Add device authorization flow for TV-app-style pairing (RFC 8628)

backend/alembic/versions/0088_devices_client_identifier.py

@@ -0,0 +1,36 @@
+"""Add client_device_identifier to devices
+
+Revision ID: 0088_devices_client_identifier
+Revises: 0087_save_state_visibility
+Create Date: 2026-04-24 00:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "0088_devices_client_identifier"
+down_revision = "0087_save_state_visibility"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("devices", schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column("client_device_identifier", sa.String(length=255), nullable=True),
+            if_not_exists=True,
+        )
+        batch_op.create_index(
+            "ix_devices_user_client_identifier",
+            ["user_id", "client_device_identifier"],
+            unique=True,
+            if_not_exists=True,
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("devices", schema=None) as batch_op:
+        batch_op.drop_index("ix_devices_user_client_identifier", if_exists=True)
+        batch_op.drop_column("client_device_identifier", if_exists=True)

backend/alembic/versions/0089_client_tokens_device_id.py

@@ -0,0 +1,45 @@
+"""Add device_id FK to client_tokens
+
+Revision ID: 0089_client_tokens_device_id
+Revises: 0088_devices_client_identifier
+Create Date: 2026-04-24 00:00:00.000000
+
+"""
+
+import sqlalchemy as sa
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision = "0089_client_tokens_device_id"
+down_revision = "0088_devices_client_identifier"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("client_tokens", schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column("device_id", sa.String(length=255), nullable=True),
+            if_not_exists=True,
+        )
+        batch_op.create_foreign_key(
+            "fk_client_tokens_device_id",
+            "devices",
+            ["device_id"],
+            ["id"],
+            ondelete="SET NULL",
+        )
+        batch_op.create_index(
+            "ix_client_tokens_device_id",
+            ["device_id"],
+            unique=False,
+            if_not_exists=True,
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("client_tokens", schema=None) as batch_op:
+        # Drop FK before the backing index -- MariaDB refuses otherwise
+        batch_op.drop_constraint("fk_client_tokens_device_id", type_="foreignkey")
+        batch_op.drop_index("ix_client_tokens_device_id", if_exists=True)
+        batch_op.drop_column("device_id", if_exists=True)

backend/decorators/database.py

@@ -10,7 +10,8 @@
 def begin_session(func):
     @functools.wraps(func)
     def wrapper(*args, **kwargs):
-        if hasattr(kwargs, "session"):
+        # Reuse a caller-provided session so the handler can join an existing unit of work
+        if kwargs.get("session") is not None:
             return func(*args, **kwargs)
 
         try:

backend/docker-compose.test.yml

@@ -0,0 +1,37 @@
+# Local test infrastructure matching .github/workflows/pytest.yml.
+# Usage: docker compose -f docker-compose.test.yml up -d
+#        uv run pytest
+services:
+  mariadb:
+    image: mariadb:10.11
+    ports:
+      - "3306:3306"
+    environment:
+      MYSQL_USER: romm_test
+      MYSQL_PASSWORD: passwd
+      MYSQL_DATABASE: romm_test
+      MYSQL_ROOT_PASSWORD: passwd
+    healthcheck:
+      test:
+        [
+          "CMD",
+          "mariadb-admin",
+          "ping",
+          "-h",
+          "127.0.0.1",
+          "-uroot",
+          "-ppasswd",
+        ]
+      interval: 5s
+      timeout: 2s
+      retries: 10
+
+  valkey:
+    image: valkey/valkey:7.2
+    ports:
+      - "6379:6379"
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 2s
+      retries: 10