@sanity/sdk 3.3.0-rc.0 → 3.3.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sanity/sdk",
-  "version": "3.3.0-rc.0",
+  "version": "3.3.0",
   "private": false,
   "description": "Sanity SDK",
   "keywords": [
@@ -45,7 +45,7 @@
   },
   "dependencies": {
     "@sanity/bifur-client": "^1.0.0",
-    "@sanity/client": "^8.6.1",
+    "@sanity/client": "^8.6.2",
     "@sanity/comlink": "^4.0.3",
     "@sanity/diff-match-patch": "^3.2.0",
     "@sanity/diff-patch": "^6.0.0",
@@ -55,7 +55,7 @@
     "@sanity/message-protocol": "^0.24.0",
     "@sanity/mutate": "^0.18.2",
     "@sanity/telemetry": "^1.1.0",
-    "@sanity/types": "^6.13.2",
+    "@sanity/types": "^6.14.1",
     "groq": "^6.13.2",
     "groq-js": "^2.0.0",
     "reselect": "^5.1.1",
@@ -70,14 +70,14 @@
     "@repo/tsconfig": "0.0.1",
     "@sanity/browserslist-config": "^1.0.5",
     "@sanity/pkg-utils": "^13.0.0",
-    "@types/node": "^24.13.4",
-    "@vitest/coverage-v8": "^5.0.0",
+    "@types/node": "^24.13.5",
+    "@vitest/coverage-v8": "^5.0.1",
     "eslint": "^10.10.0",
-    "oxfmt": "^0.67.0",
+    "oxfmt": "^0.68.0",
     "rolldown": "^1.2.8",
     "typescript": "^6.0.3",
     "vite": "^8.3.0",
-    "vitest": "^5.0.0"
+    "vitest": "^5.0.1"
   },
   "browserslist": "extends @sanity/browserslist-config",
   "scripts": {

package/src/_exports/_internal.ts

@@ -1,3 +1,4 @@
+export {getApplicationOrigin} from '../applications/applicationOrigin'
 export {isStudioConfig} from '../auth/authMode'
 export {
   type ApiErrorBody,
@@ -17,6 +18,7 @@ export {
   isDashboardEnvironment,
   requireDashboardMessageBus,
 } from '../dashboard/messageBus/store'
+export type {ApplicationStatus, ApplicationStatusUpdate} from '../dashboard/messageBus/topics'
 export {getTopicState, resolveTopic} from '../dashboard/messageBus/topicStore'
 export {PREVIEW_PROJECTION} from '../preview/previewConstants'
 export {transformProjectionToPreview} from '../preview/previewProjectionUtils'

package/src/applications/applicationOrigin.test.ts

@@ -0,0 +1,51 @@
+import {afterEach, describe, expect, it, vi} from 'vitest'
+
+import {getApplicationOrigin} from './applicationOrigin'
+import {type ApplicationBase} from './applications'
+
+const application: ApplicationBase = {
+  id: 'application-1',
+  type: 'coreApp',
+  title: 'Inbox',
+  name: 'inbox',
+  reference: 'sanity/inbox',
+  icon: null,
+  isSingleton: true,
+  visibility: 'default',
+  slug: 'inbox',
+  externalUrl: null,
+  organizationId: 'organization-1',
+  createdAt: '2026-01-01T00:00:00.000Z',
+  updatedAt: '2026-01-02T00:00:00.000Z',
+}
+
+describe('getApplicationOrigin', () => {
+  afterEach(() => vi.unstubAllGlobals())
+
+  it('derives singleton and organization origins from the slug', () => {
+    expect(getApplicationOrigin(application)).toBe('https://inbox-apps-organization-1.sanity.run')
+    expect(getApplicationOrigin({...application, isSingleton: false, slug: 'canvas'})).toBe(
+      'https://canvas.sanity.studio',
+    )
+  })
+
+  it('uses the staging domains when the host sets the runtime flag', () => {
+    vi.stubGlobal('__SANITY_STAGING__', true)
+    expect(getApplicationOrigin(application)).toBe(
+      'https://inbox-apps-organization-1.run.sanity.work',
+    )
+    expect(getApplicationOrigin({...application, isSingleton: false})).toBe(
+      'https://inbox.studio.sanity.work',
+    )
+  })
+
+  it('prefers the external URL origin and returns null without slug or URL', () => {
+    expect(
+      getApplicationOrigin({
+        ...application,
+        externalUrl: 'https://apps.example.com/external/index.html',
+      }),
+    ).toBe('https://apps.example.com')
+    expect(getApplicationOrigin({...application, slug: null})).toBeNull()
+  })
+})

