fix(auth-ui): device "Code expired", OS column, datumctl login callback

Three staging bugs surfaced during #755 testing:

- device: redirect authorize/deny to a terminal /device/complete route so
  React Router 7 post-action revalidation can't re-resolve the already-consumed
  device authorization and render a false "Code expired" over a successful
  authorize.
- sessions: thread the active ceremony requestId through the /accounts picker
  (loader + switch/remove forms + switchAccount/resolveNextPath) so selecting an
  account during a datumctl OIDC login resumes /authorize -> createCallback
  instead of hanging on "Waiting for authentication callback".
- user-agent: emit the OS token as "Mac OS" (not "macOS") so the cloud-portal
  session gateway parses the OS column from the createSession description.

datum-cloud/enhancements#755

Author: yahyafakhroji

app/modules/i18n/locales/en.po

@@ -25,7 +25,7 @@ msgstr "{0, plural, one {# attempt remaining.} other {# attempts remaining.}}"
 msgid "{0}"
 msgstr "{0}"
 
-#: app/routes/device/authorize.tsx:109
+#: app/routes/device/authorize.tsx:104
 msgid "<0>{appName}</0> is requesting access."
 msgstr "<0>{appName}</0> is requesting access."
 
@@ -37,15 +37,15 @@ msgstr "A new code has been sent to your email."
 msgid "Activate your device"
 msgstr "Activate your device"
 
-#: app/routes/accounts.tsx:79
+#: app/routes/accounts.tsx:86
 msgid "Add an account"
 msgstr "Add an account"
 
 #: app/routes/setup/mfa.tsx:160
 msgid "Add an extra layer of security to your account by setting up a second factor."
 msgstr "Add an extra layer of security to your account by setting up a second factor."
 
-#: app/routes/accounts.tsx:149
+#: app/routes/accounts.tsx:161
 msgid "Add another account"
 msgstr "Add another account"
 
@@ -92,7 +92,7 @@ msgstr "Authenticator code"
 msgid "Authenticator QR code"
 msgstr "Authenticator QR code"
 
-#: app/routes/device/authorize.tsx:96
+#: app/routes/device/complete.tsx:33
 #: app/routes/signed-in.tsx:62
 msgid "Authorization complete"
 msgstr "Authorization complete"
@@ -101,11 +101,11 @@ msgstr "Authorization complete"
 msgid "Authorization failed"
 msgstr "Authorization failed"
 
-#: app/routes/device/authorize.tsx:130
+#: app/routes/device/authorize.tsx:125
 msgid "Authorize"
 msgstr "Authorize"
 
-#: app/routes/device/authorize.tsx:105
+#: app/routes/device/authorize.tsx:100
 msgid "Authorize device"
 msgstr "Authorize device"
 
@@ -145,7 +145,7 @@ msgstr "Check your email"
 msgid "Choose a new password"
 msgstr "Choose a new password"
 
-#: app/routes/accounts.tsx:66
+#: app/routes/accounts.tsx:73
 msgid "Choose an account"
 msgstr "Choose an account"
 
@@ -209,14 +209,18 @@ msgstr "Create a new account"
 msgid "Create account"
 msgstr "Create account"
 
-#: app/routes/device/authorize.tsx:139
+#: app/routes/device/authorize.tsx:134
 msgid "Deny"
 msgstr "Deny"
 
 #: app/routes/device/index.tsx:69
 msgid "Device code"
 msgstr "Device code"
 
+#: app/routes/device/complete.tsx:41
+msgid "Device denied"
+msgstr "Device denied"
+
 #: app/routes/login/index.tsx:206
 #: app/routes/login/index.tsx:347
 #: app/routes/signup/index.tsx:266
@@ -338,7 +342,7 @@ msgstr "Linked accounts"
 msgid "Manual setup key"
 msgstr "Manual setup key"
 
-#: app/routes/accounts.tsx:118
+#: app/routes/accounts.tsx:128
 msgid "Needs re-authentication"
 msgstr "Needs re-authentication"
 
@@ -355,7 +359,7 @@ msgstr "No account was found and sign-up is not available."
 msgid "No sign-in method is available for this account."
 msgstr "No sign-in method is available for this account."
 
-#: app/routes/accounts.tsx:74
+#: app/routes/accounts.tsx:81
 msgid "No signed-in accounts."
 msgstr "No signed-in accounts."
 
@@ -468,7 +472,7 @@ msgstr "Scan the QR code below with your authenticator app, then enter the 6-dig
 msgid "Security key"
 msgstr "Security key"
 
-#: app/routes/accounts.tsx:67
+#: app/routes/accounts.tsx:74
 msgid "Select an account to continue or add a new one."
 msgstr "Select an account to continue or add a new one."
 
@@ -484,7 +488,7 @@ msgstr "Send reset link"
 msgid "Service temporarily unavailable. Please try again."
 msgstr "Service temporarily unavailable. Please try again."
 
-#: app/routes/accounts.tsx:116
+#: app/routes/accounts.tsx:126
 msgid "Session active"
 msgstr "Session active"
 
@@ -627,6 +631,10 @@ msgstr "The sign-in link was incomplete or expired."
 msgid "This device code is invalid or has expired."
 msgstr "This device code is invalid or has expired."
 
+#: app/routes/device/complete.tsx:42
+msgid "This device was not granted access. You may close this window."
+msgstr "This device was not granted access. You may close this window."
+
 #: app/routes/sso/provider/error.tsx:22
 msgid "This directory account can't be linked here yet. Sign in with your password instead."
 msgstr "This directory account can't be linked here yet. Sign in with your password instead."
@@ -767,7 +775,7 @@ msgstr "You can now sign in using <0>{loginName}</0>."
 msgid "You don't have permission to do that."
 msgstr "You don't have permission to do that."
 
-#: app/routes/device/authorize.tsx:97
+#: app/routes/device/complete.tsx:34
 msgid "You may return to your device."
 msgstr "You may return to your device."
 

app/resources/device/__tests__/device.service.test.ts

@@ -159,7 +159,7 @@ describe('loadDeviceConsent (/device/authorize loader)', () => {
 // ── /device/authorize action → resolveDeviceDecision (from authorize.test.ts) ──────
 
 describe('resolveDeviceDecision (/device/authorize action)', () => {
-  it('authorize with a session → device is authorized; outcome is not a redirect', async () => {
+  it('authorize with a session → device is authorized; redirects to the terminal /device/complete', async () => {
     const req = await requestWithSession('http://localhost/id/device/authorize');
     const outcome = await resolveDeviceDecision(
       fakeProvider(),
@@ -173,14 +173,16 @@ describe('resolveDeviceDecision (/device/authorize action)', () => {
       })
     );
 
-    // Must NOT be a 302 redirect
-    expect(outcome.kind).toBe('done');
-    const res = decisionOutcomeToResponse(outcome);
-    expect(res instanceof Response && (res as Response).status === 302).toBe(false);
+    // Success is a 302 redirect to the TERMINAL completion screen carrying the decision —
+    // authorizeDevice consumed the device-auth request, so re-rendering this route's loader
+    // would NOT_FOUND; /device/complete has no getDeviceAuth loader.
+    expect(outcome.kind).toBe('redirect');
+    const location = outcome.kind === 'redirect' ? outcome.location : '';
+    expect(location).toBe('/device/complete?decision=authorize');
 
-    // Response should carry done: 'authorize'
-    const asData = res as { data?: { done?: string } };
-    expect(asData.data?.done).toBe('authorize');
+    const res = decisionOutcomeToResponse(outcome) as Response;
+    expect(res.status).toBe(302);
+    expect(res.headers.get('location')).toBe('/device/complete?decision=authorize');
 
     // The device should now be marked as authorized in the fake singleton.
     // dev-authorize is dedicated to this test — no other test mutates it.
@@ -211,22 +213,22 @@ describe('resolveDeviceDecision (/device/authorize action)', () => {
     expect(fake.isDeviceAuthorized('dev-1')).toBe(false);
   });
 
-  it('deny → device stays unauthorized; outcome is not a redirect', async () => {
+  it('deny → device stays unauthorized; redirects to the terminal /device/complete', async () => {
     const req = await requestWithSession('http://localhost/id/device/authorize');
     const outcome = await resolveDeviceDecision(
       fakeProvider(),
       req,
       formData({ decision: 'deny', deviceAuthId: 'dev-deny', requestId: 'device_dev-deny' })
     );
 
-    // Must NOT be a 302 redirect
-    expect(outcome.kind).toBe('done');
-    const res = decisionOutcomeToResponse(outcome);
-    expect(res instanceof Response && (res as Response).status === 302).toBe(false);
+    // Deny also lands on the terminal completion screen, carrying decision=deny.
+    expect(outcome.kind).toBe('redirect');
+    const location = outcome.kind === 'redirect' ? outcome.location : '';
+    expect(location).toBe('/device/complete?decision=deny');
 
-    // Response should carry done: 'deny'
-    const asData = res as { data?: { done?: string } };
-    expect(asData.data?.done).toBe('deny');
+    const res = decisionOutcomeToResponse(outcome) as Response;
+    expect(res.status).toBe(302);
+    expect(res.headers.get('location')).toBe('/device/complete?decision=deny');
 
