Add OAuth 2.0 device authorization grant (RFC 8628) - #14
Merged
Conversation
A fourth grant type for testing APIs without registering a redirect URI:
the provider hands out a short user code, LitePost opens the verification
page in the browser and polls the token endpoint until the sign-in is
approved.
- New oauth2_device_flow command requests the device code, reports the
user code to the UI via a flow-scoped oauth-device-prompt-{id} event
(the command is still running while the user acts, so it cannot come
back in the return value), opens the browser and polls. It reuses the
PendingOAuthFlows watch channel, so the existing Cancel button works
unchanged.
- Poll state is decided by the response body, not the HTTP status:
GitHub answers authorization_pending with 200 and a form body where
the RFC says 400 and JSON. slow_down adds 5s to the interval per the
RFC, and the provider-chosen expires_in bounds the wait (capped at 30
minutes).
- verification_url is accepted alongside verification_uri — Google
spells it that way — and verification_uri_complete is preferred when
opening the browser so the code arrives pre-filled.
- The user code panel renders from the flow store rather than component
state, so a device sign-in survives switching tabs the same way the
authorization code flow does.
- OIDC discovery auto-fills the new Device Authorization URL field from
device_authorization_endpoint.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Minor bump for the new device authorization grant. Same four spots as always — package.json, tauri.conf.json, Cargo.toml, and the default User-Agent header in useTabs — plus Cargo.lock via cargo. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ionite34
approved these changes
Aug 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a fourth OAuth 2.0 grant type: the device authorization flow ("device flow"). The provider hands out a short user code, LitePost shows it with a copy button, opens the verification page in the browser, and polls the token endpoint until the sign-in is approved — no redirect URI to register, no localhost callback. Requested by ionite for quicker testing against real providers.
oauth2_device_flowRust command: requests the device code, reports the user code to the UI via a flow-scopedoauth-device-prompt-{id}event, opens the browser (preferringverification_uri_completeso the code arrives pre-filled), and polls. Reuses thePendingOAuthFlowswatch channel so the existing Cancel button works unchanged.authorization_pendingwith 200 + form encoding where the RFC says 400 + JSON.slow_downbacks off 5s per the RFC; the provider''sexpires_inbounds the wait (capped at 30 min).verification_urlspelling alongside the RFC''sverification_uri.device_authorization_endpoint.client_secretis sent on both the device authorization request and token polls when configured, for confidential clients (e.g. OpenIddict apps that require it).docs/authentication.md.Also bumps the version to 0.4.0 (all four spots + Cargo.lock).
Test plan
cargo test— 24/24, including new parser tests for device authorization responses (JSON/form/Google spelling/defaults) and poll outcomes (pending/slow_down/denied/token, GitHub 200-form quirk)npx vitest run— 422/422, including a new component suite covering the device fields, scoped prompt event, cancel-by-flow-id, and token storagenpx tsc --noEmitclean; clippy warnings are pre-existing (http_client.rs)🤖 Generated with Claude Code