@sanity/sdk 3.2.0 → 3.3.0-rc.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanity/sdk",
-  "version": "3.2.0",
+  "version": "3.3.0-rc.0",
   "private": false,
   "description": "Sanity SDK",
   "keywords": [
@@ -53,9 +53,9 @@
     "@sanity/image-url": "^2.1.1",
     "@sanity/json-match": "^1.0.5",
     "@sanity/message-protocol": "^0.24.0",
-    "@sanity/mutate": "^0.18.1",
+    "@sanity/mutate": "^0.18.2",
     "@sanity/telemetry": "^1.1.0",
-    "@sanity/types": "^6.13.0",
+    "@sanity/types": "^6.13.2",
     "groq": "^6.13.2",
     "groq-js": "^2.0.0",
     "reselect": "^5.1.1",

package/src/auth/authStore.test.ts

@@ -339,6 +339,24 @@ describe('authStore', () => {
       expect(options.authMethod).toBe('localstorage')
     })
 
+    it('only exposes oauth options when the resolved mode is oauth', () => {
+      const oauth = {
+        clientId: 'client-abc',
+        redirectUri: 'https://app.example.com/callback',
+        organizationId: 'org123',
+      }
+      vi.mocked(getStudioTokenFromLocalStorage).mockReturnValue(null)
+      vi.mocked(getTokenFromStorage).mockReturnValue(null)
+
+      // studio takes precedence over oauth, so oauth options must be dropped
+      instance = createSanityInstance({projectId: 'p', dataset: 'd', studio: {}, auth: {oauth}})
+      expect(authStore.getInitialState(instance, null).options.oauth).toBeUndefined()
+      instance.dispose()
+
+      instance = createSanityInstance({projectId: 'p', dataset: 'd', auth: {oauth}})
+      expect(authStore.getInitialState(instance, null).options.oauth).toEqual(oauth)
+    })
+
     it('logs auth initialized in logged out state when no token available', () => {
       instance = createSanityInstance({
         projectId: 'p',

package/src/auth/authStore.ts

@@ -191,7 +191,10 @@ export const authStore = defineStore<AuthStoreState>({
         storageKey: result.storageKey,
         storageArea: result.storageArea,
         authMethod: result.authMethod,
-        oauth: authConfig.oauth,
+        // Only expose oauth options when the oauth strategy is actually in use,
+        // so mode-gated actions (logout, handleAuthCallback) stay consistent
+        // with the resolved mode (e.g. `studio` takes precedence over `oauth`).
+        oauth: mode === 'oauth' ? authConfig.oauth : undefined,
       },
     }
   },

package/src/auth/handleAuthCallback.test.ts

@@ -5,6 +5,7 @@ import {createSanityInstance, type SanityInstance} from '../store/createSanityIn
 import {AuthStateType} from './authStateType'
 import {getAuthState} from './authStore'
 import {handleAuthCallback} from './handleAuthCallback'
+import {handleOAuthCallback} from './oauth/oauthActions'
 import {subscribeToStateAndFetchCurrentUser} from './subscribeToStateAndFetchCurrentUser'
 import {subscribeToStorageEventsAndSetToken} from './subscribeToStorageEventsAndSetToken'
 import {getAuthCode, getTokenFromLocation, getTokenFromStorage} from './utils'
@@ -22,6 +23,11 @@ vi.mock('./utils', async (importOriginal) => {
 vi.mock('./subscribeToStateAndFetchCurrentUser')
 vi.mock('./subscribeToStorageEventsAndSetToken')
 
