trace2: instrument authentication flows

Authentication spans browser, device-code, refresh, account selection,
and provider-specific decisions that are otherwise indistinguishable in a
trace. Add regions and mode data at those boundaries so delays and user-flow
choices can be diagnosed without recording credentials.

Assisted-by: GPT-5.6 Sol
Signed-off-by: Matthew John Cheetham <mjcheetham@outlook.com>

Author: mjcheetham

src/Atlassian.Bitbucket/BitbucketAuthentication.cs

@@ -72,6 +72,8 @@ public BitbucketAuthentication(ICommandContext context, IRegistry<BitbucketOAuth
 
         public async Task<CredentialsPromptResult> GetCredentialsAsync(Uri targetUri, string userName, AuthenticationModes modes)
         {
+            using var _ = Trace2.StartRegion("bitbucket", "get_creds");
+
             ThrowIfUserInteractionDisabled();
 
             // If we don't have a desktop session/GUI then we cannot offer OAuth since the only
@@ -250,6 +252,8 @@ private async Task<CredentialsPromptResult> GetCredentialsViaHelperAsync(
 
         public async Task<OAuth2TokenResult> CreateOAuthCredentialsAsync(GitRequest request)
         {
+            using var _ = Trace2.StartRegion("bitbucket", "oauth_browser");
+
             ThrowIfUserInteractionDisabled();
 
             var browserOptions = new OAuth2WebBrowserOptions
@@ -267,6 +271,8 @@ public async Task<OAuth2TokenResult> CreateOAuthCredentialsAsync(GitRequest requ
 
         public async Task<OAuth2TokenResult> RefreshOAuthCredentialsAsync(GitRequest request, string refreshToken)
         {
+            using var _ = Trace2.StartRegion("bitbucket", "oauth_refresh");
+
             var client = _oauth2ClientRegistry.Get(request);
             return await client.GetTokenByRefreshTokenAsync(refreshToken, CancellationToken.None);
         }

src/Core/Authentication/OAuth/OAuth2Client.cs

@@ -105,6 +105,8 @@ public IOAuth2CodeGenerator CodeGenerator
         public async Task<OAuth2AuthorizationCodeResult> GetAuthorizationCodeAsync(IEnumerable<string> scopes,
             IOAuth2WebBrowser browser, IDictionary<string, string> extraQueryParams, CancellationToken ct)
         {
+            using IDisposable region = Trace2.StartRegion(OAuth2Constants.Trace2Category, "get_authcode");
+
             string state = CodeGenerator.CreateNonce();
             string codeVerifier = CodeGenerator.CreatePkceCodeVerifier();
             string codeChallenge = CodeGenerator.CreatePkceCodeChallenge(OAuth2PkceChallengeMethod.Sha256, codeVerifier);
@@ -167,8 +169,11 @@ public async Task<OAuth2AuthorizationCodeResult> GetAuthorizationCodeAsync(IEnum
 
             // Open the browser at the request URI to start the authorization code grant flow, and
             // intercept the response parameters delivered to the redirect URI.
-            IDictionary<string, string> responseParams =
-                await browser.GetAuthenticationResponseAsync(authorizationUri, redirectUri, _responseMode, ct);
+            IDictionary<string, string> responseParams;
+            using (Trace2.StartRegion(OAuth2Constants.Trace2Category, "browser"))
+            {
+                responseParams = await browser.GetAuthenticationResponseAsync(authorizationUri, redirectUri, _responseMode, ct);
+            }
 
             // Check for errors serious enough we should terminate the flow, such as if the state value returned does
             // not match the one we passed. This indicates a badly implemented Authorization Server, or worse, some
@@ -196,8 +201,7 @@ public async Task<OAuth2AuthorizationCodeResult> GetAuthorizationCodeAsync(IEnum
 
         public async Task<OAuth2DeviceCodeResult> GetDeviceCodeAsync(IEnumerable<string> scopes, CancellationToken ct)
         {
-            var label = "get device code";
-            using IDisposable region = Trace2.StartRegion(OAuth2Constants.Trace2Category, label);
+            using IDisposable region = Trace2.StartRegion(OAuth2Constants.Trace2Category, "get_devicecode");
 
             if (_endpoints.DeviceAuthorizationEndpoint is null)
             {
@@ -234,8 +238,7 @@ public async Task<OAuth2DeviceCodeResult> GetDeviceCodeAsync(IEnumerable<string>
 
