feat: Add support for OAuth2 device auth flow

.forgejo/workflows/renovate.yml

@@ -43,7 +43,7 @@ jobs:
     name: Renovate
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/renovatebot/renovate:43.260.2@sha256:60d830108d9ff6408d11a55d5f110ee0976bed78a6b82b08211e3ddb72f72952
+      image: ghcr.io/renovatebot/renovate:43.252.1@sha256:121eb04ef758537019fb58f587aa53c99e5fda4e703993ce2ca01bd4b3926bd4
       options: --tmpfs /tmp:exec
     steps:
       - name: Checkout

CHANGELOG.md

@@ -1,12 +1,3 @@
-# Continuwuity 26.6.2 (2026-07-12)
-
-## Bugfixes
-
-- Fixed the server returning 500 errors if `admin_console_automatic` is enabled and no TTY is available. Contributed by @s1lv3r. (#1975)
-- Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.
-- Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, use `!admin users reset-password --convert-to-local-account` to reactivate them.
-
-
 # Continuwuity 26.6.1 (2026-07-12)
 
 ## Features

Cargo.lock

@@ -826,7 +826,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "aws-lc-rs",
  "clap",
@@ -864,7 +864,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_admin"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "assign",
  "clap",
@@ -890,7 +890,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_api"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "assign",
  "async-trait",
@@ -928,7 +928,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_build_metadata"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "built",
  "cargo_metadata",
@@ -936,7 +936,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_core"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "argon2",
  "arrayvec",
@@ -1004,7 +1004,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_database"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "async-channel",
  "conduwuit_core",
@@ -1025,7 +1025,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_macros"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "cargo_toml",
  "itertools 0.15.0",
@@ -1036,7 +1036,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_router"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "assign",
  "axum",
@@ -1074,7 +1074,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_service"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "askama",
  "assign",
@@ -1126,7 +1126,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_web"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "askama",
  "assign",
@@ -4799,7 +4799,7 @@ dependencies = [
 
 [[package]]
 name = "ruminuwuity"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "assign",
  "ruma",
@@ -6972,7 +6972,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "26.6.2"
+version = "26.6.1"
 dependencies = [
  "askama",
  "cargo_metadata",

Cargo.toml

@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.6.2"
+version = "26.6.1"
 
 [workspace.metadata.crane]
 name = "conduwuit"

changelog.d/+16e3dce7.feature.md

@@ -0,0 +1 @@
+Added support for the OAuth2 device authorization flow. Contributed by @ginger

changelog.d/+6d0bc844.bugfix.md

@@ -0,0 +1 @@
+Fixed `global.oauth.compatibility_mode` being required, despite being ignored, when the `[global.oauth.oidc]` config section is provided.

changelog.d/+8777c56c.bugfix.md

@@ -0,0 +1 @@
+Fixed an issue with a migration that could cause user accounts imported from an identity provider to be marked as deactivated when the server started. If you have accounts affected by this issue, use `!admin users reset-password --convert-to-local-account` to reactivate them.

src/api/client/oauth/device.rs

@@ -0,0 +1,13 @@
+use axum::{Form, Json, extract::State, response::IntoResponse};
+use http::StatusCode;
+use service::oauth::grant::DeviceCodeRequest;
+
+pub(crate) async fn device_authorization_route(
+	State(services): State<crate::State>,
+	Form(request): Form<DeviceCodeRequest>,
+) -> impl IntoResponse {
+	match services.oauth.request_device_code(request).await {
+		| Ok(response) => Ok(Json(response)),
+		| Err(err) => Err((StatusCode::BAD_REQUEST, Json(err))),
+	}
+}

src/api/client/oauth/mod.rs

@@ -10,6 +10,7 @@
 use serde_json::json;
 pub(crate) use server_metadata::*;
 
+mod device;
 mod register_client;
 mod server_metadata;
 mod token;
@@ -20,6 +21,7 @@
 const CLIENT_REGISTER_PATH: &str = "client/register";
 const TOKEN_REVOKE_PATH: &str = "client/revoke";
 const TOKEN_PATH: &str = "grant/token";
+const DEVICE_AUTHORIZATION_PATH: &str = "device";
 const ACCOUNT_MANAGEMENT_PATH: &str = concat!(conduwuit_core::ROUTE_PREFIX, "/account/deeplink");
 
 pub(crate) fn router(state: crate::State) -> Router<crate::State> {
@@ -53,4 +55,5 @@ fn oauth_router() -> Router<crate::State> {
 		.route(concat!("/", JWKS_URI_PATH), get(async || Json(json!({"keys": []}))))
 		.route(concat!("/", TOKEN_PATH), post(token::token_route))
 		.route(concat!("/", TOKEN_REVOKE_PATH), post(token::revoke_token_route))
+		.route(concat!("/", DEVICE_AUTHORIZATION_PATH), post(device::device_authorization_route))
 }

src/api/client/oauth/server_metadata.rs

@@ -12,8 +12,8 @@
 use crate::{
 	Ruma,
 	client::oauth::{
-		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, JWKS_URI_PATH, TOKEN_PATH,
-		TOKEN_REVOKE_PATH,
+		ACCOUNT_MANAGEMENT_PATH, AUTH_CODE_PATH, CLIENT_REGISTER_PATH, DEVICE_AUTHORIZATION_PATH,
+		JWKS_URI_PATH, TOKEN_PATH, TOKEN_REVOKE_PATH,
 	},
 };
 
