feat: Add support for OAuth2 device auth flow

src/api/client/oauth/device.rs

@@ -0,0 +1,13 @@
+use axum::{Form, Json, extract::State, response::IntoResponse};
+use http::StatusCode;
+use service::oauth::grant::DeviceCodeRequest;
+
+pub(crate) async fn device_authorization_route(
+	State(services): State<crate::State>,
+	Form(request): Form<DeviceCodeRequest>,
+) -> impl IntoResponse {
+	match services.oauth.request_device_code(request).await {
+		| Ok(response) => Ok(Json(response)),
+		| Err(err) => Err((StatusCode::BAD_REQUEST, Json(err))),
+	}
+}

src/api/client/oauth/mod.rs

@@ -10,6 +10,7 @@ use http::StatusCode;
 use serde_json::json;
 pub(crate) use server_metadata::*;
 
+mod device;
 mod register_client;
 mod server_metadata;
 mod token;
@@ -20,6 +21,7 @@ const JWKS_URI_PATH: &str = "client/keys.json";
 const CLIENT_REGISTER_PATH: &str = "client/register";
 const TOKEN_REVOKE_PATH: &str = "client/revoke";
 const TOKEN_PATH: &str = "grant/token";
+const DEVICE_AUTHORIZATION_PATH: &str = "device";
 const ACCOUNT_MANAGEMENT_PATH: &str = concat!(conduwuit_core::ROUTE_PREFIX, "/account/deeplink");
 
 pub(crate) fn router(state: crate::State) -> Router<crate::State> {
@@ -53,4 +55,5 @@ fn oauth_router() -> Router<crate::State> {
 		.route(concat!("/", JWKS_URI_PATH), get(async || Json(json!({"keys": []}))))
 		.route(concat!("/", TOKEN_PATH), post(token::token_route))
 		.route(concat!("/", TOKEN_REVOKE_PATH), post(token::revoke_token_route))
+		.route(concat!("/", DEVICE_AUTHORIZATION_PATH), post(device::device_authorization_route))
 }

src/api/client/oauth/server_metadata.rs

@@ -12,8 +12,8 @@ use service::Services;
 use crate::{
 	Ruma,
 	client::oauth::{
-		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, JWKS_URI_PATH, TOKEN_PATH,
-		TOKEN_REVOKE_PATH,
+		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, DEVICE_AUTHORIZATION_PATH,
+		JWKS_URI_PATH, TOKEN_PATH, TOKEN_REVOKE_PATH,
 	},
 };
 
@@ -60,7 +60,8 @@ pub(crate) async fn authorization_server_metadata(services: &Services) -> Value
 		],
 		"authorization_endpoint": endpoint_base.join(AUTH_CODE_PATH).unwrap(),
 		"code_challenge_methods_supported": ["S256"],
-		"grant_types_supported": ["authorization_code", "refresh_token"],
+		"device_authorization_endpoint": endpoint_base.join(DEVICE_AUTHORIZATION_PATH).unwrap(),
+		"grant_types_supported": ["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"],
 		"issuer": services.config.get_client_domain(),
 		"jwks_uri": endpoint_base.join(JWKS_URI_PATH).unwrap(),
 		"prompt_values_supported": prompt_values_supported,