agent-messenger 2.25.0 → 2.27.0

package/src/platforms/discord/remote-auth.test.ts

@@ -0,0 +1,261 @@
+import { afterEach, describe, expect, it } from 'bun:test'
+import { constants as cryptoConstants, createHash, generateKeyPairSync, publicEncrypt } from 'node:crypto'
+import { EventEmitter } from 'node:events'
+
+import { DiscordError } from '@/platforms/discord/client'
+import { __test, loginWithRemoteAuth } from '@/platforms/discord/remote-auth'
+
+const USER = { id: '852892297661906993', username: 'alice', discriminator: '0', avatar: 'abc' }
+const USER_PAYLOAD = `${USER.id}:${USER.discriminator}:${USER.avatar}:${USER.username}`
+const TOKEN = 'mfa.AbCdEfGhIjKlMnOpQrStUvWxYz'
+
+class FakeWebSocket extends EventEmitter {
+  sent: Record<string, unknown>[] = []
+  closed = false
+
+  send(raw: string): void {
+    this.sent.push(JSON.parse(raw))
+  }
+
+  close(): void {
+    this.closed = true
+  }
+
+  emitMessage(payload: Record<string, unknown>): void {
+    this.emit('message', Buffer.from(JSON.stringify(payload)))
+  }
+
+  lastOp(op: string): Record<string, unknown> | undefined {
+    return [...this.sent].reverse().find((m) => m.op === op)
+  }
+}
+
+function encryptForClient(encodedPublicKey: string, data: Buffer | string): string {
+  const der = Buffer.from(encodedPublicKey, 'base64')
+  const publicKey = __test.createPublicKey({ key: der, format: 'der', type: 'spki' })
+  const encrypted = publicEncrypt(
+    { key: publicKey, padding: cryptoConstants.RSA_PKCS1_OAEP_PADDING, oaepHash: 'sha256' },
+    typeof data === 'string' ? Buffer.from(data) : data,
+  )
+  return encrypted.toString('base64')
+}
+
+const originalFetch = globalThis.fetch
+afterEach(() => {
+  globalThis.fetch = originalFetch
+})
+
+describe('crypto helpers', () => {
+  it('computes nonce proof as base64url(sha256(decrypted_nonce))', () => {
+    // Given a keypair and a nonce encrypted to its public key
+    const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 })
+    const nonce = Buffer.from('the-nonce-bytes')
+    const encoded = publicKey.export({ type: 'spki', format: 'der' }).toString('base64')
+    const encryptedNonce = encryptForClient(encoded, nonce)
+
+    // When computing the proof
+    const proof = __test.computeNonceProof(privateKey, encryptedNonce)
+
+    // Then it matches the spec: hash first, then base64url without padding
+    const expected = createHash('sha256').update(nonce).digest('base64url')
+    expect(proof).toBe(expected)
+  })
+
+  it('parses the colon-delimited user payload', () => {
+    expect(__test.parseUserPayload(USER_PAYLOAD)).toEqual({
+      id: USER.id,
+      discriminator: USER.discriminator,
+      avatar: USER.avatar,
+      username: USER.username,
+    })
+  })
+})
+
+describe('loginWithRemoteAuth', () => {
+  it('completes the full handshake and returns the decrypted token', async () => {
+    // Given a fake gateway that drives the protocol
+    const ws = new FakeWebSocket()
+    const qrUrls: string[] = []
+    const pendingUsers: string[] = []
+
+    globalThis.fetch = (async (_url: string, init?: { body?: string }) => {
+      const body = JSON.parse(init?.body ?? '{}') as { ticket?: string }
+      expect(body.ticket).toBe('the-ticket')
+      const initMsg = ws.lastOp('init') as { encoded_public_key: string }
+      return new Response(JSON.stringify({ encrypted_token: encryptForClient(initMsg.encoded_public_key, TOKEN) }), {
+        status: 200,
+      })
+    }) as typeof fetch
+
+    const sessionPromise = loginWithRemoteAuth({
+      createWebSocket: () => ws as unknown as import('ws').WebSocket,
+      onQrUrl: (url) => {
+        qrUrls.push(url)
+      },
+      onPendingLogin: (user) => {
+        pendingUsers.push(user.username)
+      },
+    })
+
+    // When the gateway walks through the protocol
+    ws.emit('open')
+    ws.emitMessage({ op: 'hello', heartbeat_interval: 41250, timeout_ms: 142637 })
