fix(auth): distinguish OAuth access denials

[postoso]

Summary

• Route the exact provider error access_denied to oauthAccessDenied in both OAuth callback handlers.
• Keep other provider errors on the existing oauthSignin fallback.
• Reuse the 23 locale strings from my closed fix(auth): distinct login message for OAuth access_denied #2970 under the camelCase key.
• Cover both redirect variants, locale presence, and both rendered login messages.

Testing

• uv run --project backend pytest backend/tests/test_server.py backend/tests/test_translations.py (99 passed)
• pnpm exec cypress run --spec cypress/e2e/oauth_auth/spec.cy.ts --browser electron (4 passed)
• pre-commit hooks, Ruff, type-checking, and Prettier passed

Depends on #2955. Addresses #2956.

---

Summary by cubic

Distinguishes OAuth access denials to show a specific, localized login message, meeting Linear #2956. Previously all provider errors showed the generic message; now access_denied maps to a dedicated message while other errors keep the generic fallback.

• Routes access_denied to oauthAccessDenied in both oauth_callback and oauth_azure_hf_callback; other errors still use oauthSignin.
• Adds oauthAccessDenied to 23 locale files and tests presence across all locales.
• Expands tests to cover access-denied vs other errors for both callbacks, redirect status codes (302/303), and the rendered alert on the login page.

^{Written for commit c1d3ca1. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 27 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="backend/chainlit/server.py">

<violation number="1" location="backend/chainlit/server.py:674">
P3: OAuth provider-error mapping is now duplicated in both callback handlers, which can drift if one flow is updated later and the other is missed. A shared helper for mapping provider errors to login error keys would keep both redirect variants consistent.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: OAuth provider-error mapping is now duplicated in both callback handlers, which can drift if one flow is updated later and the other is missed. A shared helper for mapping provider errors to login error keys would keep both redirect variants consistent.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At backend/chainlit/server.py, line 674:

<comment>OAuth provider-error mapping is now duplicated in both callback handlers, which can drift if one flow is updated later and the other is missed. A shared helper for mapping provider errors to login error keys would keep both redirect variants consistent.</comment>

<file context>
@@ -671,7 +671,8 @@ async def oauth_callback(
     if error:
         logger.warning("OAuth provider %s returned error: %s", provider_id, error)
-        return _get_oauth_redirect_error(request, "oauthSignin")
+        error_key = "oauthAccessDenied" if error == "access_denied" else "oauthSignin"
+        return _get_oauth_redirect_error(request, error_key)
 
</file context>