fix(console): claim the device code before approve/deny (#1676)

better-auth's device-authorization plugin requires the verifying session
to claim the code (GET /device?user_code=…) before approve/deny — both
returned 400 'not been claimed by a verifying session' otherwise, so the
approval button silently failed (found in the bind-v2 E2E; pre-existing,
not introduced by #1673).

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: 3 people

.changeset/device-approve-claim.md

@@ -0,0 +1,5 @@
+---
+"@object-ui/console": patch
+---
+
+DeviceAuthPage claims the device code (GET /device?user_code=…) before approve/deny — better-auth's device-authorization plugin rejects both with 400 "not been claimed by a verifying session" otherwise, so approval silently failed.

apps/console/src/pages/auth/DeviceAuthPage.tsx

@@ -143,10 +143,21 @@ export function DeviceAuthPage() {
     );
   }
 
+  // better-auth's device-authorization plugin requires the verifying
+  // session to CLAIM the code (GET /device?user_code=…) before it will
+  // accept approve/deny — without it both return 400 "not been claimed
+  // by a verifying session". Idempotent, so claim right before acting.
+  const claimDevice = async () => {
+    await fetch(`${AUTH_BASE}/device?user_code=${encodeURIComponent(code)}`, {
+      credentials: 'include',
+    }).catch(() => { /* approve below surfaces the real error */ });
+  };
+
   const handleApprove = async () => {
     setError('');
     setSubmitting(true);
     try {
+      await claimDevice();
       const res = await fetch(`${AUTH_BASE}/device/approve`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
@@ -186,6 +197,7 @@ export function DeviceAuthPage() {
     setError('');
     setDenying(true);
     try {
+      await claimDevice();
       await fetch(`${AUTH_BASE}/device/deny`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },