and refuse the same way — an anonymous request reaches them and leaves with an

`auth_error` and no session.

Amended 2026-08-26 (issue #129): a refusal at `/device` remembers the terminal

code in the browser session and returns the reader to the approval after the

OAuth round trip, so one intent costs one sign-in rather than two. The refusal

itself is unchanged — no session, no approval, and the code alone grants

nothing — but two of its outputs now depend on a value the browser sent: where

the redirect points, and what the landing page prints.

That value is admitted by exactly one function.

`OpenAgents.DeviceAuthorizations.cast_user_code/1` returns `{:ok, code}` only

for the eight-character alphabet this application mints, anchored so no second

line can follow, and every place that puts the value into a URL, a session, or

a page casts it rather than trusting an earlier cast. Anything else — a host, a

scheme-relative URL, a path, a CRLF, markup, a query-string list — leaves the

reader on the bare public root with nothing remembered, which is where the

refusal put them before this existed. The proof is adversarial and enumerates

the crafted forms rather than asserting the happy path.

What this does not do: name the computer that is asking. Nothing in the device

authorization records one, so the approval page names the client and the

scopes, which are what the application actually knows.

Evidence: `OpenAgents.GitHubOAuth`, `OpenAgents.Accounts`, `OpenAgentsWeb.AuthController`,

`OpenAgentsWeb.UserAuth.require_authenticated_user/2`,

`OpenAgents.DeviceAuthorizations.cast_user_code/1`,

`OpenAgentsWeb.Endpoint.session_options/0`, `OpenAgents.GitHubOAuthTest`,

`OpenAgents.AccountsTest`, `OpenAgentsWeb.AuthControllerTest`, and

`OpenAgents.AccountsTest`, `OpenAgentsWeb.AuthControllerTest`,

`OpenAgentsWeb.DeviceSignInReturnTest`, and

`OpenAgentsWeb.AuthenticatedRouteGateTest`.

### IDENTITY-002 — Conversation lookup never accepts a client database ID

| DEGRADE-001 | `test/openagents/program_artifacts_test.exs`, `test/openagents/turn_provenance_test.exs` |

| PROGRAM-002 | `test/openagents/shadow_programs_test.exs` |

| PROGRAM-003 | `test/openagents/program_lifecycle_test.exs` |

| IDENTITY-001 | `test/openagents/github_oauth_test.exs`, `test/openagents_web/auth_controller_test.exs`, `test/openagents_web/authenticated_route_gate_test.exs` |

| IDENTITY-001 | `test/openagents/github_oauth_test.exs`, `test/openagents_web/auth_controller_test.exs`, `test/openagents_web/device_sign_in_return_test.exs`, `test/openagents_web/authenticated_route_gate_test.exs` |

| IDENTITY-002 | `test/openagents_web/auth_gate_test.exs`, `test/openagents_web/authenticated_route_gate_test.exs`, `test/openagents_web/live_view_scope_test.exs` |

| IDENTITY-003 | `test/openagents/memory_portability_test.exs` |

| IDENTITY-004 | `test/openagents/agents_test.exs`, `test/openagents_web/controllers/agent_controller_test.exs` |

  @interval_seconds 5

  @maximum_create_attempts 3

  # The alphabet `random_user_code/0` draws from. `I`, `O`, `0`, and `1` are

  # absent on purpose: a code is read off one screen and typed into another.

  @user_code_alphabet "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"

  @user_code_pattern ~r/\A[ABCDEFGHJKLMNPQRSTUVWXYZ23456789]{4}-[ABCDEFGHJKLMNPQRSTUVWXYZ23456789]{4}\z/

  @doc """

  Casts a caller-supplied user code to the exact shape this module mints.

  `get_pending_by_user_code/1` can be handed anything and answers `nil`, which

  is the right answer for a lookup. It is the wrong answer for anything that

  puts the value back into a URL, a page, or a session, because "no such

  authorization" and "not a code at all" are then indistinguishable.

  This is that second question, and it is asked wherever a code the browser

  sent goes on to build something. The pattern is anchored with `\\A` and

  `\\z` rather than `^` and `$`, so a trailing newline cannot smuggle a second

  line past it, and it admits only the thirty-two characters and one hyphen

  above — never a path, a host, a scheme, a quote, or a tag.

