OAuth Token Refresh for Providers

[yacosta738]

What

Implement OAuth 2.0 token management for providers that use OAuth authentication (e.g., Google AI Studio, Azure AD-integrated providers). Rook must handle device code flows, token exchange, and automatic refresh without user intervention.

Why

Many enterprise and some consumer AI providers use OAuth instead of static API keys:

• Google AI Studio / Gemini (OAuth via Google Cloud)
• Microsoft Azure OpenAI (OAuth via Azure AD)
• Providers that deprecate API keys in favor of OAuth

Rook currently only supports static API keys. Without OAuth, these providers cannot be used.

Basic Spec

OAuth Flow Support

OAuthProviderConfig {
  provider_id: ProviderId
  auth_type: OAuth | DeviceCode | RefreshToken
  client_id: string
  client_secret: string  // encrypted at rest
  auth_url: string
  token_url: string
  scopes: Vec<string>
  redirect_uri: string
}

Token Lifecycle

1. Initial auth: User provides OAuth credentials → Rook initiates flow
2. Device code flow: Display device code to user, poll for completion
3. Token storage: Access + refresh tokens stored encrypted in SQLite
4. Automatic refresh: Background task refreshes tokens before expiry
5. Provider request: Executor uses current valid access token

Supported Flows

• Authorization Code (standard OAuth): User authenticates in browser
• Device Code: For CLI/headless scenarios (user visits URL, enters code)
• Refresh Token: Automatic refresh when access token expires

Provider Integration

• OAuth tokens passed to provider via Authorization: Bearer <token>
• On 401 from provider: attempt token refresh, then retry
• Refresh failure → mark provider as degraded, alert operator

API

• POST /api/oauth/:provider/authorize — initiate OAuth flow
• GET /api/oauth/:provider/status — check OAuth connection status
• POST /api/oauth/:provider/refresh — manually trigger token refresh
• DELETE /api/oauth/:provider — revoke OAuth connection

User Stories

As a system operator
I want to connect a Google AI Studio account via OAuth
So that Rook can route to Gemini models without managing static API keys

As a developer
I want OAuth tokens to refresh automatically
So that my setup never breaks due to expired tokens

As a operator
I want to see OAuth connection status in the dashboard
So that I know when a connection needs re-authentication

Acceptance Criteria

• OAuth authorization code flow implemented
• OAuth device code flow implemented
• Tokens stored encrypted in SQLite
• Automatic token refresh before expiry
• On 401: refresh + retry once before failing
• OAuth status visible via API
• Azure OpenAI OAuth support (as reference implementation)

[linear-code]

DALLAY-382