+
+    const init = ws.lastOp('init') as { encoded_public_key: string }
+    expect(init).toBeDefined()
+
+    ws.emitMessage({ op: 'nonce_proof', encrypted_nonce: encryptForClient(init.encoded_public_key, 'nonce') })
+    expect(ws.lastOp('nonce_proof')).toBeDefined()
+
+    ws.emitMessage({ op: 'pending_remote_init', fingerprint: 'FINGERPRINT123' })
+    ws.emitMessage({
+      op: 'pending_ticket',
+      encrypted_user_payload: encryptForClient(init.encoded_public_key, USER_PAYLOAD),
+    })
+    ws.emitMessage({ op: 'pending_login', ticket: 'the-ticket' })
+
+    // Then the session resolves with the decrypted token and scanned user
+    const session = await sessionPromise
+    expect(session.token).toBe(TOKEN)
+    expect(session.user.username).toBe('alice')
+    expect(qrUrls).toEqual(['https://discord.com/ra/FINGERPRINT123'])
+    expect(pendingUsers).toEqual(['alice'])
+    expect(ws.closed).toBe(true)
+  })
+
+  it('rejects with a captcha error when the login endpoint demands one', async () => {
+    // Given a gateway that reaches ticket exchange but the API returns a captcha challenge
+    const ws = new FakeWebSocket()
+    globalThis.fetch = (async () =>
+      new Response(JSON.stringify({ captcha_sitekey: 'sitekey', captcha_key: ['captcha-required'] }), {
+        status: 400,
+      })) as typeof fetch
+
+    const sessionPromise = loginWithRemoteAuth({
+      createWebSocket: () => ws as unknown as import('ws').WebSocket,
+    })
+
+    ws.emitMessage({ op: 'hello', heartbeat_interval: 41250 })
+    const init = ws.lastOp('init') as { encoded_public_key: string }
+    ws.emitMessage({ op: 'nonce_proof', encrypted_nonce: encryptForClient(init.encoded_public_key, 'n') })
+    ws.emitMessage({ op: 'pending_remote_init', fingerprint: 'FP' })
+    ws.emitMessage({ op: 'pending_login', ticket: 't' })
+
+    // Then the promise rejects with a captcha-specific error code
+    await expect(sessionPromise).rejects.toMatchObject({ code: 'remote_auth_captcha' })
+  })
+
+  it('rejects when the gateway times out (close code 4003)', async () => {
+    // Given a gateway that closes with the timeout code before completion
+    const ws = new FakeWebSocket()
+    const sessionPromise = loginWithRemoteAuth({
+      createWebSocket: () => ws as unknown as import('ws').WebSocket,
+    })
+
+    ws.emitMessage({ op: 'hello', heartbeat_interval: 41250 })
+    ws.emit('close', 4003)
+
+    // Then it surfaces a timeout error
+    await expect(sessionPromise).rejects.toBeInstanceOf(DiscordError)
+    await expect(sessionPromise).rejects.toMatchObject({ code: 'remote_auth_timeout' })
+  })
+
+  it('does not reject on normal close (1000) while the ticket exchange is in flight', async () => {
+    // Given a fetch that stays pending until we release it, so close(1000) lands mid-exchange
+    const ws = new FakeWebSocket()
+    let releaseFetch: (() => void) | undefined
+    globalThis.fetch = (async () => {
+      await new Promise<void>((resolve) => {
+        releaseFetch = resolve
+      })
+      const init = ws.lastOp('init') as { encoded_public_key: string }
+      return new Response(JSON.stringify({ encrypted_token: encryptForClient(init.encoded_public_key, TOKEN) }), {
+        status: 200,
+      })
+    }) as typeof fetch
+
+    const sessionPromise = loginWithRemoteAuth({
+      createWebSocket: () => ws as unknown as import('ws').WebSocket,
+    })
+
+    ws.emitMessage({ op: 'hello', heartbeat_interval: 41250 })
+    const init = ws.lastOp('init') as { encoded_public_key: string }
+    ws.emitMessage({ op: 'nonce_proof', encrypted_nonce: encryptForClient(init.encoded_public_key, 'n') })
+    ws.emitMessage({ op: 'pending_login', ticket: 'the-ticket' })
+
+    // When the gateway closes normally before the exchange resolves
+    ws.emit('close', 1000)
+    releaseFetch?.()
+
