@sanity/sdk 3.1.0 → 3.3.0-rc.0

package/src/auth/logout.ts

@@ -3,14 +3,22 @@ import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
 import {getAuthLogger} from './authLogger'
 import {AuthStateType} from './authStateType'
 import {authStore} from './authStore'
+import {revokeOAuthTokens} from './oauth/oauthActions'
 
 /**
+ * Logs the current user out. In OAuth mode this revokes the OAuth tokens
+ * instead of calling the legacy `/auth/logout` endpoint; revocation is
+ * best-effort, so the OAuth path resolves even if the revoke request fails,
+ * whereas the legacy path rejects when `/auth/logout` fails. Local state and
+ * storage are cleared in both cases.
+ *
  * @public
  */
 export const logout = bindActionGlobally(authStore, async ({state, instance}) => {
   const logger = getAuthLogger(instance)
 
-  const {clientFactory, apiHost, providedToken, storageArea, storageKey} = state.get().options
+  const {clientFactory, apiHost, providedToken, storageArea, storageKey, oauth} =
+    state.get().options
 
   // If a token is statically provided, logout does nothing
   if (providedToken) {
@@ -25,6 +33,15 @@ export const logout = bindActionGlobally(authStore, async ({state, instance}) =>
     logger.debug('Skipping logout - already in progress')
     return
   }
+
+  if (oauth) {
+    logger.debug('OAuth mode - revoking tokens instead of calling /auth/logout')
+    state.set('loggingOut', {
+      authState: {type: AuthStateType.LOGGED_OUT, isDestroyingSession: true},
+    })
+    await revokeOAuthTokens(instance)
+    return
+  }
   const token = authState.type === AuthStateType.LOGGED_IN && authState.token
 
   try {
@@ -57,6 +74,7 @@ export const logout = bindActionGlobally(authStore, async ({state, instance}) =>
     logger.info('User logged out, clearing stored tokens')
     state.set('logoutSuccess', {
       authState: {type: AuthStateType.LOGGED_OUT, isDestroyingSession: false},
+      oauthTokens: undefined,
     })
     storageArea?.removeItem(storageKey)
     storageArea?.removeItem(`${storageKey}_last_refresh`)

package/src/auth/oauth/oauthActions.test.ts

@@ -0,0 +1,593 @@
+import {type ClientConfig, ClientError, type SanityClient} from '@sanity/client'
+import {NEVER} from 'rxjs'
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest'
+
+import {createSanityInstance, type SanityInstance} from '../../store/createSanityInstance'
+import {AuthStateType} from '../authStateType'
+import {getAuthState} from '../authStore'
+import {subscribeToStateAndFetchCurrentUser} from '../subscribeToStateAndFetchCurrentUser'
+import {
+  getOAuthTokensState,
+  handleOAuthCallback,
+  OAUTH_RETURN_TO_KEY,
+  OAUTH_STATE_KEY,
+  OAUTH_VERIFIER_KEY,
+  refreshOAuthTokens,
+  revokeOAuthTokens,
+  serializeTokens,
+  startOAuthAuthorization,
+} from './oauthActions'
+import {deserializeTokens, OAUTH_TOKENS_KEY} from './oauthAuth'
+import {type OAuthTokens} from './types'
+
+const readStored = (storage: Storage) => deserializeTokens(storage.getItem(OAUTH_TOKENS_KEY))
+
+vi.mock('../subscribeToStateAndFetchCurrentUser')
+vi.mock('../../utils/logger', async (importOriginal) => {
+  const original = await importOriginal<typeof import('../../utils/logger')>()
+  return {
+    ...original,
+    createLogger: vi.fn(() => ({
+      info: vi.fn(),
+      debug: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+      trace: vi.fn(),
+    })),
+  }
+})
+
+const oauthConfig = {
+  clientId: 'client-abc',
+  redirectUri: 'https://app.example.com/callback',
+  organizationId: 'org123',
+}
+
+const seededTokens: OAuthTokens = {
+  accessToken: 'stored-access',
+  tokenType: 'bearer',
+  expiresIn: 3600,
+  expiresAt: new Date('2030-01-01T00:00:00.000Z'),
+  refreshToken: 'stored-refresh',
+}
+
+const tokenResponse = {