+vi.mock('./oauth/oauthActions', async (importOriginal) => {
+  const original = await importOriginal<typeof import('./oauth/oauthActions')>()
+  return {...original, handleOAuthCallback: vi.fn()}
+})
+
 // Mock logger to prevent actual logging during tests
 vi.mock('../utils/logger', async (importOriginal) => {
   const original = await importOriginal<typeof import('../utils/logger')>()
@@ -277,4 +283,31 @@ describe('handleCallback', () => {
     // Verify logger was called
     expect(createLogger).toHaveBeenCalled()
   })
+
+  it('delegates to handleOAuthCallback in OAuth mode', async () => {
+    const clientFactory = vi.fn()
+    vi.mocked(getTokenFromStorage).mockReturnValue(null)
+    vi.mocked(handleOAuthCallback).mockResolvedValue('https://app.example.com/callback')
+
+    instance = createSanityInstance({
+      projectId: 'p',
+      dataset: 'd',
+      auth: {
+        clientFactory,
+        oauth: {
+          clientId: 'client-abc',
+          redirectUri: 'https://app.example.com/callback',
+          organizationId: 'org123',
+        },
+      },
+    })
+
+    const href = 'https://app.example.com/callback?code=abc&state=xyz'
+    const result = await handleAuthCallback(instance, href)
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(handleOAuthCallback).toHaveBeenCalledWith(instance, href)
+    expect(getAuthCode).not.toHaveBeenCalled()
+    expect(clientFactory).not.toHaveBeenCalled()
+  })
 })

package/src/auth/handleAuthCallback.ts

@@ -3,6 +3,7 @@ import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
 import {getAuthLogger} from './authLogger'
 import {AuthStateType} from './authStateType'
 import {authStore, type AuthStoreState, type DashboardContext} from './authStore'
+import {handleOAuthCallback} from './oauth/oauthActions'
 import {
   createLoggedInAuthState,
   getAuthCode,
@@ -12,6 +13,10 @@ import {
 } from './utils'
 
 /**
+ * Handles the auth redirect callback. In OAuth mode this delegates to
+ * {@link handleOAuthCallback}; otherwise it exchanges the legacy `sid` for a
+ * long-lived token.
+ *
  * @public
  */
 export const handleAuthCallback = bindActionGlobally(
@@ -19,7 +24,7 @@ export const handleAuthCallback = bindActionGlobally(
   async ({state, instance}, locationHref: string = getDefaultLocation()) => {
     const logger = getAuthLogger(instance)
 
-    const {providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey} =
+    const {providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey, oauth} =
       state.get().options
 
     // If a token is provided, no need to handle callback
@@ -28,6 +33,11 @@ export const handleAuthCallback = bindActionGlobally(
       return false
     }
 
+    if (oauth) {
+      logger.debug('OAuth mode - delegating to handleOAuthCallback')
+      return handleOAuthCallback(instance, locationHref)
+    }
+
     // Don't handle the callback if already in flight.
     const {authState} = state.get()
     if (authState.type === AuthStateType.LOGGING_IN && authState.isExchangingToken) {

package/src/auth/logout.test.ts

@@ -169,7 +169,7 @@ describe('logout', () => {
     expect(removeItem).toHaveBeenCalledWith('__sanity_auth_token')
   })
 
-  it('clears the OAuth tokens from the store on logout', async () => {
+  it('revokes OAuth tokens instead of calling /auth/logout in OAuth mode', async () => {
     const oauthTokens: OAuthTokens = {
       accessToken: 'oauth-access',
       tokenType: 'bearer',
@@ -204,8 +204,16 @@ describe('logout', () => {
     // Boots logged in with the persisted OAuth tokens exposed on the store.
     expect(getOAuthTokensState(instance).getCurrent()).toMatchObject({accessToken: 'oauth-access'})
 
+    const first = logout(instance)
+    // Session is marked as destroying so a concurrent call is a no-op
+    expect(getAuthState(instance).getCurrent()).toMatchObject({isDestroyingSession: true})
     await logout(instance)
+    await first
 
+    expect(mockRequest).toHaveBeenCalledTimes(1)
+    expect(mockRequest).toHaveBeenCalledWith(
+      expect.objectContaining({url: '/auth/oauth/revoke', tag: 'oauth.revoke'}),
+    )
     expect(getOAuthTokensState(instance).getCurrent()).toBeNull()
     expect(getAuthState(instance).getCurrent()).toMatchObject({type: AuthStateType.LOGGED_OUT})
     expect(map.get(OAUTH_TOKENS_KEY)).toBeUndefined()

package/src/auth/logout.ts

@@ -3,14 +3,22 @@ import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
 import {getAuthLogger} from './authLogger'
 import {AuthStateType} from './authStateType'
 import {authStore} from './authStore'
+import {revokeOAuthTokens} from './oauth/oauthActions'
 
