feat(oauth): add claim-token verification

[hiddeco]

Introduce a claim-token mechanism that ties an OAuth browser flow back to the session that initiated it. On creation the server returns a one-time token; after the provider callback the client must present it via a new verify-oauth endpoint to prove ownership before the sync is triggered.

Key changes:

• ConnectionInitSession gains three columns (initiator_user_id, initiator_session_id, claim_token_hash) and an in_progress status.
• OAuthCallbackService.verify_oauth_flow validates the token, checks caller identity, marks the session completed, and starts the deferred sync.
• Connect-js SDK stores the claim token and calls verify-oauth after popup success.

[cubic-dev-ai]

3 issues found across 24 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="backend/airweave/api/v1/endpoints/connect.py">

<violation number="1" location="backend/airweave/api/v1/endpoints/connect.py:179">
P1: Custom agent: **Check for Cursor Rules Drift**

Update the relevant Cursor rule(s) for Rule 1's "modified API patterns or data flow changes" clause. The Connect OAuth flow now requires a claim-token verification call to `/connect/source-connections/{connection_id}/verify-oauth`, but the current Cursor guidance still describes the older popup-only flow.</violation>
</file>

<file name="connect/src/lib/useOAuthFlow.ts">

<violation number="1" location="connect/src/lib/useOAuthFlow.ts:67">
P1: Custom agent: **Check for Fern Documentation Drift**

Update the Direct OAuth Fern guide for the new `claim_token` + `verify-oauth` flow. Rule 2's manual MDX examples section is now out of sync: `direct-oauth.mdx` still says sync starts automatically after callback, so readers will omit the required verification request and the deferred sync will not start.</violation>
</file>

<file name="backend/airweave/domains/oauth/callback_service.py">

<violation number="1" location="backend/airweave/domains/oauth/callback_service.py:669">
P0: Status check will always reject claim-token flows. `_complete_connection_common` calls `mark_completed` during the callback, setting the session status to `COMPLETED`. By the time the client calls `verify_oauth_flow`, the session is already `COMPLETED`, so this `IN_PROGRESS` check always fails with a 400.

Either skip `mark_completed` in `_complete_connection_common` for claim-token sessions, or change this check to accept `COMPLETED`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}