mirror of
https://github.com/rommapp/romm.git
synced 2026-06-28 06:46:00 +00:00
519abc1645
Implements RFC 8628-style device authorization so clients (argosy-launcher, grout) can pair by display instead of manually copying tokens. Device posts to an open /api/auth/device/init with its identifier and requested scopes; the server returns device_code + user_code + QR URL. User scans QR, lands at /pair/device, approves (optionally editing name/scopes/expiry); the device's next poll on /api/auth/device/token returns a ClientToken bound 1:1 to a newly- created (or deduped) Device record. Downstream endpoints (/play-sessions, /sync/negotiate) infer device_id from the bound token so the client doesn't have to ship it on every call. - Migrations 0080/0081: devices.client_device_identifier (unique per user) and client_tokens.device_id FK (ON DELETE SET NULL) - Five new endpoints under /api/auth/device (init/pending/approve/ deny/token) with Redis-backed state, per-IP rate limits, and RFC-compliant error codes (authorization_pending, slow_down, expired_token, access_denied) - HybridAuthBackend surfaces bound device_id on request.state and bumps devices.last_seen with a 5-minute debounce - /api/users/me returns current_device_id for bound tokens so a device can identify itself from its token alone - Frontend approval screen at /pair/device with editable scopes/ name/expiry (defaults to Never), 3s auto-close countdown - ClientApiTokens settings list shows bound-device chip - 20 i18n keys added to all 17 locales; generated models updated - 52 new tests across 13 classes; full suite 1334 passed Planning and review assisted by Claude Code.
32 lines
638 B
Python
32 lines
638 B
Python
from pydantic import ConfigDict
|
|
|
|
from .base import BaseModel, UTCDatetime
|
|
|
|
|
|
class ClientTokenSchema(BaseModel):
|
|
model_config = ConfigDict(from_attributes=True)
|
|
|
|
id: int
|
|
name: str
|
|
scopes: list[str]
|
|
expires_at: UTCDatetime | None
|
|
last_used_at: UTCDatetime | None
|
|
created_at: UTCDatetime
|
|
user_id: int
|
|
device_id: str | None = None
|
|
|
|
|
|
class ClientTokenCreateSchema(ClientTokenSchema):
|
|
raw_token: str
|
|
|
|
|
|
class ClientTokenAdminSchema(ClientTokenSchema):
|
|
username: str
|
|
user_avatar_path: str
|
|
user_updated_at: UTCDatetime
|
|
|
|
|
|
class ClientTokenPairSchema(BaseModel):
|
|
code: str
|
|
expires_in: int
|