package/src/applications/applicationOrigin.ts

@@ -0,0 +1,26 @@
+import {type ApplicationBase} from './applications'
+
+type SanityGlobal = typeof globalThis & {__SANITY_STAGING__?: boolean}
+
+/**
+ * The origin an application is served from, or `null` when it has neither an external URL nor
+ * a slug to derive one from. Callers treat `null` as "nothing to load" rather than failing the
+ * whole list on one bad record.
+ *
+ * @internal
+ */
+export function getApplicationOrigin(application: ApplicationBase): string | null {
+  if (application.externalUrl !== null) return new URL(application.externalUrl).origin
+  if (application.slug === null) return null
+
+  // Read at runtime, not via a bundler define: a remote is built once and runs in whichever
+  // host page loaded it, and the host sets this flag. Mirrors workbench's `getSanityEnv`.
+  const staging = (globalThis as SanityGlobal).__SANITY_STAGING__ === true
+  if (application.isSingleton) {
+    const domain = staging ? 'run.sanity.work' : 'sanity.run'
+    return `https://${application.slug}-apps-${application.organizationId}.${domain}`
+  }
+
+  const domain = staging ? 'studio.sanity.work' : 'sanity.studio'
+  return `https://${application.slug}.${domain}`
+}

package/src/auth/authStore.test.ts

@@ -339,24 +339,6 @@ describe('authStore', () => {
       expect(options.authMethod).toBe('localstorage')
     })
 
-    it('only exposes oauth options when the resolved mode is oauth', () => {
-      const oauth = {
-        clientId: 'client-abc',
-        redirectUri: 'https://app.example.com/callback',
-        organizationId: 'org123',
-      }
-      vi.mocked(getStudioTokenFromLocalStorage).mockReturnValue(null)
-      vi.mocked(getTokenFromStorage).mockReturnValue(null)
-
-      // studio takes precedence over oauth, so oauth options must be dropped
-      instance = createSanityInstance({projectId: 'p', dataset: 'd', studio: {}, auth: {oauth}})
-      expect(authStore.getInitialState(instance, null).options.oauth).toBeUndefined()
-      instance.dispose()
-
-      instance = createSanityInstance({projectId: 'p', dataset: 'd', auth: {oauth}})
-      expect(authStore.getInitialState(instance, null).options.oauth).toEqual(oauth)
-    })
-
     it('logs auth initialized in logged out state when no token available', () => {
       instance = createSanityInstance({
         projectId: 'p',

package/src/auth/authStore.ts

@@ -191,10 +191,7 @@ export const authStore = defineStore<AuthStoreState>({
         storageKey: result.storageKey,
         storageArea: result.storageArea,
         authMethod: result.authMethod,
-        // Only expose oauth options when the oauth strategy is actually in use,
-        // so mode-gated actions (logout, handleAuthCallback) stay consistent
-        // with the resolved mode (e.g. `studio` takes precedence over `oauth`).
-        oauth: mode === 'oauth' ? authConfig.oauth : undefined,
+        oauth: authConfig.oauth,
       },
     }
   },

package/src/auth/handleAuthCallback.test.ts

@@ -5,7 +5,6 @@ import {createSanityInstance, type SanityInstance} from '../store/createSanityIn
 import {AuthStateType} from './authStateType'
 import {getAuthState} from './authStore'
 import {handleAuthCallback} from './handleAuthCallback'
-import {handleOAuthCallback} from './oauth/oauthActions'
 import {subscribeToStateAndFetchCurrentUser} from './subscribeToStateAndFetchCurrentUser'
 import {subscribeToStorageEventsAndSetToken} from './subscribeToStorageEventsAndSetToken'
 import {getAuthCode, getTokenFromLocation, getTokenFromStorage} from './utils'
@@ -23,11 +22,6 @@ vi.mock('./utils', async (importOriginal) => {
 vi.mock('./subscribeToStateAndFetchCurrentUser')
 vi.mock('./subscribeToStorageEventsAndSetToken')
 
