Skip to main content

device_authorization

headless_lms_server::controllers::main_frontend::oauth::device

Function device_authorization 

Source 
pub async fn device_authorization(
    pool: Data<PgPool>,
    form: Form<DeviceAuthorizationForm>,
    app_conf: Data<ApplicationConfiguration>,
) -> ControllerResult<HttpResponse>
Expand description

Handles POST /device_authorization — the RFC 8628 device authorization endpoint.

Public, form-encoded, no session required (rate-limited like /token). Validates the client, checks it is allowed the device-code grant, validates requested scopes against the client’s registered scopes, then issues an opaque device_code (stored only as an HMAC digest) plus a human-typable user_code.

Follows RFC 8628 §3.1–§3.2.

§Example

POST /api/v0/main-frontend/oauth/device_authorization HTTP/1.1
Content-Type: application/x-www-form-urlencoded

client_id=tmc-vscode&scope=exercise-services

Successful response:

HTTP/1.1 200 OK
Content-Type: application/json

{
  "device_code": "GmRhmhcxhwAzkoEqiMEg_DnyEysNkuNhszIySk9eS",
  "user_code": "WDJB-MJHT",
  "verification_uri": "https://courses.mooc.fi/oauth_device",
  "verification_uri_complete": "https://courses.mooc.fi/oauth_device?user_code=WDJB-MJHT",
  "expires_in": 900,
  "interval": 5
}