Expose some helpers for manually creating session on callback

[JClackett]

Hi!

Little context...so im trying to build a flow that allows a user to sign up via link.

Currently, the link redirects to workos with a inviteCode in state. The callback from workos then calls the handleCallbackRoute function from this package in my route handler.

However, if I want to validate that the token/signup is valid, e.g. the invite isnt expired, or revoked, or incorrect email used. Where can I do this? because currently theres only a onSuccess callback but this runs after already creating the session? so from the users perspective if I accidentally choose the wrong email and the invite isnt valid im now logged in.

I guess in the onSuccess I can try log them back out again, but is there no way to hook into the process between verifying the code and getting the authResponse and the actual session creation?

Curious as to how best to handle this use case

[JClackett]

Im also confused about how its even creating the session, because if I throw an error in the onSuccess, I thought the onError would be hit and if I return a new Response there it wouldnt set the session headers. But that doesnt seem to be the case and it's still logging me in?

This line in the callback is setting the session regardless if the whole thing errors or not

const result = await authkit.handleCallback(request, response, { code, state: state ?? undefined });

[JClackett]

Alright, for anyone who wants more control over when someone gets signed in, you have to patch a couple workos packages so that it doesnt just automatically set the session headers

It's a bit of hack and it would be nice if there was a more practical way, maybe a onRequest callback that gets the authResponse payload before logging them in?

@workos%2Fauthkit-tanstack-react-start@0.4.1.patch

diff --git a/dist/server/server.js b/dist/server/server.js
index 2a5b94040fc4a108b04bd8add7f2387838d9e1b5..a794be373e547a53e5e1e4b33d5fb5c8a8949096 100644
--- a/dist/server/server.js
+++ b/dist/server/server.js
@@ -65,8 +65,10 @@ async function handleCallbackInternal(request, options) {
         const returnPathname = options.returnPathname ?? stateReturnPathname;
         const response = new Response();
         const authkit = await getAuthkit();
-        const result = await authkit.handleCallback(request, response, { code, state: state ?? undefined });
-        const { authResponse } = result;
+        const authResponse = await authkit.getWorkOS().userManagement.authenticateWithCode({
+            code,
+            clientId: authkit.getWorkOS().clientId,
+        });
         if (options.onSuccess) {
             await options.onSuccess({
                 accessToken: authResponse.accessToken,
@@ -79,6 +81,7 @@ async function handleCallbackInternal(request, options) {
                 state: customState,
             });
         }
+        const result = await authkit.handleCallback(authResponse, response, { code, state: state ?? undefined });
         const redirectUrl = buildRedirectUrl(url, returnPathname);
         const sessionHeaders = extractSessionHeaders(result);
         return new Response(null, {

@workos%2Fauthkit-session@0.3.2.patch

diff --git a/dist/service/AuthService.d.ts b/dist/service/AuthService.d.ts
index 536fb2279c17efee86b79feeaa39850c01b60616..81e5dd82b0580333a155a27d7032b3346ce64c0d 100644
--- a/dist/service/AuthService.d.ts
+++ b/dist/service/AuthService.d.ts
@@ -118,12 +118,12 @@ export declare class AuthService<TRequest, TResponse> {
      * Handle OAuth callback.
      * This creates a new session after successful authentication.
      *
-     * @param request - Framework-specific request (not currently used)
+     * @param authResponse - WorkOS auth response
      * @param response - Framework-specific response
      * @param options - OAuth callback options (code, state)
      * @returns Updated response, return pathname, and auth response
      */
-    handleCallback(_request: TRequest, response: TResponse, options: {
+    handleCallback(authResponse: AuthenticationResponse, response: TResponse, options: {
         code: string;
         state?: string;
     }): Promise<{
diff --git a/dist/service/AuthService.js b/dist/service/AuthService.js
index 9239d5fd625d9df9a576a8a9aaeabade6d9630bb..d7bd9e7aa05bd75b741ae90e812ae92e348ffb4d 100644
--- a/dist/service/AuthService.js
+++ b/dist/service/AuthService.js
@@ -158,17 +158,17 @@ export class AuthService {
      * Handle OAuth callback.
      * This creates a new session after successful authentication.
      *
-     * @param request - Framework-specific request (not currently used)
+     * @param authResponse - WorkOS auth response
      * @param response - Framework-specific response
      * @param options - OAuth callback options (code, state)
      * @returns Updated response, return pathname, and auth response
      */
-    async handleCallback(_request, response, options) {
-        // Authenticate with WorkOS using the OAuth code
-        const authResponse = await this.client.userManagement.authenticateWithCode({
-            code: options.code,
-            clientId: this.config.clientId,
-        });
+    async handleCallback(authResponse, response, options) {
+        // // Authenticate with WorkOS using the OAuth code
+        // const authResponse = await this.client.userManagement.authenticateWithCode({
+        //     code: options.code,
+        //     clientId: this.config.clientId,
+        // });
         // Create and save the new session
         const session = {
             accessToken: authResponse.accessToken,