  Trimming and upcasing come first, so a code retyped in lowercase is the same

  code. A letter this alphabet excludes is not silently corrected to one it

  admits: `i` upcases to `I`, which is not in the set, and is refused.

  """

  @spec cast_user_code(term()) :: {:ok, String.t()} | :error

  def cast_user_code(code) when is_binary(code) do

    normalized = normalize_user_code(code)

    if Regex.match?(@user_code_pattern, normalized), do: {:ok, normalized}, else: :error

  end

  def cast_user_code(_code), do: :error

  def create(scopes \\ ApiTokens.default_scopes())

  def create(scopes) when is_list(scopes), do: create(scopes, @maximum_create_attempts)

  end

  defp random_user_code do

    alphabet = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789"

    alphabet = @user_code_alphabet

    8

    |> :crypto.strong_rand_bytes()

defmodule OpenAgentsWeb.AuthController do

  use OpenAgentsWeb, :controller

  alias OpenAgents.{Accounts, Analytics, GitHubOAuth, Repositories}

  alias OpenAgents.{Accounts, Analytics, DeviceAuthorizations, GitHubOAuth, Repositories}

  @attempt_session_key "github_oauth_attempt"

  @identity_session_key "posthog_identity"

  def callback(conn, %{"code" => code, "state" => state}) do

    attempt = get_session(conn, @attempt_session_key)

    verifier = if is_map(attempt), do: attempt["verifier"]

    # Read before the session is cleared below, because clearing it is what

    # takes the remembered device code away.

    landing = landing_path(get_session(conn, OpenAgentsWeb.UserAuth.device_session_key()))

    conn = delete_session(conn, @attempt_session_key)

    with :ok <- GitHubOAuth.consume_attempt(attempt, state),

      |> put_session("user_id", active_user.id)

      |> put_session(@identity_session_key, identity(active_user))

      |> put_resp_header("cache-control", "no-store")

      |> redirect(to: ~p"/sarah")

      |> redirect(to: landing)

    else

      {:error, :banned} -> auth_failure(conn, "banned")

      {:error, _reason} -> auth_failure(conn, "failed")

    end

  end

  # Where a completed sign-in lands.

  #

  # A reader who came from `/device` is halfway through authorizing a terminal,

  # not starting a session at the dashboard. `OpenAgentsWeb.UserAuth` remembers

  # the terminal's code when it bounces them here, and this returns them to the

  # approval with the code still in hand, so approving is the next click rather

  # than a fresh errand.

  #

  # The code is cast a second time on the way out. The session is signed, so

  # this is not defending against a forged cookie; it is keeping one rule —

  # only a value this application mints ever becomes part of a URL — true at

  # every place that builds one, rather than true here because it happened to

  # be checked somewhere else.

  #

  # Nothing writes the key back. It has done its work, and `clear_session/1`

  # above takes it with the rest.

  defp landing_path(code) do

    case DeviceAuthorizations.cast_user_code(code) do

      {:ok, code} -> ~p"/device?user_code=#{code}"

      :error -> ~p"/sarah"

    end

  end

  # A row created and updated in the same write is a first sign-in; anything

  # else reauthenticated an existing account.

  defp capture_sign_in(user) do

              <code class="text-2xl font-semibold tracking-widest">{@form[:user_code].value}</code>

            </div>

            <div>

              <p class="font-medium">Requested access</p>

              <%!-- Approving is a grant, and a grant with no named grantee is a

              reflex rather than a decision. The CLI is what this application

              knows is asking: it is the only client that mints a device

              authorization, and `DeviceAuthorizations.claim/3` names the token

              it walks away with "OpenAgents CLI". Which computer it is running

              on is not recorded, so this does not claim to say. --%>

              <p class="font-medium">The OpenAgents CLI is asking to act as you</p>

              <p class="mt-1 text-sm text-muted-foreground">

                Approving gives it these permissions, and no others:

              </p>

              <ul class="mt-2 space-y-1 text-sm text-muted-foreground">

                <li :for={scope <- @authorization.scopes} class="flex items-baseline gap-2">

                  <code>{scope}</code>

                only if you started this login yourself.

              </p>

              <p class="mt-3 text-sm text-muted-foreground">

                The CLI never receives your GitHub token.

                The CLI never receives your GitHub token. This request expires {expires_in(

                  @authorization

                )}; after that the terminal has to ask again.