@@ -49,7 +49,8 @@ pub(crate) async fn authorization_server_metadata(services: &Services) -> Value
 		],
 		"authorization_endpoint": endpoint_base.join(AUTH_CODE_PATH).unwrap(),
 		"code_challenge_methods_supported": ["S256"],
-		"grant_types_supported": ["authorization_code", "refresh_token"],
+		"device_authorization_endpoint": endpoint_base.join(DEVICE_AUTHORIZATION_PATH).unwrap(),
+		"grant_types_supported": ["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code"],
 		"issuer": services.config.get_client_domain(),
 		"jwks_uri": endpoint_base.join(JWKS_URI_PATH).unwrap(),
 		"prompt_values_supported": ["create"],

src/service/admin/execute.rs

@@ -1,6 +1,4 @@
-use std::io::IsTerminal;
-
-use conduwuit::{Err, Result, debug, debug_info, error, info, warn};
+use conduwuit::{Err, Result, debug, debug_info, error, info};
 use ruma::events::room::message::RoomMessageEventContent;
 use tokio::time::{Duration, sleep};
 
@@ -9,16 +7,10 @@
 pub(super) const SIGNAL: &str = "SIGUSR2";
 
 impl super::Service {
-	/// Possibly spawn the terminal console at startup if configured and a TTY
-	/// is available.
+	/// Possibly spawn the terminal console at startup if configured.
 	pub(super) async fn console_auto_start(&self) {
 		#[cfg(feature = "console")]
 		if self.services.server.config.admin_console_automatic {
-			if !std::io::stdin().is_terminal() {
-				warn!("Console enabled without a tty available; Not enabling console");
-				return;
-			}
-
 			// Allow more of the startup sequence to execute before spawning
 			tokio::task::yield_now().await;
 			self.console.start().await;

src/service/oauth/client_metadata.rs

@@ -132,6 +132,8 @@ pub enum ApplicationType {
 #[serde(rename_all = "snake_case")]
 pub enum GrantType {
 	AuthorizationCode,
+	#[serde(rename = "urn:ietf:params:oauth:grant-type:device_code")]
+	DeviceCode,
 	RefreshToken,
 }
 

src/service/oauth/grant.rs

@@ -13,6 +13,7 @@
 use url::Url;
 
 use super::client_metadata::ResponseType;
+use crate::oauth::client_metadata::GrantType;
 
 #[derive(Debug, Clone, Deserialize, Serialize)]
 pub struct AuthorizationCodeQuery {
@@ -29,6 +30,33 @@ pub struct AuthorizationCodeQuery {
 	pub prompt: Option<Prompt>,
 }
 
+#[derive(Deserialize, Serialize)]
+pub struct AuthorizationCodeResponse {
+	pub state: String,
+	pub code: String,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct DeviceCodeRequest {
+	pub client_id: String,
+	pub scope: RawScopes,
+}
+
+#[derive(Deserialize, Serialize)]
+pub struct DeviceCodeResponse {
+	pub device_code: String,
+	pub user_code: String,
+	pub verification_uri: Url,
+	#[serde(skip_serializing_if = "Option::is_none")]
+	pub verification_uri_complete: Option<Url>,
+	pub expires_in: u64,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize)]
+pub struct DeviceCodeVerifyQuery {
+	pub user_code: Option<String>,
+}
+
 #[derive(Debug, Clone, Default, Deserialize, Serialize)]
 #[serde(rename_all = "snake_case")]
 #[non_exhaustive]
@@ -126,19 +154,29 @@ pub struct OAuthError {
 
 impl OAuthError {
 	#[must_use]
-	pub const fn invalid_request(error_description: &'static str) -> Self {
+	pub fn new(error: ErrorCode, error_description: String) -> Self {
 		Self {
-			error: ErrorCode::InvalidRequest,
+			error,
+			error_description: Cow::Owned(error_description),
+		}
+	}
+
+	#[must_use]
+	pub const fn new_static(error: ErrorCode, error_description: &'static str) -> Self {
+		Self {
+			error,
 			error_description: Cow::Borrowed(error_description),
 		}
 	}
 