+  access_token: 'new-access',
+  token_type: 'bearer',
+  expires_in: 3600,
+  refresh_token: 'new-refresh',
+}
+
+function createMemoryStorage(seed?: Record<string, string>): Storage {
+  const map = new Map<string, string>(Object.entries(seed ?? {}))
+  return {
+    getItem: (k) => map.get(k) ?? null,
+    setItem: (k, v) => void map.set(k, v),
+    removeItem: (k) => void map.delete(k),
+    clear: () => map.clear(),
+    key: (i) => [...map.keys()][i] ?? null,
+    get length() {
+      return map.size
+    },
+  } as Storage
+}
+
+function deferred<T>(): {
+  promise: Promise<T>
+  resolve: (v: T) => void
+  reject: (e: unknown) => void
+} {
+  let resolve!: (v: T) => void
+  let reject!: (e: unknown) => void
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res
+    reject = rej
+  })
+  return {promise, resolve, reject}
+}
+
+let instance: SanityInstance | undefined
+
+interface SetupOptions {
+  request?: ReturnType<typeof vi.fn>
+  storageSeed?: Record<string, string>
+  sessionSeed?: Record<string, string>
+  initialLocationHref?: string
+  withOAuthConfig?: boolean
+  apiHost?: string
+}
+
+function setup(options: SetupOptions = {}) {
+  const request = options.request ?? vi.fn().mockResolvedValue(tokenResponse)
+  const clientFactory = vi.fn((_config: ClientConfig) => ({request}) as unknown as SanityClient)
+  const storageArea = createMemoryStorage(options.storageSeed)
+  const session = createMemoryStorage(options.sessionSeed)
+  vi.stubGlobal('sessionStorage', session)
+
+  instance = createSanityInstance({
+    projectId: 'p',
+    dataset: 'd',
+    auth: {
+      clientFactory,
+      storageArea,
+      initialLocationHref: options.initialLocationHref ?? 'https://app.example.com/',
+      ...(options.apiHost && {apiHost: options.apiHost}),
+      ...(options.withOAuthConfig === false ? {} : {oauth: oauthConfig}),
+    },
+  })
+
+  return {request, clientFactory, storageArea, session}
+}
+
+function parseBody(body: unknown): URLSearchParams {
+  return new URLSearchParams(body as string)
+}
+
+beforeEach(() => {
+  vi.mocked(subscribeToStateAndFetchCurrentUser).mockReturnValue(NEVER.subscribe())
+})
+
+afterEach(() => {
+  instance?.dispose()
+  instance = undefined
+  vi.unstubAllGlobals()
+  vi.clearAllMocks()
+})
+
+describe('startOAuthAuthorization', () => {
+  it('persists verifier/state and navigates to the authorize URL', async () => {
+    const assign = vi.fn()
+    vi.stubGlobal('window', {location: {assign}})
+    const {session} = setup({initialLocationHref: 'https://app.example.com/'})
+
+    await startOAuthAuthorization(instance!)
+
+    expect(session.getItem(OAUTH_VERIFIER_KEY)).toBeTruthy()
+    expect(session.getItem(OAUTH_STATE_KEY)).toBeTruthy()
+
+    expect(assign).toHaveBeenCalledTimes(1)
+    const url = new URL(assign.mock.calls[0][0])
+    expect(url.pathname).toBe('/v1/auth/oauth/authorize')
+    expect(url.searchParams.get('response_type')).toBe('code')
+    expect(url.searchParams.get('client_id')).toBe('client-abc')
+    expect(url.searchParams.get('redirect_uri')).toBe(oauthConfig.redirectUri)
+    expect(url.searchParams.get('code_challenge_method')).toBe('S256')
+    expect(url.searchParams.get('code_challenge')).toBeTruthy()
+    expect(url.searchParams.get('state')).toBe(session.getItem(OAUTH_STATE_KEY))
+    expect(url.searchParams.getAll('resource')).toEqual(['urn:io.sanity:organization:org123'])
+  })
+
+  it('stashes the current location to return to, keeping app params intact', async () => {
+    const href = 'https://app.example.com/documents/abc?state=draft&code=x#h'
+    vi.stubGlobal('window', {location: {assign: vi.fn(), href}})
+    vi.stubGlobal('location', {href})
+    const {session} = setup()
+
+    await startOAuthAuthorization(instance!)
