feat(p1.6): mobile pairing via QR code#86
Merged
Merged
Conversation
P1.6 roadmap item. Desktop user generates a 5-minute one-time pairing token via /api/pair/create; mobile scans QR, calls /api/pair/consume, gets a fresh atk_ token (same user, source= 'pairing') plus the relay URL. Token storage mirrors the existing invitation pattern in userstore.
Six phases (A-F), ~16 tasks. Phase A corrects spec §5.2/§5.4 to require a Wails binding (the renderer can't hold the API token). B-C land the relay backend (userstore pairing + HTTP endpoints). D-E land desktop PairingPanel and mobile MobileSetup + PairingConsume. F wraps with i18n and an end-to-end smoke gate.
D4. Adds PairingPanel.vue which calls createPairingToken (D2), renders the qr_url as a 240px PNG via qrcode (D3), shows a 5-minute countdown, and flips to an expired state at zero. Embedded at the bottom of the relay settings pane. Also adds the minimum settings.relay.pairing.* i18n keys to en + zh-CN so the MessageKey union covers PairingPanel's t() calls (vue-tsc). F1 will polish copy and add the remaining keys for E3/E4. Tests (test-first, all three from the plan): idle button, generated QR + countdown, expired state after timer advance.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Implements P1.6 from the roadmap: a logged-in desktop user generates a 5-minute single-use QR code; a fresh mobile install scans it and skips the manual relay-URL + API-token typing.
pairing_tokenstable +api_tokens.sourcecolumn.POST /api/pair/create(Bearer-auth-gated, 10/min/user) mints apair_…token and returns{token, expires_at, qr_url}.POST /api/pair/consume(public, 10/min/IP) atomically consumes the token, mints a freshatk_…for the same user (source='pairing'), and returns{relay_url, api_token, user}. Anti-oracle: invalid/expired/already-consumed all collapse to404 {code:"pair_invalid"}.App.CreatePairingTokenWails binding (mirrorsFetchRelayMe);PairingPanel.vueembedded in Settings → Relay renders a 240×240 QR via the newqrcodedep with a live 5:00 countdown and regenerate button.@capacitor-mlkit/barcode-scanningplugin +NSCameraUsageDescription.MobileSetup.vuegrows a primary "Scan QR" button; on scan,PairingConsume.vueparses the URL, callsconsumePairing, writes the result intolocalStorage['atterm.relay'], and emitsconnected.settings.relay.pairing.*andmobile.pairing.*keys in both en + zh-CN.Spec:
docs/superpowers/specs/2026-05-31-pairing-qr-design.mdPlan:
docs/superpowers/plans/2026-05-31-pairing-qr.mdTest Plan
go test ./...— all greennpm test— 73 files / 614 tests greennpm run build:wails— succeedsnpm run build:capacitor— succeeds/api/meround-trip with new token, 404 on second consume, 404 on unknownFollow-ups (from final review, not blocking)
/api/pair/createfor parity with other state-mutating routesrelay_urlto avoid silent http downgrades through a misconfigured proxyuser.idas int + anamefield — code returns string ULID and no name. Update the spec text.