Function deviceCodeLogin

src/auth/oauth.ts:35–114

(region: Region)

 * user code, and polls /oauth2/token until the user approves.
 */
export async function deviceCodeLogin(region: Region): Promise<OAuthCredentials> {
  const host = OAUTH_HOSTS[region];

  const { randomBytes, createHash } = await import('crypto');
  const codeVerifier = randomBytes(32).toString('base64url');
  const codeChallenge = createHash('sha256').update(codeVerifier).digest('base64url');
  const state = randomBytes(16).toString('base64url');

  const codeRes = await fetch(`${host}/oauth2/device/code`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      client_id: CLIENT_ID,
      scope: SCOPES.join(' '),
      code_challenge: codeChallenge,
      code_challenge_method: 'S256',
      state,
    }),
  });

  if (!codeRes.ok) {
    const body = await codeRes.text().catch(() => '');
    throw new CLIError(
      `Failed to start device-code flow (HTTP ${codeRes.status}).`,
      ExitCode.AUTH,
      body || `URL: ${host}/oauth2/device/code`,
    );
  }

  const data = (await codeRes.json()) as DeviceCodeResponse;
  if (data.state !== state) {
    throw new CLIError('OAuth state mismatch.', ExitCode.AUTH);
  }

  openBrowser(data.verification_uri);
  process.stderr.write(`\nOpened: ${data.verification_uri}\n`);
  process.stderr.write(`Code:   ${data.user_code}\n`);
  process.stderr.write(`Client: ${CLIENT_NAME}\n`);
  process.stderr.write('Waiting for authorization...\n');

  const deadline = data.expired_in;
  const intervalMs = data.interval || 3000;

  while (Date.now() < deadline) {
    await sleep(intervalMs);

    const tokRes = await fetch(`${host}/oauth2/token`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams({
        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
        client_id: CLIENT_ID,
        user_code: data.user_code,
        code_verifier: codeVerifier,
      }),
    });

    if (!tokRes.ok) {