fix: address verified review findings (auth-config-doctor-1)

Signed-off-by: bircni <bircni@icloud.com>

internal/app/auth.go

@@ -66,12 +66,15 @@ func (a *application) sshPassphrase(ctx context.Context, policy terminal.Policy,
 }
 
 // instanceTarget selects the instance and account an auth command acts on, without authenticating:
-// with no --host, the instance of the working directory's repository when tea has accounts there,
-// else the one other commands select.
+// with no --host, the instance of the working directory's repository when tea has accounts there
+// (and the account named by --user or TEA_USER, if any), else the one other commands select.
 func (a *application) instanceTarget(ctx context.Context) (target, error) {
 	if a.options.host == "" {
 		if t, err := a.resolveTarget(ctx, true, false); err == nil && len(t.host.Users) > 0 {
-			return t, nil
+			user, _ := a.selectedUser()
+			if _, ok := matchAccount(t.host.Users, user); user == "" || ok {
+				return t, nil
+			}
 		}
 	}
 	return a.resolveTarget(ctx, false, false)
@@ -431,6 +434,9 @@ $ tea auth status --host gitea.com --json`,
 			if err != nil {
 				return err
 			}
+			if s.Hosts.Hosts, err = a.environmentHosts(s.Hosts.Hosts); err != nil {
+				return err
+			}
 			selectedHost := ""
 			if a.options.host != "" {
 				if selectedHost, err = settings.ResolveHost(a.options.host, s.Hosts.Hosts); err != nil {
@@ -496,7 +502,16 @@ func (a *application) accountStatus(ctx context.Context, s settings.Snapshot, in
 	if verify {
 		err := errors.New("credential unavailable")
 		if row.Available {
-			row.Scopes, err = a.verifyAccount(ctx, a.policy(s), instance, user, host, account, credential.AccessToken)
+			err = nil
+			if account.AuthMethod == settings.AuthOAuth {
+				// An expired access token is not a broken credential: commands refresh it before use.
+				if credential, err = a.refreshedCredential(ctx, instance, user, host); err == nil && !credential.ExpiresAt.IsZero() {
+					row.ExpiresAt = &credential.ExpiresAt
+				}
+			}
+			if err == nil {
+				row.Scopes, err = a.verifyAccount(ctx, a.policy(s), instance, user, host, account, credential.AccessToken)
+			}
 		}
 		verified := err == nil
 		row.Verified = &verified
@@ -507,6 +522,15 @@ func (a *application) accountStatus(ctx context.Context, s settings.Snapshot, in
 	return row
 }
 
+// refreshedCredential loads the OAuth credential of an account, refreshing it first when it expires.
+func (a *application) refreshedCredential(ctx context.Context, instance, user string, host settings.Host) (auth.Credential, error) {
+	manager, err := auth.NewManager(a.deps.Settings, a.deps.Credentials)
+	if err != nil {
+		return auth.Credential{}, err
+	}
+	return manager.Refresh(ctx, instance, user, a.deps.Client(instance, "", host.Insecure).HTTP, false, a.deps.Now())
+}
+
 // environmentStatus reports the GITEA_TOKEN of the environment, when one is set.
 func (a *application) environmentStatus(ctx context.Context, s settings.Snapshot, verify bool) (authStatusRow, bool) {
 	token := a.deps.Getenv("GITEA_TOKEN")