+	#[must_use]
+	pub const fn invalid_request(error_description: &'static str) -> Self {
+		Self::new_static(ErrorCode::InvalidRequest, error_description)
+	}
+
 	#[must_use]
 	pub const fn invalid_grant(error_description: &'static str) -> Self {
-		Self {
-			error: ErrorCode::InvalidGrant,
-			error_description: Cow::Borrowed(error_description),
-		}
+		Self::new_static(ErrorCode::InvalidGrant, error_description)
 	}
 }
 
@@ -158,35 +196,41 @@ pub enum ErrorCode {
 	InvalidScope,
 	InvalidGrant,
 	InvalidClientMetadata,
+	AuthorizationPending,
+	ExpiredToken,
 }
 
-#[derive(Serialize, Deserialize)]
-pub struct AuthorizationCodeResponse {
-	pub state: String,
-	pub code: String,
+#[derive(Deserialize)]
+pub struct TokenRequest {
+	pub client_id: String,
+	#[serde(flatten)]
+	pub request: TokenRequestType,
 }
 
 #[derive(Deserialize)]
 #[serde(tag = "grant_type", rename_all = "snake_case")]
-pub enum TokenRequest {
+pub enum TokenRequestType {
 	AuthorizationCode {
 		code: String,
 		redirect_uri: Url,
-		client_id: String,
 		code_verifier: String,
 	},
+	#[serde(rename = "urn:ietf:params:oauth:grant-type:device_code")]
+	DeviceCode {
+		device_code: String,
+	},
 	RefreshToken {
-		client_id: String,
 		refresh_token: String,
 	},
 }
 
-impl TokenRequest {
+impl TokenRequestType {
 	#[must_use]
-	pub fn client_id(&self) -> &str {
+	pub fn grant_type(&self) -> GrantType {
 		match self {
-			| Self::AuthorizationCode { client_id, .. }
-			| Self::RefreshToken { client_id, .. } => client_id,
+			| Self::AuthorizationCode { .. } => GrantType::AuthorizationCode,
+			| Self::DeviceCode { .. } => GrantType::DeviceCode,
+			| Self::RefreshToken { .. } => GrantType::RefreshToken,
 		}
 	}
 }

src/service/oauth/mod.rs

@@ -12,17 +12,19 @@
 use database::{Deserialized, Json, Map};
 use itertools::Itertools;
 use lru_cache::LruCache;
+use rand::distr::{Distribution, slice::Choose};
 use ruma::{DeviceId, OwnedDeviceId, OwnedUserId, UserId};
 use serde::{Deserialize, Serialize};
 use url::Url;
 
 use crate::{
-	Dep,
+	Dep, config,
 	oauth::{
 		client_metadata::{ApplicationType, ClientMetadata, ResponseType},
 		grant::{
-			AuthorizationCodeQuery, AuthorizationCodeResponse, CodeChallengeMethod, ErrorCode,
-			OAuthError, ResponseMode, Scope, TokenRequest, TokenResponse, TokenType,
+			AuthorizationCodeQuery, AuthorizationCodeResponse, CodeChallengeMethod,
+			DeviceCodeRequest, DeviceCodeResponse, ErrorCode, OAuthError, ResponseMode, Scope,
+			TokenRequest, TokenRequestType, TokenResponse, TokenType,
 		},
 	},
 	users,
@@ -35,7 +37,8 @@ pub struct Service {
 	services: Services,
 	db: Data,
 	tickets: Mutex<HashMap<String, HashMap<OAuthTicket, SystemTime>>>,
-	pending_code_grants: tokio::sync::Mutex<LruCache<String, PendingCodeGrant>>,
+	pending_auth_code_grants: tokio::sync::Mutex<LruCache<String, PendingAuthCodeGrant>>,
+	pending_device_code_grants: tokio::sync::Mutex<LruCache<String, PendingDeviceCodeGrant>>,
 }
 
 struct Data {
@@ -46,6 +49,7 @@ struct Data {
 
 struct Services {
 	users: Dep<users::Service>,
+	config: Dep<config::Service>,
 }
 
 #[derive(Debug, Deserialize, Serialize)]
@@ -62,7 +66,7 @@ struct RefreshTokenInfo {
 	device_id: OwnedDeviceId,
 }
 
-struct PendingCodeGrant {
+struct PendingAuthCodeGrant {
 	authorizing_user: OwnedUserId,
 	requested_scopes: BTreeSet<Scope>,
 	client_name: Option<String>,
@@ -72,12 +76,8 @@ struct PendingCodeGrant {
 	requested_at: SystemTime,
 }
 
-impl PendingCodeGrant {
+impl PendingAuthCodeGrant {
 	const MAX_AGE: Duration = Duration::from_mins(1);
-	const RANDOM_CODE_LENGTH: usize = 32;
-
-	#[must_use]
-	pub(crate) fn generate_code() -> String { utils::random_string(Self::RANDOM_CODE_LENGTH) }
 
