richiexec/amber-backend
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Device approve page: manual code-entry for the QR-less path #5

Merged
richiexec merged 1 commit from fix/device-approve-code-entry into main 2026-07-20 09:08:52 +00:00
Conversation 0 Commits 1 Files changed 2 +66 -6
richiexec commented 2026-07-20 09:07:16 +00:00
Owner
Copy link

Closes #55.

Problem

The TV's sign-in screen tells the user to "open …/device and enter the code", but device_page.pb.js only worked when opened with ?code= (what the QR encodes). Opening …/device bare showed "Chybí kód zařízení v odkazu." and hid the form — there was no field to type the XXXX-XXXX code into. So the QR/direct-link path worked, but the "type the code" path the TV advertises didn't exist.

Fix

Added a code-entry field shown when the page is opened without ?code=:

  • User types the XXXX-XXXX code from the TV; input formats live to XXXX-XXXX and Enter submits.
  • The code is normalized (normCode: uppercase, strip dash/spaces, cap at 8) to the dash-less form the server stores — the fix the issue called for — before the /info + /approve lookups.
  • On success the sign-in form is revealed; an unknown/expired code re-shows the field prefilled for correction instead of dead-ending.
  • The QR / direct-link path is unchanged — CODE now also runs through the same normalizer, so even a dashed link works.

No new endpoints, no crypto changes, self-contained page (no external assets) preserved.

Verification

  • node syntax-check of the hook and the inner browser <script> (compile-only via new Function).
  • 19 unit assertions over the pure logic (normCode/fmtCode/length gate): dashed↔dashless mapping, live formatting, 8-char cap, null-safety, and the submit gate accepting full codes (dashed or not) while rejecting short/empty. All pass.
  • Full sign-in E2E against the deployed backend is a redeploy-time check (consistent with the rest of device-auth), but the substantive change here — code normalization + the entry UI — is verified above.

Docs

docs/device-auth-contract.md — noted the optional ?code= and the normalization on the /device route.

🤖 Generated with Claude Code

Closes #55. ## Problem The TV's sign-in screen tells the user to *"open `…/device` and enter the code"*, but `device_page.pb.js` only worked when opened with `?code=` (what the QR encodes). Opening `…/device` bare showed **"Chybí kód zařízení v odkazu."** and hid the form — there was **no field to type the `XXXX-XXXX` code into**. So the QR/direct-link path worked, but the "type the code" path the TV advertises didn't exist. ## Fix Added a **code-entry field** shown when the page is opened without `?code=`: - User types the `XXXX-XXXX` code from the TV; input **formats live** to `XXXX-XXXX` and **Enter** submits. - The code is **normalized** (`normCode`: uppercase, strip dash/spaces, cap at 8) to the **dash-less** form the server stores — the fix the issue called for — before the `/info` + `/approve` lookups. - On success the sign-in form is revealed; an **unknown/expired code re-shows the field prefilled** for correction instead of dead-ending. - The **QR / direct-link path is unchanged** — `CODE` now also runs through the same normalizer, so even a dashed link works. No new endpoints, no crypto changes, self-contained page (no external assets) preserved. ## Verification - `node` syntax-check of the hook **and** the inner browser `<script>` (compile-only via `new Function`). - **19 unit assertions** over the pure logic (`normCode`/`fmtCode`/length gate): dashed↔dashless mapping, live formatting, 8-char cap, null-safety, and the submit gate accepting full codes (dashed or not) while rejecting short/empty. All pass. - Full sign-in E2E against the deployed backend is a redeploy-time check (consistent with the rest of device-auth), but the substantive change here — code normalization + the entry UI — is verified above. ## Docs `docs/device-auth-contract.md` — noted the optional `?code=` and the normalization on the `/device` route. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
richiexec added 1 commit 2026-07-20 09:07:16 +00:00 
The TV's sign-in screen tells the user to open …/device and enter the code,
but the approve page only worked when opened with ?code= (what the QR encodes)
— opening it bare showed 'Chybí kód zařízení v odkazu.' with no way to type
the code.

Add a code-entry field shown when the page is opened without ?code=: the user
types the XXXX-XXXX code from the TV, it's normalized (uppercase, dash/space
stripped, capped at 8) to the dash-less form the server stores before the /info
+ /approve lookups, then the sign-in form is revealed. Input formats live to
XXXX-XXXX; Enter submits; an unknown/expired code re-shows the field prefilled
for correction instead of dead-ending. The QR/direct-link path is unchanged
(CODE now also runs through the same normalizer, so a dashed link works too).

Docs: note the optional ?code= + normalization in device-auth-contract.md.

Verified: node syntax-check of the hook + inner page script, and 19 unit
assertions over the normCode/fmtCode/length-gate logic (dashed↔dashless,
formatting, cap, validation).
richiexec merged commit a1982fd760 into main 2026-07-20 09:08:52 +00:00
richiexec deleted branch fix/device-approve-code-entry 2026-07-20 09:08:52 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: richiexec/amber-backend#5
No description provided.
Delete branch "fix/device-approve-code-entry"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?