fix(auth): Recover OAuth device approval retries (#128287)

OAuth device approval errors can ask users to start over while hiding
the recovery action. Allow failed decisions, including HTTP 400 session
errors, to prepare fresh consent.

Keep code entry in its preparing state while retrying a failed context
request, whether through resubmission or retry. Adds regression coverage
for both recovery paths.

Follow-up to #128124 addressing the remaining review findings.

Author: evanpurkhiser

static/app/views/authV2/oauthDevice/useOAuthDeviceFlow.spec.tsx

@@ -330,6 +330,83 @@ describe('useOAuthDeviceFlow', () => {
     );
   });
 
+  it.each(['enterCode', 'retry'] as const)(
+    'shows code preparation while %s retries a failed context request',
+    async action => {
+      MockApiClient.addMockResponse({
+        url: '/auth/oauth/device/context/',
+        statusCode: 400,
+        body: {detail: 'Invalid or expired code.'},
+      });
+      const {result} = renderHookWithProviders(useOAuthDeviceFlow, {
+        initialRouterConfig: {location},
+      });
+
+      await waitFor(() =>
+        expect(result.current.state).toMatchObject({message: 'Invalid or expired code.'})
+      );
+
+      const delay = Promise.withResolvers<void>();
+      MockApiClient.addMockResponse({
+        url: '/auth/oauth/device/context/',
+        body: {...OAuthContextFixture(), userCode: 'ABCD-EFGH'},
+        asyncDelay: delay.promise,
+      });
+
+      act(() => result.current.actions[action]('ABCD-EFGH'));
+
+      await waitFor(() =>
+        expect(result.current.state).toMatchObject({
+          status: 'code-entry',
+          isPreparingCode: true,
+        })
+      );
+
+      await act(() => {
+        delay.resolve();
+        return delay.promise;
+      });
+
+      await waitFor(() => expect(result.current.state.status).toBe('consent'));
+    }
+  );
+
+  it('prepares fresh consent after a rejected decision with a valid code', async () => {
+    MockApiClient.addMockResponse({
+      url: '/auth/oauth/device/',
+      method: 'POST',
+      statusCode: 400,
+      body: {detail: 'Please start over.'},
+    });
+    const {result} = renderHookWithProviders(useOAuthDeviceFlow, {
+      initialRouterConfig: {location},
+    });
+
+    await waitFor(() => expect(result.current.state.status).toBe('consent'));
+
+    act(() => result.current.actions.decide('approve'));
+
+    await waitFor(() =>
+      expect(result.current.state).toMatchObject({
+        status: 'error',
+        canRetry: true,
+        message: 'Please start over.',
+      })
+    );
+
+    const prepare = MockApiClient.addMockResponse({
+      url: '/auth/oauth/device/',
+      body: consent,
+    });
+
+    act(() => result.current.actions.retry());
+
+    await waitFor(() =>
+      expect(result.current.state).toMatchObject({status: 'consent', consent})
+    );
+    expect(prepare).toHaveBeenCalledTimes(1);
+  });
+
   it('retries a transient consent failure without asking for the code again', async () => {
     MockApiClient.addMockResponse({
       url: '/auth/oauth/device/',

static/app/views/authV2/oauthDevice/useOAuthDeviceFlow.ts

@@ -158,7 +158,7 @@ export function useOAuthDeviceFlow() {
         context: undefined,
         status: 'code-entry',
         userCode,
-        isPreparingCode: false,
+        isPreparingCode: contextQuery.isFetching,
         message: getRequestErrorUserMessage(contextQuery.error),
       } as const,
       actions,
@@ -190,7 +190,7 @@ export function useOAuthDeviceFlow() {
         ...shared,
         status: 'error',
         message: getRequestErrorUserMessage(decision.error ?? consentQuery.error),
-        canRetry: canRetryOAuthRequest(decision.error ?? consentQuery.error),
+        canRetry: decision.isError || canRetryOAuthRequest(consentQuery.error),
       } as const,
       actions,
     };