Function pollForDeviceTokens

apps/cli/src/device-login.ts:220–280

(
  discovery: CliLoginDiscovery,
  grant: DeviceCodeGrant,
  options: { readonly now?: () => number } = {},
)

 * `access_denied` / `expired_token` are terminal).
 */
export const pollForDeviceTokens = async (
  discovery: CliLoginDiscovery,
  grant: DeviceCodeGrant,
  options: { readonly now?: () => number } = {},
): Promise<DeviceTokens> => {
  const now = options.now ?? (() => Date.now());
  const deadline = now() + grant.expiresInSeconds * 1000;
  let intervalMs = Math.max(1, grant.intervalSeconds) * 1000;

  for (;;) {
    if (now() >= deadline) {
      throw new DeviceLoginError("Login timed out before it was approved.");
    }
    await sleep(intervalMs);

    const response = await post(
      discovery.tokenEndpoint,
      {
        grant_type: DEVICE_CODE_GRANT_TYPE,
        device_code: grant.deviceCode,
        client_id: discovery.clientId,
      },
      discovery.requestFormat,
    );
    const body = await readJson(response);

    if (response.ok) {
      const accessToken = asString(body.access_token);
      if (!accessToken) {
        throw new DeviceLoginError("Token response was missing an access token.");
      }
      const claims = decodeAccessTokenClaims(accessToken);
      return {
        accessToken,
        refreshToken: asString(body.refresh_token),
        expiresAt: deriveExpiresAt({ accessToken, expiresIn: asNumber(body.expires_in) }),
        email:
          readUserEmail(body) ?? (typeof claims?.email === "string" ? claims.email : undefined),
        organizationId:
          asString(body.organization_id) ??
          (typeof claims?.org_id === "string" ? claims.org_id : undefined),
      };
    }

    const error = asString(body.error);
    if (error === "authorization_pending") continue;
    if (error === "slow_down") {
      intervalMs += 5000;
      continue;
    }
    if (error === "access_denied") {
      throw new DeviceLoginError("Login was denied.");
    }
    if (error === "expired_token") {
      throw new DeviceLoginError("The login request expired before it was approved.");
    }
    throw new DeviceLoginError(
      `Login failed: ${asString(body.error_description) ?? error ?? `HTTP ${response.status}`}`,