fix(auth): harden unified diagnostic execution

backend/src/routes/workspaces.ts

@@ -19,6 +19,7 @@ import type { RuntimeBindings } from "../workspaces/runtime-renderer.js";
 import type { ConnectorDiagnostics } from "../workspaces/diagnostics.js";
 import { isPrincipalContext, requirePermission } from "../auth/authorization.js";
 import type { AuthDiagnoser } from "../auth/diagnostics.js";
+import { decodeAuthDiagnostics, type AuthDiagnostics } from "../auth/group-catalog.js";
 
 export type WorkspaceDiagnoser = (
   workspace: WorkspaceDescriptor,
@@ -55,6 +56,12 @@ const SAFE_MESSAGES = {
   semantic_index_incompatible: "Semantic index is incompatible with this workspace.",
 } as const;
 
+function authenticationReport(value: unknown): AuthDiagnostics {
+  const report = decodeAuthDiagnostics(value);
+  if (!report) throw new Error("invalid authentication diagnostic report");
+  return report;
+}
+
 function workspaceErrorCode(error: unknown): keyof typeof SAFE_MESSAGES {
   return error instanceof WorkspaceRegistryError ? error.code : "workspace_invalid";
 }
@@ -149,7 +156,7 @@ export function workspaceRoutes(app: FastifyInstance, deps: WorkspaceRoutesDeps)
     try {
       const { workspace } = workspacePayload.parse(request.body);
       const canonical = validateWorkspaceDescriptor(workspace);
-      const authentication = await deps.authDiagnoser.inspect({ live: false });
+      const authentication = authenticationReport(await deps.authDiagnoser.inspect({ live: false }));
       return {
         workspace: canonical,
         contract: buildInstallationContract(canonical),
@@ -231,10 +238,11 @@ export function workspaceRoutes(app: FastifyInstance, deps: WorkspaceRoutesDeps)
         deps.secretStore,
       );
       try {
-        const [workspaceDiagnostics, authentication] = await Promise.all([
+        const [workspaceDiagnostics, inspectedAuthentication] = await Promise.all([
           deps.diagnose(operational, lease.bindings, { writeProbe: false }),
           deps.authDiagnoser.inspect({ live: true }),
         ]);
+        const authentication = authenticationReport(inspectedAuthentication);
         return {
           ...workspaceDiagnostics,
           activatable: workspaceDiagnostics.activatable && authentication.ready,