Fix chatgpt oauth

[marijnvdwerf]

Fix ChatGPT Plus OAuth: switch to device code flow

The browser-based PKCE OAuth flow broke because the callback URL changed during cleanup — a localhost redirect doesn't work for non-localhost instances. This switches to the device code flow instead, which is simpler and avoids popup blockers entirely.

How it works now: user copies a device code, opens OpenAI's verification page, pastes the code, and we poll until they approve.

Changes

Backend (openai_auth.rs, providers.rs)

• Replace PKCE browser flow with device code flow (request_device_code → poll_device_authorization → exchange_device_code)
• Remove popup/callback endpoint, PKCE verifier handling
• Support DELETE /api/providers/openai-chatgpt to remove OAuth credentials
• Increase session TTL from 15 to 30 minutes

Frontend (Settings.tsx)

• Redesign OAuth dialog with a stepped UI (copy code → open login page)
• Handle completed states properly (success → "Done", error → "Try again")
• Cancel polling on dialog close via AbortController
• Show Remove button on the provider card when configured

---

Summary

This PR migrates OpenAI ChatGPT Plus OAuth from a browser-based PKCE flow to a device code flow. The core change eliminates the need for popup windows and redirect callbacks, replacing them with a simpler device code authorization pattern where users enter a code on a verification page.

Key changes:

• Frontend — Updated Settings component to display device code and verification URL instead of opening a popup. Added state management for device code info and increased polling timeout from 180 to 360 attempts.

• Backend OAuth flow — Completely rewrote /providers/openai/oauth/browser/* endpoints to use device code flow. Removed browser popup logic, PKCE verifier handling, and the callback endpoint. Spawns background task to poll for authorization and exchange tokens.

• New device code functions — Added three new async functions in openai_auth.rs:

  • request_device_code() — requests device code from OpenAI
  • poll_device_authorization() — polls until user approves on OpenAI's device auth page
  • exchange_device_code() — exchanges authorization code for OAuth tokens

• Session management — Renamed session types from BrowserOAuthSession to DeviceOAuthSession, simplified session data (removed PKCE and redirect URI), increased TTL from 15 to 30 minutes.

• API responses — Updated OpenAiOAuthBrowserStartResponse to return user_code and verification_url instead of authorization_url.

Note

This changes the OAuth flow from browser-based to device code based. The device code pattern is simpler and avoids popup blockers. Users now enter a code directly on OpenAI's site instead of a redirect flow. Polling is now triggered automatically when the OAuth dialog opens and is cancelled when the dialog closes.
_{Written by Tembo for commit fb9114a. This will update automatically on new commits.}