feat: implement RFC 8628

.schema/config.schema.json

@@ -464,6 +464,11 @@
               "description": "Sets the session cookie name. Use with care!",
               "type": "object",
               "properties": {
+                "device_csrf": {
+                  "type": "string",
+                  "title": "CSRF Cookie Name",
+                  "default": "ory_hydra_device_csrf"
+                },
                 "login_csrf": {
                   "type": "string",
                   "title": "CSRF Cookie Name",
@@ -614,6 +619,14 @@
                 "https://my-service.com/oauth2/auth"
               ]
             },
+            "device_authorization_url": {
+              "type": "string",
+              "description": "Overwrites the OAuth2 Device Auth URL",
+              "format": "uri-reference",
+              "examples": [
+                "https://my-service.com/oauth2/device/auth"
+              ]
+            },
             "client_registration_url": {
               "description": "Sets the OpenID Connect Dynamic Client Registration Endpoint",
               "type": "string",
@@ -803,6 +816,30 @@
             "/ui/logout"
           ]
         },
+        "device": {
+          "type": "object",
+          "description": "Configure URLs for the OAuth 2.0 Device Code Flow.",
+          "properties": {
+            "verification": {
+              "type": "string",
+              "description": "Sets the device user code verification endpoint. Defaults to an internal fallback URL showing an error.",
+              "format": "uri-reference",
+              "examples": [
+                "https://my-logout.app/device_verification",
+                "/ui/device_verification"
+              ]
+            },
+            "success": {
+              "type": "string",
+              "description": "Sets the post device authentication endpoint. Defaults to an internal fallback URL showing an error.",
+              "format": "uri-reference",
+              "examples": [
+                "https://my-logout.app/device_done",
+                "/ui/device_done"
+              ]
+            }
+          }
+        },
         "error": {
           "type": "string",
           "description": "Sets the error endpoint. The error ui will be shown when an OAuth2 error occurs that which can not be sent back to the client. Defaults to an internal fallback URL showing an error.",
@@ -947,6 +984,15 @@
               "$ref": "#/definitions/duration"
             }
           ]
+        },
+        "device_user_code": {
+          "description": "Configures how long device & user codes are valid.",
+          "default": "10m",
+          "allOf": [
+            {
+              "$ref": "#/definitions/duration"
+            }
+          ]
         }
       }
     },
@@ -1124,6 +1170,28 @@
             }
           ]
         },
+        "device_authorization": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "token_polling_interval": {
+              "allOf": [
+                {
+                  "$ref": "#/definitions/duration"
+                }
+              ],
+              "default": "5s",
+              "description": "Configures how often a non-interactive device should poll the device token endpoint, this is a purely informational configuration and does not enforce rate-limiting.",
+              "examples": ["5s", "15s", "1m"]
+            },
+            "user_code_entropy": {
+              "type": "string",
+              "description": "Sets the entropy for the user codes.",
+              "default": "medium",
+              "enum": ["high", "medium", "low"]
+            }
+          }
+        },
         "token_hook": {
           "description": "Sets the token hook endpoint for all grant types. If set it will be called while providing token to customize claims.",
           "examples": ["https://my-example.app/token-hook"],
@@ -1137,8 +1205,8 @@
             }
           ]
         }
-    }
-  },
+      }
+    },
     "secrets": {
       "type": "object",
       "additionalProperties": false,
@@ -1183,7 +1251,7 @@
       "examples": ["cpu"]
     },
     "tracing": {
-      "$ref": "https://raw.githubusercontent.com/ory/x/v0.0.675/otelx/config.schema.json"
+      "$ref": "ory://tracing-config"
     },
     "sqa": {
       "type": "object",

client/.snapshots/TestHandler-common-case=create_clients-case=0-description=basic_dynamic_client_registration.json

@@ -31,5 +31,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=1-description=basic_admin_registration.json

@@ -34,5 +34,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=10-description=empty_ID_succeeds.json

@@ -31,5 +31,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=10-description=setting_skip_logout_consent_succeeds_for_admin_registration.json

@@ -32,5 +32,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=12-description=empty_ID_succeeds.json

@@ -32,5 +32,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=2-description=empty_ID_succeeds.json

