[Fix] ChatGPT device-code dialog waits forever on codes that can never succeed

[daniel-lxs]

Problem

The ChatGPT subscription connect dialog could wait forever on a device code that would never succeed, with no way for an admin to tell an expired code apart from a policy refusal.

Two separate causes:

1. No expiry. startChatGptDeviceAuth returned the poll interval but dropped the issuer's expiry, and the dialog had no expiry timer. Its while (pollingRef.current && deviceAuth) loop polled a dead code indefinitely behind a "Waiting for authorization…" spinner.
2. Terminal refusals looked identical to pending. pollChatGptDeviceAuth mapped both HTTP 403 and 404 to pending, so a code the issuer no longer recognizes, and a refusal that no amount of waiting resolves, both rendered as the same spinner as "the user hasn't typed the code in yet".

The polling loop was also invoked as void poll() with no .catch() while awaiting mutateAsync, so the awaited promise rejected unobserved.

What the endpoints actually return

I probed the live endpoints before changing the classification (unauthenticated, no credentials involved):

• deviceauth/usercode already returns expires_at, an ISO timestamp ~15 minutes out. We were discarding it.
• deviceauth/token returns HTTP 403 with error.code: "deviceauth_authorization_pending" as the normal pending response, on every poll before the user enters the code.
• An unknown or aged-out code returns HTTP 404 with error.code: "deviceauth_not_found".

So 403 could not simply be made terminal: that is the pending path, and treating it as terminal would break every connect. 404 was the branch silently mapped to pending forever.

Fix

• startChatGptDeviceAuth returns expiresInMs, derived from the issuer's expires_at. It is relative rather than absolute so clock skew between server and browser cannot expire a code early or late, and it falls back to 900s when the field is absent or unparseable.
• Poll classification keys on the structured error.code, never on message wording: the pending code stays pending, deviceauth_not_found becomes failed/expired, and any other explicit code on 403/404 becomes failed/blocked. An unrecognized body still falls back to pending, preserving prior behavior for response shapes not seen here, now bounded by the expiry deadline so it cannot spin forever.
• HTTP 429 backs off instead of failing.
• The dialog stops at the deadline with a restart prompt, renders dedicated copy for a blocked deployment (workspace policy blocks the app, contact an admin, waiting will not clear it), honors the backoff interval, and drops the dead code from the UI on any terminal state instead of leaving it next to a spinner.
• Poll results now drive the loop directly instead of being split across onSuccess/onError. That split was what let the awaited promise reject unobserved; a single code path now owns both stopping the loop and reporting the outcome, and it has the missing .catch().

Testing

Unit: 23 db tests and new dialog tests covering expiry, blocked, expired, rate-limit backoff and the rejected-poll path. Full suites green (db 45 files / 423 tests, web 359 files / 2641 tests).

Live smoke against the real endpoints, using the shipped functions:

Check	Result
Issuer expiry parsed	expiresInMs: 900229 (15.00 min)
Live un-authorized poll	pending, no regression on the normal path
Unknown code poll	failed / reason: expired

End-to-end in the browser against a real device code:

Scenario	Result
Real 15-minute expiry, nothing mocked	Last poll at 22:46:58, expiry ~22:47:00, loop stopped, expired message and Restart shown, zero polls in the following 7 minutes
Shortened window	Stops at the deadline, no further polls
Blocked	Error plus org-policy guidance, stopped after exactly one poll, code removed, Restart offered
Restart after blocked	Fresh code issued, polling resumes
Rejected poll	Error surfaced, spinner gone, polling stopped, no unhandled rejection in console

Note for reviewers

The blocked branch is verified for behavior but not against a genuinely policy-blocked account, since I have no way to produce one. It treats any non-pending 403 code as blocked, so it covers that case whatever the specific code turns out to be.

🤖 Generated with Claude Code

[roomote-community]

1 issue outstanding. See task

• apps/web/src/components/settings/ChatGptConnectDialog.tsx:146 The expiry deadline is only checked before and after await pollMutation.mutateAsync(...). A poll that remains in flight past the deadline never reaches either check, so the dialog keeps waiting without offering Restart, which preserves the indefinite-wait failure this PR is meant to prevent. Add an independent deadline timer (and ignore or abort the late request) so expiry wins even when the poll hangs.

_{Reviewed 240980a}