-vi.mock('./oauth/oauthActions', async (importOriginal) => {
-  const original = await importOriginal<typeof import('./oauth/oauthActions')>()
-  return {...original, handleOAuthCallback: vi.fn()}
-})
-
 // Mock logger to prevent actual logging during tests
 vi.mock('../utils/logger', async (importOriginal) => {
   const original = await importOriginal<typeof import('../utils/logger')>()
@@ -283,31 +277,4 @@ describe('handleCallback', () => {
     // Verify logger was called
     expect(createLogger).toHaveBeenCalled()
   })
-
-  it('delegates to handleOAuthCallback in OAuth mode', async () => {
-    const clientFactory = vi.fn()
-    vi.mocked(getTokenFromStorage).mockReturnValue(null)
-    vi.mocked(handleOAuthCallback).mockResolvedValue('https://app.example.com/callback')
-
-    instance = createSanityInstance({
-      projectId: 'p',
-      dataset: 'd',
-      auth: {
-        clientFactory,
-        oauth: {
-          clientId: 'client-abc',
-          redirectUri: 'https://app.example.com/callback',
-          organizationId: 'org123',
-        },
-      },
-    })
-
-    const href = 'https://app.example.com/callback?code=abc&state=xyz'
-    const result = await handleAuthCallback(instance, href)
-
-    expect(result).toBe('https://app.example.com/callback')
-    expect(handleOAuthCallback).toHaveBeenCalledWith(instance, href)
-    expect(getAuthCode).not.toHaveBeenCalled()
-    expect(clientFactory).not.toHaveBeenCalled()
-  })
 })

package/src/auth/handleAuthCallback.ts

@@ -3,7 +3,6 @@ import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
 import {getAuthLogger} from './authLogger'
 import {AuthStateType} from './authStateType'
 import {authStore, type AuthStoreState, type DashboardContext} from './authStore'
-import {handleOAuthCallback} from './oauth/oauthActions'
 import {
   createLoggedInAuthState,
   getAuthCode,
@@ -13,10 +12,6 @@ import {
 } from './utils'
 
 /**
- * Handles the auth redirect callback. In OAuth mode this delegates to
- * {@link handleOAuthCallback}; otherwise it exchanges the legacy `sid` for a
- * long-lived token.
- *
  * @public
  */
 export const handleAuthCallback = bindActionGlobally(
@@ -24,7 +19,7 @@ export const handleAuthCallback = bindActionGlobally(
   async ({state, instance}, locationHref: string = getDefaultLocation()) => {
     const logger = getAuthLogger(instance)
 
-    const {providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey, oauth} =
+    const {providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey} =
       state.get().options
 
     // If a token is provided, no need to handle callback
@@ -33,11 +28,6 @@ export const handleAuthCallback = bindActionGlobally(
       return false
     }
 
-    if (oauth) {
-      logger.debug('OAuth mode - delegating to handleOAuthCallback')
-      return handleOAuthCallback(instance, locationHref)
-    }
-
     // Don't handle the callback if already in flight.
     const {authState} = state.get()
     if (authState.type === AuthStateType.LOGGING_IN && authState.isExchangingToken) {

package/src/auth/logout.test.ts

@@ -169,7 +169,7 @@ describe('logout', () => {
     expect(removeItem).toHaveBeenCalledWith('__sanity_auth_token')
   })
 
-  it('revokes OAuth tokens instead of calling /auth/logout in OAuth mode', async () => {
+  it('clears the OAuth tokens from the store on logout', async () => {
     const oauthTokens: OAuthTokens = {
       accessToken: 'oauth-access',
       tokenType: 'bearer',
@@ -204,16 +204,8 @@ describe('logout', () => {
     // Boots logged in with the persisted OAuth tokens exposed on the store.
     expect(getOAuthTokensState(instance).getCurrent()).toMatchObject({accessToken: 'oauth-access'})
 
-    const first = logout(instance)
-    // Session is marked as destroying so a concurrent call is a no-op
-    expect(getAuthState(instance).getCurrent()).toMatchObject({isDestroyingSession: true})
     await logout(instance)
-    await first
 