 /**
+ * Logs the current user out. In OAuth mode this revokes the OAuth tokens
+ * instead of calling the legacy `/auth/logout` endpoint; revocation is
+ * best-effort, so the OAuth path resolves even if the revoke request fails,
+ * whereas the legacy path rejects when `/auth/logout` fails. Local state and
+ * storage are cleared in both cases.
+ *
  * @public
  */
 export const logout = bindActionGlobally(authStore, async ({state, instance}) => {
   const logger = getAuthLogger(instance)
 
-  const {clientFactory, apiHost, providedToken, storageArea, storageKey} = state.get().options
+  const {clientFactory, apiHost, providedToken, storageArea, storageKey, oauth} =
+    state.get().options
 
   // If a token is statically provided, logout does nothing
   if (providedToken) {
@@ -25,6 +33,15 @@ export const logout = bindActionGlobally(authStore, async ({state, instance}) =>
     logger.debug('Skipping logout - already in progress')
     return
   }
+
+  if (oauth) {
+    logger.debug('OAuth mode - revoking tokens instead of calling /auth/logout')
+    state.set('loggingOut', {
+      authState: {type: AuthStateType.LOGGED_OUT, isDestroyingSession: true},
+    })
+    await revokeOAuthTokens(instance)
+    return
+  }
   const token = authState.type === AuthStateType.LOGGED_IN && authState.token
 
   try {

package/src/auth/oauth/oauthActions.test.ts

@@ -9,6 +9,7 @@ import {subscribeToStateAndFetchCurrentUser} from '../subscribeToStateAndFetchCu
 import {
   getOAuthTokensState,
   handleOAuthCallback,
+  OAUTH_RETURN_TO_KEY,
   OAUTH_STATE_KEY,
   OAUTH_VERIFIER_KEY,
   refreshOAuthTokens,
@@ -156,6 +157,28 @@ describe('startOAuthAuthorization', () => {
     expect(url.searchParams.getAll('resource')).toEqual(['urn:io.sanity:organization:org123'])
   })
 
+  it('stashes the current location to return to, keeping app params intact', async () => {
+    const href = 'https://app.example.com/documents/abc?state=draft&code=x#h'
+    vi.stubGlobal('window', {location: {assign: vi.fn(), href}})
+    vi.stubGlobal('location', {href})
+    const {session} = setup()
+
+    await startOAuthAuthorization(instance!)
+
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe(href)
+  })
+
+  it('strips stale OAuth params from the stashed location when already on the callback route', async () => {
+    const href = 'https://app.example.com/callback?x=1&code=old&state=old'
+    vi.stubGlobal('window', {location: {assign: vi.fn(), href}})
+    vi.stubGlobal('location', {href})
+    const {session} = setup()
+
+    await startOAuthAuthorization(instance!)
+
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe('https://app.example.com/callback?x=1')
+  })
+
   it('throws when OAuth is not configured', async () => {
     setup({withOAuthConfig: false})
     await expect(startOAuthAuthorization(instance!)).rejects.toThrow(/OAuth is not configured/)
@@ -203,6 +226,75 @@ describe('handleOAuthCallback', () => {
     })
   })
 
+  it('returns the stashed same-origin location after a successful exchange', async () => {
+    const returnTo = 'https://app.example.com/documents/abc?x=1'
+    const {session} = setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'state-xyz',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: returnTo,
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(returnTo)
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
+  })
+
+  it('ignores a stashed location on a different origin', async () => {
+    setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'state-xyz',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: 'https://evil.example.com/',
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+  })
+
+  it('ignores a stashed location that is not a URL', async () => {
+    setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'state-xyz',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: 'not a url',
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+  })
+
+  it('does not restore the stashed location on a state mismatch', async () => {
+    const {session} = setup({
+      sessionSeed: {
+        [OAUTH_STATE_KEY]: 'different',
+        [OAUTH_VERIFIER_KEY]: 'verifier-1',
+        [OAUTH_RETURN_TO_KEY]: 'https://app.example.com/deep',
+      },
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
+  })
+
+  it('does not restore the stashed location on an ?error= callback', async () => {
+    const {session} = setup({sessionSeed: {[OAUTH_RETURN_TO_KEY]: 'https://app.example.com/deep'}})
+
+    const result = await handleOAuthCallback(
+      instance!,
+      'https://app.example.com/callback?error=access_denied',
+    )
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
+  })
+
   it('does not perform a second exchange on a duplicate concurrent invocation', async () => {
     const pending = deferred<typeof tokenResponse>()
     const request = vi.fn().mockReturnValue(pending.promise)
@@ -221,6 +313,31 @@ describe('handleOAuthCallback', () => {
     expect(await first).toBe('https://app.example.com/callback')
   })
 
