From eccf39dded9ec6028686c82169e314d8f0d88044 Mon Sep 17 00:00:00 2001
From: Teknium <127238744+teknium1@users.noreply.github.com>
Date: Tue, 28 Jul 2026 11:07:24 -0700
Subject: [PATCH] refactor(photon): route setup token check through
 validate_photon_token

Maintainer follow-up to the #72763 salvage: check_photon_token_valid()
now delegates to the existing validate_photon_token() (session lookup +
/api/projects/) instead of a bespoke get-session-only probe, since the
device flow can mint tokens that pass the session check but fail the
project APIs that setup actually uses. Semantics preserved: definitive
auth rejection = stale, transient errors = probably-valid.
---
 plugins/platforms/photon/auth.py | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/plugins/platforms/photon/auth.py b/plugins/platforms/photon/auth.py
index 066d5e99cdf7..b8b356a16b8c 100644
--- a/plugins/platforms/photon/auth.py
+++ b/plugins/platforms/photon/auth.py
@@ -201,18 +201,21 @@ def clear_photon_token() -> None:
 def check_photon_token_valid(token: str) -> bool:
     """Return True if the token is accepted by the dashboard API.
 
-    Makes a lightweight ``GET /api/auth/get-session`` call.  A non-401
-    response (including non-auth errors like network blips) is treated as
-    "probably valid" so transient failures don't force unnecessary re-login.
-    Only a definitive 401 / 403 is treated as stale.
+    Delegates to :func:`validate_photon_token`, which checks both
+    ``/api/auth/get-session`` and ``/api/projects/`` — the device flow can
+    mint tokens that pass the session lookup but are rejected by the project
+    APIs, and setup's management calls all hit the project APIs.  A
+    definitive rejection (``PhotonDashboardAuthError``) is treated as stale;
+    transient failures (network blips, 5xx) are treated as "probably valid"
+    so they don't force an unnecessary re-login.
     """
     if not token:
         return False
     try:
-        resp = _dashboard_get("/api/auth/get-session", token)
-        if resp.status_code in (401, 403):
-            return False
+        validate_photon_token(token)
         return True
+    except PhotonDashboardAuthError:
+        return False
     except Exception:
         # Transient error — don't force a re-auth; let the caller's
         # management-call error propagate if the token really is bad.