Add Device Code (RFC 8628) authentication#42
Merged
Conversation
Implements the OAuth 2.0 Device Authorization Grant as a platform-agnostic auth strategy exported from both the Node and browser entry points. Requests a device code, hands public verification details to a required onDeviceCode callback, polls the token endpoint with AbortSignal support, and exchanges the rSTS token for a Safeguard user token.
Covers disabled-grant detection, poll-loop interval transitions, access_denied/expired_token/deadline outcomes, AbortSignal cancellation, the rSTS token exchange, and the onDeviceCode callback contract using a mock HttpClient.
Saves and restores the appliance's Allowed OAuth2 Grant Types, asserts the disabled-grant ConfigurationError, and asserts the enabled path delivers a verification URL and user code. Auto-skips without SPP_HOST.
Adds Device Code to the auth strategies list and a Node + browser usage section describing the headless display-and-poll flow, the appliance grant prerequisite, and AbortSignal cancellation.
Node sample prints the verification URL and code from onDeviceCode; bundled browser sample renders them in the DOM. Updates the samples index.
New device-code functionality warrants a minor bump. Also clarify the versioning note: package.json holds the prerelease base; v* tags own stable releases.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds OAuth 2.0 Device Authorization Grant (RFC 8628) login support.
What''s included
device-codeauthentication strategy exported from the auth, root, and browser entry points.Tests
Package version is derived from git tags and is intentionally not hand-edited.