feat: implement device authorization flow for CLI authentication

[vreshch]

Summary

This PR implements the OAuth 2.0 Device Authorization Grant (RFC 8628) for CLI authentication, enabling users to authenticate their CLI tools via GitHub.

Changes

Backend (packages/backend)

• Device Code Service (src/services/device-code/)

  • Generates cryptographically secure device codes (32+ bytes)
  • Creates user-friendly 8-character codes (XXXX-XXXX format using unambiguous characters)
  • Stores codes in MongoDB with TTL index for automatic cleanup (15 min expiry)
  • Handles code authorization and JWT token generation

• New API Endpoints (added to src/routes/auth/index.ts)

  • POST /api/auth/device/code - Request a device code for CLI
  • POST /api/auth/device/token - Poll for token after user authenticates
  • POST /api/auth/device/authorize - Authorize a device code (called by frontend)
  • GET /api/auth/device/verify - Verify a user code is valid

• Updated GitHub OAuth Flow

  • Modified to support device flow via OAuth state parameter
  • Redirects to /device/authorize when coming from device flow

Frontend (packages/frontend)

• Device Entry Page (/device)

  • User enters device code displayed by CLI
  • Validates code format and verifies with backend before OAuth redirect

• Device Authorization Page (/device/authorize)

  • Handles OAuth callback for device flow
  • Authorizes the device code with user credentials
  • Shows success/error status

Shared Types (packages/shared)

• Added DeviceCodeDocument - MongoDB document structure
• Added DeviceCodeResponse, DeviceTokenResponse, DeviceAuthError types

Authentication Flow

CLI                  Backend                Frontend             GitHub
 |                      |                      |                    |
 |--POST /device/code-->|                      |                    |
 |<---device_code-------|                      |                    |
 |                      |                      |                    |
 | User opens /device   |                      |                    |
 |--------------------->|--------------------->|                    |
 |                      |                      |--/auth/github----->|
 |                      |                      |<---OAuth callback--|
 |                      |<--authorize device---|                    |
 |                      |                      |                    |
 |--POST /device/token->|                      |                    |
 |<---access_token------|                      |                    |

Testing

• Added unit tests for DeviceCodeService
• Manually tested build passes for all packages

Related

• Implements spec from specs/api-logins.md
• RFC 8628: https://tools.ietf.org/html/rfc8628

[github-actions]

✅ Pull Request Validation Successful

Step Results:

• ✅ 📦 Install dependencies: true
• ✅ 🔍 Run linting: true
• ✅ 🧪 Run tests: true
• ✅ 🏗️ Build packages: true

🎉 All quality checks passed! Ready to merge.

📋 View workflow run

---

🐳 Docker Images Built Successfully!

🏷️ Tag: pr-11

• Backend: ✅ Built
• Frontend: ✅ Built

📋 View workflow

---

⏰ Generated at: 2025-11-25T23:16:01.608Z