feat: add device token auth and devices cli

src/infra/device-pairing.test.ts

@@ -0,0 +1,43 @@
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import {
+  approveDevicePairing,
+  getPairedDevice,
+  requestDevicePairing,
+  rotateDeviceToken,
+} from "./device-pairing.js";
+
+describe("device pairing tokens", () => {
+  test("preserves existing token scopes when rotating without scopes", async () => {
+    const baseDir = await mkdtemp(join(tmpdir(), "clawdbot-device-pairing-"));
+    const request = await requestDevicePairing(
+      {
+        deviceId: "device-1",
+        publicKey: "public-key-1",
+        role: "operator",
+        scopes: ["operator.admin"],
+      },
+      baseDir,
+    );
+    await approveDevicePairing(request.request.requestId, baseDir);
+
+    await rotateDeviceToken({
+      deviceId: "device-1",
+      role: "operator",
+      scopes: ["operator.read"],
+      baseDir,
+    });
+    let paired = await getPairedDevice("device-1", baseDir);
+    expect(paired?.tokens?.operator?.scopes).toEqual(["operator.read"]);
+
+    await rotateDeviceToken({
+      deviceId: "device-1",
+      role: "operator",
+      baseDir,
+    });
+    paired = await getPairedDevice("device-1", baseDir);
+    expect(paired?.tokens?.operator?.scopes).toEqual(["operator.read"]);
+  });
+});