              </p>

            </div>

            <div class="flex flex-wrap justify-end gap-3">

  defp code_form(user_code), do: to_form(%{"user_code" => user_code}, as: :device)

  # Rendered once at mount and not counted down. A ticking clock would make the

  # page a timer, and the window is ten minutes: what the reader needs is that

  # there is one, not the second it lands on.

  defp expires_in(%{expires_at: expires_at}) do

    case DateTime.diff(expires_at, DateTime.utc_now(), :second) do

      seconds when seconds <= 60 -> "in under a minute"

      seconds -> "in about #{div(seconds + 30, 60)} minutes"

    end

  end

  defp scope_description("forge:write"),

    do: "Create and manage repositories, issues, and pull requests as you."

  @changelog_limit 5

  @impl true

  def mount(_params, _session, socket) do

  def mount(params, _session, socket) do

    if socket.assigns[:current_user] do

      if connected?(socket), do: subscribe()

       |> assign(:changed_repositories, MapSet.new())

       |> assign_dashboard()}

    else

      {:ok, socket}

      {:ok, assign(socket, :device_user_code, device_user_code(params))}

    end

  end

  # A reader who arrives here from `/device` was sent by their terminal, not by

  # a link to a product. `OpenAgentsWeb.UserAuth` puts the terminal's code in

  # the URL on the way past so this page can say what the sign-in is for; the

  # session it also wrote is what actually returns them afterwards, so this

  # value decides what is rendered and nothing else.

  #

  # It is cast rather than read. The parameter is printed on the page, so

  # admitting only the shape this application mints is what keeps a crafted

  # link from putting its own words in OpenAgents's mouth.

  defp device_user_code(params) when is_map(params) do

    case OpenAgents.DeviceAuthorizations.cast_user_code(params["user_code"]) do

      {:ok, code} -> code

      :error -> nil

    end

  end

  defp device_user_code(_not_mounted_at_router), do: nil

  # Every panel here already had a publisher or has one now, so the dashboard

  # can stop being a snapshot of the moment it was opened. The messages carry

  # ids and nothing else: each panel re-reads through the same authorized read

    """

  end

  # A reader mid-way through authorizing a terminal is not here to be sold the

  # product; they are here because a sign-in stands between them and one

  # approval. Showing them the landing page would be the third screen in a row

  # that does not mention what they are actually doing, so this says it: the

  # terminal, its code, and where the sign-in puts them next.

  #

  # None of the sign-in controls need the code threaded through them. It is in

  # the session already, so the command bar's control returns the reader to the

  # approval exactly as this one does.

  def render(%{device_user_code: code} = assigns) when is_binary(code) do

    ~H"""

    <Layouts.app

      flash={@flash}

      sidebar_sections={assigns[:sidebar_sections]}

      current_scope={@current_scope}

    >

      <main id="device-sign-in" class="mx-auto w-full max-w-lg space-y-8 px-4 py-16">

        <.header>

          Sign in to authorize your terminal

          <:subtitle>

            Your terminal is waiting on this code. Signing in brings you straight back to

            the approval — you will not need to enter it again.

          </:subtitle>

        </.header>

        <.card>

          <div class="space-y-6">

            <div>

              <p class="text-sm text-muted-foreground">Code shown in your terminal</p>

              <code id="device-sign-in-code" class="text-2xl font-semibold tracking-widest">

                {@device_user_code}

              </code>

            </div>

            <p class="text-sm text-muted-foreground">

              Check that it matches before you approve. OpenAgents signs you in through GitHub;

              your GitHub token stays here and never reaches the terminal.

            </p>

            <.github_login id="device-signin" size={:lg} />

          </div>

        </.card>

      </main>

    </Layouts.app>

    """

  end

  def render(assigns) do

    ~H"""

    <Layouts.app

  import Plug.Conn

  alias OpenAgents.Accounts

  alias OpenAgents.DeviceAuthorizations

  @session_key "user_id"

  # Read back by `OpenAgentsWeb.AuthController.callback/2`. Both ends go

  # through `DeviceAuthorizations.cast_user_code/1`, so nothing but a code this

  # application mints ever reaches it or leaves it.

  @device_session_key "device_user_code"

  # The path is written out because a route pattern cannot be a `~p` sigil.

  # `OpenAgentsWeb.RouteAuthority` classifies the same literal.

  @device_path "/device"

  @doc "The session key carrying a device authorization across the sign-in."

  def device_session_key, do: @device_session_key

  def put_no_store(conn, _options), do: put_resp_header(conn, "cache-control", "no-store")

  def fetch_current_user(conn, _options) do

      do: conn

  def require_authenticated_user(conn, _options) do

    {conn, sign_in_path} = remember_device_authorization(conn)

    conn

    |> put_resp_header("cache-control", "no-store")

    |> Phoenix.Controller.redirect(to: ~p"/")

    |> Phoenix.Controller.redirect(to: sign_in_path)

    |> halt()

  end

  # `/device` is the one authenticated route a reader reaches before they have

  # a session here: a terminal sent them, and the code it printed is in the

  # link. Bouncing them to the public root and forgetting the code turns one

  # intent into two errands — sign in, then go and find the code again — which

  # is what issue #129 is about.

  #

  # So the code is remembered in the session on the way out.

  # `OpenAgentsWeb.AuthController.callback/2` reads it back after the OAuth

  # round trip and returns the reader to the approval with the code already in

  # hand, so approving is the next click. Carrying it in the session rather

  # than in the sign-in form means every sign-in control returns them —

  # the landing page's and the command bar's alike — instead of only the one

  # that was threaded with the code.

  #

  # It rides in the URL as well, but only so the landing page can say what the

  # sign-in is for. The session is the authority; the parameter is display.

  #

  # Only a code travels, never a path. `cast_user_code/1` admits exactly the

  # shape this application mints, so a crafted `?user_code=` carrying a host, a

  # path, a newline, or markup is refused here and the reader lands on the

  # public root exactly as they did before. This is the only place in the

  # sign-out path that builds a redirect from anything the browser sent, and it

  # builds one of two constants either way.

  defp remember_device_authorization(%{request_path: @device_path} = conn) do

    conn = Plug.Conn.fetch_query_params(conn)

    case DeviceAuthorizations.cast_user_code(conn.query_params["user_code"]) do

      {:ok, code} ->

        {put_session(conn, @device_session_key, code), ~p"/?user_code=#{code}"}

      # Reaching the device page without a usable code says the reader is not

      # mid-flow with the one we may have remembered earlier. Drop it rather

      # than let it decide where a later sign-in lands.

      :error ->

        {delete_session(conn, @device_session_key), ~p"/"}

    end

  end

  defp remember_device_authorization(conn), do: {conn, ~p"/"}

  def require_admin_user(conn, _options) do

    if Accounts.admin?(conn.assigns[:current_user]) do

      conn

defmodule OpenAgentsWeb.DeviceSignInReturnTest do

  @moduledoc """

  Issue #129: signing in from the terminal was two logins wearing one name.

  A reader who is not signed in and opens the link their terminal printed —

  `/device?user_code=…` — used to be bounced to the public root, where nothing

  said why they were there. Signing in put them on the dashboard, and the

  approval they had actually come for was an errand still to run, with the code

  back in the terminal they had left.

  This proves the return path: the bounce remembers the code, the sign-in

  carries it across the OAuth round trip, and the reader lands back on the

  approval with the code already in hand.

  The adversarial half matters as much as the working one. The value that

  decides where a sign-in lands arrives in a URL that anyone can write, and it

  is printed back onto a page. So the assertions here are not "a code survives"

  but "only a code survives": every crafted `?user_code=` must leave the reader

  exactly where the old behavior left them, on the public root with nothing

  remembered, and must never reach the session, the redirect, or the page.

  """

  use OpenAgentsWeb.ConnCase, async: false

  import Phoenix.LiveViewTest

  alias OpenAgents.DeviceAuthorizations

  alias OpenAgentsWeb.UserAuth

  setup {Req.Test, :verify_on_exit!}

  setup do

    original = Application.fetch_env!(:openagents, :github_oauth)

    Application.put_env(

      :openagents,

      :github_oauth,

      Keyword.put(original, :request_options, plug: {Req.Test, __MODULE__})

    )

    on_exit(fn -> Application.put_env(:openagents, :github_oauth, original) end)

