mobile sso login flow

client.go

@@ -664,8 +664,9 @@ func (c *Client) postDNClient(ctx context.Context, reqType string, value []byte,
 	}
 }
 
-// callAPI returns the request ID, requested response data, and any error if applicable.
-func callAPI[T any](ctx context.Context, c *Client, method string, endpoint string, payload any) (string, *T, error) {
+// callAPI returns the request ID, requested response data, and any error if applicable. Optional
+// reqOpts are applied to the request before it is sent (e.g. to add an Authorization header).
+func callAPI[T any](ctx context.Context, c *Client, method string, endpoint string, payload any, reqOpts ...func(*http.Request)) (string, *T, error) {
 	dest, err := urlPath(c.dnServer, endpoint)
 	if err != nil {
 		return "", nil, err
@@ -685,6 +686,10 @@ func callAPI[T any](ctx context.Context, c *Client, method string, endpoint stri
 		return "", nil, err
 	}
 
+	for _, opt := range reqOpts {
+		opt(req)
+	}
+
 	resp, err := c.client.Do(req)
 	if err != nil {
 		return "", nil, err
@@ -804,6 +809,52 @@ func (c *Client) Downloads(ctx context.Context) (*message.DownloadsData, error)
 	return d, err
 }
 
+// EndpointPreAuthV2 begins the v2 (token flow) endpoint auth. Drive the returned LoginURL in a
+// browser, then poll with EndpointAuthPollV2 using the returned PollToken.
+func (c *Client) EndpointPreAuthV2(ctx context.Context) (*message.PreAuthData, error) {
+	_, d, err := callAPI[message.PreAuthData](ctx, c, "POST", message.PreAuthEndpointV2, nil)
+	return d, err
+}
+
+// EndpointAuthPollV2 polls a v2 auth in flight. Once Status is COMPLETED, AuthToken is set and is
+// used to authenticate the host-management calls below.
+func (c *Client) EndpointAuthPollV2(ctx context.Context, pollCode string) (*message.EndpointAuthPollDataV2, error) {
+	pollURL := fmt.Sprintf("%s?pollToken=%s", message.AuthPollEndpointV2, url.QueryEscape(pollCode))
+	_, d, err := callAPI[message.EndpointAuthPollDataV2](ctx, c, "GET", pollURL, nil)
+	return d, err
+}
+
+// ListEndpointHosts returns the hosts owned by the authenticated endpoint OIDC user. authToken is an
+// endpoint OIDC user auth token obtained from EndpointAuthPollV2.
+func (c *Client) ListEndpointHosts(ctx context.Context, authToken string) (*message.EndpointAuthHostsData, error) {
+	_, d, err := callAPI[message.EndpointAuthHostsData](ctx, c, "GET", message.EndpointAuthHostsEndpoint, nil, bearer(authToken))
+	return d, err
+}
+
+// CreateEndpointHost creates a new host for the authenticated endpoint OIDC user and returns an
+// enrollment code to redeem via Enroll. This is the explicit "add a new device" action.
+func (c *Client) CreateEndpointHost(ctx context.Context, authToken string) (*message.EndpointAuthEnrollData, error) {
+	_, d, err := callAPI[message.EndpointAuthEnrollData](ctx, c, "POST", message.EndpointAuthHostsEndpoint, nil, bearer(authToken))
+	return d, err
+}
+
+// RenewEndpointHost grants an existing host owned by the authenticated endpoint OIDC user a fresh
+// network-access window. No enrollment code is issued: the host fetches its renewed certificate and
+// config through its own (host-key-signed) update flow — call LongPollWait/DoUpdate with the host's
+// stored credentials after this returns.
+func (c *Client) RenewEndpointHost(ctx context.Context, authToken string, hostID string) (*message.EndpointAuthRenewData, error) {
+	endpoint := fmt.Sprintf("%s/%s/renew", message.EndpointAuthHostsEndpoint, url.PathEscape(hostID))
+	_, d, err := callAPI[message.EndpointAuthRenewData](ctx, c, "POST", endpoint, nil, bearer(authToken))
+	return d, err
+}
+
+// bearer returns a request option that sets the Authorization header to the given bearer token.
+func bearer(token string) func(*http.Request) {
+	return func(req *http.Request) {
+		req.Header.Set("Authorization", "Bearer "+token)
+	}
+}
+
 func urlPath(base, path string) (string, error) {
 	baseURL, err := url.Parse(base)
 	if err != nil {

client_test.go

@@ -1279,6 +1279,69 @@ func TestDoOidcPoll(t *testing.T) {
 	assert.Equal(t, 0, ts.RequestsRemaining())
 }
 
