class UserApiKey::DeviceAuth
  DEVICE_AUTH_TTL = 10.minutes
  DEVICE_AUTH_INTERVAL = 5
  DEVICE_AUTHORIZED_PAYLOAD_TTL = 1.minute
  DEVICE_CODE_REDIS_PREFIX = "user_api_key:device:".freeze
  DEVICE_USER_CODE_REDIS_PREFIX = "user_api_key:device:code:".freeze
  DEVICE_REQUEST_REDIS_PREFIX = "user_api_key:device:request:".freeze
  DEVICE_AUTHORIZATION_LOCK_REDIS_PREFIX = "user_api_key:device:lock:".freeze
  USER_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789".freeze
  DEVICE_CODE_REGEX = /\A\h{64}\z/
  DEVICE_REQUEST_TOKEN_REGEX = /\A[-_A-Za-z0-9]{8}\z/
end

class AddExpiresAtToUserApiKeys < ActiveRecord::Migration[8.0]
  def change
    add_column :user_api_keys, :expires_at, :datetime
  end
end

scope :active,
  -> { where(revoked_at: nil).where("expires_at IS NULL OR expires_at > ?", Time.zone.now) }

def expired?
  expires_at.present? && expires_at <= Time.zone.now
end

bin/rake user_api_key:device_auth \
  SITE=http://localhost:3000 \
  SCOPES=read,write \
  EXPIRES_IN=1d

# Prints verification URL + user code, polls /device/poll.json,
# decrypts payload with generated RSA private key, verifies nonce,
# optionally checks /session/current.json using the returned key.

diff --git a/app/controllers/user_api_keys_controller.rb b/app/controllers/user_api_keys_controller.rb
@@ class UserApiKeysController < ApplicationController
-  layout "no_ember"
-  requires_login only: %i[create create_otp revoke undo_revoke]
+  requires_login only: %i[create create_otp revoke undo_revoke authorize_device_request deny_device_request]
+  skip_before_action :verify_authenticity_token, only: %i[create_device_request poll_device_request]
+  before_action :set_device_auth_no_store, only: %i[new otp create create_otp create_device_request poll_device_request activate authorize_device_request deny_device_request]

@@ def new
-      head :ok, auth_api_version: AUTH_API_VERSION
+      head :ok, auth_api_version: AUTH_API_VERSION, auth_api_device_code: "true"

@@ added endpoint
+  def create_device_request
+    ensure_json_request!
+    rate_limit_device_request_creation
+    UserApiKey::DeviceAuth::CreateRequest.call(service_params) do
+      on_success do |device_request:|
+        render json: { device_code:, user_code:, verification_uri:, expires_in:, interval: }
+      end
+    end
+  end