    :ok

  end

  test "the sign-in a device code sends a reader through returns them to the approval", %{

    conn: conn

  } do

    {:ok, _authorization, _device_code, user_code} = DeviceAuthorizations.create()

    # 1. The terminal's link, opened by a browser with no session.

    bounced = get(conn, ~p"/device?user_code=#{user_code}")

    assert redirected_to(bounced) == "/?user_code=#{user_code}"

    assert get_session(bounced, UserAuth.device_session_key()) == user_code

    # 2. The page they land on says what the sign-in is for and shows the code,

    #    rather than presenting itself as a homepage.

    landing = bounced |> recycle() |> get(~p"/?user_code=#{user_code}")

    landing_html = html_response(landing, 200)

    assert landing_html =~ ~s(id="device-sign-in")

    assert landing_html =~ user_code

    assert landing_html =~ "authorize your terminal"

    # 3. One ordinary sign-in. Nothing about it names the device: the code

    #    rides in the session, so any sign-in control on the page returns them.

    started =

      landing

      |> recycle()

      |> put_req_header("x-csrf-token", Plug.CSRFProtection.get_csrf_token())

      |> post(~p"/auth/github?github_tools=enabled")

    state = oauth_state(started)

    expect_github(4_129, "device-return-person")

    authenticated =

      started

      |> recycle()

      |> get(~p"/auth/github/callback?code=valid-code&state=#{state}")

    # 4. The sign-in returns them to the approval, code in hand -- not to the

    #    dashboard with the errand still to run.

    assert redirected_to(authenticated) == "/device?user_code=#{user_code}"

    assert get_session(authenticated, "user_id")

    # The code has done its work and does not linger to redirect a later

    # sign-in somewhere the reader did not ask to go.

    assert get_session(authenticated, UserAuth.device_session_key()) == nil

    # 5. Approving is the next click. The code is already matched, so the

    #    review is on screen without anything being retyped.

    signed_in = recycle(authenticated)

    {:ok, view, _html} = live(signed_in, "/device?user_code=#{user_code}")

    assert has_element?(view, "#device-authorization-review")

    assert has_element?(view, "#approve-device")

    refute has_element?(view, "#device-code-invalid")

    view |> element("#approve-device") |> render_click()

    assert has_element?(view, "#device-approved")

  end

  test "a sign-in that did not start at the device page still lands on the dashboard", %{

    conn: conn

  } do

    started =

      conn

      |> init_test_session(%{})

      |> put_req_header("x-csrf-token", Plug.CSRFProtection.get_csrf_token())

      |> post(~p"/auth/github?github_tools=enabled")

    state = oauth_state(started)

    expect_github(4_130, "ordinary-sign-in-person")

    authenticated =

      started

      |> recycle()

      |> get(~p"/auth/github/callback?code=valid-code&state=#{state}")

    assert redirected_to(authenticated) == ~p"/sarah"

  end

  test "the device page without a code refuses exactly as it always did", %{conn: conn} do

    bounced = get(conn, ~p"/device")

    assert redirected_to(bounced) == "/"

    assert get_session(bounced, UserAuth.device_session_key()) == nil

  end

  # Everything a link can carry that is not a code this application minted. The

  # value is a redirect target and page content, so each one has to be refused

  # before it becomes either.

  #

  # `user_code[]` is here because a query string can produce a list rather than

  # a string, and a cast that only guarded binaries would raise on it.

  @crafted [

    {"an absolute URL", "https://evil.example/steal"},

    {"a scheme-relative URL", "//evil.example/steal"},

    {"a path traversal", "/../../admin"},

    {"another path on this host", "/settings/api-tokens"},

    {"markup", "<script>alert(1)</script>"},

    {"a quote breaking an attribute", ~s(ABCD-EFGH" onload=")},

    {"a header injection", "ABCD-EFGH\r\nSet-Cookie: user_id=1"},

    {"a second line", "ABCD-EFGH\nADCD-EFGH"},

    {"an appended query", "ABCD-EFGH?next=/admin"},

    {"an appended fragment", "ABCD-EFGH#/admin"},

    {"a code too long", "ABCD-EFGHJ"},

    {"a code too short", "ABC-EFGH"},

    {"the wrong separator", "ABCD_EFGH"},

    {"no separator", "ABCDEFGH"},

    {"characters the alphabet excludes", "IOL1-0OI1"},

    {"an empty value", ""},

    {"only whitespace", "   "},

    {"a list rather than a string", ["ABCD-EFGH"]}

  ]

  for {what, crafted} <- @crafted do

    test "a crafted user_code -- #{what} -- carries nothing across the sign-in", %{conn: conn} do

      crafted = unquote(Macro.escape(crafted))

      bounced = get(conn, device_path(crafted))

      assert redirected_to(bounced) == "/",

             "`#{inspect(crafted)}` decided where the reader went."

      assert get_session(bounced, UserAuth.device_session_key()) == nil,

             "`#{inspect(crafted)}` was remembered across the sign-in."

