Function createDeviceAuthRequest

apps/web/src/lib/device-auth/device-auth.ts:29–69

(params: {
  userAgent?: string;
  ipAddress?: string;
})

 */
export function generateUserCode(): string {
  const chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
  let code = '';
  for (let i = 0; i < CODE_LENGTH; i++) {
    code += chars.charAt(randomInt(chars.length));
  }
  // Format as XXXX-XXXX (8 characters total)
  return `${code.slice(0, 4)}-${code.slice(4)}`;
}

/** @deprecated — ponytail: remove after all shipped clients migrate to userCode/deviceCode split */
export const generateDeviceCode = generateUserCode;

/**
 * Generate a high-entropy device secret for polling.
 * 256-bit random value encoded as base64url.
 */
export function generateDeviceSecret(): string {
  return randomBytes(32).toString('base64url');
}

/**
 * Hash a device secret with SHA-256.
 * The secret is already high-entropy, so a plain digest is sufficient.
 */
export function hashDeviceSecret(secret: string): string {
  return createHash('sha256').update(secret).digest('hex');
}

/**
 * Create a new device authorization request.
 * Writes both the legacy code and new user_code/device_code_hash.
 */
export async function createDeviceAuthRequest(params: {
  userAgent?: string;
  ipAddress?: string;
}): Promise<{ code: string; userCode: string; deviceCode: string; expiresAt: Date }> {
  const { userAgent, ipAddress } = params;

  // Validate IP address on Production
  if (process.env['NODE_ENV'] === 'production' && !ipAddress) {
    throw new Error('IP address is required in production');
  }

  // Rate limiting: check pending requests from this IP