Method Authenticate

internal/oauth/manager.go:139–190

Authenticate ensures the session is authorized. It returns (nil, nil) once a token is available, so the caller may proceed. It returns (&Outcome{UserAction}, nil) when the user must complete the flow out of band; the flow continues in the background and the caller should show the action and have th

(ctx context.Context, prompter Prompter)

// Only one flow runs at a time. Concurrent callers either join a running secure
// flow, receive the pending user action, or are told to retry shortly.
func (m *Manager) Authenticate(ctx context.Context, prompter Prompter) (*Outcome, error) {
	if m.AccessToken() != "" {
		return nil, nil
	}

	m.mu.Lock()
	switch m.status {
	case statusAwaitingUser:
		ua := m.pending
		m.mu.Unlock()
		return &Outcome{UserAction: ua}, nil
	case statusStarting:
		m.mu.Unlock()
		return &Outcome{UserAction: &UserAction{
			Message: "GitHub authorization is already in progress. Please retry your request in a few seconds.",
		}}, nil
	case statusInProgress:
		done := m.done
		m.mu.Unlock()
		return m.joinWait(ctx, done)
	}

	// Idle: this call owns the new flow.
	m.status = statusStarting
	m.lastErr = nil
	m.done = make(chan struct{})
	done := m.done
	m.mu.Unlock()

	plan, err := m.begin(prompter)
	if err != nil {
		m.complete(nil, err)
		return nil, err
	}

	m.mu.Lock()
	if plan.userAction != nil {
		m.status = statusAwaitingUser
		m.pending = plan.userAction
	} else {
		m.status = statusInProgress
	}
	m.mu.Unlock()

	bgCtx, cancel := context.WithTimeout(context.Background(), DefaultAuthTimeout)
	go m.runFlow(bgCtx, cancel, plan)

	if plan.userAction != nil {
		return &Outcome{UserAction: plan.userAction}, nil
	}
	return m.joinWait(ctx, done)
}

// runFlow executes a prepared flow in the background and records the result. The
// optional display prompt runs concurrently: a decline (or other failure) aborts