fix(kiro): accept the authorized status from the social device poll

[Veritas-7]

Summary

Native Kiro social device login (ocx account login kiro --method google or --method github) always ends in failed after the user approves the login in the browser, and no account is stored. The poll branch in src/oauth/kiro-device-login.ts treats any non-approved status as terminal failure, but the social poll endpoint reports a completed grant as status: "authorized".

Observed replies from POST https://prod.us-east-1.auth.desktop.kiro.dev/oauth/device/poll (2026-10-13; keys and non-secret values only, token values and the account number withheld):

• While waiting: HTTP 200, status: "authorization_pending"; accessToken, refreshToken and profileArn are present as null.
• After approval: HTTP 200, keys accessToken, identityProvider ("Google"), profileArn (arn:aws:codewhisperer:us-east-1:<account>:profile/<id>), refreshToken, status: "authorized". No expiresIn and no error key.

The fix accepts "authorized" as the social success status and keeps "approved" as an alias, so existing behavior and tests are unchanged. Every other check on the success path still applies: HTTP 200, no error key or x-amzn-errortype, non-empty access and refresh tokens, and a profileArn matching the existing pattern. Unknown statuses still fail closed. The Builder ID branch is untouched.

Changed files:

• src/oauth/kiro-device-login.ts: accept "authorized" in the social poll success check (one condition).
• tests/providers/kiro/kiro-device-social.test.ts: a regression that replays the observed sequence (authorization_pending with null tokens, then authorized with identityProvider) and asserts the flow stays pending and stores nothing, then reaches done and persists the refresh token and profile ARN without leaking tokens into the public view.

Verification

Base: dev at e2886a64a (rebased; the focused results below were re-run on this base: the four device-login files give 21 pass, 0 fail, and bun run typecheck passes). Earlier figures were measured on 60752ec3c. Tests were run with Bun 1.4.2 (the runtime the package ships); CONTRIBUTING pins 1.4.3 for the suite runner, so CI is the authoritative run.

• bun test ./tests/providers/kiro/kiro-device-social.test.ts: 4 pass, 0 fail.
• Mutation check: with only the src/ change reverted, the same file gives 3 pass, 1 fail. The new case fails with Expected: "done" / Received: "failed", which is the reported symptom.
• bun test ./tests/providers/kiro/kiro-device-social.test.ts ./tests/providers/kiro/kiro-device-builder.test.ts ./tests/server/server-kiro-device-login.test.ts ./tests/cli/cli-account-kiro-device.test.ts ./tests/ci-workflows/file-size-ratchet.test.ts: 30 pass, 0 fail.
• bun run typecheck: passed.
• bun run structure:check: passed.
• bun run privacy:scan: passed.
• git diff --check: clean.

I did not run the full local suite (bun run test). The change is a single condition in one module, and the focused files above cover the social, Builder ID, server and CLI device-login paths. Required CI on the PR head still has to pass.

Checklist

• Scope stays focused and avoids unrelated cleanup: one condition in the social poll branch plus one regression test. Builder ID handling, token validation and persistence are unchanged.
• Docs or release notes were updated when needed: none needed. No documented behavior or structure/ contract names the poll status value.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults: the success path still requires HTTP 200, no error, non-empty tokens and a valid profile ARN, and unknown statuses still fail closed. The test asserts that tokens never reach the public flow view. This touches an authentication surface, so it needs maintainer sponsorship (maintainer-sponsored) per CONTRIBUTING.

🤖 Generated with Claude Code

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes
  • Social device sign-in now recognizes “authorized” as a successful completion status, while continuing to accept “approved.”

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/kiro-device-login.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/oauth/kiro-device-login.ts.

Review readiness checklist

• ✅ Required local validation passed; commands, results, and any full-suite exception are documented.
• ✅ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f0f66490-57b2-4654-9304-06599a590548

📥 Commits

Reviewing files that changed from the base of the PR and between a29cb3d and 1dc9a66.

📒 Files selected for processing (2)

• src/oauth/kiro-device-login.ts
• tests/providers/kiro/kiro-device-social.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Social device polling now accepts authorized as a completed-grant status while retaining approved as an alias. A test covers a pending poll followed by an authorized response.

Changes: Kiro social device authorization

Layer / File(s)	Summary
Accept authorized social grants src/oauth/kiro-device-login.ts, tests/providers/kiro/kiro-device-social.test.ts	The status check accepts authorized alongside approved. The test verifies that a pending poll creates no account, then checks grant completion, stored refresh token and profile ARN, and omission of credential secrets from the returned status.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 1dc9a

The authorized social login now completes through the existing credential checks and persistence flow. No merge-blocking issue is identified.

Pre-merge checks · 4 · 1

Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: accepting the "authorized" status from the Kiro social device poll.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

Carried onto an upstream branch in #7062 (with a Co-authored-by trailer) so the repository CI can run. It is held there for the security review that MAINTAINERS.md requires for authentication changes. Leaving this PR open until that review concludes.