From 671aa3d80db8b6148fb9bca15f296921540fbada Mon Sep 17 00:00:00 2001
From: Krishna lokhande <87197325+krishna3554@users.noreply.github.com>
Date: Tue, 18 Aug 2026 19:23:29 +0530
Subject: [PATCH] fix(oauth): treat Kiro social poll status as alias of error
 for pending states (#10620)

Kiro's device poll endpoint reports progress in a `status` field (e.g.
`authorization_pending`), but `classifyKiroSocialPoll()` only inspected
`data.error`. This caused every pre-authorization poll to fall through to
the terminal `invalid_token_response` error, making social login impossible
for Kiro AI and Amazon Q via Google/GitHub.

Changes:
- Add `status` field to `KiroSocialPollData` type
- Update `classifyKiroSocialPoll()` to check `data.status` as fallback
  for `data.error` when detecting pending states
- Add tests covering `status`-based pending detection and precedence

Closes #10618
---
 src/lib/oauth/kiroSocialPoll.ts     |  7 +++++--
 tests/unit/kiro-social-poll.test.ts | 20 ++++++++++++++++++++
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/src/lib/oauth/kiroSocialPoll.ts b/src/lib/oauth/kiroSocialPoll.ts
index e6c332f79b..70cbfec7e2 100644
--- a/src/lib/oauth/kiroSocialPoll.ts
+++ b/src/lib/oauth/kiroSocialPoll.ts
@@ -1,5 +1,7 @@
 export type KiroSocialPollData = {
   error?: unknown;
+  /** Kiro reports poll progress here (e.g. "authorization_pending"), not in `error`. */
+  status?: unknown;
   accessToken?: unknown;
   refreshToken?: unknown;
 };
@@ -26,8 +28,9 @@ export function classifyKiroSocialPoll(
   responseStatus: number,
   data: KiroSocialPollData
 ): KiroSocialPollOutcome {
-  if (data.error === "authorization_pending" || data.error === "slow_down") {
-    return { kind: "pending", error: data.error };
+  const progress = data.error ?? data.status;
+  if (progress === "authorization_pending" || progress === "slow_down") {
+    return { kind: "pending", error: progress as "authorization_pending" | "slow_down" };
   }
 
   if (!responseOk || data.error) {
diff --git a/tests/unit/kiro-social-poll.test.ts b/tests/unit/kiro-social-poll.test.ts
index 359cfa6d0a..35d2acf136 100644
--- a/tests/unit/kiro-social-poll.test.ts
+++ b/tests/unit/kiro-social-poll.test.ts
@@ -21,6 +21,26 @@ test("classifyKiroSocialPoll keeps only documented pending states retryable", ()
   });
 });
 
+test("classifyKiroSocialPoll treats status as alias of error for pending states", () => {
+  // Kiro upstream returns progress in `status`, not `error`
+  assert.deepEqual(classifyKiroSocialPoll(true, 200, { status: "authorization_pending" }), {
+    kind: "pending",
+    error: "authorization_pending",
+  });
+  assert.deepEqual(classifyKiroSocialPoll(true, 200, { status: "slow_down" }), {
+    kind: "pending",
+    error: "slow_down",
+  });
+  // error takes precedence over status if both present
+  assert.deepEqual(
+    classifyKiroSocialPoll(true, 200, { error: "slow_down", status: "authorization_pending" }),
+    {
+      kind: "pending",
+      error: "slow_down",
+    }
+  );
+});
+
 test("classifyKiroSocialPoll stops on denied, expired and malformed responses", () => {
   assert.deepEqual(classifyKiroSocialPoll(false, 403, { error: "access_denied" }), {
     kind: "error",