+  it('does not clobber LOGGED_IN when called again with a stale callback URL', async () => {
+    const {request} = setup({
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
+    })
+
+    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
+      'https://app.example.com/callback',
+    )
+    // Artifacts are now cleared; a repeat with the same URL fails state validation.
+    // Seed fresh artifacts as if a re-authorization started in this tab: the
+    // ignored stale callback must not wipe them.
+    sessionStorage.setItem(OAUTH_STATE_KEY, 'state-next')
+    sessionStorage.setItem(OAUTH_VERIFIER_KEY, 'verifier-next')
+    const result = await handleOAuthCallback(instance!, callbackHref)
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(request).toHaveBeenCalledTimes(1)
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({
+      type: AuthStateType.LOGGED_IN,
+      token: 'new-access',
+    })
+    expect(sessionStorage.getItem(OAUTH_STATE_KEY)).toBe('state-next')
+    expect(sessionStorage.getItem(OAUTH_VERIFIER_KEY)).toBe('verifier-next')
+  })
+
   it('surfaces an ?error= callback as ERROR without exchanging', async () => {
     const {request} = setup()
 
@@ -234,6 +351,25 @@ describe('handleOAuthCallback', () => {
     expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.ERROR})
   })
 
+  it('ignores an ?error= callback when a session is already established', async () => {
+    setup({
+      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
+      sessionSeed: {[OAUTH_STATE_KEY]: 'state-next', [OAUTH_VERIFIER_KEY]: 'verifier-next'},
+    })
+
+    const result = await handleOAuthCallback(
+      instance!,
+      'https://app.example.com/callback?error=access_denied',
+    )
+
+    expect(result).toBe('https://app.example.com/callback')
+    expect(getAuthState(instance!).getCurrent()).toMatchObject({
+      type: AuthStateType.LOGGED_IN,
+      token: seededTokens.accessToken,
+    })
+    expect(sessionStorage.getItem(OAUTH_STATE_KEY)).toBe('state-next')
+  })
+
   it('surfaces an ?error= callback without a description', async () => {
     setup()
     await handleOAuthCallback(instance!, 'https://app.example.com/callback?error=access_denied')

package/src/auth/oauth/oauthActions.ts

@@ -17,6 +17,25 @@ export const OAUTH_VERIFIER_KEY = '__sanity_oauth_verifier'
 /** sessionStorage key for the CSRF `state` value. */
 export const OAUTH_STATE_KEY = '__sanity_oauth_state'
 
+/** sessionStorage key for the location to return to after the callback. */
+export const OAUTH_RETURN_TO_KEY = '__sanity_oauth_return_to'
+
+const OAUTH_CALLBACK_PARAMS = ['code', 'state', 'error', 'error_description']
+
+/** Strips the OAuth callback params from a URL. */
+function stripOAuthParams(href: string): string {
+  const url = new URL(href, DEFAULT_BASE)
+  for (const param of OAUTH_CALLBACK_PARAMS) url.searchParams.delete(param)
+  return url.toString()
+}
+
+/** Whether `href` is the registered redirect URI (origin + pathname; query and hash ignored). */
+function isCallbackRoute(href: string, redirectUri: string): boolean {
+  const current = new URL(href, DEFAULT_BASE)
+  const redirect = new URL(redirectUri, DEFAULT_BASE)
+  return current.origin === redirect.origin && current.pathname === redirect.pathname
+}
+
 interface TokenEndpointResponse {
   access_token: string
   token_type: string
@@ -99,6 +118,17 @@ export const startOAuthAuthorization = bindActionGlobally(authStore, async ({sta
   const session = typeof sessionStorage !== 'undefined' ? sessionStorage : undefined
   session?.setItem(OAUTH_VERIFIER_KEY, codeVerifier)
   session?.setItem(OAUTH_STATE_KEY, oauthState)
+  // The redirect URI must match the registered one exactly, so the current
+  // location (deep link) is stashed here and restored by the callback. OAuth
+  // params are only stripped when we are already on the callback route, so
+  // legitimate app params like `?state=draft` survive the round trip.
+  const currentHref = getDefaultLocation()
+  if (currentHref !== DEFAULT_BASE) {
+    const returnTo = isCallbackRoute(currentHref, options.oauth.redirectUri)
+      ? stripOAuthParams(currentHref)
+      : currentHref
+    session?.setItem(OAUTH_RETURN_TO_KEY, returnTo)
+  }
 
