feat(makelore): add platform oidc login

electron/main/index.ts

@@ -65,6 +65,7 @@ import { createReleaseUtilityPreparer } from '../services/release-utility-proces
 import { createStaticArtifactSnapshot } from '../services/static-release-server';
 import {
   consumeWorksSquareStartupRuntimeCleanupRequired,
+  commitWorksSquareSessionFromTokenPayload,
   getWorksSquareSessionRestoreStatus,
   getWorksSquareSessionSnapshot,
   initializeWorksSquareSession,
@@ -73,7 +74,11 @@ import {
 } from '../services/works-square-session';
 import { shouldUseSecureWorksSquareSessionPersistence } from '../services/works-square-session-persistence-policy';
 import { initializeRememberedPassword } from '../services/remembered-password';
-import { clearManagedWorksSquareRuntimeBestEffort } from '../services/works-square-runtime';
+import {
+  clearManagedWorksSquareRuntimeBestEffort,
+  ensureManagedWorksSquareRuntimeClean,
+} from '../services/works-square-runtime';
+import { completePlatformAuthorization } from '../services/platform-auth';
 import { WorksSquareDesignWorkspace } from '../image-workspace/works-square-workspace';
 import type { DesignWorkspaceModule } from '../image-workspace/module';
 import {
@@ -207,6 +212,12 @@ let releaseJobs: ReleaseJobManager | null = null;
 let codingProducts: CodingProductComposition | null = null;
 let windowIpcBindings: ReturnType<typeof registerIpcHandlers> | null = null;
 let unsubscribeAuthSession: (() => void) | null = null;
+let platformAuthReady = false;
+let queuedPlatformAuthCallback: {
+  requestId: string | null;
+  code: string;
+  state: string;
+} | null = null;
 const mainWindowFocusState = createMainWindowFocusState();
 const quitLifecycleState = createQuitLifecycleState();
 const launchDeepLinkUrl = findNianCodeDeepLinkUrl(process.argv);
@@ -365,6 +376,33 @@ function requestMainWindowFocus(reason: string): void {
   logger.debug(`Main window is not ready yet; deferring focus for ${reason}`);
 }
 
+function completePlatformAuthCallback(callback: {
+  requestId: string | null;
+  code: string;
+  state: string;
+}): void {
+  void (async () => {
+    // Match the password/mobile login path: clean the previous account's
+    // derived runtime before making the new account active. Keeping the
+    // authorization pending until cleanup succeeds lets the user retry after
+    // a transient local cleanup failure.
+    await ensureManagedWorksSquareRuntimeClean({
+      codingProducts: codingProducts ?? undefined,
+      imageWorkspace: imageWorkspaceModule ?? undefined,
+    });
+    const payload = await completePlatformAuthorization(
+      callback.requestId,
+      callback.code,
+      callback.state,
+    );
+    await commitWorksSquareSessionFromTokenPayload(payload);
+    requestMainWindowFocus('platform OIDC callback');
+  })().catch((error) => {
+    logger.warn('[auth] Platform OIDC callback was not completed', error);
+    requestMainWindowFocus('platform OIDC callback failure');
+  });
+}
+
 function handleAppDeepLinkActivation(rawUrl: string): boolean {
   const deepLink = parseNianCodeDeepLinkUrl(rawUrl);
   if (!deepLink) {
@@ -378,7 +416,21 @@ function handleAppDeepLinkActivation(rawUrl: string): boolean {
     queueTeacherPreviewRevision(deepLink.draftRevision);
     mainWindow?.webContents.send('navigate', '/coding-teacher-preview?draftRevision=' + deepLink.draftRevision);
   } else {
-    logger.info(`Received Makelore app link: type=${deepLink.type}, request_id=${deepLink.requestId}`);
+    if (deepLink.code && deepLink.state) {
+      const callback = {
+        requestId: deepLink.requestId ?? null,
+        code: deepLink.code,
+        state: deepLink.state,
+      };
+      if (platformAuthReady) {
+        completePlatformAuthCallback(callback);
+      } else {
+        queuedPlatformAuthCallback = callback;
+        logger.debug('[auth] Queued platform OIDC callback until session restore is ready');
+      }
+    } else {
+      logger.info(`Received Makelore app link: type=${deepLink.type}, request_id=${deepLink.requestId ?? 'none'}`);
+    }
   }
   requestMainWindowFocus('app deep link');
   return true;
@@ -664,6 +716,12 @@ async function initialize(): Promise<void> {
         }, 'expired persisted session during startup');
       });
     }
+    platformAuthReady = true;
+    if (queuedPlatformAuthCallback) {
+      const callback = queuedPlatformAuthCallback;
+      queuedPlatformAuthCallback = null;
+      completePlatformAuthCallback(callback);
+    }
     if (!isE2EMode) {
       projectProgressSync = createProjectProgressSync(codingProjectStore);
       const activateProgrammingServices = (): void => {