fix(desktop): stop the OAuth connect callback from failing on a bare-path callback URL

The desktop connect launcher passed better-auth a same-origin path as its
callbackURL. Better Auth stores that value verbatim in the OAuth state, and
the callback's credential-draft reader parsed it with a bare `new URL()`,
which rejects a path. That throw happened inside the `account.create.before`
database hook, which better-auth's OAuth callback does not guard, so the
provider redirect landed on a 500 after authorization had already succeeded.

Send an absolute URL from the connect page, matching the workspace-scoped
branch and every other connect surface, and accept a path-absolute callback
URL in the draft reader so the shape can never fail the callback again.
Protocol-relative and malformed values still throw, keeping an unreadable
binding loud.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/desktop/connect/connect-launcher.tsx

@@ -8,8 +8,13 @@ import { DesktopHandoffShell } from '@/app/desktop/components/desktop-handoff-sh
 
 interface ConnectLauncherProps {
   providerId: string
-  /** Same-origin path better-auth returns the browser to after the callback. */
-  completePath: string
+  /**
+   * Absolute URL better-auth returns the browser to after the callback. Better
+   * Auth stores it verbatim in the OAuth state and the callback reads the
+   * credential draft back off it, so a bare path would be parsed without an
+   * origin — keep this a full URL, as every other connect surface passes.
+   */
+  completeUrl: string
 }
 
 /**
@@ -19,7 +24,7 @@ interface ConnectLauncherProps {
  * leaves for the provider immediately, so the UI is just a brief interstitial
  * plus an error state with retry.
  */
-export function ConnectLauncher({ providerId, completePath }: ConnectLauncherProps) {
+export function ConnectLauncher({ providerId, completeUrl }: ConnectLauncherProps) {
   const startedRef = useRef(false)
   const [error, setError] = useState<string | null>(null)
 
@@ -28,18 +33,18 @@ export function ConnectLauncher({ providerId, completePath }: ConnectLauncherPro
     try {
       await client.oauth2.link({
         providerId,
-        callbackURL: completePath,
+        callbackURL: completeUrl,
         // Failed flows bounce to the same complete page (which forwards the
         // failure to the loopback) instead of waiting out the handoff TTL.
         // Do NOT bake in a query param here: better-auth appends its own
         // `&error=<code>`, and a second `error` key deserializes to an array
         // that the complete page can't read — so it would look like success.
-        errorCallbackURL: completePath,
+        errorCallbackURL: completeUrl,
       })
     } catch (err) {
       setError(getErrorMessage(err, 'Could not start the connection.'))
     }
-  }, [providerId, completePath])
+  }, [providerId, completeUrl])
 
   useEffect(() => {
     if (startedRef.current) return

apps/sim/app/desktop/connect/page.test.tsx

@@ -0,0 +1,131 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockGetSession, mockRedirect } = vi.hoisted(() => ({
+  mockGetSession: vi.fn(),
+  mockRedirect: vi.fn((url: string) => {
+    throw new Error(`NEXT_REDIRECT:${url}`)
+  }),
+}))
+
+vi.mock('@/lib/auth', () => ({
+  auth: { api: { getSession: mockGetSession } },
+  getSession: vi.fn(),
+}))
+
+vi.mock('@/lib/auth/auth-client', () => ({
+  client: { oauth2: { link: vi.fn() } },
+  signOut: vi.fn(),
+}))
+
+vi.mock('@/lib/core/utils/urls', () => ({
+  getBaseUrl: () => 'https://sim.test',
+}))
+
+/** Keeps the landing-page barrel the real shell pulls in out of this graph. */
+vi.mock('@/app/desktop/components/desktop-handoff-shell', () => ({
+  DesktopHandoffShell: () => null,
+}))
+
+vi.mock('next/navigation', () => ({
+  redirect: mockRedirect,
+}))
+
+vi.mock('next/headers', () => ({
+  headers: vi.fn(async () => new Headers()),
+}))
+
+import DesktopConnectPage from '@/app/desktop/connect/page'
+
+const VALID_STATE = 'a'.repeat(32)
+const PORT = '57979'
+
+function pageProps(params: Record<string, string>) {
+  return { searchParams: Promise.resolve(params) }
+}
+
+async function renderPage(params: Record<string, string>) {
+  const result = (await DesktopConnectPage(pageProps(params))) as unknown as {
+    type: { name: string }
+    props: Record<string, unknown>
+  }
+  return result
+}
+
+describe('DesktopConnectPage', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1', email: 'user@example.com' } })
+  })
+
+  it('hands the launcher an absolute complete URL so the callback can read the draft back', async () => {
+    // Better Auth stores `callbackURL` verbatim, and the OAuth callback parses it
+    // with `new URL`. A bare path threw there, failing the whole callback with a
+    // 500 after the provider had already authorized.
+    const result = await renderPage({
+      provider: 'google-email',
+      state: VALID_STATE,
+      port: PORT,
+      draftId: 'draft-1',
+    })
+
+    expect(result.type.name).toBe('ConnectLauncher')
+    expect(result.props.providerId).toBe('google-email')
+
+    const completeUrl = new URL(result.props.completeUrl as string)
+    expect(completeUrl.origin).toBe('https://sim.test')
+    expect(completeUrl.pathname).toBe('/desktop/connect/complete')
+    expect(completeUrl.searchParams.get('state')).toBe(VALID_STATE)
+    expect(completeUrl.searchParams.get('port')).toBe(PORT)
+    expect(completeUrl.searchParams.get('credentialDraftId')).toBe('draft-1')
+  })
+
+  it('keeps the complete URL absolute when no draft rides along', async () => {
+    const result = await renderPage({
+      provider: 'google-email',
+      state: VALID_STATE,
+      port: PORT,
+    })
+
+    expect(result.type.name).toBe('ConnectLauncher')
+    expect(() => new URL(result.props.completeUrl as string)).not.toThrow()
+  })
+
+  it('sends a workspace-scoped connect to the authorize route with an absolute callback', async () => {
+    await expect(
+      DesktopConnectPage(
+        pageProps({
+          provider: 'google-email',
+          state: VALID_STATE,
+          port: PORT,
+          workspaceId: 'workspace-1',
+        })
+      )
+    ).rejects.toThrow('NEXT_REDIRECT:')
+
+    const authorize = new URL(mockRedirect.mock.calls[0][0])
+    expect(authorize.pathname).toBe('/api/auth/oauth2/authorize')
+    expect(authorize.searchParams.get('providerId')).toBe('google-email')
+    expect(authorize.searchParams.get('workspaceId')).toBe('workspace-1')
+    expect(authorize.searchParams.get('callbackURL')).toBe(
+      `https://sim.test/desktop/connect/complete?state=${VALID_STATE}&port=${PORT}`
+    )
+  })
+
+  it('rejects a malformed request without reading the session', async () => {
+    const invalid = [
+      { provider: 'Google', state: VALID_STATE, port: PORT },
+      { provider: 'google-email', state: 'short', port: PORT },
+      { provider: 'google-email', state: VALID_STATE },
+      { provider: 'google-email', state: VALID_STATE, port: PORT, draftId: 'bad draft' },
+    ]
+
+    for (const params of invalid) {
+      const result = await renderPage(params)
+      expect(result.type.name).toBe('InvalidRequest')
+    }
+    expect(mockGetSession).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/desktop/connect/page.tsx