   const authorizeUrl = new URL(
     '/v1/auth/oauth/authorize',
@@ -123,9 +153,14 @@ export const startOAuthAuthorization = bindActionGlobally(authStore, async ({sta
  * responses, exchanges the authorization `code` for tokens, persists them, and
  * transitions to `LOGGED_IN`.
  *
- * Returns the callback URL cleaned of OAuth params (for the caller to
- * `history.replaceState`) when a callback was processed, or `false` when there
- * was nothing to handle (no code, or an exchange already in progress).
+ * Returns the URL for the caller to `history.replaceState` to when a callback
+ * was processed: on success, the same-origin location the user was on when
+ * the flow started (if any), otherwise the callback URL cleaned of OAuth
+ * params. Returns `false` when there was nothing to handle (no code, or an
+ * exchange already in progress). A callback that fails validation while a
+ * session is already `LOGGED_IN` (e.g. a remount before the params were
+ * stripped) is ignored with a warning and still returns the cleaned URL, so a
+ * string result does not imply an exchange ran.
  *
  * @public
  */
@@ -152,22 +187,29 @@ export const handleOAuthCallback = bindActionGlobally(
 
     const session = typeof sessionStorage !== 'undefined' ? sessionStorage : undefined
 
-    const cleanedUrlObj = new URL(locationHref, DEFAULT_BASE)
-    for (const param of ['code', 'state', 'error', 'error_description']) {
-      cleanedUrlObj.searchParams.delete(param)
+    const cleanedUrl = stripOAuthParams(locationHref)
+
+    // Callback failures move to ERROR, unless a session is already
+    // established: a stale callback URL (e.g. remount before the params were
+    // stripped, after the artifacts were cleared) or a denied re-authorization
+    // must not clobber LOGGED_IN.
+    const rejectCallback = (name: string, message: string): string => {
+      if (authState.type === AuthStateType.LOGGED_IN) {
+        // Leave PKCE artifacts alone: a re-authorization may be in flight.
+        logger.warn(`${message} — ignoring callback, session already established`)
+        return cleanedUrl
+      }
+      logger.error(`${message} — rejecting callback`)
+      clearOAuthArtifacts(session)
+      state.set(name, {authState: {type: AuthStateType.ERROR, error: new Error(message)}})
+      return cleanedUrl
     }
-    const cleanedUrl = cleanedUrlObj.toString()
 
     if (error) {
-      logger.warn('OAuth callback returned an error', {error, errorDescription})
-      clearOAuthArtifacts(session)
-      state.set('oauthCallbackError', {
-        authState: {
-          type: AuthStateType.ERROR,
-          error: new Error(errorDescription ? `${error}: ${errorDescription}` : error),
-        },
-      })
-      return cleanedUrl
+      return rejectCallback(
+        'oauthCallbackError',
+        errorDescription ? `${error}: ${errorDescription}` : error,
+      )
     }
 
     if (!code) {
@@ -177,22 +219,12 @@ export const handleOAuthCallback = bindActionGlobally(
 
     const storedState = session?.getItem(OAUTH_STATE_KEY) ?? null
     if (!returnedState || !storedState || returnedState !== storedState) {
-      logger.error('OAuth state mismatch — rejecting callback')
-      clearOAuthArtifacts(session)
-      state.set('oauthStateMismatch', {
-        authState: {type: AuthStateType.ERROR, error: new Error('OAuth state mismatch')},
-      })
-      return cleanedUrl
+      return rejectCallback('oauthStateMismatch', 'OAuth state mismatch')
     }
 
