mirror of
https://github.com/discourse/discourse.git
synced 2026-08-12 03:37:13 +08:00
5458a5f150Adds an OAuth-style device authorization flow for user API keys so applications that can't open a browser (CLIs, headless tools, IoT clients) can request a key by displaying a short user-facing code. The client POSTs to `/user-api-key/device` to obtain a device code, a user code, and a verification URL. The user visits the URL, authenticates, confirms the application and scopes, and either approves or denies the request. Meanwhile the client polls `/user-api-key/device/poll` until it receives the encrypted key payload, a denial, or expiry. The flow is implemented as a `UserApiKey::DeviceAuth` namespace of service objects (`CreateRequest`, `Authorize`, `Deny`, `Poll`, `Store`, `Crypto`, `ApprovalTokenStore`, `GrantPresenter`). Pending grants live in Redis with a short TTL and are rate limited per IP and per user code. Encrypted payload generation is shared with the existing redirect-based flow. Also adds first-class expiration for user API keys: - New `expires_at` column on `user_api_keys`. - New `max_user_api_key_expiry_days` site setting (default 365). - Clients can request a key lifetime via `expires_in_seconds`, which is surfaced to the user on the authorization screen and serialized back to the client. - A `user_api_key` rake task for listing, inspecting, expiring, and revoking keys from the console. --------- Co-authored-by: Penar Musaraj <pmusaraj@gmail.com> |
||
|---|---|---|
| .. | ||
| add_topic_to_quotes.rake | ||
| admin.rake | ||
| annotate.rake | ||
| annotate_rb.rake | ||
| api.rake | ||
| api_docs.rake | ||
| assets.rake | ||
| autospec.rake | ||
| avatars.rake | ||
| backfill.thor | ||
| categories.rake | ||
| cdn.rake | ||
| compatibility.rake | ||
| db.rake | ||
| db_structure.rake | ||
| destroy.rake | ||
| dev.rake | ||
| docker.rake | ||
| documentation.rake | ||
| emails.rake | ||
| export.rake | ||
| groups.rake | ||
| hashtags.rake | ||
| i18n.rake | ||
| images.rake | ||
| import.rake | ||
| incoming_emails.rake | ||
| javascript.rake | ||
| list_email_templates_strings.rake | ||
| log.rake | ||
| maxminddb.rake | ||
| migrate_advanced_search_banner_to_welcome_banner.rake | ||
| migrate_discourse_gifs_to_core.rake | ||
| plugin.rake | ||
| populate.rake | ||
| populate.thor | ||
| posts.rake | ||
| profile.rake | ||
| qunit.rake | ||
| redis.rake | ||
| release.rake | ||
| release_note.rake | ||
| reviewables.rake | ||
| revisions.rake | ||
| rspec.rake | ||
| s3.rake | ||
| scheduler.rake | ||
| search.rake | ||
| site.rake | ||
| site_settings.rake | ||
| smoke_test.rake | ||
| svg_icons.rake | ||
| svg_sprites.rake | ||
| tags.rake | ||
| themes.rake | ||
| topic_localizations.rake | ||
| topics.rake | ||
| turbo.rake | ||
| typepad.thor | ||
| uploads.rake | ||
| user_api_key.rake | ||
| users.rake | ||
