, deps.settings);
+    const baseCatalogSettings = resolvedCatalog.settings;
+    const codexCatalogSettings = baseCatalogSettings.codexSubscriptionEnabled
+      ? withCodexCatalogProvider(baseCatalogSettings)
+      : baseCatalogSettings;
+    const catalogSettings = baseCatalogSettings.supergrokSubscriptionEnabled
       ? withXaiSubscriptionCatalogProvider(codexCatalogSettings)
       : codexCatalogSettings;
     return c.json(
@@ -681,6 +807,7 @@ export function createAppComposition(deps: AppDependencies): {
         models: configuredModels(catalogSettings).map(projectClientModel),
         defaultReasoningEffort: deps.settings.openaiReasoningEffort,
         allowedReasoningEfforts: configuredAllowedReasoningEfforts(deps.settings),
+        defaultSandboxBackend: deps.settings.sandboxBackend,
         mcpServers: deps.settings.mcpServers.map((server) => ({
           id: server.id,
           name: server.name ?? server.id,
@@ -783,7 +910,8 @@ export function createAppComposition(deps: AppDependencies): {
       const transport = new WebStandardStreamableHTTPServerTransport({
         enableJsonResponse: true,
       });
-      const mcp = buildOpenGeniMcpServer(routeDeps, grant, {
+      const mcpDeps = await resolveWorkspaceMcpRouteDeps(routeDeps, grant);
+      const mcp = buildOpenGeniMcpServer(mcpDeps, grant, {
         requestOrigin: new URL(c.req.url).origin,
         workspaceMemoryEnabled,
         workspaceMemoryPromptMode,
@@ -956,6 +1084,11 @@ export function createAppComposition(deps: AppDependencies): {
   return { app, routeDeps };
 }
 
+function managedAuthOAuthCallbackProvider(pathname: string): "google" | "github" | null {
+  const match = pathname.match(/^\/v1\/auth\/callback\/(google|github)$/u);
+  return match?.[1] === "google" || match?.[1] === "github" ? match[1] : null;
+}
+
 function mutationOutcomeUnknown(error: unknown, method: string): boolean {
   if (method === "GET" || method === "HEAD" || method === "OPTIONS") return false;
   const cause = error instanceof HTTPException ? error.cause : error;
@@ -1072,6 +1205,14 @@ function clientAuthConfig(settings: AppDependencies["settings"]) {
       mode: "managedSession" as const,
       session: "cookie" as const,
       emailVerificationRequired: settings.environment !== "local",
+      socialProviders: [
+        ...(settings.managedAuthGoogleClientId && settings.managedAuthGoogleClientSecret
+          ? (["google"] as const)
+          : []),
+        ...(settings.managedAuthGithubClientId && settings.managedAuthGithubClientSecret
+          ? (["github"] as const)
+          : []),
+      ],
     };
   }
   if (settings.productAccessMode === "configured") {
@@ -1260,11 +1401,14 @@ type ReadinessCheckResult = { ok: boolean; error?: string };
 function readinessChecks(deps: AppDependencies): ReadinessChecks {
   const configuredNatsCheck = deps.readinessChecks?.nats;
   return {
-    db:
-      deps.readinessChecks?.db ??
-      (async () => {
+    db: async () => {
+      if (deps.readinessChecks?.db) {
+        await deps.readinessChecks.db();
+      } else {
         await deps.db.execute(dbSql`select 1`);
-      }),
+      }
+      await resolveCatalogSettings(deps.db, deps.settings);
+    },
     nats: async () => {
       requireSessionEventDurableFanoutCapability(deps.bus);
       if (configuredNatsCheck) {
@@ -1354,6 +1498,22 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/codex\/status$/,
     label: "/v1/workspaces/:workspaceId/codex/status",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/codex\/source$/,
+    label: "/v1/workspaces/:workspaceId/codex/source",
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/codex\/(accounts|settings)$/,
+    label: (match) => `/v1/organizations/:organizationId/codex/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/codex\/connect\/(start|poll)$/,
+    label: (match) => `/v1/organizations/:organizationId/codex/connect/${match[1]}`,
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/codex\/accounts\/[^/]+(?:\/activate)?$/,
+    label: "/v1/organizations/:organizationId/codex/accounts/:accountId",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/supergrok\/connect\/(start|poll)$/,
     label: (match) => `/v1/workspaces/:workspaceId/supergrok/connect/${match[1]}`,
@@ -1513,6 +1673,11 @@ const routeLabelPatterns: Array<{
     label:
       "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets/:targetId/observation",
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/targets\/[^/]+\/screenshot$/,
+    label:
+      "/v1/workspaces/:workspaceId/computer-sessions/:computerSessionId/targets/:targetId/screenshot",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/computer-sessions\/[^/]+\/operations\/[^/]+$/,
     label:
@@ -1689,6 +1854,18 @@ const routeLabelPatterns: Array<{
     pattern: /^\/v1\/workspaces\/[^/]+\/api-keys\/[^/]+$/,
     label: "/v1/workspaces/:workspaceId/api-keys/:id",
   },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/api-keys$/,
+    label: "/v1/organizations/:organizationId/api-keys",
+  },
+  {
+    pattern: /^\/v1\/organizations\/[^/]+\/api-keys\/[^/]+$/,
+    label: "/v1/organizations/:organizationId/api-keys/:id",
+  },
+  {
+    pattern: /^\/v1\/workspaces\/external$/,
+    label: "/v1/workspaces/external",
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/scheduled-tasks$/,
     label: "/v1/workspaces/:workspaceId/scheduled-tasks",