 	#[must_use]
 	pub(crate) fn is_valid_for(&self, client_id: &str) -> bool {
@@ -90,6 +90,43 @@ pub(crate) fn is_valid_for(&self, client_id: &str) -> bool {
 	}
 }
 
+struct PendingDeviceCodeGrant {
+	state: DeviceCodeGrantState,
+	requested_scopes: BTreeSet<Scope>,
+	client_name: Option<String>,
+	client_id: String,
+	requested_at: SystemTime,
+}
+
+enum DeviceCodeGrantState {
+	Unverified {
+		user_code: String,
+	},
+	Verified {
+		authorizing_user: OwnedUserId,
+	},
+}
+
+impl PendingDeviceCodeGrant {
+	const MAX_AGE: Duration = Duration::from_mins(1);
+
+	#[must_use]
+	pub(crate) fn is_valid_for(&self, client_id: &str) -> bool {
+		let now = SystemTime::now();
+
+		self.client_id == client_id
+			&& now
+				.duration_since(self.requested_at)
+				.is_ok_and(|age| age < Self::MAX_AGE)
+	}
+}
+
+pub struct DeviceCodeGrantInfo {
+	pub device_code: String,
+	pub client_metadata: ClientMetadata,
+	pub requested_scopes: BTreeSet<Scope>,
+}
+
 /// A time-limited grant for a client to perform some sensitive action.
 #[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub enum OAuthTicket {
@@ -112,6 +149,7 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 		Ok(Arc::new(Self {
 			services: Services {
 				users: args.depend::<users::Service>("users"),
+				config: args.depend::<config::Service>("config"),
 			},
 			db: Data {
 				clientid_clientmetadata: args.db["clientid_clientmetadata"].clone(),
@@ -119,8 +157,11 @@ fn build(args: crate::Args<'_>) -> Result<Arc<Self>> {
 				refreshtoken_refreshtokeninfo: args.db["refreshtoken_refreshtokeninfo"].clone(),
 			},
 			tickets: Mutex::default(),
-			pending_code_grants: tokio::sync::Mutex::new(LruCache::new(
-				Self::MAX_PENDING_CODE_GRANTS,
+			pending_auth_code_grants: tokio::sync::Mutex::new(LruCache::new(
+				Self::MAX_PENDING_GRANTS,
+			)),
+			pending_device_code_grants: tokio::sync::Mutex::new(LruCache::new(
+				Self::MAX_PENDING_GRANTS,
 			)),
 		}))
 	}
@@ -133,11 +174,21 @@ impl Service {
 	// Maximum number of pending code grants which will be held in memory at once,
 	// to prevent unbounded memory use if someone decides to repeatedly reload the
 	// grant page.
-	const MAX_PENDING_CODE_GRANTS: usize = 100;
+	const MAX_PENDING_GRANTS: usize = 100;
 	const RANDOM_TOKEN_LENGTH: usize = 32;
+	const USER_CODE_CHARACTERS: &[char] = &['0', '1', '2', '3', '4', '5', '6', '7', '8', '9'];
+	const USER_CODE_LENGTH: usize = 6;
 
 	fn generate_token() -> String { utils::random_string(Self::RANDOM_TOKEN_LENGTH) }
 
+	fn generate_user_code() -> String {
+		Choose::new(Self::USER_CODE_CHARACTERS)
+			.unwrap()
+			.sample_iter(&mut rand::rng())
+			.take(Self::USER_CODE_LENGTH)
+			.collect()
+	}
+
 	pub async fn register_client(&self, metadata: &ClientMetadata) -> Result<String, OAuthError> {
 		metadata.validate().map_err(|error| OAuthError {
 			error: ErrorCode::InvalidClientMetadata,
@@ -231,14 +282,14 @@ pub async fn request_authorization_code(
 			| ResponseMode::Query => '?',
 		};
 
-		let code = PendingCodeGrant::generate_code();
+		let code = Self::generate_token();
 
 		info!(
 			client_id = &query.client_id,
 			client_name = &client_metadata.client_name,
 			?requested_scopes,
 			?authorizing_user,
-			"Issuing oauth authorization code"
+			"Issuing OAuth authorization code"
 		);
 
 		let redirect_uri = format!(
@@ -252,7 +303,7 @@ pub async fn request_authorization_code(
 			.unwrap(),
 		);
 
-		let pending_grant = PendingCodeGrant {
+		let pending_grant = PendingAuthCodeGrant {
 			authorizing_user,
 			requested_scopes,
 			client_name: client_metadata.client_name,
@@ -262,7 +313,7 @@ pub async fn request_authorization_code(
 			requested_at: SystemTime::now(),
 		};
 
-		self.pending_code_grants
+		self.pending_auth_code_grants
 			.lock()
 			.await
 			.insert(code, pending_grant);
@@ -270,15 +321,129 @@ pub async fn request_authorization_code(
 		Ok(redirect_uri)
 	}
 