     const codeVerifier = session?.getItem(OAUTH_VERIFIER_KEY) ?? null
     if (!codeVerifier) {
-      logger.error('OAuth code verifier missing — cannot exchange code')
-      clearOAuthArtifacts(session)
-      state.set('oauthVerifierMissing', {
-        authState: {type: AuthStateType.ERROR, error: new Error('OAuth code verifier missing')},
-      })
-      return cleanedUrl
+      return rejectCallback('oauthVerifierMissing', 'OAuth code verifier missing')
     }
 
     logger.info('Exchanging OAuth code for tokens')
@@ -220,6 +252,7 @@ export const handleOAuthCallback = bindActionGlobally(
 
       const tokens = toOAuthTokens(response)
       options.storageArea?.setItem(options.storageKey, serializeTokens(tokens))
+      const returnTo = getSameOriginReturnTo(session, options.oauth.redirectUri)
       clearOAuthArtifacts(session)
 
       logger.info('OAuth tokens obtained, user logged in')
@@ -227,7 +260,7 @@ export const handleOAuthCallback = bindActionGlobally(
         authState: createLoggedInAuthState(tokens.accessToken, null),
         oauthTokens: tokens,
       })
-      return cleanedUrl
+      return returnTo ?? cleanedUrl
     } catch (exchangeError) {
       logger.error('Failed to exchange OAuth code for tokens', {error: exchangeError})
       clearOAuthArtifacts(session)
@@ -386,4 +419,20 @@ export const getOAuthTokensState = bindActionGlobally(
 function clearOAuthArtifacts(session: Storage | undefined): void {
   session?.removeItem(OAUTH_VERIFIER_KEY)
   session?.removeItem(OAUTH_STATE_KEY)
+  session?.removeItem(OAUTH_RETURN_TO_KEY)
+}
+
+/**
+ * Reads the stashed pre-authorize location, only honouring it when it shares
+ * the registered redirect URI's origin so a tampered value cannot redirect
+ * off-site. (`origin` includes the scheme, so non-http(s) URLs are rejected.)
+ */
+function getSameOriginReturnTo(session: Storage | undefined, redirectUri: string): string | null {
+  const returnTo = session?.getItem(OAUTH_RETURN_TO_KEY) ?? null
+  if (!returnTo) return null
+  try {
+    return new URL(returnTo).origin === new URL(redirectUri).origin ? returnTo : null
+  } catch {
+    return null
+  }
 }

package/src/auth/oauth/oauthAuth.test.ts

@@ -83,6 +83,11 @@ describe('serialize/deserialize tokens', () => {
     expect(deserializeTokens('{"foo":"bar"}')).toBeNull()
     expect(deserializeTokens('123')).toBeNull()
   })
+
+  it('returns null when expiresAt does not parse to a valid date', () => {
+    const raw = JSON.stringify({...JSON.parse(serializeTokens(tokens)), expiresAt: 'garbage'})
+    expect(deserializeTokens(raw)).toBeNull()
+  })
 })
 
 describe('getOauthInitialState', () => {
@@ -94,6 +99,16 @@ describe('getOauthInitialState', () => {
     expect(result.authMethod).toBe('localstorage')
   })
 
+  it('returns LOGGED_OUT and clears storage when persisted tokens are corrupt', () => {
+    const storageArea = createMemoryStorage({
+      [OAUTH_TOKENS_KEY]: '{"accessToken":"a","expiresAt":"garbage"}',
+    })
+    const result = getOauthInitialState(baseOptions({storageArea}))
+    expect(result.authState).toEqual({type: AuthStateType.LOGGED_OUT, isDestroyingSession: false})
+    expect(result.oauthTokens).toBeUndefined()
+    expect(storageArea.getItem(OAUTH_TOKENS_KEY)).toBeNull()
+  })
+
   it('returns LOGGING_IN when the callback URL matches the redirect URI', () => {
     const storageArea = createMemoryStorage()
     const result = getOauthInitialState(
@@ -110,6 +125,14 @@ describe('getOauthInitialState', () => {
     expect(result.authState).toEqual({type: AuthStateType.LOGGED_OUT, isDestroyingSession: false})
   })
 