@@ -30,5 +30,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=4-description=non-uuid_works.json

@@ -34,5 +34,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=5-description=setting_client_id_as_uuid_works.json

@@ -34,5 +34,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=7-description=setting_skip_consent_suceeds_for_admin_registration.json

@@ -31,5 +31,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=8-description=empty_ID_succeeds.json

@@ -30,5 +30,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=8-description=setting_skip_consent_succeeds_for_admin_registration.json

@@ -32,5 +32,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=8-description=setting_skip_consent_suceeds_for_admin_registration.json

@@ -31,5 +31,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=create_clients-case=9-description=empty_ID_succeeds.json

@@ -31,5 +31,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-common-case=fetching_existing_client-endpoint=admin.json

@@ -32,7 +32,10 @@
     "jwt_bearer_grant_access_token_lifespan": null,
     "refresh_token_grant_id_token_lifespan": null,
     "refresh_token_grant_access_token_lifespan": null,
-    "refresh_token_grant_refresh_token_lifespan": null
+    "refresh_token_grant_refresh_token_lifespan": null,
+    "device_authorization_grant_id_token_lifespan": null,
+    "device_authorization_grant_access_token_lifespan": null,
+    "device_authorization_grant_refresh_token_lifespan": null
   },
   "status": 200
 }

client/.snapshots/TestHandler-common-case=fetching_existing_client-endpoint=selfservice.json

@@ -31,7 +31,10 @@
     "jwt_bearer_grant_access_token_lifespan": null,
     "refresh_token_grant_id_token_lifespan": null,
     "refresh_token_grant_access_token_lifespan": null,
-    "refresh_token_grant_refresh_token_lifespan": null
+    "refresh_token_grant_refresh_token_lifespan": null,
+    "device_authorization_grant_id_token_lifespan": null,
+    "device_authorization_grant_access_token_lifespan": null,
+    "device_authorization_grant_refresh_token_lifespan": null
   },
   "status": 200
 }

client/.snapshots/TestHandler-common-case=update_the_lifespans_of_an_OAuth2_client.json

@@ -32,7 +32,10 @@
     "jwt_bearer_grant_access_token_lifespan": "37h0m0s",
     "refresh_token_grant_id_token_lifespan": "40h0m0s",
     "refresh_token_grant_access_token_lifespan": "41h0m0s",
-    "refresh_token_grant_refresh_token_lifespan": "42h0m0s"
+    "refresh_token_grant_refresh_token_lifespan": "42h0m0s",
+    "device_authorization_grant_id_token_lifespan": "45h0m0s",
+    "device_authorization_grant_access_token_lifespan": "46h0m0s",
+    "device_authorization_grant_refresh_token_lifespan": "47h0m0s"
   },
   "status": 200
 }

client/.snapshots/TestHandler-common-case=updating_existing_client-endpoint=admin.json

@@ -34,7 +34,10 @@
     "jwt_bearer_grant_access_token_lifespan": null,
     "refresh_token_grant_id_token_lifespan": null,
     "refresh_token_grant_access_token_lifespan": null,
-    "refresh_token_grant_refresh_token_lifespan": null
+    "refresh_token_grant_refresh_token_lifespan": null,
+    "device_authorization_grant_id_token_lifespan": null,
+    "device_authorization_grant_access_token_lifespan": null,
+    "device_authorization_grant_refresh_token_lifespan": null
   },
   "status": 200
 }

client/.snapshots/TestHandler-common-case=updating_existing_client-endpoint=dynamic_client_registration.json

@@ -33,7 +33,10 @@
     "jwt_bearer_grant_access_token_lifespan": null,
     "refresh_token_grant_id_token_lifespan": null,
     "refresh_token_grant_access_token_lifespan": null,
-    "refresh_token_grant_refresh_token_lifespan": null
+    "refresh_token_grant_refresh_token_lifespan": null,
+    "device_authorization_grant_id_token_lifespan": null,
+    "device_authorization_grant_access_token_lifespan": null,
+    "device_authorization_grant_refresh_token_lifespan": null
   },
   "status": 200
 }

client/.snapshots/TestHandler-create_client_registration_tokens-case=0-dynamic=true.json

@@ -27,5 +27,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-create_client_registration_tokens-case=1-dynamic=false.json