+	pub async fn request_device_code(
+		&self,
+		query: DeviceCodeRequest,
+	) -> Result<DeviceCodeResponse, OAuthError> {
+		let Some(client_metadata) = self.get_client_metadata(&query.client_id).await else {
+			return Err(OAuthError::invalid_grant("Invalid client ID"));
+		};
+
+		let requested_scopes = query
+			.scope
+			.to_scopes()
+			.map_err(|err| OAuthError::new(ErrorCode::InvalidGrant, err))?;
+
+		let device_code = Self::generate_token();
+		let user_code = Self::generate_user_code();
+
+		let verification_uri = self
+			.services
+			.config
+			.get_client_domain()
+			.join(&format!("{}/oauth2/grant/device_code", conduwuit::ROUTE_PREFIX))
+			.unwrap();
+
+		let mut verification_uri_complete = verification_uri.clone();
+		verification_uri_complete
+			.query_pairs_mut()
+			.append_pair("user_code", &user_code);
+
+		info!(
+			client_id = &query.client_id,
+			client_name = &client_metadata.client_name,
+			?requested_scopes,
+			"Issuing OAuth device code"
+		);
+
+		let pending_grant = PendingDeviceCodeGrant {
+			state: DeviceCodeGrantState::Unverified { user_code: user_code.clone() },
+			requested_scopes,
+			client_name: client_metadata.client_name,
+			client_id: query.client_id,
+			requested_at: SystemTime::now(),
+		};
+
+		self.pending_device_code_grants
+			.lock()
+			.await
+			.insert(device_code.clone(), pending_grant);
+
+		Ok(DeviceCodeResponse {
+			device_code,
+			user_code,
+			verification_uri,
+			verification_uri_complete: Some(verification_uri_complete),
+			expires_in: PendingDeviceCodeGrant::MAX_AGE.as_secs(),
+		})
+	}
+
+	pub async fn grant_info_for_user_code(
+		&self,
+		supplied_user_code: &str,
+	) -> Option<DeviceCodeGrantInfo> {
+		let pending_grants = self.pending_device_code_grants.lock().await;
+
+		let (device_code, grant) = pending_grants
+			.iter()
+			.find(|(_, grant)| {
+				matches!(&grant.state, DeviceCodeGrantState::Unverified { user_code } if user_code == supplied_user_code)
+			})?;
+
+		let client_metadata = self
+			.get_client_metadata(&grant.client_id)
+			.await
+			.expect("client should exist");
+
+		Some(DeviceCodeGrantInfo {
+			device_code: device_code.clone(),
+			client_metadata,
+			requested_scopes: grant.requested_scopes.clone(),
+		})
+	}
+
+	pub async fn validate_device_code(
+		&self,
+		authorizing_user: OwnedUserId,
+		device_code: &str,
+	) -> Result<(), String> {
+		let mut pending_grants = self.pending_device_code_grants.lock().await;
+
+		let Some(pending_grant) = pending_grants.get_mut(device_code) else {
+			return Err("Invalid device code".to_owned());
+		};
+
+		match &mut pending_grant.state {
+			| state @ DeviceCodeGrantState::Unverified { .. } => {
+				*state = DeviceCodeGrantState::Verified { authorizing_user };
+
+				Ok(())
+			},
+			| DeviceCodeGrantState::Verified {
+				authorizing_user: previous_authorizing_user,
+			} =>
+				if *previous_authorizing_user == authorizing_user {
+					Ok(())
+				} else {
+					Err("Device code is already verified".to_owned())
+				},
+		}
+	}
+
 	pub async fn issue_token(&self, request: TokenRequest) -> Result<TokenResponse, OAuthError> {
+		let TokenRequest { client_id, request } = request;
+
+		let Some(client_metadata) = self.get_client_metadata(&client_id).await else {
+			return Err(OAuthError::invalid_request("Invalid client ID"));
+		};
+
+		if !client_metadata.grant_types.contains(&request.grant_type()) {
+			return Err(OAuthError::invalid_grant("Client cannot request this grant type"));
+		}
+
 		match request {
-			| TokenRequest::AuthorizationCode {
-				code,
-				redirect_uri,
-				client_id,
-				code_verifier,
-			} => {
-				let mut pending_grants = self.pending_code_grants.lock().await;
+			| TokenRequestType::AuthorizationCode { code, redirect_uri, code_verifier } => {
+				let mut pending_grants = self.pending_auth_code_grants.lock().await;
 