-    expect(mockRequest).toHaveBeenCalledTimes(1)
-    expect(mockRequest).toHaveBeenCalledWith(
-      expect.objectContaining({url: '/auth/oauth/revoke', tag: 'oauth.revoke'}),
-    )
     expect(getOAuthTokensState(instance).getCurrent()).toBeNull()
     expect(getAuthState(instance).getCurrent()).toMatchObject({type: AuthStateType.LOGGED_OUT})
     expect(map.get(OAUTH_TOKENS_KEY)).toBeUndefined()

package/src/auth/logout.ts

@@ -3,22 +3,14 @@ import {DEFAULT_API_VERSION, REQUEST_TAG_PREFIX} from './authConstants'
 import {getAuthLogger} from './authLogger'
 import {AuthStateType} from './authStateType'
 import {authStore} from './authStore'
-import {revokeOAuthTokens} from './oauth/oauthActions'
 
 /**
- * Logs the current user out. In OAuth mode this revokes the OAuth tokens
- * instead of calling the legacy `/auth/logout` endpoint; revocation is
- * best-effort, so the OAuth path resolves even if the revoke request fails,
- * whereas the legacy path rejects when `/auth/logout` fails. Local state and
- * storage are cleared in both cases.
- *
  * @public
  */
 export const logout = bindActionGlobally(authStore, async ({state, instance}) => {
   const logger = getAuthLogger(instance)
 
-  const {clientFactory, apiHost, providedToken, storageArea, storageKey, oauth} =
-    state.get().options
+  const {clientFactory, apiHost, providedToken, storageArea, storageKey} = state.get().options
 
   // If a token is statically provided, logout does nothing
   if (providedToken) {
@@ -33,15 +25,6 @@ export const logout = bindActionGlobally(authStore, async ({state, instance}) =>
     logger.debug('Skipping logout - already in progress')
     return
   }
-
-  if (oauth) {
-    logger.debug('OAuth mode - revoking tokens instead of calling /auth/logout')
-    state.set('loggingOut', {
-      authState: {type: AuthStateType.LOGGED_OUT, isDestroyingSession: true},
-    })
-    await revokeOAuthTokens(instance)
-    return
-  }
   const token = authState.type === AuthStateType.LOGGED_IN && authState.token
 
   try {

package/src/auth/oauth/oauthActions.test.ts

@@ -9,7 +9,6 @@ import {subscribeToStateAndFetchCurrentUser} from '../subscribeToStateAndFetchCu
 import {
   getOAuthTokensState,
   handleOAuthCallback,
-  OAUTH_RETURN_TO_KEY,
   OAUTH_STATE_KEY,
   OAUTH_VERIFIER_KEY,
   refreshOAuthTokens,
@@ -157,28 +156,6 @@ describe('startOAuthAuthorization', () => {
     expect(url.searchParams.getAll('resource')).toEqual(['urn:io.sanity:organization:org123'])
   })
 
-  it('stashes the current location to return to, keeping app params intact', async () => {
-    const href = 'https://app.example.com/documents/abc?state=draft&code=x#h'
-    vi.stubGlobal('window', {location: {assign: vi.fn(), href}})
-    vi.stubGlobal('location', {href})
-    const {session} = setup()
-
-    await startOAuthAuthorization(instance!)
-
-    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe(href)
-  })
-
-  it('strips stale OAuth params from the stashed location when already on the callback route', async () => {
-    const href = 'https://app.example.com/callback?x=1&code=old&state=old'
-    vi.stubGlobal('window', {location: {assign: vi.fn(), href}})
-    vi.stubGlobal('location', {href})
-    const {session} = setup()
-
-    await startOAuthAuthorization(instance!)
-
-    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBe('https://app.example.com/callback?x=1')
-  })
-
   it('throws when OAuth is not configured', async () => {
     setup({withOAuthConfig: false})
     await expect(startOAuthAuthorization(instance!)).rejects.toThrow(/OAuth is not configured/)
@@ -226,75 +203,6 @@ describe('handleOAuthCallback', () => {
     })
   })
 
-  it('returns the stashed same-origin location after a successful exchange', async () => {
-    const returnTo = 'https://app.example.com/documents/abc?x=1'
-    const {session} = setup({
-      sessionSeed: {
-        [OAUTH_STATE_KEY]: 'state-xyz',
-        [OAUTH_VERIFIER_KEY]: 'verifier-1',
-        [OAUTH_RETURN_TO_KEY]: returnTo,
-      },
-    })
-
-    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(returnTo)
-    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
-  })
-
-  it('ignores a stashed location on a different origin', async () => {
-    setup({
-      sessionSeed: {
-        [OAUTH_STATE_KEY]: 'state-xyz',
-        [OAUTH_VERIFIER_KEY]: 'verifier-1',
-        [OAUTH_RETURN_TO_KEY]: 'https://evil.example.com/',
-      },
-    })
-
-    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
-      'https://app.example.com/callback',
-    )
-  })
-
-  it('ignores a stashed location that is not a URL', async () => {
-    setup({
-      sessionSeed: {
-        [OAUTH_STATE_KEY]: 'state-xyz',
-        [OAUTH_VERIFIER_KEY]: 'verifier-1',
-        [OAUTH_RETURN_TO_KEY]: 'not a url',
-      },
-    })
-
-    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
-      'https://app.example.com/callback',
-    )
-  })
-
-  it('does not restore the stashed location on a state mismatch', async () => {
-    const {session} = setup({
-      sessionSeed: {
-        [OAUTH_STATE_KEY]: 'different',
-        [OAUTH_VERIFIER_KEY]: 'verifier-1',
-        [OAUTH_RETURN_TO_KEY]: 'https://app.example.com/deep',
-      },
-    })
-
-    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
-      'https://app.example.com/callback',
-    )
-    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
-  })
-
-  it('does not restore the stashed location on an ?error= callback', async () => {
-    const {session} = setup({sessionSeed: {[OAUTH_RETURN_TO_KEY]: 'https://app.example.com/deep'}})
-
-    const result = await handleOAuthCallback(
-      instance!,
-      'https://app.example.com/callback?error=access_denied',
-    )
-
-    expect(result).toBe('https://app.example.com/callback')
-    expect(session.getItem(OAUTH_RETURN_TO_KEY)).toBeNull()
-  })
-
   it('does not perform a second exchange on a duplicate concurrent invocation', async () => {
     const pending = deferred<typeof tokenResponse>()
     const request = vi.fn().mockReturnValue(pending.promise)
@@ -313,31 +221,6 @@ describe('handleOAuthCallback', () => {
     expect(await first).toBe('https://app.example.com/callback')
   })
 
-  it('does not clobber LOGGED_IN when called again with a stale callback URL', async () => {
-    const {request} = setup({
-      sessionSeed: {[OAUTH_STATE_KEY]: 'state-xyz', [OAUTH_VERIFIER_KEY]: 'verifier-1'},
-    })
-
-    expect(await handleOAuthCallback(instance!, callbackHref)).toBe(
-      'https://app.example.com/callback',
-    )
-    // Artifacts are now cleared; a repeat with the same URL fails state validation.
-    // Seed fresh artifacts as if a re-authorization started in this tab: the
-    // ignored stale callback must not wipe them.
-    sessionStorage.setItem(OAUTH_STATE_KEY, 'state-next')
-    sessionStorage.setItem(OAUTH_VERIFIER_KEY, 'verifier-next')
-    const result = await handleOAuthCallback(instance!, callbackHref)
-
-    expect(result).toBe('https://app.example.com/callback')
-    expect(request).toHaveBeenCalledTimes(1)
-    expect(getAuthState(instance!).getCurrent()).toMatchObject({
-      type: AuthStateType.LOGGED_IN,
-      token: 'new-access',
-    })
-    expect(sessionStorage.getItem(OAUTH_STATE_KEY)).toBe('state-next')
-    expect(sessionStorage.getItem(OAUTH_VERIFIER_KEY)).toBe('verifier-next')
-  })
-
   it('surfaces an ?error= callback as ERROR without exchanging', async () => {
     const {request} = setup()
 
@@ -351,25 +234,6 @@ describe('handleOAuthCallback', () => {
     expect(getAuthState(instance!).getCurrent()).toMatchObject({type: AuthStateType.ERROR})
   })
 
-  it('ignores an ?error= callback when a session is already established', async () => {
-    setup({
-      storageSeed: {[OAUTH_TOKENS_KEY]: serializeTokens(seededTokens)},
-      sessionSeed: {[OAUTH_STATE_KEY]: 'state-next', [OAUTH_VERIFIER_KEY]: 'verifier-next'},
-    })
-
-    const result = await handleOAuthCallback(
-      instance!,
-      'https://app.example.com/callback?error=access_denied',
-    )
-
-    expect(result).toBe('https://app.example.com/callback')
-    expect(getAuthState(instance!).getCurrent()).toMatchObject({
-      type: AuthStateType.LOGGED_IN,
-      token: seededTokens.accessToken,
-    })
-    expect(sessionStorage.getItem(OAUTH_STATE_KEY)).toBe('state-next')
-  })
-
   it('surfaces an ?error= callback without a description', async () => {
     setup()
     await handleOAuthCallback(instance!, 'https://app.example.com/callback?error=access_denied')

package/src/auth/oauth/oauthActions.ts

@@ -17,25 +17,6 @@ export const OAUTH_VERIFIER_KEY = '__sanity_oauth_verifier'
 /** sessionStorage key for the CSRF `state` value. */
 export const OAUTH_STATE_KEY = '__sanity_oauth_state'
 
-/** sessionStorage key for the location to return to after the callback. */
-export const OAUTH_RETURN_TO_KEY = '__sanity_oauth_return_to'
-
-const OAUTH_CALLBACK_PARAMS = ['code', 'state', 'error', 'error_description']
-
-/** Strips the OAuth callback params from a URL. */
-function stripOAuthParams(href: string): string {
-  const url = new URL(href, DEFAULT_BASE)
-  for (const param of OAUTH_CALLBACK_PARAMS) url.searchParams.delete(param)
-  return url.toString()
-}
-
-/** Whether `href` is the registered redirect URI (origin + pathname; query and hash ignored). */
-function isCallbackRoute(href: string, redirectUri: string): boolean {
-  const current = new URL(href, DEFAULT_BASE)
-  const redirect = new URL(redirectUri, DEFAULT_BASE)
-  return current.origin === redirect.origin && current.pathname === redirect.pathname
-}
-
 interface TokenEndpointResponse {
   access_token: string
   token_type: string
@@ -118,17 +99,6 @@ export const startOAuthAuthorization = bindActionGlobally(authStore, async ({sta
   const session = typeof sessionStorage !== 'undefined' ? sessionStorage : undefined
   session?.setItem(OAUTH_VERIFIER_KEY, codeVerifier)
   session?.setItem(OAUTH_STATE_KEY, oauthState)
-  // The redirect URI must match the registered one exactly, so the current
-  // location (deep link) is stashed here and restored by the callback. OAuth
-  // params are only stripped when we are already on the callback route, so
-  // legitimate app params like `?state=draft` survive the round trip.
-  const currentHref = getDefaultLocation()
-  if (currentHref !== DEFAULT_BASE) {
-    const returnTo = isCallbackRoute(currentHref, options.oauth.redirectUri)
-      ? stripOAuthParams(currentHref)
-      : currentHref
-    session?.setItem(OAUTH_RETURN_TO_KEY, returnTo)
-  }
 
   const authorizeUrl = new URL(
     '/v1/auth/oauth/authorize',
@@ -153,14 +123,9 @@ export const startOAuthAuthorization = bindActionGlobally(authStore, async ({sta
  * responses, exchanges the authorization `code` for tokens, persists them, and
  * transitions to `LOGGED_IN`.
  *
- * Returns the URL for the caller to `history.replaceState` to when a callback
- * was processed: on success, the same-origin location the user was on when
- * the flow started (if any), otherwise the callback URL cleaned of OAuth
- * params. Returns `false` when there was nothing to handle (no code, or an
- * exchange already in progress). A callback that fails validation while a
- * session is already `LOGGED_IN` (e.g. a remount before the params were
- * stripped) is ignored with a warning and still returns the cleaned URL, so a
- * string result does not imply an exchange ran.
+ * Returns the callback URL cleaned of OAuth params (for the caller to
+ * `history.replaceState`) when a callback was processed, or `false` when there
+ * was nothing to handle (no code, or an exchange already in progress).
  *
  * @public
  */
@@ -187,29 +152,22 @@ export const handleOAuthCallback = bindActionGlobally(
 
     const session = typeof sessionStorage !== 'undefined' ? sessionStorage : undefined
 
