From fb56f87260044660d77c2ea8d7d77a8ca77dcfa9 Mon Sep 17 00:00:00 2001
From: Taesu <166604494+bytaesu@users.noreply.github.com>
Date: Wed, 18 Feb 2026 02:23:51 +0900
Subject: [PATCH] fix(oauth-provider): return `url` instead of `uri` in
 continue and consent endpoints (#7811)

(cherry picked from commit 88e1e995b19e7a06405ba9b0f8430d410a7beb48)
---
 packages/oauth-provider/src/consent.ts    |  4 ++--
 packages/oauth-provider/src/continue.ts   |  6 +++---
 packages/oauth-provider/src/mcp.test.ts   |  2 +-
 packages/oauth-provider/src/oauth.test.ts | 18 +++++++++---------
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/packages/oauth-provider/src/consent.ts b/packages/oauth-provider/src/consent.ts
index 8adecb01ed..e6f1484de6 100644
--- a/packages/oauth-provider/src/consent.ts
+++ b/packages/oauth-provider/src/consent.ts
@@ -43,7 +43,7 @@ export async function consentEndpoint(
 	if (!accepted) {
 		return {
 			redirect: true,
-			uri: formatErrorURL(
+			url: formatErrorURL(
 				query.get("redirect_uri") ?? "",
 				"access_denied",
 				"User denied access",
@@ -121,6 +121,6 @@ export async function consentEndpoint(
 	const { url } = await authorizeEndpoint(ctx, opts);
 	return {
 		redirect: true,
-		uri: url,
+		url,
 	};
 }
diff --git a/packages/oauth-provider/src/continue.ts b/packages/oauth-provider/src/continue.ts
index e94cc8d18c..e221363c5e 100644
--- a/packages/oauth-provider/src/continue.ts
+++ b/packages/oauth-provider/src/continue.ts
@@ -41,7 +41,7 @@ async function selected(
 	const { url } = await authorizeEndpoint(ctx, opts);
 	return {
 		redirect: true,
-		uri: url,
+		url,
 	};
 }
 
@@ -61,7 +61,7 @@ async function created(
 	const { url } = await authorizeEndpoint(ctx, opts);
 	return {
 		redirect: true,
-		uri: url,
+		url,
 	};
 }
 
@@ -84,6 +84,6 @@ async function postLogin(
 	});
 	return {
 		redirect: true,
-		uri: url,
+		url,
 	};
 }
diff --git a/packages/oauth-provider/src/mcp.test.ts b/packages/oauth-provider/src/mcp.test.ts
index df78a9ae6d..61148386fb 100644
--- a/packages/oauth-provider/src/mcp.test.ts
+++ b/packages/oauth-provider/src/mcp.test.ts
@@ -327,7 +327,7 @@ describe("mcp - server-client flows", async () => {
 					},
 				},
 			);
-			const url = new URL(consentRes.data?.uri ?? "");
+			const url = new URL(consentRes.data?.url ?? "");
 			const _state = url.searchParams.get("state");
 			if ((state || _state) && state !== _state) {
 				throw new Error("state mismatch");
diff --git a/packages/oauth-provider/src/oauth.test.ts b/packages/oauth-provider/src/oauth.test.ts
index dd91f6a6cd..0571d3f0ff 100644
--- a/packages/oauth-provider/src/oauth.test.ts
+++ b/packages/oauth-provider/src/oauth.test.ts
@@ -774,11 +774,11 @@ describe("oauth - prompt", async () => {
 			},
 		);
 		expect(consentRes.redirect).toBeTruthy();
-		expect(consentRes.uri).toContain(redirectUri);
-		expect(consentRes.uri).toContain(`code=`);
+		expect(consentRes.url).toContain(redirectUri);
+		expect(consentRes.url).toContain(`code=`);
 		vi.stubGlobal("window", {
 			location: {
-				search: new URL(consentRes.uri, authServerBaseUrl).search,
+				search: new URL(consentRes.url, authServerBaseUrl).search,
 			},
 		});
 		onTestFinished(() => {
@@ -786,7 +786,7 @@ describe("oauth - prompt", async () => {
 		});
 
 		let callbackURL = "";
-		await client.$fetch(consentRes.uri, {
+		await client.$fetch(consentRes.url, {
 			method: "GET",
 			headers: oauthHeaders,
 			onError(context) {
@@ -985,7 +985,7 @@ describe("oauth - prompt", async () => {
 			},
 		);
 		expect(selectedAccountRes.redirect).toBeTruthy();
-		const selectedAccountRedirectUri = selectedAccountRes?.uri;
+		const selectedAccountRedirectUri = selectedAccountRes?.url;
 		expect(selectedAccountRedirectUri).toContain(redirectUri);
 		expect(selectedAccountRedirectUri).toContain(`code=`);
 
@@ -1142,7 +1142,7 @@ describe("oauth - prompt", async () => {
 			},
 		);
 		expect(selectedAccountRes.redirect).toBeTruthy();
-		const consentRedirectUri = selectedAccountRes?.uri;
+		const consentRedirectUri = selectedAccountRes?.url;
 		expect(consentRedirectUri).toContain(`/consent`);
 		expect(consentRedirectUri).toContain(`client_id=${oauthClient.client_id}`);
 		expect(consentRedirectUri).toContain(`scope=`);
@@ -1235,7 +1235,7 @@ describe("oauth - prompt", async () => {
 			},
 		);
 		expect(selectedAccountRes.redirect).toBeTruthy();
-		const consentRedirectUri = selectedAccountRes?.uri;
+		const consentRedirectUri = selectedAccountRes?.url;
 		expect(consentRedirectUri).toContain(`/consent`);
 		expect(consentRedirectUri).toContain(`client_id=${oauthClient.client_id}`);
 		expect(consentRedirectUri).toContain(`scope=`);
@@ -1260,8 +1260,8 @@ describe("oauth - prompt", async () => {
 				onResponse: cookieSetter(headers),
 			},
 		);
-		expect(consentRes.uri).toContain(redirectUri);
-		expect(consentRes.uri).toContain(`code=`);
+		expect(consentRes.url).toContain(redirectUri);
+		expect(consentRes.url).toContain(`code=`);
 
 		enablePostLogin = false;
 	});