+    // Then the login still succeeds with the token from the completed exchange
+    const session = await sessionPromise
+    expect(session.token).toBe(TOKEN)
+  })
+
+  it('rejects (does not crash) when an encrypted payload is malformed', async () => {
+    // Given a nonce_proof whose ciphertext cannot be decrypted by the private key
+    const ws = new FakeWebSocket()
+    const sessionPromise = loginWithRemoteAuth({
+      createWebSocket: () => ws as unknown as import('ws').WebSocket,
+    })
+
+    ws.emitMessage({ op: 'hello', heartbeat_interval: 41250 })
+    // When garbage arrives where ciphertext is expected
+    ws.emitMessage({ op: 'nonce_proof', encrypted_nonce: 'not-valid-base64-ciphertext' })
+
+    // Then the decrypt error is surfaced as a rejection instead of throwing out of the handler
+    await expect(sessionPromise).rejects.toBeInstanceOf(Error)
+  })
+
+  it('resolves with a null user when pending_login arrives without pending_ticket', async () => {
+    // Given the gateway skips pending_ticket and goes straight to pending_login
+    const ws = new FakeWebSocket()
+    globalThis.fetch = (async () => {
+      const init = ws.lastOp('init') as { encoded_public_key: string }
+      return new Response(JSON.stringify({ encrypted_token: encryptForClient(init.encoded_public_key, TOKEN) }), {
+        status: 200,
+      })
+    }) as typeof fetch
+
+    const sessionPromise = loginWithRemoteAuth({
+      createWebSocket: () => ws as unknown as import('ws').WebSocket,
+    })
+
+    ws.emitMessage({ op: 'hello', heartbeat_interval: 41250 })
+    const init = ws.lastOp('init') as { encoded_public_key: string }
+    ws.emitMessage({ op: 'nonce_proof', encrypted_nonce: encryptForClient(init.encoded_public_key, 'n') })
+    ws.emitMessage({ op: 'pending_login', ticket: 'the-ticket' })
+
+    // Then the token is returned but user is null rather than a fabricated blank user
+    const session = await sessionPromise
+    expect(session.token).toBe(TOKEN)
+    expect(session.user).toBeNull()
+  })
+
+  it('exchanges the ticket only once even if pending_login is delivered twice', async () => {
+    // Given a duplicate pending_login from the gateway
+    const ws = new FakeWebSocket()
+    let fetchCalls = 0
+    globalThis.fetch = (async () => {
+      fetchCalls++
+      const init = ws.lastOp('init') as { encoded_public_key: string }
+      return new Response(JSON.stringify({ encrypted_token: encryptForClient(init.encoded_public_key, TOKEN) }), {
+        status: 200,
+      })
+    }) as typeof fetch
+
+    const sessionPromise = loginWithRemoteAuth({
+      createWebSocket: () => ws as unknown as import('ws').WebSocket,
+    })
+
+    ws.emitMessage({ op: 'hello', heartbeat_interval: 41250 })
+    const init = ws.lastOp('init') as { encoded_public_key: string }
+    ws.emitMessage({ op: 'nonce_proof', encrypted_nonce: encryptForClient(init.encoded_public_key, 'n') })
+    ws.emitMessage({ op: 'pending_login', ticket: 't' })
+    ws.emitMessage({ op: 'pending_login', ticket: 't' })
+
+    // Then only a single token exchange is performed
+    await sessionPromise
+    expect(fetchCalls).toBe(1)
+  })
+})

package/src/platforms/discord/remote-auth.ts

@@ -0,0 +1,317 @@
+import {
+  constants as cryptoConstants,
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  privateDecrypt,
+} from 'node:crypto'
+
+import WebSocket from 'ws'
+
+import { DiscordError } from './client'
+import { getDiscordHeaders } from './super-properties'
+
+const REMOTE_AUTH_GATEWAY_URL = 'wss://remote-auth-gateway.discord.gg/?v=2'
+const REMOTE_AUTH_ORIGIN = 'https://discord.com'
+const REMOTE_AUTH_LOGIN_URL = 'https://discord.com/api/v9/users/@me/remote-auth/login'
+const QR_URL_PREFIX = 'https://discord.com/ra/'
+const DEFAULT_TIMEOUT_MS = 150_000
+
+interface RemoteAuthUser {
+  id: string
+  username: string
+  discriminator: string
+  avatar: string | null
+}
