fix(coding): close PI-100 review findings

electron/api/coding-provider-auth.ts

@@ -0,0 +1,40 @@
+import { resolvePiProviderCredentialFromSecretStore } from '../coding-runtime/pi/provider-config';
+import { getProviderService } from '../services/providers/provider-service';
+import {
+  getFreshWorksSquareAIGatewayCredential,
+  markWorksSquareAIGatewayCredentialExpired,
+} from '../services/works-square-ai-gateway';
+
+const WORKS_SQUARE_AI_GATEWAY_CREDENTIAL_MODE = 'works_square_ai_gateway';
+const AUTHENTICATION_ERROR_PATTERN = /\b(?:401|403|unauthori[sz]ed|forbidden|authentication failed|auth failed|invalid (?:api key|credential|access token|bearer token)|(?:access |bearer )?token expired)\b/i;
+
+export function isCodingProviderAuthenticationError(error: unknown): boolean {
+  return error instanceof Error && AUTHENTICATION_ERROR_PATTERN.test(error.message);
+}
+
+export async function refreshCodingProviderCredential(accountId: string): Promise<void> {
+  const providerService = getProviderService();
+  const account = await providerService.getAccount(accountId);
+  if (!account?.enabled) throw new Error('Provider account is unavailable');
+
+  if (account.metadata?.worksSquareCredentialMode === WORKS_SQUARE_AI_GATEWAY_CREDENTIAL_MODE) {
+    markWorksSquareAIGatewayCredentialExpired();
+    const credential = await getFreshWorksSquareAIGatewayCredential();
+    if (!credential) throw new Error('Provider credential refresh failed');
+    await providerService.updateAccount(account.id, {
+      baseUrl: credential.oneApiBaseUrl,
+      metadata: {
+        ...account.metadata,
+        worksSquareCredentialExpiresAt: credential.expiresAt === null
+          ? undefined
+          : new Date(credential.expiresAt).toISOString(),
+      },
+    }, credential.accessToken);
+    return;
+  }
+
+  const current = await resolvePiProviderCredentialFromSecretStore(account);
+  if (!current && account.authMode !== 'local') {
+    throw new Error('Provider credential is unavailable');
+  }
+}