 				let Some(pending_grant) = pending_grants
 					.remove(&code)
@@ -305,7 +470,39 @@ pub async fn issue_token(&self, request: TokenRequest) -> Result<TokenResponse,
 				)
 				.await
 			},
-			| TokenRequest::RefreshToken { client_id, refresh_token } =>
+			| TokenRequestType::DeviceCode { device_code } => {
+				let mut pending_grants = self.pending_device_code_grants.lock().await;
+
+				let Some(pending_grant) = pending_grants
+					.remove(&device_code)
+					.filter(|grant| grant.is_valid_for(&client_id))
+				else {
+					return Err(OAuthError::new_static(
+						ErrorCode::ExpiredToken,
+						"Invalid device code",
+					));
+				};
+
+				match &pending_grant.state {
+					| DeviceCodeGrantState::Unverified { .. } => {
+						pending_grants.insert(device_code, pending_grant);
+
+						Err(OAuthError::new_static(
+							ErrorCode::AuthorizationPending,
+							"Authorization is pending",
+						))
+					},
+					| DeviceCodeGrantState::Verified { authorizing_user } =>
+						self.create_session(
+							authorizing_user.to_owned(),
+							pending_grant.requested_scopes,
+							pending_grant.client_name,
+							client_id,
+						)
+						.await,
+				}
+			},
+			| TokenRequestType::RefreshToken { refresh_token } =>
 				self.refresh_session(client_id, refresh_token).await,
 		}
 	}
@@ -364,11 +561,10 @@ async fn create_session(
 			.await
 			.is_ok()
 		{
-			return Err(OAuthError {
-				error: ErrorCode::InvalidScope,
-				error_description: "A device with the supplied ID already exists for this user"
-					.into(),
-			});
+			return Err(OAuthError::new_static(
+				ErrorCode::InvalidScope,
+				"A device with the supplied ID already exists for this user",
+			));
 		}
 
 		self.services

src/web/pages/components/mod.rs

@@ -65,17 +65,17 @@ pub(super) async fn for_local_user(services: &Services, user_id: &UserId) -> Sel
 	}
 
 	pub(super) fn for_device(
-		oauth_metadata: Option<&ClientMetadata>,
+		client_metadata: Option<&ClientMetadata>,
 		display_name: Option<&str>,
 	) -> Self {
-		let avatar_src = oauth_metadata
+		let avatar_src = client_metadata
 			.and_then(|metadata| metadata.logo_uri.as_ref())
 			.map(|uri| uri.as_str().to_owned());
 
 		let avatar_type = if let Some(avatar_src) = avatar_src {
 			AvatarType::Image(avatar_src)
 		} else if let Some(initial) = display_name.and_then(|name| name.chars().next()) {
-			if oauth_metadata.is_some() {
+			if client_metadata.is_some() {
 				AvatarType::Initial(initial)
 			} else {
 				AvatarType::Initial('❖')
@@ -86,6 +86,20 @@ pub(super) fn for_device(
 
 		Self { avatar_type }
 	}
+
+	pub(super) fn for_client(client_metadata: &ClientMetadata) -> Self {
+		let avatar_type = if let Some(logo) = &client_metadata.logo_uri {
+			AvatarType::Image(logo.to_string())
+		} else if let Some(name) = &client_metadata.client_name
+			&& let Some(char) = name.chars().next()
+		{
+			AvatarType::Initial(char)
+		} else {
+			AvatarType::Initial('?')
+		};
+
+		Self { avatar_type }
+	}
 }
 
 #[derive(Debug, Template)]

src/web/pages/oauth/grant.rs

@@ -4,9 +4,12 @@
 	response::Redirect,
 	routing::on,
 };
-use conduwuit_service::oauth::grant::{AuthorizationCodeQuery, Prompt};
+use conduwuit_service::oauth::{
+	client_metadata::ClientMetadata,
+	grant::{AuthorizationCodeQuery, DeviceCodeVerifyQuery, Prompt},
+};
 use ruma::OwnedUserId;
-use url::Url;
+use serde::Deserialize;
 
 use crate::{
 	ROUTE_PREFIX, WebError,
@@ -14,7 +17,7 @@
 	pages::{
 		GET_POST, Result, TemplateContext,
 		account::register::{RegisterQuery, RequestedRegistrationFlow},
-		components::{Avatar, AvatarType, ClientScopes},
+		components::{Avatar, ClientScopes, UserCard},
 	},
 	response,
 	session::{LoginIntent, LoginQuery, LoginTarget, User},
@@ -22,7 +25,9 @@
 };
 
 pub(crate) fn build() -> Router<crate::State> {
-	Router::new().route("/authorization_code", on(GET_POST, route_authorization_code))
+	Router::new()
+		.route("/authorization_code", on(GET_POST, route_authorization_code))
+		.route("/device_code", on(GET_POST, route_device_code))
 }
 
 template! {
@@ -30,12 +35,9 @@ struct Grant use "grant.html.j2" {
 		logout_query: String,
 		user_id: OwnedUserId,
 		user_avatar: Avatar,
-		client_uri: Url,
-		client_name: String,
-		client_avatar: Avatar,
-		policy_uri: Option<Url>,
-		tos_uri: Option<Url>,
-		scopes: ClientScopes
+		client_metadata: ClientMetadata,
+		scopes: ClientScopes,
+		device_code: Option<String>
 	}
 }
 
