Device Flow (RFC 8628)

#!/usr/bin/env bash
set -euo pipefail
 
AUTHORITY="${AUTHORITY:-http://localhost:11560}"
CLIENT_ID="${CLIENT_ID:-pc_cli}"
SCOPE="${SCOPE:-openid profile engine_read}"
 
# 1. Device Authorization Request
resp=$(curl -sS -X POST "$AUTHORITY/device/auth" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "client_id=$CLIENT_ID" \
  --data-urlencode "scope=$SCOPE")
 
device_code=$(echo "$resp" | jq -r .device_code)
user_code=$(echo "$resp" | jq -r .user_code)
verification_uri=$(echo "$resp" | jq -r .verification_uri)
interval=$(echo "$resp" | jq -r '.interval // 5')
 
echo "Open: $verification_uri"
echo "Code: $user_code"
 
# 2. Polling
while true; do
  sleep "$interval"
  token_resp=$(curl -sS -X POST "$AUTHORITY/token" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    --data-urlencode "grant_type=urn:ietf:params:oauth:grant-type:device_code" \
    --data-urlencode "device_code=$device_code" \
    --data-urlencode "client_id=$CLIENT_ID")
 
  error=$(echo "$token_resp" | jq -r '.error // empty')
 
  case "$error" in
    "")                       echo "$token_resp" | jq .; exit 0 ;;
    authorization_pending)    continue ;;
    slow_down)                interval=$((interval + 5)); continue ;;
    *)                        echo "Error: $error" >&2; exit 1 ;;
  esac
done

npm install openid-client open

import { Issuer } from 'openid-client';
import open from 'open';
 
const AUTHORITY = process.env.AUTHORITY ?? 'http://localhost:11560';
const CLIENT_ID = process.env.CLIENT_ID ?? 'pc_cli';
const SCOPE = process.env.SCOPE ?? 'openid profile engine_read';
 
async function login(): Promise<void> {
  const issuer = await Issuer.discover(AUTHORITY);
  const client = new issuer.Client({
    client_id: CLIENT_ID,
    token_endpoint_auth_method: 'none',
  });
 
  const handle = await client.deviceAuthorization({ scope: SCOPE });
 
  console.log(`Open: ${handle.verification_uri}`);
  console.log(`Code: ${handle.user_code}`);
 
  if (handle.verification_uri_complete) {
    await open(handle.verification_uri_complete);
  }
 
  const tokenSet = await handle.poll();
 
  console.log('Access Token:', tokenSet.access_token);
  console.log('Expires at:', new Date((tokenSet.expires_at ?? 0) * 1000));
}
 
login().catch((error) => {
  console.error(error);
  process.exit(1);
});

const AUTHORITY = 'http://localhost:11560';
const CLIENT_ID = 'pc_cli';
const SCOPE = 'openid profile engine_read';
 
interface DeviceAuthResponse {
  device_code: string;
  user_code: string;
  verification_uri: string;
  verification_uri_complete?: string;
  expires_in: number;
  interval?: number;
}
 
interface TokenResponse {
  access_token: string;
  id_token: string;
  refresh_token?: string;
  token_type: 'Bearer';
  expires_in: number;
}
 
async function login(): Promise<TokenResponse> {
  const authResponse = await fetch(`${AUTHORITY}/device/auth`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({ client_id: CLIENT_ID, scope: SCOPE }),
  });
  const auth = (await authResponse.json()) as DeviceAuthResponse;
 
  console.log(`Open: ${auth.verification_uri}`);
  console.log(`Code: ${auth.user_code}`);
 
  let interval = auth.interval ?? 5;
 
  while (true) {
    await new Promise((resolve) => setTimeout(resolve, interval * 1000));
 
    const tokenResponse = await fetch(`${AUTHORITY}/token`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
        device_code: auth.device_code,
        client_id: CLIENT_ID,
      }),
    });
 
    const body = await tokenResponse.json();
 
    if (tokenResponse.ok) {
      return body as TokenResponse;
    }
    if (body.error === 'authorization_pending') continue;
    if (body.error === 'slow_down') { interval += 5; continue; }
    throw new Error(`${body.error}: ${body.error_description ?? ''}`);
  }
}
 
login().then((token) => console.log(token)).catch(console.error);

pc engine login http://localhost:56000 --client-id pc_cli --scope "openid,profile,engine_read"