     // The device should NOT be authorized
     expect(fakeProvider().isDeviceAuthorized('dev-deny')).toBe(false);

app/resources/device/device.service.ts

@@ -199,12 +199,16 @@ export function deviceConsentErrorToResponse(error: DeviceConsentError) {
 
 /**
  * Typed outcome of the /device/authorize action. The route turns it into a Response via
- * `decisionOutcomeToResponse`: a redirect to /login (unauthenticated authorize), a `data()`
- * success carrying the decision, or a `data()` error with the appropriate status.
+ * `decisionOutcomeToResponse`: a redirect to /login (unauthenticated authorize), a redirect to
+ * the terminal /device/complete screen (decision applied), or a `data()` error.
+ *
+ * The success path is a REDIRECT, not a `data()` payload: authorizeDevice LEGITIMATELY CONSUMES
+ * the device-auth request, so RR7's post-action auto-revalidation of this route's loader
+ * (getDeviceAuth) would NOT_FOUND and render a false "Code expired". Sending the decision to the
+ * terminal /device/complete route (which has NO getDeviceAuth loader) sidesteps that revalidation.
  */
 export type DeviceDecisionOutcome =
   | { kind: 'redirect'; location: string }
-  | { kind: 'done'; decision: 'authorize' | 'deny' }
   | { kind: 'error'; error: 'invalid_input'; status: 400 }
   | { kind: 'error'; error: 'provider_error'; status: 502 };
 
@@ -267,16 +271,17 @@ export async function resolveDeviceDecision(
     actor: entry?.loginName ? hashActor(entry.loginName) : undefined,
   });
 
-  return { kind: 'done', decision };
+  // Redirect to the terminal completion screen carrying the decision. authorizeDevice has
+  // consumed the device-auth request, so re-rendering THIS route (whose loader re-resolves
+  // getDeviceAuth) would NOT_FOUND; /device/complete carries the decision and never re-resolves.
+  return { kind: 'redirect', location: paths.device.complete({ decision }) };
 }
 
 /** Turn a DeviceDecisionOutcome into the Response the /device/authorize route returns. */
 export function decisionOutcomeToResponse(outcome: DeviceDecisionOutcome) {
   switch (outcome.kind) {
     case 'redirect':
       return redirect(outcome.location);
-    case 'done':
-      return data({ done: outcome.decision });
     case 'error':
       return data({ error: outcome.error }, { status: outcome.status });
   }

app/resources/session/__tests__/session.service.switch.test.ts

@@ -17,7 +17,7 @@
 import { FakeAuthProvider } from '@/modules/auth/providers/fake/fake-provider';
 import { sessionsCookie } from '@/modules/auth/session/cookie';
 import type { User } from '@/modules/auth/types';
-import { switchAccount } from '@/resources/session';
+import { removeAccount, switchAccount } from '@/resources/session';
 import { describe, it, expect } from 'vitest';
 
 const BASE_URL = 'http://localhost/id/accounts';
@@ -47,10 +47,19 @@ function makeRequest(cookie: string): Request {
   return new Request(BASE_URL, { headers: { cookie: cookie.split(';')[0] } });
 }
 
-function switchForm(sessionId: string): FormData {
+function switchForm(sessionId: string, requestId?: string): FormData {
   const form = new FormData();
   form.set('intent', 'switch');
   form.set('sessionId', sessionId);
+  if (requestId !== undefined) form.set('requestId', requestId);
+  return form;
+}
+
+function removeForm(sessionId: string, requestId?: string): FormData {
+  const form = new FormData();
+  form.set('intent', 'remove');
+  form.set('sessionId', sessionId);
+  if (requestId !== undefined) form.set('requestId', requestId);
   return form;
 }
 
