fix(auth): harden unified diagnostic execution

backend/src/auth/oidc-client.ts

@@ -611,23 +611,37 @@ export function createOidcProtocol(options: OidcProtocolOptions): OidcProtocol {
       signal.throwIfAborted();
     },
     async verifyDeviceFlow(signal, present) {
+      const maximumDeadline = AbortSignal.timeout(MAX_DEVICE_FLOW_TIMEOUT_MS);
+      const operationSignal = AbortSignal.any([signal, maximumDeadline]);
       let config: Configuration;
       try {
+        operationSignal.throwIfAborted();
         config = await configuration();
+        operationSignal.throwIfAborted();
         const endpoint = config.serverMetadata().device_authorization_endpoint;
         httpsEndpoint(endpoint);
       } catch (error) {
         if (error instanceof OidcIssuerMismatchError || error instanceof OidcProviderUnavailableError) throw error;
         throw new OidcDeviceFlowUnavailableError();
       }
-      const deadline = AbortSignal.timeout(MAX_DEVICE_FLOW_TIMEOUT_MS);
-      const deviceSignal = AbortSignal.any([signal, deadline]);
       try {
-        deviceSignal.throwIfAborted();
-        const device = await initiateDeviceAuthorization(config, { scope: options.scopes.join(" ") });
+        operationSignal.throwIfAborted();
+        const device = await awaitWithAbort(
+          initiateDeviceAuthorization(config, { scope: options.scopes.join(" ") }),
+          operationSignal,
+        );
         if (!text(device.verification_uri, 2048) || !text(device.user_code, 256)) {
           throw new OidcDeviceFlowUnavailableError();
         }
+        const providerLifetimeMs = device.expires_in * 1000;
+        if (!Number.isSafeInteger(providerLifetimeMs) || providerLifetimeMs <= 0) {
+          throw new OidcDeviceFlowUnavailableError();
+        }
+        const deviceSignal = AbortSignal.any([
+          signal,
+          maximumDeadline,
+          AbortSignal.timeout(Math.min(providerLifetimeMs, MAX_DEVICE_FLOW_TIMEOUT_MS)),
+        ]);
         const verificationUri = httpsEndpoint(device.verification_uri);
         present(verificationUri.href, device.user_code);
         const tokens = await pollDeviceAuthorizationGrant(config, device, undefined, { signal: deviceSignal });