DA Onboarding: async login service

[knolleary]

Description

This task is to create an async login service in support of the new Device Agent onboarding flow - FlowFuse/device-agent#678

This is going to make use of the rendezvous pattern

1. An agent does POST /start/device/registration (url tbd)
2. An AsyncLoginSession database record is created including:
   • sessionToken (text) - a session identifier token. Must not be guessable or enumerable.
   • doneToken (text) - a session identifier token. Must not be guessable or enumerable.
   • status - pending|success|failure - the state of the session
   • result (text) - a JSON blob containing the 'result' of the login session
3. The session/done tokens are returned in response to the POST:
   • registerURL: TBD/{sessionToken}
   • doneURL: TBD/{doneToken}
4. The agent prompts the user to access registerURL in their browser
5. They create a new remote instance.
6. On completion, the device OTC is written to the AsyncLoginSession.result field and the session status marked success.

A new endpoint GET {doneURL} can be polled to get the current status.

• If status is pending, it returns 202 and sets the Retry-After header to 5/10 seconds.
• if status is success, it returns 200 with the result in the payload.
• If status is error, it returns 401 with the value of result.
• If doneToken can't be correlated to an AsyncLoginSession it returns 404.

It only returns result once before the AsyncLoginSession record is deleted.

The AsyncLoginSession will have a max-age of 30 minutes - after which any access to its doneToken will result in a 404.

---

The scope of this task is to build the core infrastructure for the async login service. The UI work to complete step 3 (They create a new remote instance) is a separate task that will plug into this.

Epic/Story

No response

Have you provided an initial effort estimate for this issue?

I have provided an initial effort estimate