Fix OAuth PKCE session update: add missing updated_at column

[demdxx]

Problem

Production OAuth authorize fails after login when creating the authorize response / PKCE session update.

Error (2026-09-18 ~14:20 UTC):

ERROR: record "new" has no field "updated_at" (SQLSTATE 42703)
UPDATE "auth_session" SET "form"='...' WHERE id=17 AND "auth_session"."deleted_at" IS NULL

Flow: Cursor MCP OAuth → /oauth/authorize → user logs in → authorize again → CreateAuthorizeCodeSession → CreatePKCERequestSession UPDATE fails

Root Cause

The auth_session table has a BEFORE UPDATE trigger (since initial migration 003_auth.up.sql line 102-103):

CREATE TRIGGER updated_at_triger BEFORE UPDATE
    ON auth_session FOR EACH ROW EXECUTE PROCEDURE updated_at_column();

This trigger calls updated_at_column() which sets NEW.updated_at = now(), but the auth_session table schema never included an updated_at column, causing the PostgreSQL error.

The trigger was copied from auth_client (which has updated_at), but the column was never added to auth_session.

Solution

Added updated_at column to align schema ↔ model ↔ trigger:

1. Migration 011: Add updated_at TIMESTAMP NOT NULL DEFAULT NOW() to auth_session table
2. Model: Add UpdatedAt time.Time field to AuthSession struct
3. Tests: Update to account for GORM auto-updating updated_at in UPDATE statements

This aligns auth_session with the pattern used on auth_client and makes the existing trigger work correctly.

Changes

• deploy/migrations/initial/011_auth_session_updated_at.up.sql - Add updated_at column
• deploy/migrations/initial/011_auth_session_updated_at.down.sql - Rollback migration
• repository/authclient/models/auth_session.go - Add UpdatedAt field
• pkg/auth/oauth2/serverprovider/storage_test.go - Update tests for new field

Preserved behavior:

• ✅ UNIQUE(access_token) constraint
• ✅ UPDATE-by-access_token for PKCE (no duplicate INSERT)
• ✅ All existing tests pass

Testing

• ✅ TestCreatePKCERequestSessionUpdatesExistingSession - exercises full UPDATE path
• ✅ TestCreateRefreshTokenSessionUpdatesByPrimaryKey - verifies updated_at in other UPDATE
• ✅ All auth package tests pass

Next Steps

After merge:

1. Run migration 011 on production database
2. Affyard will bump the blaze-api submodule (separate task)
3. Deploy and verify OAuth flow works

Notes

• Migration is safe: adds column with DEFAULT, no existing data impact
• The trigger has existed since initial schema but was broken until now
• Example migrations are symlinked to deploy migrations (already covered)

  

[coveralls]

Coverage Report for CI Build 35356819848

Warning

No base build found for commit 823c11c on main.
Coverage changes can't be calculated without a base build.
If a base build is processing, this comment will update automatically when it completes.

Coverage: 3.918%

Details

• Patch coverage: No coverable lines changed in this PR.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

Requires a base build to compare against. How to fix this →

---

Coverage Stats

Relevant Lines:	27435
Covered Lines:	1075
Line Coverage:	3.92%
Coverage Strength:	0.04 hits per line

---

💛 - Coveralls