Durable Provider Auth Gate

type AuthProvider interface {
    Metadata() AuthProviderMetadata
    Status(ctx context.Context, c *Computer) (*AuthStatus, error)
    Begin(ctx context.Context, c *Computer, s *AuthSession) (*AuthChallenge, error)
    Submit(ctx context.Context, c *Computer, s *AuthSession, input AuthInput) (*AuthStatus, error)
    Cancel(ctx context.Context, c *Computer, s *AuthSession) error
}

type AuthProviderMetadata struct {
    ID          string `json:"id"`           // "claude"
    DisplayName string `json:"display_name"` // "Claude"
    Method      string `json:"method"`       // "oauth_code"
}

No Prepare(). No Complete(). No Probe(). No Verify(). Workspace config stays in template.go. Auth does auth.

type AuthState string

const (
    AuthUnknown          AuthState = "unknown"
    AuthUnauthenticated  AuthState = "unauthenticated"
    AuthChallengePending AuthState = "challenge_pending"
    AuthVerifying        AuthState = "verifying"
    AuthAuthenticated    AuthState = "authenticated"
    AuthBlocked          AuthState = "blocked"
    AuthFailed           AuthState = "failed"
)

type AuthStatus struct {
    State     AuthState `json:"state"`
    Provider  string    `json:"provider"`
    Detail    string    `json:"detail,omitempty"`
    CheckedAt int64     `json:"checked_at"`
    ExpiresAt int64     `json:"expires_at,omitempty"`
    ErrorCode string    `json:"error_code,omitempty"`
    ErrorText string    `json:"error_text,omitempty"`
}

type AuthChallenge struct {
    URL        string `json:"url,omitempty"`
    ExpiresAt  int64  `json:"expires_at,omitempty"`
    SubmitHint string `json:"submit_hint,omitempty"` // "paste_code"
}

type AuthInput struct {
    Code string `json:"code,omitempty"`
}

CREATE TABLE IF NOT EXISTS auth_sessions (
    id TEXT PRIMARY KEY,
    computer TEXT NOT NULL,
    provider TEXT NOT NULL,
    state TEXT NOT NULL,
    challenge_url TEXT NOT NULL DEFAULT '',
    challenge_expires_at INTEGER,
    status_checked_at INTEGER,
    status_expires_at INTEGER,
    lease_owner TEXT NOT NULL DEFAULT '',
    lease_until INTEGER,
    attempt INTEGER NOT NULL DEFAULT 1,
    submit_hash TEXT NOT NULL DEFAULT '',
    error_code TEXT NOT NULL DEFAULT '',
    error_text TEXT NOT NULL DEFAULT '',
    created_at INTEGER NOT NULL,
    updated_at INTEGER NOT NULL,
    completed_at INTEGER,
    cancelled_at INTEGER
);

CREATE UNIQUE INDEX IF NOT EXISTS idx_auth_active
ON auth_sessions(computer, provider)
WHERE state IN ('challenge_pending', 'verifying');

CREATE INDEX IF NOT EXISTS idx_auth_lookup
ON auth_sessions(computer, provider, updated_at);

func (s *AuthService) EnsureReady(ctx context.Context, c *Computer) error {
    // 1. Read latest auth_session from DB
    session := s.db.LatestAuthStatus(c.Name, providerID)

    // 2. If authenticated and TTL valid → return nil (cached)
    if session.State == AuthAuthenticated && session.StatusExpiresAt > now {
        return nil
    }

    // 3. Stale or unknown → run provider.Status() with short timeout
    status, err := s.provider.Status(ctx, c)
    if err != nil {
        return fmt.Errorf("auth check failed: %w", err)
    }

    // 4. Update DB with fresh status + new TTL
    s.db.UpdateAuthSession(session.ID, func(r *AuthSessionRecord) {
        r.State = status.State
        r.StatusCheckedAt = now
        r.StatusExpiresAt = now + TTL
    })

    // 5. If not authenticated → return error (blocks Start)
    if status.State != AuthAuthenticated {
        return fmt.Errorf("auth required: state=%s", status.State)
    }
    return nil
}