@ttl_seconds 600

  @interval_seconds 5

  @maximum_create_attempts 3

  @maximum_device_name_length 80

  # The alphabet `random_user_code/0` draws from. `I`, `O`, `0`, and `1` are

  # absent on purpose: a code is read off one screen and typed into another.

  def cast_user_code(_code), do: :error

  def create(scopes \\ ApiTokens.default_scopes())

  def create(scopes \\ ApiTokens.default_scopes(), device_name \\ nil)

  def create(scopes) when is_list(scopes), do: create(scopes, @maximum_create_attempts)

  def create(scopes, device_name) when is_list(scopes),

    do: insert_authorization(scopes, normalize_device_name(device_name), @maximum_create_attempts)

  def create(_scopes), do: {:error, :invalid_scopes}

  def create(_scopes, _device_name), do: {:error, :invalid_scopes}

  def get_pending_by_user_code(user_code) when is_binary(user_code) do

    now = DateTime.utc_now()

  def poll(_device_code), do: {:error, :access_denied}

  defp create(_scopes, 0), do: {:error, :authorization_unavailable}

  defp insert_authorization(_scopes, _device_name, 0),

    do: {:error, :authorization_unavailable}

  defp create(scopes, attempts_left) do

  defp insert_authorization(scopes, device_name, attempts_left) do

    device_code = random_url_token(32)

    user_code = random_user_code()

    expires_at = DateTime.add(DateTime.utc_now(), @ttl_seconds, :second)

    |> DeviceAuthorization.create_changeset(%{

      device_code_digest: digest(device_code),

      user_code_digest: digest(user_code),

      device_name: device_name,

      expires_at: expires_at,

      interval_seconds: @interval_seconds,

      scopes: scopes

      {:error, changeset} ->

        if Keyword.has_key?(changeset.errors, :device_code_digest) or

             Keyword.has_key?(changeset.errors, :user_code_digest),

           do: create(scopes, attempts_left - 1),

           do: insert_authorization(scopes, device_name, attempts_left - 1),

           else: {:error, changeset}

    end

  end

  # A computer name is display metadata, not authority. Normalize it rather

  # than letting a hostname with a control character or excessive length stop

  # sign-in. HEEx escapes the remaining text when the approval page renders it.

  defp normalize_device_name(name) when is_binary(name) do

    name =

      name

      |> String.replace(~r/[\x00-\x1F\x7F]/u, " ")

      |> String.trim()

      |> String.slice(0, @maximum_device_name_length)

    if name == "", do: nil, else: name

  end

  defp normalize_device_name(_name), do: nil

  defp transition(user_code, next_state, user_id, user) do

    now = DateTime.utc_now()

  schema "device_authorizations" do

    field :device_code_digest, :binary

    field :user_code_digest, :binary

    field :device_name, :string

    field :state, :string, default: "pending"

    field :scopes, {:array, :string}, default: ["chat:account", "forge:write"]

    field :interval_seconds, :integer, default: 5

    |> cast(attrs, [

      :device_code_digest,

      :user_code_digest,

      :device_name,

      :expires_at,

      :interval_seconds,

      :scopes

      :interval_seconds

    ])

    |> validate_number(:interval_seconds, greater_than_or_equal_to: 1, less_than_or_equal_to: 30)

    |> validate_length(:device_name, max: 80)

    |> unique_constraint(:device_code_digest)

    |> unique_constraint(:user_code_digest)

    |> check_constraint(:state, name: :device_authorizations_state_check)

  alias OpenAgents.{ApiTokens, DeviceAuthorizations}

  def create(conn, params) do

    case DeviceAuthorizations.create(requested_scopes(params)) do

    case DeviceAuthorizations.create(requested_scopes(params), params["device_name"]) do

      {:ok, authorization, device_code, user_code} ->

        verification_uri = OpenAgentsWeb.Endpoint.url() <> "/device"

            </div>

            <div>

              <%!-- Approving is a grant, and a grant with no named grantee is a

              reflex rather than a decision. The CLI is what this application

              knows is asking: it is the only client that mints a device

              authorization, and `DeviceAuthorizations.claim/3` names the token

              it walks away with "OpenAgents CLI". Which computer it is running

              on is not recorded, so this does not claim to say. --%>

              <p class="font-medium">The OpenAgents CLI is asking to act as you</p>

              reflex rather than a decision. The CLI supplies the computer name

              for recognition; the server supplies the scopes and treats the

              name as display metadata, never as authority. Older clients leave

              it empty and are identified honestly as unnamed. --%>

              <p

                id="device-requesting-computer"

                class="font-medium"

                data-device-name={@authorization.device_name}

              >

                The OpenAgents CLI on

                <span class="font-semibold">{@authorization.device_name || "an unnamed computer"}</span>

                is asking to act as you

              </p>

              <p class="mt-1 text-sm text-muted-foreground">

                Approving gives it these permissions, and no others:

              </p>

    20260826010000,

    20260826103000,

    20260826145554,

    20260826160000

    20260826160000,

    20260827004027

  ],

  "required_tables": [

    "users",

defmodule OpenAgents.Repo.Migrations.AddDeviceNameToDeviceAuthorizations do

  use Ecto.Migration

  def change do

    alter table(:device_authorizations) do

      add :device_name, :string, size: 80

    end

  end

end

  alias OpenAgents.Repo

  test "a pending device authorization is digested and polling is paced", %{conn: conn} do

    created = post(conn, ~p"/api/v1/device/authorizations", %{})

    created =

      post(conn, ~p"/api/v1/device/authorizations", %{

        "device_name" => "Christopher's MacBook"

      })

    assert %{

             "device_code" => device_code,

    assert get_resp_header(created, "cache-control") == ["no-store"]

    authorization = Repo.one!(DeviceAuthorization)

    assert authorization.device_name == "Christopher's MacBook"

    refute authorization.device_code_digest == device_code

    refute authorization.user_code_digest == user_code

    refute inspect(authorization) =~ device_code

    assert get_resp_header(paced, "cache-control") == ["no-store"]

  end

  test "a computer name is bounded and control characters cannot enter the approval", %{

    conn: conn

  } do

    name = "  MacBook\nPro " <> String.duplicate("x", 100)

    conn = post(conn, ~p"/api/v1/device/authorizations", %{"device_name" => name})

    assert json_response(conn, 201)["user_code"]

    authorization = Repo.one!(DeviceAuthorization)

    assert authorization.device_name =~ "MacBook Pro"

    refute authorization.device_name =~ "\n"

    assert String.length(authorization.device_name) == 80

  end

  test "approval returns one PAT exactly once", %{conn: conn} do

    %{"device_code" => device_code, "user_code" => user_code} =

      conn

  test "an authenticated user reviews and approves a matching terminal code", %{conn: conn} do

    user = github_user("device-live-approval", "device-live-owner")

    {:ok, _authorization, _device_code, user_code} = OpenAgents.DeviceAuthorizations.create()

    {:ok, _authorization, _device_code, user_code} =

      OpenAgents.DeviceAuthorizations.create(

        OpenAgents.ApiTokens.default_scopes(),

        "Christopher's MacBook"

      )

    conn = Plug.Test.init_test_session(conn, %{"user_id" => user.id})

    {:ok, view, _html} = live(conn, ~p"/device?user_code=#{user_code}")

    assert has_element?(view, "#device-authorization-review")

    assert has_element?(

             view,

             "#device-requesting-computer[data-device-name=\"Christopher's MacBook\"]"

           )

    assert has_element?(view, "#approve-device")

    refute has_element?(view, "#device-code-invalid")