+func TestEndpointTokenFlowV2(t *testing.T) {
+	t.Parallel()
+
+	useragent := "dnclientUnitTests/1.0.0 (not a real client)"
+	ts := dnapitest.NewServer(useragent)
+	client := NewClient(useragent, ts.URL)
+	t.Cleanup(func() { ts.Close() })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+	defer cancel()
+
+	// preauth (v2)
+	ts.ExpectAPIRequest(http.StatusOK, func(any) []byte {
+		return jsonMarshal(message.APIResponse[message.PreAuthData]{Data: message.PreAuthData{PollToken: "poll-1", LoginURL: "https://example.com/login"}})
+	})
+	pre, err := client.EndpointPreAuthV2(ctx)
+	require.NoError(t, err)
+	assert.Equal(t, "poll-1", pre.PollToken)
+
+	// poll (v2) completes with an auth token
+	ts.ExpectAPIRequest(http.StatusOK, func(any) []byte {
+		return jsonMarshal(message.APIResponse[message.EndpointAuthPollDataV2]{Data: message.EndpointAuthPollDataV2{
+			Status:    message.EndpointAuthCompleted,
+			AuthToken: "eou-token",
+		}})
+	})
+	poll, err := client.EndpointAuthPollV2(ctx, "poll-1")
+	require.NoError(t, err)
+	assert.Equal(t, message.EndpointAuthCompleted, poll.Status)
+	assert.Equal(t, "eou-token", poll.AuthToken)
+
+	// list hosts (empty)
+	ts.ExpectAPIRequest(http.StatusOK, func(any) []byte {
+		return jsonMarshal(message.APIResponse[message.EndpointAuthHostsData]{Data: message.EndpointAuthHostsData{Hosts: []message.EndpointAuthHost{}}})
+	})
+	hosts, err := client.ListEndpointHosts(ctx, poll.AuthToken)
+	require.NoError(t, err)
+	assert.Empty(t, hosts.Hosts)
+
+	// create a host
+	ts.ExpectAPIRequest(http.StatusOK, func(any) []byte {
+		return jsonMarshal(message.APIResponse[message.EndpointAuthEnrollData]{Data: message.EndpointAuthEnrollData{HostID: "host-1", EnrollmentCode: "code-new"}})
+	})
+	created, err := client.CreateEndpointHost(ctx, poll.AuthToken)
+	require.NoError(t, err)
+	assert.Equal(t, "host-1", created.HostID)
+	assert.Equal(t, "code-new", created.EnrollmentCode)
+
+	// renew the existing host: no enrollment code, just a fresh network-access window
+	until := time.Now().Add(8 * time.Hour).UTC().Truncate(time.Second)
+	ts.ExpectAPIRequest(http.StatusOK, func(any) []byte {
+		return jsonMarshal(message.APIResponse[message.EndpointAuthRenewData]{Data: message.EndpointAuthRenewData{HostID: "host-1", NetworkAccessUntil: &until}})
+	})
+	renew, err := client.RenewEndpointHost(ctx, poll.AuthToken, "host-1")
+	require.NoError(t, err)
+	assert.Equal(t, "host-1", renew.HostID)
+	require.NotNil(t, renew.NetworkAccessUntil)
+	assert.True(t, until.Equal(*renew.NetworkAccessUntil))
+
+	assert.Empty(t, ts.Errors())
+	assert.Equal(t, 0, ts.RequestsRemaining())
+}
+
 func TestDownloads(t *testing.T) {
 	t.Parallel()
 

dnapitest/dnapitest.go

@@ -17,6 +17,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
+	"strings"
 	"time"
 