+  it('returns LOGGED_OUT when the redirect URI only carries a stray state param', () => {
+    const storageArea = createMemoryStorage()
+    const result = getOauthInitialState(
+      baseOptions({storageArea, initialLocationHref: 'https://app/callback?state=s'}),
+    )
+    expect(result.authState).toEqual({type: AuthStateType.LOGGED_OUT, isDestroyingSession: false})
+  })
+
   it('returns LOGGED_OUT when there are no tokens and no callback', () => {
     const storageArea = createMemoryStorage()
     const result = getOauthInitialState(baseOptions({storageArea}))

package/src/auth/oauth/oauthAuth.ts

@@ -19,7 +19,9 @@ interface SerializedOAuthTokens extends Omit<OAuthTokens, 'expiresAt'> {
 
 /**
  * Parses persisted token JSON back into {@link OAuthTokens}. Returns `null`
- * when the value is missing or malformed.
+ * when the value is missing or malformed, including an `expiresAt` that does
+ * not parse to a valid date (an `Invalid Date` would otherwise read as never
+ * expiring, since `NaN <= now` is always `false`).
  *
  * @internal
  */
@@ -38,11 +40,13 @@ export function deserializeTokens(raw: string | null): OAuthTokens | null {
       return null
     }
     const value = parsed as SerializedOAuthTokens
+    const expiresAt = new Date(value.expiresAt)
+    if (Number.isNaN(expiresAt.getTime())) return null
     return {
       accessToken: value.accessToken,
       tokenType: 'bearer',
       expiresIn: value.expiresIn,
-      expiresAt: new Date(value.expiresAt),
+      expiresAt,
       ...(value.refreshToken !== undefined && {refreshToken: value.refreshToken}),
     }
   } catch {
@@ -55,7 +59,7 @@ export function deserializeTokens(raw: string | null): OAuthTokens | null {
  *
  * State discovery order:
  * 1. Persisted tokens in `__sanity_oauth_tokens` → `LOGGED_IN`
- * 2. Callback URL (contains `code`/`state`/`error` and matches `redirectUri`)
+ * 2. Callback URL (contains `code` or `error` and matches `redirectUri`)
  *    → `LOGGING_IN`
  * 3. Otherwise → `LOGGED_OUT`
  *
@@ -68,7 +72,12 @@ export function getOauthInitialState(options: AuthStrategyOptions): AuthStrategy
   const redirectUri = authConfig.oauth?.redirectUri
 
   // Persisted tokens win
-  const tokens = deserializeTokens(storageArea?.getItem(OAUTH_TOKENS_KEY) ?? null)
+  const rawTokens = storageArea?.getItem(OAUTH_TOKENS_KEY) ?? null
+  const tokens = deserializeTokens(rawTokens)
+  if (rawTokens && !tokens) {
+    // Corrupt entry: drop it so it cannot keep shadowing a fresh login
+    storageArea?.removeItem(OAUTH_TOKENS_KEY)
+  }
   if (tokens) {
     return {
       authState: createLoggedInAuthState(tokens.accessToken, null),
@@ -80,11 +89,12 @@ export function getOauthInitialState(options: AuthStrategyOptions): AuthStrategy
     }
   }
 
-  // Callback URL with code/state/error whose origin + pathname match our
-  // redirect URI (query and hash are ignored).
+  // Callback URL with code/error whose origin + pathname match our redirect
+  // URI (query and hash are ignored). `state` alone is not a callback: the
+  // server always sends `code` or `error`, and handleOAuthCallback would
+  // otherwise leave the app stuck in LOGGING_IN.
   const {searchParams} = new URL(initialLocationHref, DEFAULT_BASE)
-  const isCallback =
-    searchParams.has('code') || searchParams.has('state') || searchParams.has('error')
+  const isCallback = searchParams.has('code') || searchParams.has('error')
   if (redirectUri && isCallback) {
     const loc = new URL(initialLocationHref, DEFAULT_BASE)
     const redirect = new URL(redirectUri, DEFAULT_BASE)