refactor(auth): clear oauth state after validation (#1754)

Author: xHeaven

packages/auth/src/OAuth/GenericOAuthClient.php

@@ -100,7 +100,12 @@ public function fetchUser(AccessToken $token): OAuthUser
 
     public function authenticate(Request $request, Closure $map): Authenticatable
     {
-        if ($this->session->get($this->sessionKey) !== $request->get('state')) {
+        $expectedState = $this->session->get($this->sessionKey);
+        $actualState = $request->get('state');
+
+        $this->session->remove($this->sessionKey);
+
+        if ($expectedState !== $actualState) {
             throw new OAuthStateWasInvalid();
         }
 

packages/auth/src/OAuth/Testing/TestingOAuthClient.php

@@ -9,6 +9,7 @@
 use PHPUnit\Framework\Assert;
 use Tempest\Auth\Authentication\Authenticatable;
 use Tempest\Auth\Authentication\Authenticator;
+use Tempest\Auth\Exceptions\OAuthStateWasInvalid;
 use Tempest\Auth\OAuth\OAuthClient;
 use Tempest\Auth\OAuth\OAuthConfig;
 use Tempest\Auth\OAuth\OAuthUser;
@@ -124,6 +125,15 @@ public function createRedirect(array $scopes = [], array $options = []): Redirec
 
     public function authenticate(Request $request, Closure $map): Authenticatable
     {
+        $expectedState = $this->state;
+        $actualState = $request->get('state');
+
+        $this->state = null;
+
+        if ($expectedState !== $actualState) {
+            throw new OAuthStateWasInvalid();
+        }
+
         $user = $this->fetchUser($this->requestAccessToken($request->get('code')));
 
         $authenticatable = $map($user);

tests/Integration/Auth/OAuth/TestingOAuthClientTest.php

@@ -5,6 +5,7 @@
 use PHPUnit\Framework\Attributes\Test;
 use PHPUnit\Framework\Attributes\TestWith;
 use Tempest\Auth\Authentication\Authenticatable;
+use Tempest\Auth\Exceptions\OAuthStateWasInvalid;
 use Tempest\Auth\OAuth\Config\GitHubOAuthConfig;
 use Tempest\Auth\OAuth\OAuthClient;
 use Tempest\Auth\OAuth\OAuthUser;
@@ -263,6 +264,69 @@ public function abstracted_flow(): void
         $this->assertEquals('Jane Developer', $user->full_name);
         $this->assertEquals('janedev', $user->username);
     }
+
+    #[Test]
+    public function state_is_cleared_after_authentication(): void
+    {
+        $this->database->reset(migrate: false);
+        $this->database->migrate(CreateMigrationsTable::class, CreateUsersTable::class);
+
+        $this->container->config(new GitHubOAuthConfig(
+            clientId: 'foo',
+            clientSecret: 'bar', // @mago-expect lint:no-literal-password
+            redirectTo: '/oauth/github',
+        ));
+
+        $client = $this->oauth->fake($this->user);
+
+        $client->createRedirect();
+
+        $this->assertNotNull($client->getState());
+
+        $request = new GenericRequest(
+            method: Method::GET,
+            uri: Uri\set_query('/oauth/callback', code: 'auth-code', state: $client->getState()),
+        );
+
+        $client->authenticate(
+            $request,
+            static fn (OAuthUser $user): User => query(User::class)->updateOrCreate(
+                ['github_id' => $user->id],
+                ['email' => $user->email ?? '', 'full_name' => $user->name ?? '', 'username' => $user->nickname ?? ''],
+            ),
+        );
+
+        $this->assertNull($client->getState());
+    }
+
+    #[Test]
+    public function state_is_cleared_even_when_validation_fails(): void
+    {
+        $this->container->config(new GitHubOAuthConfig(
+            clientId: 'foo',
+            clientSecret: 'bar', // @mago-expect lint:no-literal-password
+            redirectTo: '/oauth/github',
+        ));
+
+        $client = $this->oauth->fake($this->user);
+
+        $client->createRedirect();
+
+        $this->assertNotNull($client->getState());
+
+        $request = new GenericRequest(
+            method: Method::GET,
+            uri: Uri\set_query('/oauth/callback', code: 'auth-code', state: 'invalid-state'),
+        );
+
+        try {
+            $client->authenticate($request, static fn (OAuthUser $user): User => new User('', '', '', ''));
+        } catch (OAuthStateWasInvalid) {
+            // @mago-expect lint:no-empty-catch-clause
+        }
+
+        $this->assertNull($client->getState());
+    }
 }
 
 final class User implements Authenticatable