Device Authorization Flow

import { AurisClient } from '@auris/js'
 
const auris = new AurisClient({
  domain: 'auth.tuodominio.com',
  clientId: 'il-tuo-client-id-dispositivo',
})
 
// Passo 1: Richiedi un device code
const deviceAuth = await fetch('https://auth.tuodominio.com/api/oauth/device/code', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    client_id: 'il-tuo-client-id-dispositivo',
    scope: 'openid profile email',
  }),
}).then(r => r.json())
 
// Passo 2: Mostra all'utente
console.log(`Vai su: ${deviceAuth.verification_uri}`)
console.log(`Inserisci il codice: ${deviceAuth.user_code}`)
 
// Passo 3: Polling per il token
const token = await pollForToken(deviceAuth)
 
async function pollForToken(deviceAuth) {
  const interval = deviceAuth.interval * 1000 // converti in ms
  const expiresAt = Date.now() + deviceAuth.expires_in * 1000
 
  while (Date.now() < expiresAt) {
    await new Promise(resolve => setTimeout(resolve, interval))
 
    const response = await fetch('https://auth.tuodominio.com/api/auth/token', {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
        device_code: deviceAuth.device_code,
        client_id: 'il-tuo-client-id-dispositivo',
      }),
    })
 
    if (response.ok) {
      return await response.json()
    }
 
    const error = await response.json()
 
    if (error.error === 'authorization_pending') {
      continue // l'utente non ha ancora approvato
    }
    if (error.error === 'slow_down') {
      await new Promise(resolve => setTimeout(resolve, 5000)) // rallenta
      continue
    }
    if (error.error === 'expired_token') {
      throw new Error('Device code scaduto. Riavvia il flusso.')
    }
    if (error.error === 'access_denied') {
      throw new Error('L\'utente ha negato la richiesta di autorizzazione.')
    }
 
    throw new Error(`Errore inatteso: ${error.error}`)
  }
 
  throw new Error('Device code scaduto.')
}

# Passo 1: Richiedi un device code
curl -X POST https://auth.tuodominio.com/api/oauth/device/code \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=il-tuo-client-id-dispositivo" \
  -d "scope=openid profile email"
 
# Risposta:
# {
#   "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
#   "user_code": "WDJB-MJHT",
#   "verification_uri": "https://auth.tuodominio.com/hosted/device",
#   "verification_uri_complete": "https://auth.tuodominio.com/hosted/device?user_code=WDJB-MJHT",
#   "expires_in": 600,
#   "interval": 5
# }
 
# Passo 2: L'utente visita verification_uri e inserisce lo user_code
 
# Passo 3: Polling per il token (ripeti ogni `interval` secondi)
curl -X POST https://auth.tuodominio.com/api/auth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
  -d "device_code=GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS" \
  -d "client_id=il-tuo-client-id-dispositivo"
 
# Risposta in attesa (HTTP 400):
# { "error": "authorization_pending" }
 
# Risposta di successo (HTTP 200):
# {
#   "access_token": "eyJhbGciOiJSUzI1NiJ9...",
#   "token_type": "Bearer",
#   "expires_in": 3600,
#   "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2g...",
#   "scope": "openid profile email"
# }

#!/usr/bin/env node
// Esempio: flusso di login CLI con device authorization
 
import open from 'open'
 
const AURIS_DOMAIN = 'https://auth.tuodominio.com'
const CLIENT_ID = 'il-tuo-cli-client-id'
 
async function login() {
  // Richiedi il device code
  const codeResponse = await fetch(`${AURIS_DOMAIN}/api/oauth/device/code`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({ client_id: CLIENT_ID, scope: 'openid profile' }),
  }).then(r => r.json())
 
  console.log('\n  Il tuo codice di autorizzazione è:\n')
  console.log(`    ${codeResponse.user_code}\n`)
  console.log(`  Visita: ${codeResponse.verification_uri}\n`)
 
  // Tenta di aprire il browser automaticamente
  const uriComplete = codeResponse.verification_uri_complete
  if (uriComplete) {
    console.log('  Apertura browser...')
    await open(uriComplete)
  }
 
  // Polling per il token
  console.log('  In attesa di autorizzazione...\n')
 
  let interval = codeResponse.interval * 1000
  const deadline = Date.now() + codeResponse.expires_in * 1000
 
  while (Date.now() < deadline) {
    await new Promise(r => setTimeout(r, interval))
 
    const res = await fetch(`${AURIS_DOMAIN}/api/auth/token`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
        device_code: codeResponse.device_code,
        client_id: CLIENT_ID,
      }),
    })
 
    if (res.ok) {
      const token = await res.json()
      console.log('  Autenticazione riuscita!')
      return token
    }
 
    const err = await res.json()
    if (err.error === 'slow_down') {
      interval += 5000
    } else if (err.error !== 'authorization_pending') {
      throw new Error(`Autorizzazione fallita: ${err.error}`)
    }
  }
 
  throw new Error('Autorizzazione scaduta.')
}
 
login()
  .then(token => console.log('Token:', token.access_token.slice(0, 20) + '...'))
  .catch(err => console.error(err.message))