Device authentication

// Runs in Node 20+ and modern browsers (global fetch + WebCrypto).
const BASE = "https://abyrgverslun.is";
const CLIENT_ID = "abyrg_device";

// --- base64url helpers -------------------------------------------------
const enc = new TextEncoder();
function b64url(bytes) {
  let s = "";
  for (const b of new Uint8Array(bytes)) s += String.fromCharCode(b);
  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
}
const b64urlJson = (obj) => b64url(enc.encode(JSON.stringify(obj)));

// --- 1. The device's key pair -------------------------------------------
// Create it once and keep it for the life of the device link: the device
// code, the refresh token and every access token are bound to this key.
// (Persist it in secure storage; a browser can keep a non-extractable
// CryptoKey in IndexedDB.)
const keyPair = await crypto.subtle.generateKey(
  { name: "ECDSA", namedCurve: "P-256" },
  false, // private key not extractable; the public key always is
  ["sign", "verify"],
);
const { kty, crv, x, y } = await crypto.subtle.exportKey("jwk", keyPair.publicKey);
const publicJwk = { kty, crv, x, y };

// --- 2. A DPoP proof: a fresh one for every request ----------------------
async function dpopProof(htm, url, accessToken) {
  const u = new URL(url);
  const payload = {
    jti: crypto.randomUUID(),            // unique per proof; reuse is rejected
    htm,                                  // HTTP method, upper case
    htu: u.origin + u.pathname,           // no query string or fragment
    iat: Math.floor(Date.now() / 1000),   // seconds; must be within 60 s of server time
  };
  if (accessToken) {
    // ath = base64url(SHA-256(access token)), on resource calls
    payload.ath = b64url(await crypto.subtle.digest("SHA-256", enc.encode(accessToken)));
  }
  const header = { typ: "dpop+jwt", alg: "ES256", jwk: publicJwk };
  const input = b64urlJson(header) + "." + b64urlJson(payload);
  // WebCrypto returns the raw 64-byte r||s signature that ES256 expects.
  const sig = await crypto.subtle.sign(
    { name: "ECDSA", hash: "SHA-256" },
    keyPair.privateKey,
    enc.encode(input),
  );
  return input + "." + b64url(sig);
}

// --- 3. Start the device flow -------------------------------------------
async function startDeviceAuthorization() {
  const url = BASE + "/api/oauth/device_authorization";
  const res = await fetch(url, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      DPoP: await dpopProof("POST", url),
    },
    body: JSON.stringify({
      client_id: CLIENT_ID,
      device_id: "till-01",          // optional: your own hardware id
      device_name: "Till 1, Laugavegur", // optional: default name shown to the admin
    }),
  });
  const body = await res.json();
  if (!res.ok) throw new Error(body.error + ": " + (body.error_description ?? ""));
  return body; // { device_code, user_code, verification_uri, verification_uri_complete, expires_in, interval }
}

// --- 4. Token endpoint helper (form-encoded, with a DPoP proof) --------
async function tokenRequest(params) {
  const url = BASE + "/api/oauth/token";
  const res = await fetch(url, {
    method: "POST",
    headers: {
      "Content-Type": "application/x-www-form-urlencoded",
      DPoP: await dpopProof("POST", url),
    },
    body: new URLSearchParams(params),
  });
  return { ok: res.ok, status: res.status, body: await res.json() };
}

const sleep = (ms) => new Promise((r) => setTimeout(r, ms));

// --- 5. Poll until an admin approves ------------------------------------
async function pollForTokens(auth) {
  const deadline = Date.now() + auth.expires_in * 1000;
  let interval = auth.interval;
  while (Date.now() < deadline) {
    await sleep(interval * 1000);
    const { ok, body } = await tokenRequest({
      grant_type: "urn:ietf:params:oauth:grant-type:device_code",
      device_code: auth.device_code,
      client_id: CLIENT_ID,
    });
    if (ok) return body; // { access_token, token_type: "DPoP", expires_in, refresh_token, scope }
    if (body.error === "authorization_pending") {
      interval = body.interval ?? interval;
      continue;
    }
    throw new Error(body.error); // expired_token, access_denied, invalid_grant, ...
  }
  throw new Error("expired_token");
}

// --- 6. Refresh (rotates the refresh token) -----------------------------
let tokens;
async function refresh() {
  const { ok, body } = await tokenRequest({
    grant_type: "refresh_token",
    refresh_token: tokens.refresh_token,
  });
  if (!ok) throw new Error(body.error); // invalid_grant: link the device again
  tokens = body; // store the NEW refresh_token right away; the old one is dead
}

// --- 7. Call the API -----------------------------------------------------
async function api(method, path, json, retried = false) {
  const url = BASE + path;
  const res = await fetch(url, {
    method,
    headers: {
      Authorization: "DPoP " + tokens.access_token,
      DPoP: await dpopProof(method, url, tokens.access_token),
      ...(json ? { "Content-Type": "application/json" } : {}),
    },
    body: json ? JSON.stringify(json) : undefined,
  });
  if (res.status === 401 && !retried) {
    await refresh(); // access tokens last 5 minutes
    return api(method, path, json, true);
  }
  return { status: res.status, body: await res.json() };
}

// --- Putting it together ------------------------------------------------
const auth = await startDeviceAuthorization();
console.log("On the dashboard, enter", auth.user_code);
console.log("or open", auth.verification_uri_complete);
tokens = await pollForTokens(auth);

const me = await api("GET", "/api/v1/devices/me");
console.log("Linked as", me.body.data.name, me.body.data.id);

const verification = await api("POST", "/api/v1/verifications", {
  method: "pass",
  passData: "2QWPSZMFXGAGCH1NAJB0RMH298XB106N5E2D7WTW5M2H4XEHYZZ4H",
  requiredAge: 18,
});
console.log(verification.body); // { result: "pass" | "fail", transactionId, reason? }