fix(plugin-auth): land OAuth callback errors on the console login page (objectui#2458 item 1) (#2888)

better-auth redirects a failed OAuth callback (expired/replayed state, IdP
error) to its default error URL `${baseURL}/error`, which bounces to
`/?error=<code>` — and the root→console redirect drops the query string.
Net effect: a user who just signed in successfully at the IdP lands on a
silent login form (the reported "login silent failure").

Set onAPIError.errorURL to the console login page so the browser lands on
`/_console/login?error=<code>`; the console login page (objectui PR, paired)
renders that param as a visible error banner.

Refs objectstack-ai/objectui#2458 (item 1)

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

packages/plugins/plugin-auth/src/auth-manager.test.ts

@@ -886,6 +886,30 @@ describe('AuthManager', () => {
     });
   });
 
+  describe('onAPIError.errorURL (objectui#2458 item 1)', () => {
+    it('points browser-flow errors at the console login page so ?error= is surfaced', async () => {
+      let capturedConfig: any;
+      (betterAuth as any).mockImplementation((config: any) => {
+        capturedConfig = config;
+        return { handler: vi.fn(), api: {} };
+      });
+
+      const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+      const manager = new AuthManager({
+        secret: 'test-secret-at-least-32-chars-long',
+        baseUrl: 'http://localhost:3000',
+      });
+      await manager.getAuthInstance();
+      warnSpy.mockRestore();
+
+      // Default error redirect (`${baseURL}/error` → `/?error=…`) loses the
+      // query on the root→console bounce; the login page renders it instead.
+      expect(capturedConfig.onAPIError).toEqual({
+        errorURL: 'http://localhost:3000/_console/login',
+      });
+    });
+  });
+
   describe('emailAndPassword passthrough', () => {
     it('should default emailAndPassword to enabled: true', async () => {
       let capturedConfig: any;

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -1169,6 +1169,17 @@ export class AuthManager {
         }),
       },
 
+      // Where better-auth redirects a browser flow that fails server-side —
+      // most importantly an OAuth callback error (expired/replayed `state`,
+      // IdP error). The default is `${baseURL}/error`, which bounces to
+      // `/?error=<code>`; the root→console redirect then DROPS the query, so
+      // the user lands on a silent login form right after a successful IdP
+      // sign-in (objectui#2458 item 1). Point it at the console login page,
+      // which renders `?error=` as an inline banner.
+      onAPIError: {
+        errorURL: this.getConsolePageUrl('/login'),
+      },
+
       // Trusted origins for CSRF protection (supports wildcards like "https://*.example.com")
       // Auto-includes origins from OS_CORS_ORIGIN env var so CORS and CSRF stay in sync.
       ...(() => {