-    const cleanedUrl = stripOAuthParams(locationHref)
-
-    // Callback failures move to ERROR, unless a session is already
-    // established: a stale callback URL (e.g. remount before the params were
-    // stripped, after the artifacts were cleared) or a denied re-authorization
-    // must not clobber LOGGED_IN.
-    const rejectCallback = (name: string, message: string): string => {
-      if (authState.type === AuthStateType.LOGGED_IN) {
-        // Leave PKCE artifacts alone: a re-authorization may be in flight.
-        logger.warn(`${message} — ignoring callback, session already established`)
-        return cleanedUrl
-      }
-      logger.error(`${message} — rejecting callback`)
-      clearOAuthArtifacts(session)
-      state.set(name, {authState: {type: AuthStateType.ERROR, error: new Error(message)}})
-      return cleanedUrl
+    const cleanedUrlObj = new URL(locationHref, DEFAULT_BASE)
+    for (const param of ['code', 'state', 'error', 'error_description']) {
+      cleanedUrlObj.searchParams.delete(param)
     }
+    const cleanedUrl = cleanedUrlObj.toString()
 
     if (error) {
-      return rejectCallback(
-        'oauthCallbackError',
-        errorDescription ? `${error}: ${errorDescription}` : error,
-      )
+      logger.warn('OAuth callback returned an error', {error, errorDescription})
+      clearOAuthArtifacts(session)
+      state.set('oauthCallbackError', {
+        authState: {
+          type: AuthStateType.ERROR,
+          error: new Error(errorDescription ? `${error}: ${errorDescription}` : error),
+        },
+      })
+      return cleanedUrl
     }
 
     if (!code) {
@@ -219,12 +177,22 @@ export const handleOAuthCallback = bindActionGlobally(
 
     const storedState = session?.getItem(OAUTH_STATE_KEY) ?? null
     if (!returnedState || !storedState || returnedState !== storedState) {
-      return rejectCallback('oauthStateMismatch', 'OAuth state mismatch')
+      logger.error('OAuth state mismatch — rejecting callback')
+      clearOAuthArtifacts(session)
+      state.set('oauthStateMismatch', {
+        authState: {type: AuthStateType.ERROR, error: new Error('OAuth state mismatch')},
+      })
+      return cleanedUrl
     }
 
     const codeVerifier = session?.getItem(OAUTH_VERIFIER_KEY) ?? null
     if (!codeVerifier) {
-      return rejectCallback('oauthVerifierMissing', 'OAuth code verifier missing')
+      logger.error('OAuth code verifier missing — cannot exchange code')
+      clearOAuthArtifacts(session)
+      state.set('oauthVerifierMissing', {
+        authState: {type: AuthStateType.ERROR, error: new Error('OAuth code verifier missing')},
+      })
+      return cleanedUrl
     }
 
     logger.info('Exchanging OAuth code for tokens')
@@ -252,7 +220,6 @@ export const handleOAuthCallback = bindActionGlobally(
 
       const tokens = toOAuthTokens(response)
       options.storageArea?.setItem(options.storageKey, serializeTokens(tokens))
-      const returnTo = getSameOriginReturnTo(session, options.oauth.redirectUri)
       clearOAuthArtifacts(session)
 
       logger.info('OAuth tokens obtained, user logged in')
@@ -260,7 +227,7 @@ export const handleOAuthCallback = bindActionGlobally(
         authState: createLoggedInAuthState(tokens.accessToken, null),
         oauthTokens: tokens,
       })
-      return returnTo ?? cleanedUrl
+      return cleanedUrl
     } catch (exchangeError) {
       logger.error('Failed to exchange OAuth code for tokens', {error: exchangeError})
       clearOAuthArtifacts(session)
@@ -419,20 +386,4 @@ export const getOAuthTokensState = bindActionGlobally(
 function clearOAuthArtifacts(session: Storage | undefined): void {
   session?.removeItem(OAUTH_VERIFIER_KEY)
   session?.removeItem(OAUTH_STATE_KEY)
-  session?.removeItem(OAUTH_RETURN_TO_KEY)
-}
-
-/**
- * Reads the stashed pre-authorize location, only honouring it when it shares
- * the registered redirect URI's origin so a tampered value cannot redirect
- * off-site. (`origin` includes the scheme, so non-http(s) URLs are rejected.)
- */
-function getSameOriginReturnTo(session: Storage | undefined, redirectUri: string): string | null {
-  const returnTo = session?.getItem(OAUTH_RETURN_TO_KEY) ?? null
-  if (!returnTo) return null
-  try {
-    return new URL(returnTo).origin === new URL(redirectUri).origin ? returnTo : null
-  } catch {
-    return null
-  }
 }