chore(auth): diagnose unexpected managed OAuth callback failures

[icecrasher321]

GitHub Search account connections on dev fail in both the installation setup and individual enrollment paths, but the callback currently records only errorClass: unexpected. This hides the distinction between session authentication, enrollment authentication, and authorization completion failures.

Add the failing callback stage, an allowlisted underlying error type, a message fingerprint, and a bounded database error code to unexpected-error diagnostics. Reuse the shared cause-chain describer; raw messages, SQL parameters, provider responses, and credentials are not logged. Tests cover wrapped database errors, arbitrary private error metadata, and both installation callback stages.

This is a diagnostic change. It needs a dev deployment and another connection attempt before the underlying authorization failure can be identified.

Validation: 52 focused callback/redirect tests passed; app type check, API validation audit, Biome, and diff checks passed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 16, 2026 10:36pm UTC

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no actionable correctness, security, or repository-rule failures remain.

Summary

This PR adds bounded diagnostics for unexpected managed OAuth callback failures without logging raw error messages or arbitrary metadata.

• Distinguishes session authentication, setup completion, enrollment authentication, and enrollment completion stages.
• Reports an allowlisted deepest-cause type, a truncated message fingerprint, and a constrained database error code.
• Adds coverage for wrapped database failures, private metadata, and both installation callback stages.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    Callback[Managed OAuth callback] --> Setup{Installation setup?}
    Setup -->|Yes| Session[Session authentication]
    Session --> SetupCompletion[Setup completion]
    Setup -->|No| EnrollmentAuth[Enrollment authentication]
    EnrollmentAuth --> EnrollmentCompletion[Enrollment completion]
    Session -->|Unexpected failure| Diagnostic[Bounded diagnostic]
    SetupCompletion -->|Unexpected failure| Diagnostic
    EnrollmentAuth -->|Unexpected failure| Diagnostic
    EnrollmentCompletion -->|Unexpected failure| Diagnostic
    Diagnostic --> Fields[Stage, allowlisted error type, fingerprint, optional database code]
    Fields --> Redirect[Failure redirect]

Loading

_{Reviews (1) · Last reviewed commit: "chore(auth): diagnose unexpected managed..."}