[DJTJ21]

Why

First piece of the idem CLI (repo Idem-AI/cli): idem login opens the browser and shows a code; the developer approves on iDeploy, without copying a token. This is the device flow used by the Railway, Vercel and GitHub CLIs.

API

Route	Auth	Role
POST /api/v1/cli/auth/start { host }	public	Returns deviceCode (secret, 64 hex), userCode (ABCD-EFGH, no look-alike characters), verificationUrl, expiresIn 600, interval 3
GET /api/v1/cli/auth/requests/:code	session	The request: machine, status
POST /api/v1/cli/auth/requests/:code { approve }	session	Approve (issues a PAT "CLI — ", valid one year) or refuse
POST /api/v1/cli/auth/poll { device_code }	public	pending / approved + token (handed over once, then deleted) / denied / expired

• The requests live in Redis (10 min TTL). Nothing is written to the database before approval.
• The router is mounted before the routers on /api/v1 that authenticate everything (like the webhooks). Otherwise start and poll would answer 401.

Web

• /cli/authorize?code=… page:
  • says which machine is asking;
  • asks to check that the code matches the terminal;
  • shows Authorise / Refuse;
  • warns to approve only a request you started yourself.
• authGuard: the page a signed-out visitor asked for is kept and opened after the console login, which only came back to the root. The kept URL is only a path of the app, used once.
• i18n fr/en.

Tests

Unit tests: code format, reading a typed code back, cleaning the machine name.