From 9d5ab9e21527d0d8353d221fa1410dc49733f261 Mon Sep 17 00:00:00 2001
From: Codex Bot <codex-bot@gitea.entroia.local>
Date: Thu, 5 Nov 2026 18:55:29 +0800
Subject: [PATCH] Fix shared OAuth exchange SQL by avoiding a reserved
 identifier

---
 internal/auth/auth.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index e2e5137..f15c2c6 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -284,13 +284,13 @@ func (s *service) exchange(w http.ResponseWriter, r *http.Request, project strin
 	}
 	session := token()
 	result, err := s.db.ExecContext(r.Context(), `
-  WITH grant AS (
+  WITH redeemed_grant AS (
    DELETE FROM login_grants
    WHERE token_hash = $1 AND project = $2 AND frontend_challenge = $3 AND expires_at > now()
    RETURNING account_id
   )
   INSERT INTO project_sessions
-  SELECT $4, $2, account_id, now() + interval '8 hours' FROM grant
+  SELECT $4, $2, account_id, now() + interval '8 hours' FROM redeemed_grant
  `, digest(code), project, digest(verifier), digest(session))
 	if err != nil {
 		return err