mirror of
https://github.com/rommapp/romm.git
synced 2026-06-28 06:46:00 +00:00
519abc1645
Implements RFC 8628-style device authorization so clients (argosy-launcher, grout) can pair by display instead of manually copying tokens. Device posts to an open /api/auth/device/init with its identifier and requested scopes; the server returns device_code + user_code + QR URL. User scans QR, lands at /pair/device, approves (optionally editing name/scopes/expiry); the device's next poll on /api/auth/device/token returns a ClientToken bound 1:1 to a newly- created (or deduped) Device record. Downstream endpoints (/play-sessions, /sync/negotiate) infer device_id from the bound token so the client doesn't have to ship it on every call. - Migrations 0080/0081: devices.client_device_identifier (unique per user) and client_tokens.device_id FK (ON DELETE SET NULL) - Five new endpoints under /api/auth/device (init/pending/approve/ deny/token) with Redis-backed state, per-IP rate limits, and RFC-compliant error codes (authorization_pending, slow_down, expired_token, access_denied) - HybridAuthBackend surfaces bound device_id on request.state and bumps devices.last_seen with a 5-minute debounce - /api/users/me returns current_device_id for bound tokens so a device can identify itself from its token alone - Frontend approval screen at /pair/device with editable scopes/ name/expiry (defaults to Never), 3s auto-close countdown - ClientApiTokens settings list shows bound-device chip - 20 i18n keys added to all 17 locales; generated models updated - 52 new tests across 13 classes; full suite 1334 passed Planning and review assisted by Claude Code.
54 lines
1.4 KiB
Python
54 lines
1.4 KiB
Python
from typing import NotRequired, TypedDict, get_type_hints
|
|
|
|
from pydantic import ConfigDict
|
|
from starlette.requests import Request
|
|
|
|
from handler.metadata.ra_handler import RAUserProgression
|
|
from models.user import Role, User
|
|
|
|
from .base import BaseModel, UTCDatetime
|
|
|
|
RAProgression = TypedDict( # type: ignore[misc]
|
|
"RAProgression",
|
|
{k: NotRequired[v] for k, v in get_type_hints(RAUserProgression).items()}, # type: ignore[misc]
|
|
total=False,
|
|
)
|
|
|
|
|
|
class UserSchema(BaseModel):
|
|
model_config = ConfigDict(from_attributes=True)
|
|
|
|
id: int
|
|
username: str
|
|
email: str | None
|
|
enabled: bool
|
|
role: Role
|
|
oauth_scopes: list[str]
|
|
avatar_path: str
|
|
last_login: UTCDatetime | None
|
|
last_active: UTCDatetime | None
|
|
ra_username: str | None = None
|
|
ra_progression: RAProgression | None = None
|
|
ui_settings: dict | None = None
|
|
current_device_id: str | None = None
|
|
|
|
created_at: UTCDatetime
|
|
updated_at: UTCDatetime
|
|
|
|
@classmethod
|
|
def from_orm_with_request(
|
|
cls, db_user: User | None, request: Request
|
|
) -> "UserSchema | None":
|
|
if not db_user:
|
|
return None
|
|
|
|
schema = cls.model_validate(db_user)
|
|
schema.current_device_id = getattr(
|
|
request.state, "device_id", None
|
|
) or request.session.get("device_id")
|
|
return schema
|
|
|
|
|
|
class InviteLinkSchema(BaseModel):
|
|
token: str
|