+
+export interface RemoteAuthSession {
+  token: string
+  user: RemoteAuthUser | null
+}
+
+export interface RemoteAuthOptions {
+  onQrUrl?: (url: string) => void | Promise<void>
+  onPendingLogin?: (user: RemoteAuthUser) => void
+  debug?: (message: string) => void
+  fetchImpl?: typeof fetch
+  timeoutMs?: number
+  createWebSocket?: (url: string) => WebSocket
+}
+
+interface RemoteAuthHello {
+  op: 'hello'
+  timeout_ms?: number
+  heartbeat_interval: number
+}
+
+interface RemoteAuthNonceProof {
+  op: 'nonce_proof'
+  encrypted_nonce: string
+}
+
+interface RemoteAuthPendingRemoteInit {
+  op: 'pending_remote_init'
+  fingerprint: string
+}
+
+interface RemoteAuthPendingTicket {
+  op: 'pending_ticket'
+  encrypted_user_payload: string
+}
+
+interface RemoteAuthPendingLogin {
+  op: 'pending_login'
+  ticket: string
+}
+
+type RemoteAuthMessage =
+  | RemoteAuthHello
+  | RemoteAuthNonceProof
+  | RemoteAuthPendingRemoteInit
+  | RemoteAuthPendingTicket
+  | RemoteAuthPendingLogin
+  | { op: 'heartbeat_ack' }
+  | { op: 'cancel' }
+  | { op: string; [key: string]: unknown }
+
+/**
+ * Authenticate a Discord user account via the Remote Auth ("scan QR with the mobile app") flow.
+ *
+ * The desktop side (this function) opens a WebSocket to Discord's remote-auth gateway, performs an
+ * RSA-OAEP key exchange, and renders a QR code. Once the user scans it with an authenticated Discord
+ * mobile app and confirms, Discord returns an encrypted ticket which is exchanged for the user token.
+ */
+export function loginWithRemoteAuth(options: RemoteAuthOptions = {}): Promise<RemoteAuthSession> {
+  const debug = options.debug
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS
+
+  const { publicKey, privateKey } = generateKeyPairSync('rsa', {
+    modulusLength: 2048,
+    publicExponent: 0x10001,
+  })
+
+  const ws = options.createWebSocket
+    ? options.createWebSocket(REMOTE_AUTH_GATEWAY_URL)
+    : new WebSocket(REMOTE_AUTH_GATEWAY_URL, { headers: { Origin: REMOTE_AUTH_ORIGIN } })
+
+  return new Promise<RemoteAuthSession>((resolve, reject) => {
+    let settled = false
+    let heartbeatTimer: ReturnType<typeof setInterval> | null = null
+    let pendingUser: RemoteAuthUser | null = null
+    let exchangeStarted = false
+
+    const cleanup = (): void => {
+      if (heartbeatTimer) {
+        clearInterval(heartbeatTimer)
+        heartbeatTimer = null
+      }
+      clearTimeout(timeoutTimer)
+      try {
+        ws.close()
+      } catch {}
+    }
+
+    const fail = (error: Error): void => {
+      if (settled) return
+      settled = true
+      cleanup()
+      reject(error)
+    }
+
+    const succeed = (session: RemoteAuthSession): void => {
+      if (settled) return
+      settled = true
+      cleanup()
+      resolve(session)
+    }
+
+    const timeoutTimer = setTimeout(() => {
+      fail(new DiscordError('Remote auth timed out before the QR code was scanned.', 'remote_auth_timeout'))
+    }, timeoutMs)
+    timeoutTimer.unref?.()
+
+    const send = (payload: Record<string, unknown>): void => {
+      try {
+        ws.send(JSON.stringify(payload))
+      } catch (error) {
+        fail(error instanceof Error ? error : new Error(String(error)))
+      }
+    }
+
+    ws.on('open', () => {
+      debug?.('Connected to remote auth gateway')
+    })
+
+    ws.on('message', (raw: WebSocket.RawData) => {
+      let message: RemoteAuthMessage
+      try {
+        message = JSON.parse(raw.toString()) as RemoteAuthMessage
+      } catch {
+        return
+      }
+
+      try {
+        handleMessage(message)
+      } catch (error) {
+        fail(error instanceof Error ? error : new Error(String(error)))
+      }
+    })
+
+    const handleMessage = (message: RemoteAuthMessage): void => {
+      switch (message.op) {
+        case 'hello': {
+          const interval = (message as RemoteAuthHello).heartbeat_interval
