fix(auth): dispatch customOAuthState before signInWithRedirect_failure on OAuth error redirects

[y-hsgw]

Description of changes

When signInWithRedirect fails during the OAuth callback (e.g. Cognito redirects back with ?error=...&error_description=...&state=..., such as when a PreSignUp Lambda trigger throws to block sign-in), completeOAuthFlow threw before reaching the point where customOAuthState is dispatched. As a result, any customState passed to signInWithRedirect({ customState }) was lost on failure — only signInWithRedirect_failure fired, with no way to recover the custom state via the Hub event system.

This change dispatches customOAuthState from the error branch of completeOAuthFlow before throwing, so signInWithRedirect_failure listeners can still read the custom state that was passed to signInWithRedirect.

Per the maintainer's guidance on the issue, the custom state is recovered from the state Amplify itself persisted when signInWithRedirect({ customState }) was called (oAuthStore.loadOAuthState()), rather than from the unvalidated state query param. This avoids dispatching attacker-influenceable data into customOAuthState, which commonly drives a redirect target. The existing isCustomState / getCustomState / urlSafeDecode helpers are reused, matching the success path in completeFlow.

Issue #, if available

#14853

Description of how you validated changes

Added unit tests in completeOAuthFlow.test.ts covering the error redirect path:

• dispatches customOAuthState (recovered from the persisted state) before throwing when the persisted state contains a custom state
• does not dispatch customOAuthState when the persisted state has no custom state
• does not dispatch customOAuthState when there is no persisted state

yarn test --scope @aws-amplify/auth passes for the affected suites.

Checklist

• PR description included
• yarn test passes
• Unit Tests are changed or added

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[changeset-bot]

🦋 Changeset detected

Latest commit: 208a6c0

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@aws-amplify/auth	Patch
@aws-amplify/pubsub	Patch
aws-amplify	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR