feat: add Device Auth Tokens tab to User Preferences

packages/common/src/dto/api/index.ts

@@ -73,6 +73,29 @@ export type NewSshKey = Omit<SshKey, 'creationTimestamp'> & {
   key: string;
 };
 
+export type DeviceAuthToken = {
+  name: string;
+  provider?: string;
+  /** ISO 8601 timestamp string as returned by Kubernetes and serialized by Fastify */
+  creationTimestamp?: string;
+  /** Token validity from a separate validate call. 'unknown' means check could not complete. */
+  valid?: 'valid' | 'invalid' | 'unknown';
+};
+
+export type DeviceCodeResponse = {
+  deviceCode: string;
+  userCode: string;
+  verificationUri: string;
+  interval: number;
+};
+
+export type DeviceAuthPollResult =
+  | { status: 'pending' }
+  | { status: 'slow_down' }
+  | { status: 'authorized'; token: DeviceAuthToken }
+  | { status: 'expired' }
+  | { status: 'error'; message: string };
+
 export interface IPatch {
   op: string;
   path: string;

packages/common/src/dto/cluster-config.ts

@@ -28,4 +28,5 @@ export interface ClusterConfig {
   allWorkspacesLimit: number;
   runningWorkspacesLimit: number;
   currentArchitecture?: Architecture;
+  githubDeviceAuthEnabled: boolean;
 }

packages/dashboard-backend/src/app.ts

@@ -29,6 +29,7 @@ import { registerBackupRoutes } from '@/routes/api/backup';
 import { registerClusterConfigRoute } from '@/routes/api/clusterConfig';
 import { registerClusterInfoRoute } from '@/routes/api/clusterInfo';
 import { registerDataResolverRoute } from '@/routes/api/dataResolver';
+import { registerDeviceAuthTokenRoutes } from '@/routes/api/deviceAuthToken';
 import { registerDevWorkspaceClusterRoutes } from '@/routes/api/devworkspaceCluster';
 import { registerDevworkspaceResourcesRoute } from '@/routes/api/devworkspaceResources';
 import { registerDevworkspacesRoutes } from '@/routes/api/devworkspaces';
@@ -149,5 +150,7 @@ export default async function buildApp(server: FastifyInstance): Promise<unknown
     registerAiConfigRoutes(server),
 
     registerAiRegistryRoute(isLocalRun(), server),
+
+    registerDeviceAuthTokenRoutes(server),
   ]);
 }

packages/dashboard-backend/src/constants/schemas.ts

@@ -298,6 +298,50 @@ export const aiProviderKeyParamsSchema: JSONSchema7 = {
   required: ['namespace', 'toolId'],
 };
 
+export const deviceAuthTokenParamsSchema: JSONSchema7 = {
+  type: 'object',
+  properties: {
+    namespace: {
+      type: 'string',
+    },
+    tokenName: {
+      type: 'string',
+      pattern: '^[a-z0-9]([a-z0-9.-]*[a-z0-9])?$',
+      maxLength: 253,
+    },
+  },
+  required: ['namespace', 'tokenName'],
+};
+
+export const deviceAuthPollBodySchema: JSONSchema7 = {
+  type: 'object',
+  required: ['deviceCode'],
+  properties: {
+    deviceCode: { type: 'string', minLength: 1, maxLength: 100, pattern: '^[a-zA-Z0-9_-]+$' },
+  },
+};
+
+export const deviceAuthTokenResponseSchema = {
+  type: 'array',
+  items: {
+    type: 'object',
+    properties: {
+      name: { type: 'string' },
+      provider: { type: 'string' },
+      creationTimestamp: { type: 'string' },
+    },
+    required: ['name'],
+  },
+};
+
+export const deviceAuthValidateResponseSchema = {
+  type: 'object',
+  properties: {
+    valid: { type: 'string', enum: ['valid', 'invalid', 'unknown'] },
+  },
+  required: ['valid'],
+};
+
 // namespaced schemas
 
 export const namespacedSchema: JSONSchema7 = {

packages/dashboard-backend/src/devworkspaceClient/__mocks__/index.ts

@@ -14,6 +14,7 @@ import {
   IAiProviderKeyApi,
   IAiRegistryApi,
   IAirGapSampleApi,
+  IDeviceAuthTokenApi,
   IDevWorkspaceApi,
   IDevWorkspaceClusterApi,
   IDevWorkspaceSingletonClient,
@@ -93,6 +94,10 @@ export class DevWorkspaceClient implements IDevWorkspaceClient {
     throw new Error('Method not implemented.');
   }
 
+  get deviceAuthTokenApi(): IDeviceAuthTokenApi {
+    throw new Error('Method not implemented.');
+  }
+
   get sccPermissionApi(): ISccPermissionApi {
     throw new Error('Method not implemented.');
   }

packages/dashboard-backend/src/devworkspaceClient/index.ts

@@ -15,6 +15,7 @@ import * as k8s from '@kubernetes/client-node';
 import { AiProviderKeyApiService } from '@/devworkspaceClient/services/aiProviderKeyApi';
 import { AiRegistryApiService } from '@/devworkspaceClient/services/aiRegistryApi';
 import { AirGapSampleApiService } from '@/devworkspaceClient/services/airGapSampleApi';
+import { GitHubDeviceAuthTokenApiService } from '@/devworkspaceClient/services/deviceAuthTokenApi';
 import { DevWorkspaceApiService } from '@/devworkspaceClient/services/devWorkspaceApi';
 import { DevWorkspaceClusterApiService } from '@/devworkspaceClient/services/devWorkspaceClusterApiService';
 import { DevWorkspaceTemplateApiService } from '@/devworkspaceClient/services/devWorkspaceTemplateApi';
@@ -36,6 +37,7 @@ import {
   IAiProviderKeyApi,
   IAiRegistryApi,
   IAirGapSampleApi,
+  IDeviceAuthTokenApi,
   IDevWorkspaceApi,
   IDevWorkspaceClient,
   IDevWorkspaceClusterApi,
@@ -141,6 +143,12 @@ export class DevWorkspaceClient implements IDevWorkspaceClient {
     return new AiRegistryApiService(this.kubeConfig);
   }
 
+  private _deviceAuthTokenApi: IDeviceAuthTokenApi | undefined;
+
+  get deviceAuthTokenApi(): IDeviceAuthTokenApi {
+    return (this._deviceAuthTokenApi ??= new GitHubDeviceAuthTokenApiService(this.kubeConfig));
+  }
+
   get sccPermissionApi(): ISccPermissionApi {
     return new SccPermissionApiService(this.kubeConfig);
   }