OAuth 2.0 device flow methods return () and discard device_code/user_code and the access token

[sneg55]

OAuth 2.0 device flow methods return unit and discard the response bodies, so the device grant cannot be completed with the official clients

Context: API Makeathon participant. Found while reviewing the OAuth device-flow methods. The same defect is present in kittycad.go, and the root cause is in the shared API spec.

The device-authorization endpoint returns the device_code and user_code the app must show the user, and the device-token endpoint returns the access token that is the entire point of polling. Both generated methods read the status, throw the success body away, and return nothing.

Evidence

Rust: kittycad/src/oauth2.rs:211-232 (device_auth_request -> Result<(), Error>) and oauth2.rs:269-290 (device_access_token -> Result<(), Error>). Go: paths.go DeviceAuthRequest(body) error and DeviceAccessToken(body) error.

Root cause: spec.json declares only an untyped default response for both operations ("content": {"*/*": {"schema": {}}}), so the generator emits () / error-only signatures. The Rust doc examples even show polling device_access_token in a loop that can never yield a token.

Concrete failure

Any third-party app trying to implement "log in with Zoo" via the device grant using the official clients cannot complete the flow at all: device_auth_request gives back no user_code to display, and device_access_token gives back no token. Users must hand-roll the raw HTTP requests.

Verify

The signatures alone show it: both return Result<(), Error> (Rust) or error-only (Go). No field of the response is exposed to the caller.

Suggested fix

Give both operations typed responses in the API spec (device-authorization and token response schemas), then regenerate the clients so the methods return the codes and the token.

Environment

Reviewed against the current main of KittyCAD/kittycad.rs (and KittyCAD/kittycad.go); the fix belongs in the shared API spec.