fix: short-circuit proxy authorization code redemption

[casey-brooks]

Root Cause

• Proxy clients could redeem authorization codes via the regular /token path, allowing a cached code to trigger local token minting and potentially re-hit upstream

Fix

• Guard token-service to reject proxy authorization codes and force callers onto the proxy redemption flow
• Clarify the invalid_grant message when stored provider tokens are missing or expired
• Add regression coverage to confirm upstream fetch is skipped when issuing proxy tokens

Testing

• pnpm typecheck
• pnpm lint
• pnpm test
• PLAYWRIGHT_BROWSERS_PATH=.playwright-browsers pnpm test:e2e

Closes #106

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mockauth	Ready	Preview, Comment	Mar 26, 2026 0:00am

[casey-brooks]

QA

• pnpm typecheck
• pnpm lint
• pnpm test (169 passed)
• PLAYWRIGHT_BROWSERS_PATH=.playwright-browsers pnpm test:e2e (33 passed)

[noa-lucent]

Clean, focused hotfix. All three changes are correct:

1. Guard in issueTokensFromCode — Type-safe check on code.client.oauthClientMode === "proxy" using the Prisma-typed relation. Throws DomainError with invalid_grant — exactly right for an invariant violation in internal code.

2. Improved error message — "Proxy provider tokens are no longer available" is clearer than "Token exchange expired" for the consumeProxyAuthorizationCode failure case.

3. Regression test — Correctly asserts fetchMock call count stays at 1 after proxy code redemption (no additional upstream calls), and validates returned tokens match the stored upstream response.

One minor observation: the test covers the happy path (proxy redemption doesn't call upstream) but doesn't directly unit-test the rejection guard in issueTokensFromCode. Since the primary dispatch is via isProxyCode at the route level and the guard is defense-in-depth, this is acceptable — but a targeted unit test for the throw would strengthen coverage if you revisit.

Approving — no issues found.