fix(auth): harden unified diagnostic execution

backend/test/oidc-client.test.ts

@@ -1,5 +1,5 @@
 import { createSign, generateKeyPairSync } from "node:crypto";
-import { expect, test } from "vitest";
+import { expect, test, vi } from "vitest";
 import {
   createOidcProtocol,
   OidcIssuerMismatchError,
@@ -170,6 +170,51 @@ test("refuses device flow when discovery has no safe device authorization endpoi
     .rejects.toBeInstanceOf(OidcDeviceFlowUnavailableError);
 });
 
+test("stops authorization-pending polling at the provider device expiry", async () => {
+  const caller = new AbortController();
+  const timeout = vi.spyOn(AbortSignal, "timeout");
+  try {
+    const tokenResponse = vi.fn(async () => Response.json(
+      { error: "authorization_pending", error_description: "pending" },
+      { status: 400 },
+    ));
+    const subject = protocol({
+      discoveryMetadata: { device_authorization_endpoint: `${issuer}/device` },
+      deviceResponse: async () => Response.json({
+        device_code: "ephemeral-device-code",
+        user_code: "ABCD-EFGH",
+        verification_uri: `${issuer}/device`,
+        expires_in: 0.05,
+        interval: 0.01,
+      }),
+      tokenResponse,
+    });
+    const completion = subject.verifyDeviceFlow!(caller.signal, () => undefined);
+
+    expect(await settlesWithin(completion, 250)).toBe("rejected");
+    expect(tokenResponse.mock.calls.length).toBeLessThanOrEqual(5);
+    expect(timeout).toHaveBeenCalledWith(10 * 60_000);
+    expect(timeout).toHaveBeenCalledWith(50);
+    await expect(completion).rejects.toThrow(OidcProtocolError);
+  } finally {
+    caller.abort();
+    timeout.mockRestore();
+  }
+});
+
+test("combines the caller cancellation with device-flow deadlines before provider requests", async () => {
+  const seen: URL[] = [];
+  const caller = new AbortController();
+  caller.abort(new DOMException("caller deadline", "AbortError"));
+  const subject = protocol({
+    seen,
+    discoveryMetadata: { device_authorization_endpoint: `${issuer}/device` },
+  });
+
+  await expect(subject.verifyDeviceFlow!(caller.signal, () => undefined)).rejects.toThrow(OidcProtocolError);
+  expect(seen).toEqual([]);
+});
+
 test("rejects a hanging discovery request at the provider transport deadline", async () => {
   let aborted = false;
   const subject = protocol({