+
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe(href)
+  })
+
+  it('strips stale OAuth params from the stashed location when already on the callback route', async () => {
+    const href = 'https://app.example.com/callback?x=1&code=old&state=old'
+    vi.stubGlobal('window', {location: {assign: vi.fn(), href}})
+    vi.stubGlobal('location', {href})
+    const {session} = setup()
+
+    await startOAuthAuthorization(instance!)
+
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe('https://app.example.com/callback?x=1')
+  })
+
+  it('throws when OAuth is not configured', async () => {
+    setup({withOAuthConfig: false})
+    await expect(startOAuthAuthorization(instance!)).rejects.toThrow(/OAuth is not configured/)
+  })
+})
+
+describe('handleOAuthCallback', () => {
+  const callbackHref = 'https://app.example.com/callback?code=auth-code&state=state-xyz'
+
+  it('exchanges the code, persists tokens, clears artifacts and logs in', async () => {
+    const {request, storageArea, session, clientFactory} = setup({
+      apiHost: 'https://api.sanity.work',
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
+    })
+
+    const result = await handleOAuthCallback(instance!, callbackHref)
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(clientFactory).toHaveBeenCalledWith(
+      expect.objectContaining({apiHost: 'https://api.sanity.work'}),
+    )
+    expect(request).toHaveBeenCalledTimes(1)
+    const call = request.mock.calls[0][0]
+    expect(call).toMatchObject({
+      method: 'POST',
+      url: '/auth/oauth/token',
+      headers: {'content-type': 'application/x-www-form-urlencoded'},
+      tag: 'oauth.token',
+    })
+    const body = parseBody(call.body)
+    expect(body.get('grant_type')).toBe('authorization_code')
+    expect(body.get('code')).toBe('auth-code')
+    expect(body.get('code_verifier')).toBe('verifier-1')
+    expect(body.get('redirect_uri')).toBe(oauthConfig.redirectUri)
+    expect(body.get('client_id')).toBe('client-abc')
+    expect(body.get('resource')).toBe('urn:io.sanity:organization:org123')
+
+    expect(readStored(storageArea)).toMatchObject({accessToken: 'new-access'})
+    expect(session.getItem(OAUTH_VERIFIER_KEY)).toBeNull()
+    expect(session.getItem(OAUTH_STATE_KEY)).toBeNull()
+
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({
+      type: AuthStateType.LOGGED_IN,
+      token: 'new-access',
+    })
+  })
+
+  it('returns the stashed same-origin location after a successful exchange', async () => {
+    const returnTo = 'https://app.example.com/documents/abc?x=1'
+    const {session} = setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'state-xyz',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: returnTo,
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(returnTo)
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
+  })
+
+  it('ignores a stashed location on a different origin', async () => {
+    setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'state-xyz',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: 'https://evil.example.com/',
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+  })
+
+  it('ignores a stashed location that is not a URL', async () => {
+    setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'state-xyz',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: 'not a url',
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+  })
+
+  it('does not restore the stashed location on a state mismatch', async () => {
+    const {session} = setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'different',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: 'https://app.example.com/deep',
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
+  })
+
+  it('does not restore the stashed location on an ?error= callback', async () => {
+    const {session} = setup({sessionSeed: {[OAUTH_RETURN_TO_KEY]: 'https://app.example.com/deep'}})
+
+    const result = await handleOAuthCallback(
+      instance!,
+      'https://app.example.com/callback?error=access_denied',
+    )
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
+  })
+
+  it('does not perform a second exchange on a duplicate concurrent invocation', async () => {
+    const pending = deferred<typeof tokenResponse>()
+    const request = vi.fn().mockReturnValue(pending.promise)
+    setup({
+      request,
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
+    })
+
+    const first = handleOAuthCallback(instance!, callbackHref)
+    const second = await handleOAuthCallback(instance!, callbackHref)
+
+    expect(second).toBe(false)
+    expect(request).toHaveBeenCalledTimes(1)
+
+    pending.resolve(tokenResponse)
+    expect(await first).toBe('https://app.example.com/callback')
+  })
+
+  it('does not clobber LOGGED_IN when called again with a stale callback URL', async () => {
+    const {request} = setup({
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+    // Artifacts are now cleared; a repeat with the same URL fails state validation.
+    // Seed fresh artifacts as if a re-authorization started in this tab: the
+    // ignored stale callback must not wipe them.
