feat(core): support isProviderConnected in stateful strategy

[halvaradop]

Description

This pull request adds Stateful session support for the isProviderConnected() API and the GET /providers/:provider endpoint.

With this change, the provider connection APIs now support both available session strategies:

• Stateless (JWT)
• Stateful (Database)

The implementation ensures consistent behavior across both strategies, allowing applications to verify whether an OAuth or OpenID Connect (OIDC) provider is connected to the current session regardless of the configured session storage mechanism.

Key Changes

• Added Stateful session support for api.isProviderConnected().
• Added Stateful session support for the GET /providers/:provider endpoint.
• Verified consistent behavior between the Stateless and Stateful session strategies.
• Extended provider connection management support for database-backed sessions.

Note

This PR is part of the ongoing effort to implement the Stateful session strategy. To keep reviews focused and manageable, the implementation has been split into a series of smaller pull requests, each covering a specific aspect of the feature.

Related PRs

• feat(core): support revokeToken in stateful strategy #234
• feat(core): implement getProviderTokens for stateful sessions #231
• test: expand auth API coverage and reorganize test suite #230
• test: expand stateful session strategy coverage #229
• feat(core): implement experimental stateful session strategy" #228
• feat(core): introduce stateful session strategy types #227

@coderabbitai ignore

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
auth	Skipped		Jul 25, 2026 9:15pm

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds isProviderConnected to the session strategy contract and implementations, delegates the API check to strategies, and adds stateful connection, response, cookie, account-status, and regression coverage.

Changes

Provider connection status

Layer / File(s)	Summary
API delegation and session contract packages/core/src/@types/session.ts, packages/core/src/api/isProviderConnected.ts	The strategy contract adds isProviderConnected; the API validates OAuth headers and delegates connection status to the session strategy.
Stateful and stateless strategy checks packages/core/src/session/stateful.ts, packages/core/src/session/stateless.ts	The stateful strategy checks session validity and active account status; the stateless strategy verifies the provider access-token cookie.
Connection behavior and regression coverage packages/core/test/actions/providers/connected/stateful.test.ts, packages/core/test/api/stateful/isProviderConnected.test.ts, packages/core/test/presets.ts, packages/core/test/actions/providers/tokens/revoke/stateful.test.ts	Tests cover invalid providers, sessions, cookies, accounts, responses, multiple providers, and updated account fixtures.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• aura-stack-ts/auth#223: Introduces the experimental provider connection feature extended here.
• aura-stack-ts/auth#228: Adds the stateful session strategy that this change extends.
• aura-stack-ts/auth#220: Updates the shared SessionStrategy interface with experimental APIs.

Suggested labels: experimental

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant isProviderConnected
  participant SessionStrategy
  participant SessionStore
  Client->>isProviderConnected: Request provider connection status
  isProviderConnected->>SessionStrategy: Validate OAuth headers and check provider
  SessionStrategy->>SessionStore: Read session and account data
  SessionStore-->>SessionStrategy: Session and account records
  SessionStrategy-->>isProviderConnected: connected boolean
  isProviderConnected-->>Client: success, connected, and headers

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title matches a real, central part of the change by adding isProviderConnected support, though it narrows scope to the stateful strategy only.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/support-is-provider-connected

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/core/src/session/stateful.ts`:
- Around line 990-998: Update the expired-session branch in isProviderConnected
to call config.adapter.revokeSession with sessionByToken.id and "user_logout"
before logging and returning false, matching the cleanup behavior of getSession,
refreshSession, getProviderTokens, and revokeToken. Keep inactive-session
handling unchanged and avoid revoking sessions that are not expired.

In `@packages/core/src/session/stateless.ts`:
- Around line 363-378: Update isProviderConnected to catch errors from
jwt.verifyToken(cookieValue) and return false for malformed, tampered, or
expired provider tokens, matching the existing getCookie failure behavior and
getSession’s authentication-error handling.

In `@packages/core/test/actions/providers/connected/stateful.test.ts`:
- Around line 130-306: Correct the affected tests around the stateful
isProviderConnected flow so getSessionByTokenMock supplies a session for both
verifySession and the strategy, using two mockResolvedValueOnce calls or
persistent mockResolvedValue. Update “handles expired session token” to exercise
the intended session-expiry behavior rather than mock exhaustion, and replace
the malformed/expired provider-token cookie tests because stateful
isProviderConnected does not read provider access-token cookies. Preserve the
provider-matching coverage in “handles multiple providers” with a valid second
session response.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 02d67df4-c062-4943-8838-06d4ff60136b

📥 Commits

Reviewing files that changed from the base of the PR and between 11f6c38 and e09d46a.

📒 Files selected for processing (8)

• packages/core/src/@types/session.ts
• packages/core/src/api/isProviderConnected.ts
• packages/core/src/session/stateful.ts
• packages/core/src/session/stateless.ts
• packages/core/test/actions/providers/connected/stateful.test.ts
• packages/core/test/actions/providers/tokens/revoke/stateful.test.ts
• packages/core/test/api/stateful/isProviderConnected.test.ts
• packages/core/test/presets.ts