@@ -27,5 +27,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/.snapshots/TestHandler-create_client_registration_tokens-case=2-dynamic=false.json

@@ -28,5 +28,8 @@
   "jwt_bearer_grant_access_token_lifespan": null,
   "refresh_token_grant_id_token_lifespan": null,
   "refresh_token_grant_access_token_lifespan": null,
-  "refresh_token_grant_refresh_token_lifespan": null
+  "refresh_token_grant_refresh_token_lifespan": null,
+  "device_authorization_grant_id_token_lifespan": null,
+  "device_authorization_grant_access_token_lifespan": null,
+  "device_authorization_grant_refresh_token_lifespan": null
 }

client/client.go

@@ -79,6 +79,7 @@ type Client struct {
 	// - OpenID Connect Implicit Grant (deprecated!): `implicit`
 	// - Refresh Token Grant: `refresh_token`
 	// - OAuth 2.0 Token Exchange: `urn:ietf:params:oauth:grant-type:jwt-bearer`
+	// - OAuth 2.0 Device Code Grant: `urn:ietf:params:oauth:grant-type:device_code`
 	GrantTypes sqlxx.StringSliceJSONFormat `json:"grant_types" db:"grant_types"`
 
 	// OAuth 2.0 Client Response Types
@@ -379,6 +380,21 @@ type Lifespans struct {
 	//
 	// The lifespan of a refresh token issued by the OAuth2 2.0 Refresh Token Grant for this OAuth 2.0 Client.
 	RefreshTokenGrantRefreshTokenLifespan x.NullDuration `json:"refresh_token_grant_refresh_token_lifespan,omitempty" db:"refresh_token_grant_refresh_token_lifespan"`
+
+	// OAuth2 2.0 Device Authorization Grant ID Token Lifespan
+	//
+	// The lifespan of an ID token issued by the OAuth2 2.0 Device Authorization Grant for this OAuth 2.0 Client.
+	DeviceAuthorizationGrantIDTokenLifespan x.NullDuration `json:"device_authorization_grant_id_token_lifespan,omitempty" db:"device_authorization_grant_id_token_lifespan"`
+
+	// OAuth2 2.0 Device Authorization Grant Access Token Lifespan
+	//
+	// The lifespan of an access token issued by the OAuth2 2.0 Device Authorization Grant for this OAuth 2.0 Client.
+	DeviceAuthorizationGrantAccessTokenLifespan x.NullDuration `json:"device_authorization_grant_access_token_lifespan,omitempty" db:"device_authorization_grant_access_token_lifespan"`
+
+	// OAuth2 2.0 Device Authorization Grant Device Authorization Lifespan
+	//
+	// The lifespan of a Device Authorization issued by the OAuth2 2.0 Device Authorization Grant for this OAuth 2.0 Client.
+	DeviceAuthorizationGrantRefreshTokenLifespan x.NullDuration `json:"device_authorization_grant_refresh_token_lifespan,omitempty" db:"device_authorization_grant_refresh_token_lifespan"`
 }
 
 func (Client) TableName() string {
@@ -549,6 +565,14 @@ func (c *Client) GetEffectiveLifespan(gt fosite.GrantType, tt fosite.TokenType,
 		} else if tt == fosite.RefreshToken && c.RefreshTokenGrantRefreshTokenLifespan.Valid {
 			cl = &c.RefreshTokenGrantRefreshTokenLifespan.Duration
 		}
+	} else if gt == fosite.GrantTypeDeviceCode {
+		if tt == fosite.AccessToken && c.DeviceAuthorizationGrantAccessTokenLifespan.Valid {
+			cl = &c.DeviceAuthorizationGrantAccessTokenLifespan.Duration
+		} else if tt == fosite.IDToken && c.DeviceAuthorizationGrantIDTokenLifespan.Valid {
+			cl = &c.DeviceAuthorizationGrantIDTokenLifespan.Duration
+		} else if tt == fosite.RefreshToken && c.DeviceAuthorizationGrantRefreshTokenLifespan.Valid {
+			cl = &c.DeviceAuthorizationGrantRefreshTokenLifespan.Duration
+		}
 	}
 
 	if cl == nil {