+    sessionStorage.setItem(OAUTH_STATE_KEY, 'state-next')
+    sessionStorage.setItem(OAUTH_VERIFIER_KEY, 'verifier-next')
+    const result = await handleOAuthCallback(instance!, callbackHref)
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(request).toHaveBeenCalledTimes(1)
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({
+      type: AuthStateType.LOGGED_IN,
+      token: 'new-access',
+    })
+    expect(sessionStorage.getItem(OAUTH_STATE_KEY)).toBe('state-next')
+    expect(sessionStorage.getItem(OAUTH_VERIFIER_KEY)).toBe('verifier-next')
+  })
+
+  it('surfaces an ?error= callback as ERROR without exchanging', async () => {
+    const {request} = setup()
+
+    const result = await handleOAuthCallback(
+      instance!,
+      'https://app.example.com/callback?error=access_denied&error_description=denied',
+    )
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(request).not.toHaveBeenCalled()
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.ERROR})
+  })
+
+  it('ignores an ?error= callback when a session is already established', async () => {
+    setup({
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-next', [OAUTH_VERIFIER_KEY]: 'verifier-next'},
+    })
+
+    const result = await handleOAuthCallback(
+      instance!,
+      'https://app.example.com/callback?error=access_denied',
+    )
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({
+      type: AuthStateType.LOGGED_IN,
+      token: seededTokens.accessToken,
+    })
+    expect(sessionStorage.getItem(OAUTH_STATE_KEY)).toBe('state-next')
+  })
+
+  it('surfaces an ?error= callback without a description', async () => {
+    setup()
+    await handleOAuthCallback(instance!, 'https://app.example.com/callback?error=access_denied')
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.ERROR})
+  })
+
+  it('rejects a state mismatch as ERROR without exchanging', async () => {
+    const {request} = setup({
+      sessionSeed: {[OAUTH_STATE_KEY]: 'different', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
+    })
+
+    const result = await handleOAuthCallback(instance!, callbackHref)
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(request).not.toHaveBeenCalled()
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.ERROR})
+  })
+
+  it('errors when the code verifier is missing', async () => {
+    const {request} = setup({sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz'}})
+
+    const result = await handleOAuthCallback(instance!, callbackHref)
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(request).not.toHaveBeenCalled()
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.ERROR})
+  })
+
+  it('returns false when there is no code in the URL', async () => {
+    const {request} = setup()
+    const result = await handleOAuthCallback(instance!, 'https://app.example.com/callback')
+    expect(result).toBe(false)
+    expect(request).not.toHaveBeenCalled()
+  })
+
+  it('sets ERROR when the token exchange fails', async () => {
+    const request = vi.fn().mockRejectedValue(new Error('boom'))
+    const {session} = setup({
+      request,
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
+    })
+
+    const result = await handleOAuthCallback(instance!, callbackHref)
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.ERROR})
+    expect(session.getItem(OAUTH_VERIFIER_KEY)).toBeNull()
+  })
+})
+
+describe('refreshOAuthTokens', () => {
+  it('refreshes tokens and persists them', async () => {
+    const {request, storageArea} = setup({
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+    })
+
+    const result = await refreshOAuthTokens(instance!)
+
+    expect(request).toHaveBeenCalledTimes(1)
+    const body = parseBody(request.mock.calls[0][0].body)
+    expect(body.get('grant_type')).toBe('refresh_token')
+    expect(body.get('refresh_token')).toBe('stored-refresh')
+    expect(body.get('client_id')).toBe('client-abc')
+    expect(body.get('resource')).toBe('urn:io.sanity:organization:org123')
+
+    expect(result).toMatchObject({accessToken: 'new-access', refreshToken: 'new-refresh'})
+    expect(readStored(storageArea)).toMatchObject({accessToken: 'new-access'})
+  })
+
+  it('shares a single in-flight request across concurrent callers', async () => {
+    const pending = deferred<typeof tokenResponse>()
+    const request = vi.fn().mockReturnValue(pending.promise)
+    setup({
+      request,
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+    })
+
+    const a = refreshOAuthTokens(instance!)
+    const b = refreshOAuthTokens(instance!)
+
+    pending.resolve(tokenResponse)
+    const [ra, rb] = await Promise.all([a, b])
+
+    expect(request).toHaveBeenCalledTimes(1)
+    expect(ra).toBe(rb)
+    expect(ra).toMatchObject({accessToken: 'new-access'})
+  })
+
+  it('keeps the previous refresh token when the endpoint omits one', async () => {
+    const request = vi.fn().mockResolvedValue({
+      access_token: 'new-access',
+      token_type: 'bearer',
+      expires_in: 3600,
+    })
+    const {storageArea} = setup({
+      request,
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+    })
+
+    await refreshOAuthTokens(instance!)