      # And it cannot get in the back way either: even carried all the way to a

      # completed sign-in, it does not become a landing path.

      started =

        bounced

        |> recycle()

        |> put_req_header("x-csrf-token", Plug.CSRFProtection.get_csrf_token())

        |> post(~p"/auth/github?github_tools=enabled")

      state = oauth_state(started)

      expect_github(4_131, "crafted-code-person")

      authenticated =

        started

        |> recycle()

        |> get(~p"/auth/github/callback?code=valid-code&state=#{state}")

      assert redirected_to(authenticated) == ~p"/sarah"

    end

  end

  # The bounce and the landing both go through `cast_user_code/1`, so this pins

  # what it admits directly rather than only through the routes that use it.

  test "only the shape this application mints casts" do

    {:ok, _authorization, _device_code, minted} = DeviceAuthorizations.create()

    assert DeviceAuthorizations.cast_user_code(minted) == {:ok, minted}

    # A code read off one screen and typed into another arrives however the

    # reader typed it.

    assert DeviceAuthorizations.cast_user_code(String.downcase(minted)) == {:ok, minted}

    assert DeviceAuthorizations.cast_user_code("  " <> minted <> "  ") == {:ok, minted}

    for {_what, crafted} <- @crafted do

      assert DeviceAuthorizations.cast_user_code(crafted) == :error,

             "`#{inspect(crafted)}` cast as a user code."

    end

    assert DeviceAuthorizations.cast_user_code(nil) == :error

    assert DeviceAuthorizations.cast_user_code(%{"user_code" => "ABCD-EFGH"}) == :error

  end

  # Built by hand rather than with `~p`, because half the point is that these

  # are query strings a verified route would refuse to construct. Percent

  # encoding is what a browser does, and Plug decodes it back before anything

  # here sees it, so `%0D%0A` reaches the cast as a real CRLF.

  defp device_path(crafted) when is_list(crafted),

    do: "/device?" <> URI.encode_query(Enum.map(crafted, &{"user_code[]", &1}))

  defp device_path(crafted), do: "/device?" <> URI.encode_query(%{"user_code" => crafted})

  defp oauth_state(conn) do

    conn

    |> redirected_to()

    |> URI.parse()

    |> Map.fetch!(:query)

    |> URI.decode_query()

    |> Map.fetch!("state")

  end

  defp expect_github(github_id, login) do

    Req.Test.expect(__MODULE__, fn conn ->

      Req.Test.json(conn, %{

        "access_token" => "ephemeral-github-token",

        "scope" => "repo,read:org"

      })

    end)

    Req.Test.expect(__MODULE__, fn conn ->

      Req.Test.json(conn, %{

        "id" => github_id,

        "login" => login,

        "avatar_url" => "https://avatars.githubusercontent.com/u/#{github_id}?v=4"

      })

    end)

  end

end

    refute has_element?(view, "#device-authorization-review")

  end

  # Still a refusal: no session, no approval, and the code alone grants nothing.

  # What changed with issue #129 is where the refusal sends them. It used to be

  # the bare public root, which forgot why they were there; it is now the

  # sign-in that returns them here with the code still in hand.

  # `OpenAgentsWeb.DeviceSignInReturnTest` proves the whole round trip.

  test "a signed-out browser cannot approve a device code", %{conn: conn} do

    {:ok, _authorization, _device_code, user_code} = OpenAgents.DeviceAuthorizations.create()

    assert {:error, {:redirect, %{to: "/"}}} = live(conn, ~p"/device?user_code=#{user_code}")

    assert {:error, {:redirect, %{to: "/?user_code=" <> ^user_code}}} =

             live(conn, ~p"/device?user_code=#{user_code}")

  end

end