Device Authorization Flow

import { AurisClient } from '@auris/js'
 
const auris = new AurisClient({
  domain: 'auth.yourdomain.com',
  clientId: 'your-device-app-client-id',
})
 
// Schritt 1: Gerätecode anfordern
const deviceAuth = await fetch('https://auth.yourdomain.com/api/oauth/device/code', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    client_id: 'your-device-app-client-id',
    scope: 'openid profile email',
  }),
}).then(r => r.json())
 
// Schritt 2: Dem Benutzer anzeigen
console.log(`Besuche: ${deviceAuth.verification_uri}`)
console.log(`Code eingeben: ${deviceAuth.user_code}`)
 
// Schritt 3: Auf Token warten
const token = await pollForToken(deviceAuth)
 
async function pollForToken(deviceAuth) {
  const interval = deviceAuth.interval * 1000 // in ms umwandeln
  const expiresAt = Date.now() + deviceAuth.expires_in * 1000
 
  while (Date.now() < expiresAt) {
    await new Promise(resolve => setTimeout(resolve, interval))
 
    const response = await fetch('https://auth.yourdomain.com/api/auth/token', {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
        device_code: deviceAuth.device_code,
        client_id: 'your-device-app-client-id',
      }),
    })
 
    if (response.ok) {
      return await response.json()
    }
 
    const error = await response.json()
 
    if (error.error === 'authorization_pending') {
      continue // Benutzer hat noch nicht genehmigt
    }
    if (error.error === 'slow_down') {
      await new Promise(resolve => setTimeout(resolve, 5000)) // zurückrudern
      continue
    }
    if (error.error === 'expired_token') {
      throw new Error('Gerätecode abgelaufen. Bitte Flow neu starten.')
    }
    if (error.error === 'access_denied') {
      throw new Error('Benutzer hat die Autorisierungsanfrage abgelehnt.')
    }
 
    throw new Error(`Unerwarteter Fehler: ${error.error}`)
  }
 
  throw new Error('Gerätecode abgelaufen.')
}

# Schritt 1: Gerätecode anfordern
curl -X POST https://auth.yourdomain.com/api/oauth/device/code \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=your-device-app-client-id" \
  -d "scope=openid profile email"
 
# Antwort:
# {
#   "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
#   "user_code": "WDJB-MJHT",
#   "verification_uri": "https://auth.yourdomain.com/hosted/device",
#   "verification_uri_complete": "https://auth.yourdomain.com/hosted/device?user_code=WDJB-MJHT",
#   "expires_in": 600,
#   "interval": 5
# }
 
# Schritt 2: Benutzer besucht verification_uri und gibt user_code ein
 
# Schritt 3: Auf Token warten (alle `interval` Sekunden wiederholen)
curl -X POST https://auth.yourdomain.com/api/auth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
  -d "device_code=GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS" \
  -d "client_id=your-device-app-client-id"
 
# Ausstehende Antwort (HTTP 400):
# { "error": "authorization_pending" }
 
# Erfolgs-Antwort (HTTP 200):
# {
#   "access_token": "eyJhbGciOiJSUzI1NiJ9...",
#   "token_type": "Bearer",
#   "expires_in": 3600,
#   "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2g...",
#   "scope": "openid profile email"
# }

#!/usr/bin/env node
// Beispiel: CLI-Tool-Login-Flow mit Device Authorization
 
import open from 'open'
import readline from 'readline'
 
const AURIS_DOMAIN = 'https://auth.yourdomain.com'
const CLIENT_ID = 'your-cli-client-id'
 
async function login() {
  // Gerätecode anfordern
  const codeResponse = await fetch(`${AURIS_DOMAIN}/api/oauth/device/code`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({ client_id: CLIENT_ID, scope: 'openid profile' }),
  }).then(r => r.json())
 
  console.log('\n  Dein Autorisierungscode:\n')
  console.log(`    ${codeResponse.user_code}\n`)
  console.log(`  Besuche: ${codeResponse.verification_uri}\n`)
 
  // Versuchen, Browser automatisch zu öffnen
  const uriComplete = codeResponse.verification_uri_complete
  if (uriComplete) {
    console.log('  Browser wird geöffnet...')
    await open(uriComplete)
  }
 
  // Auf Token warten
  console.log('  Warte auf Autorisierung...\n')
 
  let interval = codeResponse.interval * 1000
  const deadline = Date.now() + codeResponse.expires_in * 1000
 
  while (Date.now() < deadline) {
    await new Promise(r => setTimeout(r, interval))
 
    const res = await fetch(`${AURIS_DOMAIN}/api/auth/token`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
        device_code: codeResponse.device_code,
        client_id: CLIENT_ID,
      }),
    })
 
    if (res.ok) {
      const token = await res.json()
      console.log('  Erfolgreich authentifiziert!')
      return token
    }
 
    const err = await res.json()
    if (err.error === 'slow_down') {
      interval += 5000
    } else if (err.error !== 'authorization_pending') {
      throw new Error(`Autorisierung fehlgeschlagen: ${err.error}`)
    }
  }
 
  throw new Error('Autorisierung abgelaufen.')
}
 
login()
  .then(token => console.log('Token:', token.access_token.slice(0, 20) + '...'))
  .catch(err => console.error(err.message))