Add async registration flow for devices by knolleary · Pull Request #7820 · FlowFuse/flowfuse

knolleary · 2026-07-14T10:57:41Z

This creates an async device registration service that allows a Device Agent to direct a user to a URL to get their device registered, and have the OTC registration code get returned to the device.

We don't have the corresponding Device Agent changes (yet), but to test this PR you can simulate it on the command line.

In these examples, I'm assuming you are testing against a forge app running on localhost:3000 - you'll need to adjusted the hostname/port as appropriate.

Start an async registration:

curl -X POST http://localhost:3000/api/v1/devices/_/register

This will return an JSON object with registerUrl and doneUrl. Note they are actually paths rather than full URLs.
Open registerUrl in your browser. It will take you through the device registration process. At the end, it shows you the OTC for the newly registered device.
Poll the doneUrl in the background - it will return 202 status code whilst the registration process is in progress. Once the device has been registered, this url will return 200 with the otc in the payload object. It will only do this once - subsequent requests will 404.

I have added UTs for the backend apis that cover all the interactions with the API. I have not done any UI Test coverage.

There are a couple items outstanding (that may be follow up PRs)

billing notification (show the pricing table if the device registration will incur charges)
check the full end-to-end "a user has to sign-up first, then gets redirected back to this flow". I have done that a couple times, but need to double check it all.

cstns

Looking very good overall, just a few minor nitpicks from me. The most important one is the rate limiter on the registration endpoint.

cstns · 2026-07-14T16:08:56Z

+        const age = Date.now() - session.createdAt.getTime()
+        if (age > 1000 * 60 * 30) {
+            // session is older than 30 minutes, expire it
+            await session.destroy()


I feel we should also add a housekeeper task to do a daily cleanup. Some tokens might be created and never used and remain stale.

cstns · 2026-07-15T14:37:05Z

+    <div class="ff-layout--plain">
+        <div class="ff-header">
+            <!-- Mobile: Icon-only logo -->
+            <img class="ff-logo lg:hidden" src="/ff-minimal-red.svg" alt="FlowFuse">


this should be wrapped in an anchor link to enable navigation when clicked.

Found myself in a situation where i couldn't navigate back home without altering the url. Also worth adding a home button under the The registration session you are trying to use is invalid or has expired. Please start the registration process again. notice, similar to our 404 pages

cstns · 2026-07-15T14:48:45Z

@@ -0,0 +1,261 @@
+<template>
+    <MultiStepForm
+        ref="multiStepForm"


I'm unable to navigate through the steps by clicking the progress step indicator

Don't blame the guy using your component 😉 . This has always been the case AFAIK, unless there's some secret sauce I've missed.

I vaguely remember adding something that allowed you to block particular steps or all of them, I need to check sure

I added a way to disable the top indicators, but a flag check is tripping it up. I'll raise a separate fix for it

cstns · 2026-07-15T14:59:35Z

        })
    })

+    describe.only('Async device registration', async function () {


dev leftover

cstns · 2026-07-15T15:00:01Z

+                    if (this.registrationSession) {
+                        payload.registrationSession = this.registrationSession
+                    }
+                    console.log(payload)


dev leftover

cstns · 2026-07-15T15:29:31Z

            <p>Applications are used to manage and group together your Node-RED Instances and resources.</p>

-            <div v-if="writableApplications.length > 5" class="search-wrapper flex justify-center my-2">
+            <div v-if="writableApplications.length > 1" class="search-wrapper flex justify-center my-2">


I'm trying to understand why this was shown only if we had more than 5 writ-able applications

This was the choice someone made in the original form. Presumably, if there are <6, then they are all visible and quick to pick from the list. Only if there is more does the list become harder to manage and the filter is helpful.

I may be guilty of that, looking at it now it seems to be an arbitrary number

cstns · 2026-07-15T15:30:34Z

+    name: 'ff-layout-plain',
+    computed: {
+        ...mapState(useUxStore, ['overlay']),
+        ...mapState(useProductBrokersStore, ['interview']),


do we need this?

cstns · 2026-07-15T15:34:14Z

@@ -52,25 +52,6 @@ export default {
        ...mapState(useUxStore, ['overlay']),
        ...mapState(useProductBrokersStore, ['interview']),
        ...mapState(useAccountSettingsStore, ['hasAvailableTeams'])


...mapState(useAccountSettingsStore, ['hasAvailableTeams']) can also be removed as it was only used in the stale block you removed

cstns · 2026-07-15T15:35:52Z

+        meta: {
+            title: 'Register Remote Instance',
+            layout: 'plain'
+            // menu: {


we should remove this, there's nowhere to go back from, this was a newly opened page

knolleary added 4 commits July 14, 2026 09:44

Add plain layout

e747383

Add AsyncLoginSession model

ff2058c

Add device async registration flow

c1d238a

Add async device registration flow

b8c7cc9

knolleary added the area:migration Involves a database migration label Jul 14, 2026

knolleary requested a review from cstns July 14, 2026 10:58

knolleary changed the title ~~7731 asyncsession api~~ Add async registration flow for devices Jul 14, 2026

knolleary temporarily deployed to staging July 14, 2026 11:01 — with GitHub Actions Inactive

cstns requested changes Jul 15, 2026

View reviewed changes

knolleary added 2 commits July 17, 2026 17:24

Add index for doneToken

5f51877

Tidy up misc items from review

34bf5f7

knolleary temporarily deployed to staging July 17, 2026 16:32 — with GitHub Actions Inactive

Uh oh!

Conversation

knolleary commented Jul 14, 2026

Uh oh!

cstns left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants