feat: Add support for device code grant by SimonVanacco · Pull Request #229 · thephpleague/oauth2-server-bundle

SimonVanacco · 2025-03-25T18:24:27Z

This PR adds support for device code grants, which has been available for some time in oauth2-server

Ready to be tested, I'd love to get some feedback if you think some areas could be improved !

Design considerations

I've decided to let end-users handle the device code verification page on their own. This is to prevent having to require twig in the bundle itself and create more complexity to accommodate all use cases. An example controller has been added in the documentation
This does not support verification_uri_complete, only verification_uri
Logic for code approval is in DeviceCodeRepository::approveDeviceCode. I was unable to re-use the logic from oauth2-server as they fetch the code by "device_code" instead of by "user_code". Not sure if this is a mistake in the parent bundle or some use-case I don't understand, but it does not accommodate most people use-cases. I'm open to moving the logic somewhere else if you find a better place for it !
I've added some basic tests but this is not my strong suit : please let me know if I missed something :)

chalasr

Thanks for the PR! Can you rebase it? Here are some comments also

docs/device-code-grant.md

src/Manager/Doctrine/DeviceCodeManager.php

SimonVanacco · 2025-04-26T08:27:32Z

Hi @chalasr

I'm not entirely sure I understood correctly what you wanted for the docs/device-code-grant.md improvements, but I tried my best to fit to your feedback :)

PR is rebased !

Mika56 · 2025-10-20T08:47:17Z

Interested in this PR, but there's been no activity for a few months. Anything we can do to help?

Renrhaf · 2025-10-21T11:26:16Z

+1 interested as well !

ajgarlag

Thank you for your work here. I've managed to create a working demo. I've reviewed your code and added some suggestions.

src/DependencyInjection/Configuration.php

src/Manager/DeviceCodeManagerInterface.php

src/Repository/ClientRepository.php

src/Repository/DeviceCodeRepository.php

src/DependencyInjection/Configuration.php

ajgarlag · 2025-11-07T12:39:17Z

src/Repository/DeviceCodeRepository.php

+        $this->deviceCodeManager->save($deviceCode, $newDeviceCode);
+    }
+
+    public function approveDeviceCode(string $userCode, string $userId): void


I'm not sure whether this method should be included in the bundle. I've created a working demo that doesn't use this it.

Either way, I'll move this method to the DeviceCodeManagerInterface and rename it resolveDeviceCode, adding a third required boolean parameter to indicate whether the request has been approved.

I'm not sure whether this method should be included in the bundle

Oauth2-server does bring a DeviceCodeGrant::completeDeviceAuthorizationRequest method already but I'm struggling to understand how they expect it to be used. It fetches from the manager by $deviceCode where I'm pretty sure we need to use $userCode... Maybe I'm missing something.

I'll move this method to the DeviceCodeManagerInterface and rename it resolveDeviceCode, adding a third required boolean parameter to indicate whether the request has been approved.

I'm happy to move to DeviceCodeManagerInterface, however it will result in two duplicated methods with the exact same logic (for in memory and doctrine) - If that's fine by you let me know and I'll do another commit.

Having reviewed it again, this method should be completely removed. There is a method in the league/oauth2-server code to approve (or deny) a device code authorization request: AuthorizationServer::completeDeviceAuthorizationRequest.

chalasr · 2025-11-17T18:34:06Z

Happy to merge once Antonio's review comments are resolved.

ajgarlag · 2025-12-02T11:32:23Z

@SimonVanacco Friendly ping

…thods

SimonVanacco · 2025-12-02T14:43:08Z

Hi @ajgarlag

Thank you for the review, and sorry for the delay. The past few weeks have been a bit hectic :)

I implemented some of your requests (new configuration options, refactoring of the repository) and left comments on the ones I won't be able to do myself without some guidance : Supporting Symfony routes for the verification_uri and removing approveDeviceCode.

Let me know your thoughts on the update and I'll try to be quicker to respond now !

chalasr · 2025-12-02T16:31:19Z

Thanks. Supporting route names can be done in a follow-up PR, no problem. Regarding approveDeviceCode, I'll let Antonio have the final word as I have no strong opinion.

ajgarlag · 2025-12-05T07:25:46Z

src/Repository/DeviceCodeRepository.php

+    private function updateDeviceCodeModel(
+        DeviceCodeInterface $deviceCode,
+        DeviceCodeEntityInterface $deviceCodeEntity,
+    ): DeviceCodeInterface {
+        if ($deviceCodeEntity->getLastPolledAt()) {
+            $deviceCode->setLastPolledAt($deviceCodeEntity->getLastPolledAt());
+        }
+
+        if ($deviceCodeEntity->getUserIdentifier()) {
+            $deviceCode->setUserIdentifier($deviceCodeEntity->getUserIdentifier());
+            $deviceCode->setUserApproved($deviceCodeEntity->getUserApproved());
+        }
+
+        return $deviceCode;


As this method mutates the received $deviceCode, I think it should not return anything.

Suggested change

private function updateDeviceCodeModel(

DeviceCodeInterface $deviceCode,

DeviceCodeEntityInterface $deviceCodeEntity,

): DeviceCodeInterface {

if ($deviceCodeEntity->getLastPolledAt()) {

$deviceCode->setLastPolledAt($deviceCodeEntity->getLastPolledAt());

}

if ($deviceCodeEntity->getUserIdentifier()) {

$deviceCode->setUserIdentifier($deviceCodeEntity->getUserIdentifier());

$deviceCode->setUserApproved($deviceCodeEntity->getUserApproved());

}

return $deviceCode;

private function updateDeviceCodeModel(

DeviceCodeInterface $deviceCode,

DeviceCodeEntityInterface $deviceCodeEntity,

): void {

if ($deviceCodeEntity->getLastPolledAt()) {

$deviceCode->setLastPolledAt($deviceCodeEntity->getLastPolledAt());

}

if ($deviceCodeEntity->getUserIdentifier()) {

$deviceCode->setUserIdentifier($deviceCodeEntity->getUserIdentifier());

$deviceCode->setUserApproved($deviceCodeEntity->getUserApproved());

}

ajgarlag · 2025-12-05T07:29:27Z

src/Repository/DeviceCodeRepository.php

+        $client = $this->clientRepository->getClientEntity($deviceCode->getClient()->getIdentifier());
+        if ($client) {
+            $deviceCodeEntity->setClient($client);
+        }


Prevent the casting of an object to a boolean value

Suggested change

$client = $this->clientRepository->getClientEntity($deviceCode->getClient()->getIdentifier());

if ($client) {

$deviceCodeEntity->setClient($client);

}

if (null !== $client = $this->clientRepository->getClientEntity($deviceCode->getClient()->getIdentifier())) {

$deviceCodeEntity->setClient($client);

}

ajgarlag · 2025-12-05T07:31:36Z

src/Repository/DeviceCodeRepository.php

+        if ($deviceCode->getLastPolledAt()) {
+            $deviceCodeEntity->setLastPolledAt($deviceCode->getLastPolledAt());
+        }


Prevent the casting of an object to a boolean value, and prevent calling the same method twice

Suggested change

if ($deviceCode->getLastPolledAt()) {

$deviceCodeEntity->setLastPolledAt($deviceCode->getLastPolledAt());

}

if (null !== $lastPolledAt = $deviceCode->getLastPolledAt()) {

$deviceCodeEntity->setLastPolledAt($lastPolledAt);

}

ajgarlag · 2025-12-05T07:33:05Z

src/Repository/DeviceCodeRepository.php

+        if ($deviceCode->getUserIdentifier()) {
+            $deviceCodeEntity->setUserIdentifier($deviceCode->getUserIdentifier());
+        }


Prevent the casting of a string to a boolean value, and prevent calling the same method twice

Suggested change

if ($deviceCode->getUserIdentifier()) {

$deviceCodeEntity->setUserIdentifier($deviceCode->getUserIdentifier());

}

if (null !== $userIdentifier = $deviceCode->getUserIdentifier()) {

$deviceCodeEntity->setUserIdentifier($userIdentifier);

}

chalasr · 2026-02-06T11:59:25Z

@SimonVanacco can you look into last comments sometime?

SimonVanacco mentioned this pull request Mar 25, 2025

Discussion : support for device authorization flow (RFC8628) #226

Closed

chalasr requested changes Apr 17, 2025

View reviewed changes

docs/device-code-grant.md Outdated Show resolved Hide resolved

docs/device-code-grant.md Outdated Show resolved Hide resolved

docs/device-code-grant.md Show resolved Hide resolved

src/Manager/Doctrine/DeviceCodeManager.php Show resolved Hide resolved

SimonVanacco added a commit to SimonVanacco/oauth2-server-bundle that referenced this pull request Apr 26, 2025

fix: feedback from PR thephpleague#229

76db145

SimonVanacco force-pushed the master branch from ba183bf to 515c942 Compare April 26, 2025 08:22

SimonVanacco added a commit to SimonVanacco/oauth2-server-bundle that referenced this pull request Apr 26, 2025

fix: feedback from PR thephpleague#229

3d3ceaa

ajgarlag requested changes Nov 7, 2025

View reviewed changes

SimonVanacco added 3 commits December 2, 2025 13:45

feat: Add support for device code grant

5fb34a6

fix: lint and static analysis

b12a121

fix: feedback from PR thephpleague#229

434b797

SimonVanacco force-pushed the master branch from 3d3ceaa to 434b797 Compare December 2, 2025 12:46

feat: new configuration options for device_code grant, refactoring me…

3d24c9c

…thods

ajgarlag requested changes Dec 5, 2025

View reviewed changes

ajgarlag pushed a commit that referenced this pull request Feb 11, 2026

fix: feedback from PR #229

75a4dee

Conversation

SimonVanacco commented Mar 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Design considerations

Uh oh!

chalasr left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SimonVanacco commented Apr 26, 2025

Uh oh!

Mika56 commented Oct 20, 2025

Uh oh!

Renrhaf commented Oct 21, 2025

Uh oh!

ajgarlag left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ajgarlag Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

SimonVanacco Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ajgarlag Dec 4, 2025

Choose a reason for hiding this comment

Uh oh!

chalasr commented Nov 17, 2025

Uh oh!

ajgarlag commented Dec 2, 2025

Uh oh!

SimonVanacco commented Dec 2, 2025

Uh oh!

chalasr commented Dec 2, 2025

Uh oh!

ajgarlag Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

ajgarlag Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

ajgarlag Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

ajgarlag Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

chalasr commented Feb 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

SimonVanacco commented Mar 25, 2025 •

edited

Loading

SimonVanacco Dec 2, 2025 •

edited

Loading