Refactor provider session

[darinkrauss]

• Refactor provider session
• Unify separate user-specific provider session endpoints and functions
• Add unique index constraints to enforce provider session expectations
• Rename ProviderSessionAccessor to ProviderSessionClient

[Copilot]

Pull request overview

Refactors the provider session subsystem by consolidating previously user-scoped provider session APIs into unified client/repository interfaces, updating HTTP endpoints accordingly, and adjusting storage/indexing expectations to match the new model.

Changes:

• Renames ProviderSessionAccessor → ProviderSessionClient across auth clients, mocks, and test helpers.
• Unifies provider session create/delete flows around CreateProviderSession(create.UserID) and DeleteProviderSessions(filter) and updates v1 routes (keeping deprecated user-scoped routes).
• Updates provider session storage validation and MongoDB indexes, plus adjusts related test data generators.

Reviewed changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
data/source/test/source.go	Updates random filter generation to use single provider values (array-of-one) helpers.
data/source/source_test.go	Adjusts tests to match single-value provider arrays.
auth/test/provider_session_client.go	Adds new test client stub for the renamed provider session interface.
auth/test/provider_session_accessor.go	Removes old accessor-based test stub.
auth/test/provider_session.go	Removes multi-value random helpers; adds optional-field support for provider sessions/updates.
auth/test/client.go	Switches test client embedding to ProviderSessionClient.
auth/test/auth_mocks.go	Regenerates/updates gomock methods for renamed provider session APIs.
auth/store/test/provider_session_repository.go	Test repository now wraps ProviderSessionClient and drops ListAllProviderSessions.
auth/store/store.go	Refactors provider session repository interface to explicit CRUD/list methods.
auth/store/mongo/provider_session_repository.go	Updates indexes and refactors create/list behavior to require/validate filter & create payload.
auth/service/test/service.go	Removes AuthServiceClient accessors from service test harness.
auth/service/service/service.go	Renames AuthServiceClient() → AuthClient() usage and fixes a typo in an error wrap message.
auth/service/service/client.go	Refactors service client to unified provider-session create/delete APIs.
auth/service/service.go	Removes AuthServiceClient() from the auth service interface.
auth/service/client.go	Removes legacy auth service client interface definition.
auth/service/api/v1/provider_session.go	Adds unified /v1/provider_sessions POST/DELETE endpoints; keeps deprecated user-scoped endpoints.
auth/service/api/v1/oauth.go	Updates OAuth flows to use unified provider-session create/delete; improves unauthenticated messaging.
auth/providersession/test/provider_session_mocks.go	Regenerates mocks for ProviderSessionClient.
auth/providersession/provider_session.go	Updates go:generate and alias type to ProviderSessionClient.
auth/provider_session.go	Renames interface, adds userId to create payload, and tightens filter validation semantics.
auth/events/events.go	Updates user-deletion handler to call DeleteProviderSessions with a filter.
auth/client/client.go	Updates external auth client to use unified provider-session endpoints.
auth/auth.go	Updates top-level auth.Client interface embedding to ProviderSessionClient.

Comments suppressed due to low confidence (1)

auth/service/service/client.go:60

• CreateProviderSession dereferences create (and uses create.Type/create.Name) before checking for nil, which can panic if a caller passes a nil create. Add explicit ctx == nil and create == nil validation (and ideally validate create before using its fields) to keep behavior consistent with the other client methods.

func (c *Client) CreateProviderSession(ctx context.Context, create *auth.ProviderSessionCreate) (*auth.ProviderSession, error) {
	prvdr, err := c.providerFactory.Get(create.Type, create.Name)
	if err != nil {
		return nil, err
	}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[darinkrauss]

This is wrong. There was never a unique index on type, name, and externalId. Furthermore, there shouldn't be.

For twiist, this will work fine as implemented because the TidepoolLinkID is unique per OAuth session (i.e. ProviderSession).

[darinkrauss]

@toddkazakov Would you please double-check my analysis here? To me, Copilot is wrong, but I want to get a set of extra eyes on this since it would be important.

[darinkrauss]

Updates based upon feedback included in later PR.