package/src/auth/managed-auth-attempt-context.ts

@@ -1,13 +1,33 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 
 type ManagedAuthAttemptContext =
-  | { kind: "isolated_transaction"; transactionId: string }
+  | {
+      kind: "isolated_transaction";
+      transactionId: string;
+      providerId: "credential" | "google" | "github";
+      createdAuthSessionId: string | null;
+    }
+  | { kind: "provider"; providerId: "credential" | "google" | "github" }
   | { kind: "discard_provider_session" };
 
 const managedAuthAttemptStorage = new AsyncLocalStorage<ManagedAuthAttemptContext>();
 
-export function runManagedAuthAttempt<T>(transactionId: string, action: () => T): T {
-  return managedAuthAttemptStorage.run({ kind: "isolated_transaction", transactionId }, action);
+export function runManagedAuthAttempt<T>(
+  transactionId: string,
+  providerId: "credential" | "google" | "github",
+  action: () => T,
+): T {
+  return managedAuthAttemptStorage.run(
+    { kind: "isolated_transaction", transactionId, providerId, createdAuthSessionId: null },
+    action,
+  );
+}
+
+export function runManagedAuthProvider<T>(
+  providerId: "credential" | "google" | "github",
+  action: () => T,
+): T {
+  return managedAuthAttemptStorage.run({ kind: "provider", providerId }, action);
 }
 
 export function runManagedAuthDiscardedProviderSession<T>(action: () => T): T {
@@ -19,6 +39,23 @@ export function currentManagedAuthAttemptId(): string | null {
   return context?.kind === "isolated_transaction" ? context.transactionId : null;
 }
 
+export function currentManagedAuthProviderId(): "credential" | "google" | "github" {
+  const context = managedAuthAttemptStorage.getStore();
+  return context?.kind === "isolated_transaction" || context?.kind === "provider"
+    ? context.providerId
+    : "credential";
+}
+
+export function recordCurrentManagedAuthSession(authSessionId: string): void {
+  const context = managedAuthAttemptStorage.getStore();
+  if (context?.kind === "isolated_transaction") context.createdAuthSessionId = authSessionId;
+}
+
+export function currentManagedAuthCreatedSessionId(): string | null {
+  const context = managedAuthAttemptStorage.getStore();
+  return context?.kind === "isolated_transaction" ? context.createdAuthSessionId : null;
+}
+
 export function shouldDiscardCurrentManagedAuthProviderSession(): boolean {
   return managedAuthAttemptStorage.getStore()?.kind === "discard_provider_session";
 }

package/src/auth/managed-auth-session-adapter.ts

@@ -19,6 +19,7 @@ export function createBetterAuthSessionAdapter(
       }
       const result = await runManagedAuthAttempt(
         input.transactionId,
+        "credential",
         async () =>
           await auth.api.signInEmail({
             body: {

package/src/auth/managed-auth.ts

@@ -1,4 +1,4 @@
-import type { Settings } from "@opengeni/config";
+import { canonicalPublicOrigin, type Settings } from "@opengeni/config";
 import {
   type ManagedAuth,
   type ManagedEmailMessage,
@@ -20,7 +20,9 @@ import { Pool } from "pg";
 
 import { decideCanonicalHumanSessionAdmission } from "./canonical-human-session-admission";
 import {
+  currentManagedAuthProviderId,
   currentManagedAuthAttemptId,
+  recordCurrentManagedAuthSession,
   shouldDiscardCurrentManagedAuthProviderSession,
 } from "./managed-auth-attempt-context";
 
@@ -44,6 +46,21 @@ export function managedAuthUserCreateOverride(
   return { data: { ...user, emailVerified: true } };
 }
 
+export function managedAuthUserCreateAdmission(
+  settings: Pick<Settings, "environment">,
+  user: { emailVerified: boolean } & Record<string, unknown>,
+  providerId: string,
+): { data: typeof user } | false | undefined {
+  if (
+    managedAuthRequiresEmailVerification(settings) &&
+    providerId !== "credential" &&
+    !user.emailVerified
+  ) {
+    return false;
+  }
+  return managedAuthUserCreateOverride(settings, user);
+}
+
 /** Keep Better Auth password policy and storage format behind this boundary. */
 export async function hashManagedAuthPassword(password: string): Promise<string> {
   return await hashPassword(password);
@@ -165,6 +182,27 @@ export function createManagedAuth(
       accountLinking: {
         enabled: false,
       },
+      encryptOAuthTokens: true,
+      storeStateStrategy: "database",
+    },
+    socialProviders: {
+      ...(settings.managedAuthGoogleClientId && settings.managedAuthGoogleClientSecret
+        ? {
+            google: {
+              clientId: settings.managedAuthGoogleClientId,
+              clientSecret: settings.managedAuthGoogleClientSecret,
+              prompt: "select_account" as const,
+            },
+          }
+        : {}),
+      ...(settings.managedAuthGithubClientId && settings.managedAuthGithubClientSecret
+        ? {
+            github: {
+              clientId: settings.managedAuthGithubClientId,
+              clientSecret: settings.managedAuthGithubClientSecret,
+            },
+          }
+        : {}),
     },
     verification: {
       modelName: "auth_verifications",
@@ -229,6 +267,7 @@ export function createManagedAuth(
       session: {
         create: {
           before: async (session) => {
+            const providerId = currentManagedAuthProviderId();
             await ensureCanonicalHumanIdentityForAuthUser(db, session.userId);
             const preflightProjection = await getCanonicalHumanIdentityProjection(
               db,
@@ -242,7 +281,7 @@ export function createManagedAuth(
             if (!preflight.allowed) {
               const exactRecoveryBinding = await getCanonicalHumanExactLoginBindingForAuthUser(db, {
                 authUserId: session.userId,
-                providerId: "credential",
+                providerId,
               });
               const recoveryBinding = preflightProjection.loginBindings.find(
                 (binding) =>
@@ -282,7 +321,7 @@ export function createManagedAuth(
             const projection = await getCanonicalHumanIdentityProjection(db, session.userId);
             const exactBinding = await getCanonicalHumanExactLoginBindingForAuthUser(db, {
               authUserId: session.userId,
-              providerId: "credential",
+              providerId,
             });
             const activeBinding = projection.loginBindings.find(
               (binding) => binding.id === exactBinding.id,
@@ -318,6 +357,7 @@ export function createManagedAuth(
             };
           },
           after: async (session) => {
+            recordCurrentManagedAuthSession(session.id);
             if (!shouldDiscardCurrentManagedAuthProviderSession()) return;
             await db.execute(sql`delete from auth_sessions where id = ${session.id}`);
           },
@@ -325,7 +365,8 @@ export function createManagedAuth(
       },
       user: {
         create: {
-          before: async (user) => managedAuthUserCreateOverride(settings, user),
+          before: async (user) =>
+            managedAuthUserCreateAdmission(settings, user, currentManagedAuthProviderId()),
           after: async (user) => {
             if (!user.emailVerified) return;
             await ensureManagedAccessForUser(db, {
@@ -342,6 +383,125 @@ export function createManagedAuth(
   }) as ManagedAuth;
 }
 
