fix(server): pairing grants use SQLite-compatible scope flags

[lastobelus]

Pairing credential consumption binds requestedScopes === undefined directly into an SQLite query. On Node 24.13.1, native SQLite rejects boolean bind values, so valid pairing requests fail with BootstrapCredentialConsumeAvailableError before the intended scope checks run. This is a small, focused fix for an obvious parameter-type bug; it preserves the existing pairing and scope behavior and qualifies for the no-prior-discussion exception.

Bind the scope-omission flag as 1 or 0. Add regression cases showing that empty and ungranted scope requests receive the intended scope error without consuming the token; a subsequent request omitting scopes still receives its original grant and consumes it exactly once.

Verification on Node 24.13.1:

• Both new regression cases fail on the original boolean binding and pass with the numeric flag.
• vp test run apps/server/src/auth/PairingGrantStore.test.ts apps/server/src/auth/EnvironmentAuth.test.ts apps/server/src/auth/SessionStore.test.ts apps/server/src/auth/http.test.ts: 56 tests pass across four files, covering omitted and requested scopes, proof binding, and concurrent one-time consumption.
• Focused formatting, lint, and whitespace checks pass.
• No browser checks were needed for this persistence-only change. Repository-wide checks remain with GitHub CI.

Model: GPT-6.1 Sol. Harness: Codex.

Independent downstream delivery: https://redirect.github.com/lastobelus/lastCode/pull/318.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The implementation is a narrow SQLite compatibility fix with focused regression tests, but it changes the production authentication path that validates requested scopes and consumes pairing credentials. Authentication-sensitive behavior requires human review even when the diff is small and the intended behavior is preserved.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

Pre-merge checks failed. Please resolve the failing checks before merging.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2f005c79-ef38-41d3-857d-be38ba36db5c

📥 Commits

Reviewing files that changed from the base of the PR and between cd41c4a and 039e127.

📒 Files selected for processing (2)

• apps/server/src/auth/PairingGrantStore.test.ts
• apps/server/src/persistence/AuthPairingLinks.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The pairing grant scope predicate now uses a numeric SQL condition. Tests cover rejected scope requests and one-time grant consumption.

Changes

Pairing grant scope matching

Layer / File(s)	Summary
Scope matching and grant consumption apps/server/src/persistence/AuthPairingLinks.ts, apps/server/src/auth/PairingGrantStore.test.ts	The SQL predicate uses 1 when no scopes are requested and 0 otherwise. Tests verify that empty and ungranted scope requests fail, the grant can then be consumed without a scope request, and reuse fails.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to 039e1

The scope checks preserve rejection of empty or ungranted requests while allowing a valid unscoped one-time consume. No material merge-blocking risk is evident; proceed with normal checks.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore (reviewers only)

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Approvability	❌ Error	This pull request changes pairing credential consumption in apps/server/src/persistence/AuthPairingLinks.ts. It changes the scope-selection condition for consuming a pairing link. This matches the r…	A maintainer must review the pairing credential consumption change before CodeRabbit approves this pull request.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the SQLite-compatible scope-flag fix for pairing grants.
Description check	✅ Passed	The description explains the problem, the change, why the focused fix needs no prior approval, and the specific verification results.

Full details: Approvability

Explanation

This pull request changes pairing credential consumption in apps/server/src/persistence/AuthPairingLinks.ts. It changes the scope-selection condition for consuming a pairing link. This matches the rule: “Changes authentication, pairing, credentials, secrets, or remote connection trust.” The regression tests in apps/server/src/auth/PairingGrantStore.test.ts also cover pairing-grant consumption. This pull request needs a maintainer's review.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[juliusmarminge]

Note

Grok responding on behalf of Julius.

Closing as superseded by #16730 (merged in 4daec10), which lands the same 1/0 bind fix for the pairing consume query and resolves #16797. Thanks for the fix! If you think the extra regression cases here are still worth having, feel free to open a small tests-only PR against current main.