         public async Task<OAuth2TokenResult> GetTokenByAuthorizationCodeAsync(OAuth2AuthorizationCodeResult authorizationCodeResult, CancellationToken ct)
         {
-            var label = "get token by auth code";
-            using IDisposable region = Trace2.StartRegion(OAuth2Constants.Trace2Category, label);
+            using IDisposable region = Trace2.StartRegion(OAuth2Constants.Trace2Category, "token_by_authcode");
 
             var formData = new Dictionary<string, string>
             {
@@ -273,8 +276,7 @@ public async Task<OAuth2TokenResult> GetTokenByAuthorizationCodeAsync(OAuth2Auth
 
         public async Task<OAuth2TokenResult> GetTokenByRefreshTokenAsync(string refreshToken, CancellationToken ct)
         {
-            var label = "get token by refresh token";
-            using IDisposable region = Trace2.StartRegion(OAuth2Constants.Trace2Category, label);
+            using IDisposable region = Trace2.StartRegion(OAuth2Constants.Trace2Category, "token_by_refresh");
 
             var formData = new Dictionary<string, string>
             {
@@ -306,6 +308,8 @@ public async Task<OAuth2TokenResult> GetTokenByRefreshTokenAsync(string refreshT
 
         public async Task<OAuth2TokenResult> GetTokenByDeviceCodeAsync(OAuth2DeviceCodeResult deviceCodeResult, CancellationToken ct)
         {
+            using IDisposable region = Trace2.StartRegion(OAuth2Constants.Trace2Category, "token_by_devicecode");
+
             var formData = new Dictionary<string, string>
             {
                 [OAuth2Constants.DeviceAuthorization.GrantTypeParameter] = OAuth2Constants.DeviceAuthorization.DeviceCodeGrantType,

src/GitHub/GitHubAuthentication.cs

@@ -72,6 +72,7 @@ public GitHubAuthentication(ICommandContext context)
 
         public async Task<string> SelectAccountAsync(Uri targetUri, IEnumerable<string> accounts)
         {
+            using var _ = Trace2.StartRegion("github", "select_account");
             ThrowIfUserInteractionDisabled();
 
             if (Context.Settings.IsGuiPromptsEnabled && Context.SessionManager.IsDesktopSession)
@@ -135,12 +136,17 @@ public async Task<string> SelectAccountAsync(Uri targetUri, IEnumerable<string>
 
         public async Task<AuthenticationPromptResult> GetAuthenticationAsync(Uri targetUri, string userName, AuthenticationModes modes)
         {
+            using var _ = Trace2.StartRegion("github", "get_auth");
+            Trace2.WriteData("github", "modes/initial", modes.ToString());
+
             // If we cannot start a browser then don't offer the option
             if (!Context.SessionManager.IsWebBrowserAvailable)
             {
                 modes = modes & ~AuthenticationModes.Browser;
             }
 
+            Trace2.WriteData("github", "modes/available", modes.ToString());
+
             // We need at least one mode!
             if (modes == AuthenticationModes.None)
             {
@@ -348,6 +354,8 @@ private async Task<AuthenticationPromptResult> GetAuthenticationViaHelperAsync(
 
         public async Task<string> GetTwoFactorCodeAsync(Uri targetUri, bool isSms)
         {
+            using var _ = Trace2.StartRegion("github", "get_tfa");
+
             ThrowIfUserInteractionDisabled();
 
             if (Context.Settings.IsGuiPromptsEnabled && Context.SessionManager.IsDesktopSession)
@@ -408,6 +416,8 @@ private async Task<string> GetTwoFactorCodeViaHelperAsync(bool isSms, string arg
 
         public async Task<OAuth2TokenResult> GetOAuthTokenViaBrowserAsync(Uri targetUri, IEnumerable<string> scopes, string loginHint)
         {
+            using var _ = Trace2.StartRegion("github", "oauth_browser");
+
             ThrowIfUserInteractionDisabled();
 
             var oauthClient = new GitHubOAuth2Client(HttpClient, Context.Settings, targetUri);
@@ -447,6 +457,8 @@ public async Task<OAuth2TokenResult> GetOAuthTokenViaBrowserAsync(Uri targetUri,
 
         public async Task<OAuth2TokenResult> GetOAuthTokenViaDeviceCodeAsync(Uri targetUri, IEnumerable<string> scopes)
         {
+            using var _ = Trace2.StartRegion("github", "oauth_device_code");
+
             ThrowIfUserInteractionDisabled();
 
             var oauthClient = new GitHubOAuth2Client(HttpClient, Context.Settings, targetUri);