 	"github.com/DefinedNet/dnapi/keys"
@@ -79,12 +80,30 @@ func (s *Server) handler(w http.ResponseWriter, r *http.Request) {
 		s.expectedRequests = s.expectedRequests[1:]
 		w.WriteHeader(expected.StatusCode())
 		_, _ = w.Write(expected.Respond(nil))
+	case message.PreAuthEndpointV2, message.EndpointAuthHostsEndpoint:
+		s.handlerQueued(w, r)
+	case message.AuthPollEndpointV2:
+		s.handlerDoOidcPoll(w, r)
 	default:
+		// The renew path embeds the host ID (/v2/endpoint-auth/hosts/{hostID}/renew).
+		if strings.HasPrefix(r.URL.Path, message.EndpointAuthHostsEndpoint+"/") && strings.HasSuffix(r.URL.Path, "/renew") {
+			s.handlerQueued(w, r)
+			return
+		}
 		s.errors = append(s.errors, fmt.Errorf("invalid request path %s", r.URL.Path))
 		http.NotFound(w, r)
 	}
 }
 
+// handlerQueued responds with the next queued mock response, regardless of request contents. Used
+// for endpoints whose requests carry no fields the mock needs to validate.
+func (s *Server) handlerQueued(w http.ResponseWriter, _ *http.Request) {
+	expected := s.expectedRequests[0]
+	s.expectedRequests = s.expectedRequests[1:]
+	w.WriteHeader(expected.StatusCode())
+	_, _ = w.Write(expected.Respond(nil))
+}
+
 func (s *Server) handlerEnroll(w http.ResponseWriter, r *http.Request) {
 	// Get the test case to validate
 	expectedRaw := s.expectedRequests[0]

message/message.go

@@ -269,6 +269,58 @@ type EndpointAuthPollData struct {
 	EnrollmentCode string            `json:"enrollmentCode"`
 }
 
+// PreAuthEndpointV2 begins the v2 (token flow) endpoint auth. Unlike v1, a completed auth yields an
+// endpoint OIDC user auth token rather than an enrollment code.
+const PreAuthEndpointV2 = "/v2/endpoint-auth/preauth"
+
+// AuthPollEndpointV2 is polled during the v2 flow. On completion it returns an AuthToken.
+const AuthPollEndpointV2 = "/v2/endpoint-auth/poll"
+
+// EndpointAuthPollDataV2 is returned by AuthPollEndpointV2.
+type EndpointAuthPollDataV2 struct {
+	Status EndpointAuthState `json:"state"`
+	// AuthToken is set once Status is COMPLETED. It is an endpoint OIDC user auth token used to
+	// authenticate the host-management endpoints below.
+	AuthToken string `json:"authToken"`
+}
+
+// EndpointAuthHostsEndpoint lists the hosts owned by the authenticated endpoint OIDC user, and
+// (via POST) creates a new host. Requires an endpoint OIDC user auth token.
+const EndpointAuthHostsEndpoint = "/v2/endpoint-auth/hosts"
+
+// EndpointAuthHost summarizes a host owned by the authenticated endpoint OIDC user.
+type EndpointAuthHost struct {
+	ID                 string     `json:"id"`
+	Name               string     `json:"name"`
+	NetworkID          string     `json:"networkID"`
+	IsBlocked          bool       `json:"isBlocked"`
+	NetworkAccessUntil *time.Time `json:"networkAccessUntil"`
+	CreatedAt          time.Time  `json:"createdAt"`
+}
+
+// EndpointAuthHostsData is returned by a GET to EndpointAuthHostsEndpoint.
+type EndpointAuthHostsData struct {
+	Hosts []EndpointAuthHost `json:"hosts"`
+}
+
+// EndpointAuthEnrollData is returned when creating a host. The client redeems EnrollmentCode via
+// EnrollEndpoint to bring the newly-created host online. Do NOT send the endpoint OIDC user auth
+// token on the enroll call — EnrollEndpoint rejects requests carrying one.
+type EndpointAuthEnrollData struct {
+	HostID         string `json:"hostID"`
+	EnrollmentCode string `json:"enrollmentCode"`
+}
+
+// EndpointAuthRenewData is returned when renewing a host. The host has been granted a fresh
+// network-access window and queued for update; it fetches its renewed certificate and config
+// through its own (host-key-signed) update flow, so no enrollment code is issued — the server
+// never overwrites the host's key. NetworkAccessUntil is nil when the provider imposes no
+// session expiry.
+type EndpointAuthRenewData struct {
+	HostID             string     `json:"hostID"`
+	NetworkAccessUntil *time.Time `json:"networkAccessUntil"`
+}
+
 const DownloadsEndpoint = "/v1/downloads"
 
 type DownloadsData struct {