@@ -125,7 +125,7 @@ export default async function DesktopConnectPage({ searchParams }: DesktopConnec
   return (
     <ConnectLauncher
       providerId={providerId}
-      completePath={buildConnectCompletePath(state, port, draftId)}
+      completeUrl={`${getBaseUrl()}${buildConnectCompletePath(state, port, draftId)}`}
     />
   )
 }

apps/sim/lib/credentials/draft-processor.test.ts

@@ -119,11 +119,23 @@ describe('parseCredentialDraftIdFromCallbackUrl', () => {
     ).toBe('draft-1')
   })
 
+  it('reads a same-origin path, which Better Auth stores verbatim', () => {
+    expect(
+      parseCredentialDraftIdFromCallbackUrl(
+        '/desktop/connect/complete?state=abc&port=57979&credentialDraftId=draft-1'
+      )
+    ).toBe('draft-1')
+    expect(
+      parseCredentialDraftIdFromCallbackUrl('/desktop/connect/complete?state=abc&port=57979')
+    ).toBeUndefined()
+  })
+
   it('fails closed for malformed or non-string callback state', () => {
     expect(() => parseCredentialDraftIdFromCallbackUrl({})).toThrow(
       'OAuth state callback URL must be a string'
     )
     expect(() => parseCredentialDraftIdFromCallbackUrl('not a URL')).toThrow()
+    expect(() => parseCredentialDraftIdFromCallbackUrl('//elsewhere.test/path')).toThrow()
   })
 })
 

apps/sim/lib/credentials/draft-processor.ts

@@ -25,13 +25,34 @@ type AvailableOAuthCredentialDraftBinding = Extract<
 
 const oauthCredentialDraftBindings = new WeakMap<object, AvailableOAuthCredentialDraftBinding>()
 
-/** Extracts a draft binding from Better Auth state and rejects malformed callback state. */
+/**
+ * Origin a path-absolute callback URL is resolved against. Only the query string
+ * is ever read, so the origin is immaterial — a placeholder keeps this parse
+ * independent of `NEXT_PUBLIC_APP_URL`, which `getBaseUrl()` throws without.
+ */
+const SAME_ORIGIN_CALLBACK_BASE = 'http://callback.invalid'
+
+/**
+ * Extracts a draft binding from Better Auth state and rejects malformed callback state.
+ *
+ * Better Auth stores `callbackURL` verbatim, so a path-absolute value is as
+ * valid as a full URL. Bare `new URL()` rejects the former, and since this runs
+ * inside the `account.create.before` database hook — which Better Auth's OAuth
+ * callback does not guard — that rejection surfaced as a 500 on the callback
+ * itself rather than a failed connection. Only those two shapes are accepted:
+ * a protocol-relative `//host/path` is not a path, and still throws along with
+ * everything else malformed, so an unreadable binding stays loud.
+ */
 export function parseCredentialDraftIdFromCallbackUrl(callbackUrl: unknown): string | undefined {
   if (callbackUrl === undefined) return undefined
   if (typeof callbackUrl !== 'string') {
     throw new Error('OAuth state callback URL must be a string')
   }
-  return new URL(callbackUrl).searchParams.get(OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM) ?? undefined
+  const isPathAbsolute = callbackUrl.startsWith('/') && !callbackUrl.startsWith('//')
+  const url = isPathAbsolute
+    ? new URL(callbackUrl, SAME_ORIGIN_CALLBACK_BASE)
+    : new URL(callbackUrl)
+  return url.searchParams.get(OAUTH_CREDENTIAL_DRAFT_CALLBACK_PARAM) ?? undefined
 }
 
 /** Reads an exact draft binding without falling back when OAuth state is unavailable. */