Add device authorization flow for API token management#35
Merged
Conversation
Implement OAuth 2.0-style device authorization flow to enable external tools (e.g. a future CLI) to authenticate with Lunar. A device requests a code, the user approves it in the browser, and the device receives an API token for subsequent requests. Server-side: - Add api_tokens table (migration 000010) with token hash storage - Implement DeviceAuthStore for in-memory pending auth requests - Add endpoints: device-request, device-approve, device-token - Add token management endpoints: list and revoke - Extend AuthMiddleware to accept Bearer tokens (hashed lookup) - Add token generation package (internal/token) Frontend: - Add device approval view with CodeDisplay component - Add connected clients view with token table - Add Functions and Clients links to navbar - Add Clients entry to command palette - Update OpenAPI docs, translations (en/pt-BR), routes This is the foundation work to enable a CLI client that will come later.
Remove page header, use CardHeader for the title instead. Card is horizontally centered with max-width and margin auto. Remove unused .centered-page CSS.
Check json.Decode return values to satisfy golangci-lint errcheck rule.
Owner
Author
|
Could you take a look @adamcrossland? |
Contributor
|
So sorry, but I missed this. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is the foundation work to enable a CLI client that will come later.
What's included
Server-side:
api_tokenstable (migration 000010) storing only SHA-256 hashes of tokensDeviceAuthStorefor short-lived pending auth requests (5 min TTL)POST /api/auth/device-request,GET/POST /api/auth/device-approve,GET /api/auth/device-tokenGET /api/tokens,POST /api/tokens/{id}/revokeAuthMiddlewareextended to validate Bearer tokens via hashed lookupinternal/tokenpackage for secure token generation and hashingFrontend:
#!/device-approve/:code) with newCodeDisplaycomponent#!/clients) matching existing table layout patternsScreenshots:
