sync·device

A device is requesting access to your sync account.

Enter the code shown on your device\n

\n \n

${esc(prefillCode)}

\n \n \n \n

🔐

Waiting for passkey...

✗

Failed

🚫

Access Denied

The device will be notified.

\n\n`;\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// POST /auth/device/lookup\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function handleDeviceLookup(req: Request): Promise {\n const { user_code } = await req.json();\n if (!user_code) return jsonResp({ error: \"user_code required\" }, 400);\n const code = await db.getDeviceCodeByUserCode(user_code.toUpperCase());\n if (!code) return jsonResp({ error: \"not_found\" }, 404);\n if (code.status !== \"pending\") return jsonResp({ error: \"already_used\" }, 409);\n return jsonResp({ device_code: code.deviceCode, scope: code.scope, user_code: code.userCode });\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// POST /auth/device/approve (kept for backward compat — consent page uses /auth/consent/approve)\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function handleDeviceApprove(req: Request): Promise {\n const { device_code, session_id, user_code, scope: narrowedScope } = await req.json();\n if (!session_id) return jsonResp({ error: \"session_id required\" }, 400);\n const session = await db.validateSession(session_id);\n if (!session) return jsonResp({ error: \"invalid_session\" }, 401);\n let dc;\n if (device_code) dc = await db.getDeviceCode(device_code);\n else if (user_code) dc = await db.getDeviceCodeByUserCode(user_code);\n if (!dc) return jsonResp({ error: \"not_found\" }, 404);\n if (dc.status !== \"pending\") return jsonResp({ error: \"already_processed\" }, 409);\n if (narrowedScope && typeof narrowedScope === \"string\" && narrowedScope.trim()) {\n await db.updateDeviceCodeScope(dc.deviceCode, narrowedScope.trim());\n }\n const ok = await db.approveDeviceCode(dc.deviceCode, session.userId);\n if (!ok) return jsonResp({ error: \"approval_failed\" }, 500);\n await db.deleteSession(session_id);\n return jsonResp({ approved: true, device_code: dc.deviceCode });\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// POST /auth/device/deny\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function handleDeviceDeny(req: Request): Promise {\n const { device_code } = await req.json();\n if (!device_code) return jsonResp({ error: \"device_code required\" }, 400);\n await db.denyDeviceCode(device_code);\n return jsonResp({ denied: true });\n}\n\n// ═══════════════════════════════════════════════════════════════════\n// POST /auth/device/token — CLI polls for token\n// ═══════════════════════════════════════════════════════════════════\n\nexport async function handleDeviceToken(req: Request): Promise {\n let body: Record;\n const ct = req.headers.get(\"content-type\") ?? \"\";\n if (ct.includes(\"application/x-www-form-urlencoded\")) {\n body = Object.fromEntries(new URLSearchParams(await req.text()));\n } else {\n body = await req.json();\n }\n const deviceCode = body.device_code;\n if (!deviceCode) return jsonResp({ error: \"invalid_request\", error_description: \"device_code required\" }, 400);\n const dc = await db.getDeviceCode(deviceCode);\n if (!dc) return jsonResp({ error: \"invalid_grant\", error_description: \"Unknown device code\" }, 400);\n if (new Date(dc.expiresAt) < new Date()) return jsonResp({ error: \"expired_token\" }, 400);\n switch (dc.status) {\n case \"pending\": return jsonResp({ error: \"authorization_pending\" });\n case \"denied\": return jsonResp({ error: \"access_denied\" }, 403);\n case \"consumed\": return jsonResp({ error: \"invalid_grant\", error_description: \"Already consumed\" }, 400);\n case \"approved\": {\n const consumed = await db.consumeDeviceCode(deviceCode);\n if (!consumed) return jsonResp({ error: \"server_error\" }, 500);\n const result = await db.mintToken({\n userId: consumed.approvedBy, scope: consumed.scope,\n label: \"Device auth\", clientId: dc.clientId ?? \"cli\",\n expiresInSec: ACCESS_TOKEN_EXPIRY, withRefresh: true,\n });\n return jsonResp({\n access_token: result.token, token_type: \"Bearer\",\n expires_in: ACCESS_TOKEN_EXPIRY, refresh_token: result.refreshToken,\n scope: consumed.scope,\n });\n }\n default: return jsonResp({ error: \"server_error\" }, 500);\n }\n}\n","deleted","label",[180,161],"mcp","permalink","https://www.val.town/x/c15r/sync/code/mcp/device.ts","extension","actionData","errors"]