+          heartbeatTimer = setInterval(() => send({ op: 'heartbeat' }), interval)
+          heartbeatTimer.unref?.()
+          send({ op: 'init', encoded_public_key: encodePublicKey(publicKey) })
+          debug?.('Sent init with public key')
+          break
+        }
+
+        case 'nonce_proof': {
+          const encrypted = (message as RemoteAuthNonceProof).encrypted_nonce
+          const proof = computeNonceProof(privateKey, encrypted)
+          send({ op: 'nonce_proof', proof })
+          debug?.('Sent nonce proof')
+          break
+        }
+
+        case 'pending_remote_init': {
+          const { fingerprint } = message as RemoteAuthPendingRemoteInit
+          const qrUrl = `${QR_URL_PREFIX}${fingerprint}`
+          debug?.('Received fingerprint; QR ready')
+          Promise.resolve(options.onQrUrl?.(qrUrl)).catch((error) => {
+            fail(error instanceof Error ? error : new Error(String(error)))
+          })
+          break
+        }
+
+        case 'pending_ticket': {
+          const payload = decryptPayload(privateKey, (message as RemoteAuthPendingTicket).encrypted_user_payload)
+          pendingUser = parseUserPayload(payload.toString('utf8'))
+          options.onPendingLogin?.(pendingUser)
+          debug?.(`QR scanned by ${pendingUser.username}`)
+          break
+        }
+
+        case 'pending_login': {
+          if (exchangeStarted) break
+          exchangeStarted = true
+          const { ticket } = message as RemoteAuthPendingLogin
+          debug?.('Exchanging ticket for token')
+          exchangeTicket(ticket, privateKey, options.fetchImpl ?? fetch)
+            .then((token) => succeed({ token, user: pendingUser }))
+            .catch(fail)
+          break
+        }
+
+        case 'cancel': {
+          fail(new DiscordError('Remote auth was cancelled from the mobile device.', 'remote_auth_cancelled'))
+          break
+        }
+      }
+    }
+
+    ws.on('close', (code: number) => {
+      if (settled) return
+      // The gateway closes the socket right after pending_login; the in-flight
+      // ticket exchange settles the result, so this close must not preempt it.
+      if (exchangeStarted) return
+      // 4003 is the gateway's timeout close code.
+      if (code === 4003) {
+        fail(
+          new DiscordError('Remote auth session expired. Generate a new QR code and try again.', 'remote_auth_timeout'),
+        )
+        return
+      }
+      fail(new DiscordError(`Remote auth connection closed before completion (code ${code}).`, 'remote_auth_closed'))
+    })
+
+    ws.on('error', (error: Error) => {
+      fail(error instanceof Error ? error : new Error(String(error)))
+    })
+  })
+}
+
+function encodePublicKey(publicKey: ReturnType<typeof generateKeyPairSync>['publicKey']): string {
+  const spki = publicKey.export({ type: 'spki', format: 'der' })
+  return spki.toString('base64')
+}
+
+function decryptPayload(
+  privateKey: ReturnType<typeof generateKeyPairSync>['privateKey'],
+  encryptedBase64: string,
+): Buffer {
+  return privateDecrypt(
+    {
+      key: privateKey,
+      padding: cryptoConstants.RSA_PKCS1_OAEP_PADDING,
+      oaepHash: 'sha256',
+    },
+    Buffer.from(encryptedBase64, 'base64'),
+  )
+}
+
+function computeNonceProof(
+  privateKey: ReturnType<typeof generateKeyPairSync>['privateKey'],
+  encryptedNonce: string,
+): string {
+  const nonce = decryptPayload(privateKey, encryptedNonce)
+  return base64UrlNoPadding(createHash('sha256').update(nonce).digest())
+}
+
+function parseUserPayload(payload: string): RemoteAuthUser {
+  const [id = '', discriminator = '0', avatar = '', username = ''] = payload.split(':')
+  return { id, username, discriminator, avatar: avatar || null }
+}
+
+async function exchangeTicket(
+  ticket: string,
+  privateKey: ReturnType<typeof generateKeyPairSync>['privateKey'],
+  fetchImpl: typeof fetch,
+): Promise<string> {
+  const { Authorization: _omit, ...headers } = getDiscordHeaders('')
+  const response = await fetchImpl(REMOTE_AUTH_LOGIN_URL, {
+    method: 'POST',
+    headers: { ...headers, 'Content-Type': 'application/json' },
+    body: JSON.stringify({ ticket }),
+  })
+
+  if (response.status === 400) {
+    const body = (await response.json().catch(() => ({}))) as { captcha_sitekey?: string }
+    if (body.captcha_sitekey) {
+      throw new DiscordError(
+        'Discord requires a captcha to complete this login. Captcha solving is not supported; use `auth extract` instead.',
+        'remote_auth_captcha',
+      )
+    }
+  }
+
+  if (!response.ok) {
+    throw new DiscordError(
+      `Failed to exchange remote auth ticket (HTTP ${response.status}).`,
+      'remote_auth_login_failed',
+    )
+  }
+
+  const body = (await response.json()) as { encrypted_token?: string }
+  if (!body.encrypted_token) {
+    throw new DiscordError('Remote auth response did not include a token.', 'remote_auth_login_failed')
+  }
+
+  return decryptPayload(privateKey, body.encrypted_token).toString('utf8')
+}
+
+function base64UrlNoPadding(buffer: Buffer): string {
+  return buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
+}
+
+export const __test = {
+  encodePublicKey,
+  computeNonceProof,
+  parseUserPayload,
+  base64UrlNoPadding,
+  createPublicKey,
+  createPrivateKey,
+}

package/src/platforms/slack/qr-http-login.test.ts

@@ -132,6 +132,53 @@ describe('loginWithQr', () => {
     await expect(promise).rejects.toThrow(/expired/)
   })
 
+  it('reports SSO enforcement when the z-app hop redirects to an identity provider', async () => {
+    // Given a workspace whose z-app hop redirects off Slack to an SSO IdP (no d cookie issued)
+    const dataUrl = await qrDataUrl(ZAPP_URL)
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/z-app-secret`)
+      }
+      return redirect('https://accounts.google.com/o/oauth2/auth?redirect_uri=https://slack.com/sso/google')
+    }) as typeof fetch
+
+    // When logging in, the error names SSO + the detected provider and points to a working auth method
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/enforces SSO \(via Google\)/)
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/auth extract/)
+  })
+
+  it('reports SSO enforcement for an unrecognized/vanity IdP host', async () => {
+    // Given a z-app hop that redirects off Slack to a custom SAML IdP not in the known-provider list
+    const dataUrl = await qrDataUrl(ZAPP_URL)
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/z-app-secret`)
+      }
+      return redirect('https://login.acme.example/saml')
+    }) as typeof fetch
+
+    // When logging in, it is still classified as SSO (without naming a provider) and routes to auth extract
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/enforces SSO/)
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/auth extract/)
+  })
+
+  it('reports an expired link when the final page is Slack\u2019s "Link Expired" page', async () => {
+    // Given a z-app chain that completes on a Slack host but returns the expired page with no d cookie
+    const dataUrl = await qrDataUrl(ZAPP_URL)
+    const fetchImpl = (async (input: string | URL) => {
+      const url = typeof input === 'string' ? input : input.toString()
+      if (url.startsWith('https://app.slack.com/t/')) {
+        return redirect(`https://${WORKSPACE}.slack.com/z-app-secret`)
+      }
+      return new Response('<title>Link Expired | Slack</title>', { status: 200 })
+    }) as typeof fetch
+
+    // When logging in, the error names the expiry explicitly
+    await expect(loginWithQr(dataUrl, { fetchImpl })).rejects.toThrow(/has expired or was already used/)
+  })
+
   it('fails with qr_token_failed when the token cannot be retrieved', async () => {
     const dataUrl = await qrDataUrl(ZAPP_URL)