@@ -111,3 +120,127 @@ describe('switchAccount — 755-M10 MFA-setup nudge suppression', () => {
     expect(outcome.location).toContain('checkAfter=true');
   });
 });
+
+describe('switchAccount — current ceremony requestId threading (datumctl OIDC hang)', () => {
+  // A no-MFA user whose org seeds a non-zero skip window resolves to /signed-in (the same setup
+  // as the nudge-suppression spec). The cookie entry carries NO requestId, so any requestId on
+  // the destination must come from the CURRENT ceremony form field, not the stale cookie one.
+  const user: User = { id: 'u1', loginName: 'alice@acme.test', displayName: 'Alice' };
+
+  function makeProvider(): FakeAuthProvider {
+    const provider = new FakeAuthProvider({
+      users: [user],
+      authMethods: { u1: [] },
+      settingsByOrg: { 'nudge-org': { mfaInitSkipLifetimeMs: 10_000 } },
+    });
+    provider.seedLiveSession({ id: 's1', token: 'tok-s1', user });
+    return provider;
+  }
+
+  async function cookie(): Promise<string> {
+    return mintCookie({
+      id: 's1',
+      token: 'tok-s1',
+      loginName: 'alice@acme.test',
+      organization: 'nudge-org',
+    });
+  }
+
+  it('threads the CURRENT ceremony requestId onto the resolved /signed-in destination', async () => {
+    const provider = makeProvider();
+    const reqId = 'oidc_V3-current';
+
+    const outcome = await switchAccount(
+      provider,
+      makeRequest(await cookie()),
+      switchForm('s1', reqId)
+    );
+
+    expect(outcome.kind).toBe('redirect');
+    if (outcome.kind !== 'redirect') throw new Error('expected redirect');
+    expect(outcome.location).toMatch(/^\/signed-in(\?|$)/);
+    expect(outcome.location).toContain(`requestId=${encodeURIComponent(reqId)}`);
+  });
+
+  it('omits requestId when none is provided (standalone switch fallback unchanged)', async () => {
+    const provider = makeProvider();
+
+    const outcome = await switchAccount(provider, makeRequest(await cookie()), switchForm('s1'));
+
+    expect(outcome.kind).toBe('redirect');
+    if (outcome.kind !== 'redirect') throw new Error('expected redirect');
+    expect(outcome.location).toMatch(/^\/signed-in(\?|$)/);
+    expect(outcome.location).not.toContain('requestId=');
+  });
+
+  it('ignores a non-allowlisted requestId (treated as no ceremony)', async () => {
+    const provider = makeProvider();
+
+    const outcome = await switchAccount(
+      provider,
+      makeRequest(await cookie()),
+      switchForm('s1', 'evil_https://attacker.example')
+    );
+
+    expect(outcome.kind).toBe('redirect');
+    if (outcome.kind !== 'redirect') throw new Error('expected redirect');
+    expect(outcome.location).toMatch(/^\/signed-in(\?|$)/);
+    expect(outcome.location).not.toContain('requestId=');
+  });
+});
+
+describe('removeAccount — ceremony requestId threading', () => {
+  // removeAccount deletes the entry provider-side (best-effort, seeded so it succeeds) then
+  // redirects back to /accounts. The CURRENT ceremony id must ride that redirect so removing an
+  // account mid-ceremony keeps the flow — but only an allowlisted value is reflected (no injection).
+  const user: User = { id: 'u1', loginName: 'alice@acme.test', displayName: 'Alice' };
+
+  function makeProvider(): FakeAuthProvider {
+    const provider = new FakeAuthProvider({ users: [user] });
+    provider.seedLiveSession({ id: 's1', token: 'tok-s1', user });
+    return provider;
+  }
+
+  async function cookie(): Promise<string> {
+    return mintCookie({ id: 's1', token: 'tok-s1', loginName: 'alice@acme.test' });
+  }
+
+  it('carries an allowlisted requestId onto the /accounts redirect', async () => {
+    const provider = makeProvider();
+    const reqId = 'oidc_V3-current';
+
+    const outcome = await removeAccount(
+      provider,
+      makeRequest(await cookie()),
+      removeForm('s1', reqId)
+    );
+
+    expect(outcome.kind).toBe('redirect');
+    if (outcome.kind !== 'redirect') throw new Error('expected redirect');
+    expect(outcome.location).toBe(`/accounts?requestId=${encodeURIComponent(reqId)}`);
+  });
+
+  it('redirects to bare /accounts when no requestId is provided', async () => {
+    const provider = makeProvider();
+
+    const outcome = await removeAccount(provider, makeRequest(await cookie()), removeForm('s1'));
+
+    expect(outcome.kind).toBe('redirect');
+    if (outcome.kind !== 'redirect') throw new Error('expected redirect');
+    expect(outcome.location).toBe('/accounts');
+  });
+
+  it('drops a non-allowlisted requestId (no injection onto /accounts)', async () => {
+    const provider = makeProvider();
+
+    const outcome = await removeAccount(
+      provider,
+      makeRequest(await cookie()),
+      removeForm('s1', 'evil_x')
+    );
+
+    expect(outcome.kind).toBe('redirect');
+    if (outcome.kind !== 'redirect') throw new Error('expected redirect');
+    expect(outcome.location).toBe('/accounts');
+  });
+});