@@ -102,27 +104,6 @@ async fn route_authorization_code(
 
 	let scopes = query.scope.to_scopes().map_err(WebError::BadRequest)?;
 
-	let client_name = if let Some(name) = &client.client_name {
-		name
-	} else {
-		"Unknown application"
-	}
-	.to_owned();
-
-	let client_avatar = {
-		let avatar_type = if let Some(logo) = &client.logo_uri {
-			AvatarType::Image(logo.to_string())
-		} else if let Some(name) = &client.client_name
-			&& let Some(char) = name.chars().next()
-		{
-			AvatarType::Initial(char)
-		} else {
-			AvatarType::Initial('?')
-		};
-
-		Avatar { avatar_type }
-	};
-
 	let user_avatar = Avatar::for_local_user(&services, &user_id).await;
 
 	response!(Grant::new(
@@ -135,11 +116,102 @@ async fn route_authorization_code(
 		.unwrap(),
 		user_id,
 		user_avatar,
-		client.client_uri.clone(),
-		client_name,
-		client_avatar,
-		client.policy_uri.clone(),
-		client.tos_uri.clone(),
+		client,
 		ClientScopes { scopes },
+		None,
 	))
 }
+
+#[derive(Deserialize)]
+#[serde(tag = "stage", rename_all = "snake_case")]
+enum DeviceCodeForm {
+	Lookup {
+		user_code: String,
+	},
+	Confirm {
+		device_code: String,
+	},
+}
+
+template! {
+	struct DeviceCodeGrant use "device_code_grant.html.j2" {
+		user_card: UserCard,
+		body: DeviceCodeGrantBody
+	}
+}
+
+#[derive(Debug)]
+enum DeviceCodeGrantBody {
+	Lookup {
+		user_code_error: bool,
+	},
+	Success,
+}
+
+async fn route_device_code(
+	State(services): State<crate::State>,
+	Extension(context): Extension<TemplateContext>,
+	user: User<true>,
+	Expect(Query(query)): Expect<Query<DeviceCodeVerifyQuery>>,
+	PostForm(form): PostForm<DeviceCodeForm>,
+) -> Result {
+	let user_id = if let Some(user) = user.into_session() {
+		user.user_id
+	} else {
+		let next = LoginTarget::DeviceCode(query.clone());
+
+		let uri = format!(
+			"{}/account/login?{}",
+			ROUTE_PREFIX,
+			serde_urlencoded::to_string(LoginQuery { next: Some(next), ..Default::default() })
+				.unwrap()
+		);
+
+		return response!(Redirect::to(&uri));
+	};
+
+	let user_card = UserCard::for_local_user(&services, user_id.clone()).await;
+
+	match (form, query.user_code.clone()) {
+		| (None, Some(user_code)) | (Some(DeviceCodeForm::Lookup { user_code }), _) => {
+			let Some(grant_info) = services.oauth.grant_info_for_user_code(&user_code).await
+			else {
+				return response!(DeviceCodeGrant::new(
+					context,
+					user_card,
+					DeviceCodeGrantBody::Lookup { user_code_error: true }
+				));
+			};
+
+			let user_avatar = Avatar::for_local_user(&services, &user_id).await;
+
+			response!(Grant::new(
+				context,
+				serde_urlencoded::to_string(LoginQuery {
+					next: Some(LoginTarget::DeviceCode(query)),
+					intent: Some(LoginIntent::SwitchAccounts),
+					..Default::default()
+				})
+				.unwrap(),
+				user_id,
+				user_avatar,
+				grant_info.client_metadata,
+				ClientScopes { scopes: grant_info.requested_scopes },
+				Some(grant_info.device_code),
+			))
+		},
+		| (Some(DeviceCodeForm::Confirm { device_code }), _) => {
+			services
+				.oauth
+				.validate_device_code(user_id, &device_code)
+				.await
+				.map_err(WebError::BadRequest)?;
+
+			response!(DeviceCodeGrant::new(context, user_card, DeviceCodeGrantBody::Success))
+		},
+		| (None, None) =>
+			response!(DeviceCodeGrant::new(context, user_card, DeviceCodeGrantBody::Lookup {
+				user_code_error: false
+			})),
+	}
+}

src/web/pages/resources/grant.css

@@ -20,3 +20,17 @@
     font-style: italic;
     text-align: center;
 }
+
+.user-code {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+
+    input {
+        text-align: center;
+        font-weight: bold;
+        font-size: 200%;
+        padding: 0.2em;
+        width: 6em !important;
+    }
+}

src/web/pages/templates/device_code_grant.html.j2

@@ -0,0 +1,50 @@
+{% extends "_layout.html.j2" %}
+
+{%- block head -%}
+<link rel="stylesheet" href="{{ crate::ROUTE_PREFIX }}/resources/grant.css">
+{%- endblock -%}
+
+{%- block title -%}
+Authorize client
+{%- endblock -%}
+
+{%- block content -%}
+<div class="panel narrow">
+    <h1>Authorize device</h1>
+    {{ user_card }}
+    {% match body %}
+        {% when DeviceCodeGrantBody::Lookup { user_code_error }  %}
+            <p>
+                Enter the code displayed on your device, or in the app you're signing into.
+            </p>
+            <p>
+                <em class="negative">Never enter a code given to you by someone else.</em>
+                Your homeserver administrator will never ask you to enter a code on this page.
+            </p>
+
+            <form method="post">
+                <p>
+                    <div class="user-code">
+                        <label for="user_code">Validation code</label>
+                        <input
+                            type="text"
+                            id="user_code"
+                            name="user_code"
+                            maxlength="6"
+                            spellcheck="false"
+                            pattern="\d{6}"
+                            title="Enter the six-digit validation code"
+                        >
+                    </div>
+                    {% if user_code_error %}
+                        <small class="error">Invalid code</small>
+                    {% endif %}
+                </p>
+                <input type="hidden" name="stage" value="lookup">
+                <button type="submit">Continue</button>
+            </form>
+        {% when DeviceCodeGrantBody::Success %}
+            <p>Success! 🎉 You can close this tab and return to your device.</p>
+    {% endmatch %}
+</div>
+{% endblock %}

src/web/pages/templates/grant.html.j2

@@ -9,6 +9,7 @@ Authorize client
 {%- endblock -%}
 
 {%- block content -%}
+{% let client_name = client_metadata.client_name.as_deref().unwrap_or("Unknown application") %}
 <div class="panel narrow">
     <h1>Authorize {{ client_name }}</h1>
     <div class="avatars">
@@ -18,17 +19,17 @@ Authorize client
         <div class="separator" aria-hidden="true">
             ⇄
         </div>
-        {{ client_avatar }}
+        {{ Avatar::for_client(client_metadata) }}
     </div>
     <div class="identity">
         Signed in as <code>{{ user_id }}</code>. <a href="{{ crate::ROUTE_PREFIX }}/account/logout?{{ logout_query }}">Switch accounts</a>
     </div>
     <p>
-        <b>{{ client_name }}</b> (<a href="{{ client_uri }}">{{ client_uri.domain().unwrap() }}</a>) would like
+        <b>{{ client_name }}</b> (<a href="{{ client_metadata.client_uri }}">{{ client_metadata.client_uri.domain().unwrap() }}</a>) would like
         your permission to:
         {{ scopes }}
     </p>
-    {% match (&policy_uri, &tos_uri) %}
+    {% match (&client_metadata.policy_uri, &client_metadata.tos_uri) %}
         {% when (Some(policy_uri), Some(tos_uri)) %}
             <p>
                 {{ client_name }}'s <a href="{{ policy_uri }}">policies</a>
@@ -49,6 +50,10 @@ Authorize client
     {% endmatch %}
 
     <form method="post">
+        <input type="hidden" name="stage" value="confirm">
+        {% if let Some(device_code) = device_code %}
+            <input type="hidden" name="device_code" value="{{ device_code }}">
+        {% endif %}
         <button type="submit">Continue</button>
     </form>
 </div>

src/web/session/mod.rs

@@ -9,7 +9,7 @@
 	http::request::Parts,
 	response::{IntoResponse, Redirect, Response},
 };
-use conduwuit_service::oauth::grant::AuthorizationCodeQuery;
+use conduwuit_service::oauth::grant::{AuthorizationCodeQuery, DeviceCodeVerifyQuery};
 use ruma::{OwnedUserId, UserId};
 use serde::{Deserialize, Serialize};
 use tower_sessions::Session;
@@ -38,6 +38,7 @@ pub(crate) enum LoginTarget {
 	ChangeEmail,
 	CrossSigningReset,
 	Deactivate,
+	DeviceCode(DeviceCodeVerifyQuery),
 	DeviceInfo(DevicePath),
 	RemoveDevice(DevicePath),
 }
@@ -59,6 +60,9 @@ pub(crate) fn target_path(&self) -> String {
 			| Self::ChangeEmail => "account/email/change/".into(),
 			| Self::CrossSigningReset => "account/cross_signing_reset".into(),
 			| Self::Deactivate => "account/deactivate".into(),
+			| Self::DeviceCode(code) =>
+				format!("oauth2/grant/device_code?{}", serde_urlencoded::to_string(code).unwrap())
+					.into(),
 			| Self::DeviceInfo(path) => format!("account/device/{}/", path.device).into(),
 			| Self::RemoveDevice(path) => format!("account/device/{}/remove", path.device).into(),
 		};