+export type ManagedAuthOAuthAttempt = {
+  transactionId: string;
+  provider: "google" | "github";
+  authorityHash: string;
+  transactionSecretHash: string;
+  expectedGeneration: string;
+  expectedActorEpoch: string;
+};
+
+/**
+ * Resolve OpenGeni's server-only login transaction proof from Better Auth's
+ * database-backed OAuth state before the provider callback consumes it.
+ */
+export async function resolveManagedAuthOAuthAttempt(
+  auth: ManagedAuth,
+  request: Request,
+  provider: "google" | "github",
+  publicBaseUrl: string,
+): Promise<ManagedAuthOAuthAttempt | null> {
+  const expectedOrigin = canonicalPublicOrigin(publicBaseUrl);
+  if (!expectedOrigin) return null;
+  const state = new URL(request.url).searchParams.get("state");
+  if (!state) return null;
+  const verification = await (await auth.$context).internalAdapter.findVerificationValue(state);
+  if (!verification?.value) return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(verification.value);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const stateData = parsed as Record<string, unknown>;
+  const proof = stateData.opengeniManagedAuth;
+  if (!proof || typeof proof !== "object") return null;
+  const value = proof as Record<string, unknown>;
+  if (
+    value.version !== 1 ||
+    value.provider !== provider ||
+    typeof value.transactionId !== "string" ||
+    typeof value.authorityHash !== "string" ||
+    typeof value.transactionSecretHash !== "string" ||
+    typeof value.expectedGeneration !== "string" ||
+    typeof value.expectedActorEpoch !== "string" ||
+    !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+      value.transactionId,
+    ) ||
+    !/^[0-9a-f]{64}$/u.test(value.authorityHash) ||
+    !/^[0-9a-f]{64}$/u.test(value.transactionSecretHash) ||
+    !/^[1-9][0-9]*$/u.test(value.expectedGeneration) ||
+    !/^[1-9][0-9]*$/u.test(value.expectedActorEpoch)
+  ) {
+    return null;
+  }
+  const callbackURL = typeof stateData.callbackURL === "string" ? stateData.callbackURL : null;
+  const errorURL = typeof stateData.errorURL === "string" ? stateData.errorURL : null;
+  if (
+    !callbackURL ||
+    !errorURL ||
+    !managedAuthOAuthReturnMatches(callbackURL, expectedOrigin, value.transactionId, "complete") ||
+    !managedAuthOAuthReturnMatches(errorURL, expectedOrigin, value.transactionId, "error")
+  ) {
+    return null;
+  }
+  return {
+    transactionId: value.transactionId,
+    provider,
+    authorityHash: value.authorityHash,
+    transactionSecretHash: value.transactionSecretHash,
+    expectedGeneration: value.expectedGeneration,
+    expectedActorEpoch: value.expectedActorEpoch,
+  };
+}
+
+export async function isolatedManagedAuthOAuthCallbackRequest(
+  auth: ManagedAuth,
+  request: Request,
+): Promise<{ request: Request; stateCookieName: string }> {
+  const context = await auth.$context;
+  const stateCookieName = context.createAuthCookie("state").name;
+  const headers = new Headers(request.headers);
+  const stateCookie = cookiePair(headers.get("cookie"), stateCookieName);
+  if (stateCookie) headers.set("cookie", stateCookie);
+  else headers.delete("cookie");
+  headers.delete("authorization");
+  headers.delete("x-forwarded-user");
+  return { request: new Request(request, { headers }), stateCookieName };
+}
+
+export function managedAuthOAuthReturnMatches(
+  raw: string,
+  expectedOrigin: string,
+  transactionId: string,
+  outcome: "complete" | "error",
+): boolean {
+  try {
+    const url = new URL(raw);
+    return (
+      url.origin === expectedOrigin &&
+      url.pathname === "/account-auth" &&
+      url.searchParams.size === 2 &&
+      url.searchParams.get("transaction") === transactionId &&
+      url.searchParams.get("social") === outcome &&
+      !url.hash
+    );
+  } catch {
+    return false;
+  }
+}
+
+function cookiePair(header: string | null, name: string): string | null {
+  for (const part of header?.split(";") ?? []) {
+    const separator = part.indexOf("=");
+    if (separator < 0 || part.slice(0, separator).trim() !== name) continue;
+    return `${name}=${part.slice(separator + 1).trim()}`;
+  }
+  return null;
+}
+
 function betterAuthBaseUrl(settings: Settings) {
   const allowedHosts = splitCsv(settings.betterAuthAllowedHosts);
   if (allowedHosts.length === 0) {