+
+    expect(readStored(storageArea)).toMatchObject({refreshToken: 'stored-refresh'})
+  })
+
+  it('logs out when there is no refresh token', async () => {
+    const noRefresh = {...seededTokens, refreshToken: undefined}
+    const {request, storageArea} = setup({
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(noRefresh)},
+    })
+
+    const result = await refreshOAuthTokens(instance!)
+
+    expect(result).toBeNull()
+    expect(request).not.toHaveBeenCalled()
+    expect(readStored(storageArea)).toBeNull()
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.LOGGED_OUT})
+  })
+
+  it('clears tokens and logs out on an unrecoverable (4xx) refresh failure', async () => {
+    const invalidGrant = new ClientError({
+      statusCode: 400,
+      headers: {},
+      body: {error: 'invalid_grant'},
+    })
+    const request = vi.fn().mockRejectedValue(invalidGrant)
+    const {storageArea} = setup({
+      request,
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+    })
+
+    await expect(refreshOAuthTokens(instance!)).rejects.toBe(invalidGrant)
+    expect(readStored(storageArea)).toBeNull()
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.LOGGED_OUT})
+  })
+
+  it('keeps the session on a transient refresh failure', async () => {
+    const networkError = new Error('network down')
+    const request = vi.fn().mockRejectedValue(networkError)
+    const {storageArea} = setup({
+      request,
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+    })
+
+    await expect(refreshOAuthTokens(instance!)).rejects.toBe(networkError)
+    // Tokens are preserved and the user stays logged in for a retry.
+    expect(readStored(storageArea)).toMatchObject({accessToken: 'stored-access'})
+    expect(getOAuthTokensState(instance!).getCurrent()).toMatchObject({
+      accessToken: 'stored-access',
+    })
+  })
+
+  it('keeps the session on a 429 rate-limit refresh failure', async () => {
+    const rateLimited = new ClientError({
+      statusCode: 429,
+      headers: {},
+      body: {error: 'rate_limited'},
+    })
+    const request = vi.fn().mockRejectedValue(rateLimited)
+    const {storageArea} = setup({
+      request,
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+    })
+
+    await expect(refreshOAuthTokens(instance!)).rejects.toBe(rateLimited)
+    expect(readStored(storageArea)).toMatchObject({accessToken: 'stored-access'})
+  })
+})
+
+describe('revokeOAuthTokens', () => {
+  it('revokes with token and client_id, then clears local state', async () => {
+    const {request, storageArea} = setup({
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+    })
+
+    await revokeOAuthTokens(instance!)
+
+    expect(request).toHaveBeenCalledTimes(1)
+    const call = request.mock.calls[0][0]
+    expect(call).toMatchObject({method: 'POST', url: '/auth/oauth/revoke', tag: 'oauth.revoke'})
+    const body = parseBody(call.body)
+    expect(body.get('token')).toBe('stored-refresh')
+    expect(body.get('client_id')).toBe('client-abc')
+
+    expect(readStored(storageArea)).toBeNull()
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.LOGGED_OUT})
+  })
+
+  it('clears local state even when the revoke request fails', async () => {
+    const request = vi.fn().mockRejectedValue(new Error('revoke failed'))
+    const {storageArea} = setup({
+      request,
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+    })
+
+    await expect(revokeOAuthTokens(instance!)).resolves.toBeUndefined()
+    expect(readStored(storageArea)).toBeNull()
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.LOGGED_OUT})
+  })
+
+  it('clears state without calling the endpoint when there is no token', async () => {
+    const {request, storageArea} = setup()
+
+    await revokeOAuthTokens(instance!)
+
+    expect(request).not.toHaveBeenCalled()
+    expect(readStored(storageArea)).toBeNull()
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.LOGGED_OUT})
+  })
+})
+
+describe('getOAuthTokensState', () => {
+  it('exposes the current OAuth tokens', () => {
+    setup({storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)}})
+    expect(getOAuthTokensState(instance!).getCurrent()).toEqual(seededTokens)
+  })
+
+  it('returns null when there are no OAuth tokens', () => {
+    setup()
+    expect(getOAuthTokensState(instance!).getCurrent()).toBeNull()
+  })
+})