107 lines
3.3 KiB
TypeScript
107 lines
3.3 KiB
TypeScript
import { type NextRequest } from 'next/server';
|
|
import { getSupabaseAdmin } from '@/lib/supabase/admin';
|
|
import { jsonNoStore } from '@/lib/admin/response';
|
|
import {
|
|
generateDeviceToken,
|
|
hashToken,
|
|
} from '@/lib/device';
|
|
|
|
export const runtime = 'nodejs';
|
|
export const dynamic = 'force-dynamic';
|
|
|
|
type TokenBody = { device_code?: unknown };
|
|
|
|
type Pairing = {
|
|
id: number;
|
|
status: string;
|
|
user_id: string | null;
|
|
expires_at: string;
|
|
interval_seconds: number;
|
|
last_polled_at: string | null;
|
|
};
|
|
|
|
/**
|
|
* Device-token endpoint (PUBLIC). The device polls this with its device_code.
|
|
* Returns authorization_pending until the user approves, then mints a device
|
|
* token exactly once.
|
|
*/
|
|
export async function POST(req: NextRequest) {
|
|
let body: TokenBody;
|
|
try {
|
|
body = (await req.json()) as TokenBody;
|
|
} catch {
|
|
return jsonNoStore({ error: 'invalid_grant' }, { status: 400 });
|
|
}
|
|
const deviceCode =
|
|
typeof body.device_code === 'string' ? body.device_code : '';
|
|
if (!deviceCode) {
|
|
return jsonNoStore({ error: 'invalid_grant' }, { status: 400 });
|
|
}
|
|
|
|
const admin = getSupabaseAdmin();
|
|
const { data: pairing, error: pairingErr } = await admin
|
|
.from('device_pairings')
|
|
.select('id, status, user_id, expires_at, interval_seconds, last_polled_at')
|
|
.eq('device_code_hash', hashToken(deviceCode))
|
|
.maybeSingle<Pairing>();
|
|
if (pairingErr) {
|
|
return jsonNoStore({ error: 'failed' }, { status: 500 });
|
|
}
|
|
if (!pairing) {
|
|
return jsonNoStore({ error: 'invalid_grant' }, { status: 400 });
|
|
}
|
|
|
|
// Optional slow_down: reject when polled faster than the advertised interval.
|
|
const now = Date.now();
|
|
if (pairing.last_polled_at) {
|
|
const sinceLast = now - new Date(pairing.last_polled_at).getTime();
|
|
if (sinceLast < pairing.interval_seconds * 1000) {
|
|
await admin
|
|
.from('device_pairings')
|
|
.update({ last_polled_at: new Date(now).toISOString() })
|
|
.eq('id', pairing.id);
|
|
return jsonNoStore({ error: 'slow_down' }, { status: 429 });
|
|
}
|
|
}
|
|
await admin
|
|
.from('device_pairings')
|
|
.update({ last_polled_at: new Date(now).toISOString() })
|
|
.eq('id', pairing.id);
|
|
|
|
if (new Date(pairing.expires_at).getTime() < now) {
|
|
await admin
|
|
.from('device_pairings')
|
|
.update({ status: 'expired' })
|
|
.eq('id', pairing.id);
|
|
return jsonNoStore({ error: 'expired_token' }, { status: 400 });
|
|
}
|
|
|
|
if (pairing.status === 'pending') {
|
|
return jsonNoStore({ error: 'authorization_pending' }, { status: 400 });
|
|
}
|
|
|
|
if (pairing.status === 'approved' && pairing.user_id) {
|
|
const deviceToken = generateDeviceToken();
|
|
const { error: insErr } = await admin.from('device_tokens').insert({
|
|
token_hash: hashToken(deviceToken),
|
|
user_id: pairing.user_id,
|
|
label: 'HA add-on',
|
|
});
|
|
if (insErr) {
|
|
return jsonNoStore({ error: 'failed' }, { status: 500 });
|
|
}
|
|
const { error: claimErr } = await admin
|
|
.from('device_pairings')
|
|
.update({ status: 'claimed', claimed_at: new Date(now).toISOString() })
|
|
.eq('id', pairing.id)
|
|
.eq('status', 'approved');
|
|
if (claimErr) {
|
|
return jsonNoStore({ error: 'failed' }, { status: 500 });
|
|
}
|
|
return jsonNoStore({ device_token: deviceToken, token_type: 'Bearer' });
|
|
}
|
|
|
|
// claimed or expired.
|
|
return jsonNoStore({ error: 'expired_token' }, { status: 400 });
|
|
}
|