activeadmin-device_authorization 0.1.3

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 17955a07d8a7c82ff64a20e93c37a448417e69dad7581fb3c80bd087db93210f
+  data.tar.gz: 5d6a98485620a0501dc4325c5c40b7e7eb2c895d8793dfe6504e91ee937b07db
+SHA512:
+  metadata.gz: 8c6a2334c39150906f51ff4cd2ac98c595752c0b318051a2d3823fb83f3b8b27d32d1a641294451440acba61a4b0892bbce07de62447bc1d959d9db55ac9aa42
+  data.tar.gz: ea90ab0aa9708c0eb4f9232782ac28f688cd1e9608ecef79e5207ed77550e53ebe98ceca5c9e51bb9c37ab321ebb25c2e548ff026825c8f7cdf4837165fab58a

data/CHANGELOG.md

@@ -0,0 +1,25 @@
+# CHANGELOG
+
+## Unreleased
+
+## 0.1.3 (2026-10-26)
+
+- Add RFC 8628 device authorization with ActiveAdmin consent, token exchange, and retention helpers
+- Add English, Finnish, and Swedish strings for the consent and code-entry UI
+- Add a schedulable retention task for expired authorization records
+- Require Rails 7.2.3.2 or newer
+- Require host rate limits before mounting the public OAuth endpoints and fail closed unless a limiter returns true
+- Reject unknown and client-disallowed scopes with `invalid_scope`
+- Return protocol-correct OAuth errors and cache-prevention headers
+- Protect standalone consent decisions from cross-site request forgery
+- Filter `device_code`, `user_code`, and `access_token` from Rails request logs
+- Serve standalone code-entry and consent pages, normalize entered user codes, and prompt code comparison with the device
+- Run consent and token callbacks after commit without hiding committed results when a callback fails
+- Draw absolute controller paths so nesting under `namespace :admin` does not prefix `Admin::` onto gem controllers
+- Clamp consent absolute TTL against `access_token_absolute_ttl`
+- Delete idle-expired tokens during retention
+- Raise the required poll interval by `slow_down_increment` when the grant stores `poll_interval_seconds`
+- Document public install from RubyGems or git, host rate-limit / HTTPS / Host / retention duties, and `make release`
+- Improve standalone consent markup for narrow screens, contrast on the code-comparison prompt, and readable user codes
+- Require Ruby 3.4 or newer (Rails 7.2 pulls `rdoc` 8 / `rbs` 4, which need Ruby 3.3+)
+- Wire Polyrun coverage collection and CI coverage reporting so `coverage/merged.json` is produced

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,26 @@
+# Code of Conduct
+
+## Pledge
+
+Participation is a harassment-free experience. Treat each other with respect. Keep private context private.
+
+## Expected behavior
+
+- Engage with genuine curiosity. Admit uncertainty.
+- Own every line you submit, including generated code.
+- Correct errors politely.
+- Use language that welcomes people and respects identity and privacy.
+
+## Unacceptable behavior
+
+- Harassment, trolling, or insulting comments, public or private.
+- Using jargon or volume, including automated spam, to silence others.
+- Sharing others' data or personal context without permission.
+
+## Automation
+
+You remain responsible for bugs, security holes, and bias in generated artifacts you submit.
+
+## Enforcement
+
+Report abusive or harassing behavior to contact@kiskolabs.com. Reports are reviewed and investigated.

data/CONTRIBUTING.md

@@ -0,0 +1,23 @@
+# Contributing Guidelines
+
+## Automation authorship
+
+You may use AI and automation tools. You remain the author of every line you submit: review, debug, and understand the change.
+
+Keep pull requests small enough to review. Annotate non-obvious logic.
+
+Never send project secrets or private context to public models.
+
+## How to contribute
+
+### Reporting issues
+
+Verify the facts before filing. Use issue templates for goals, constraints, and reproduction steps.
+
+### Pull requests
+
+Keep one pull request to one goal. Explain why the change is needed. Run smoke tests and regression checks locally before opening the request.
+
+### Review
+
+Reviewers will ask about approach and trade-offs. Treat suggested changes as part of the work.

data/GOVERNANCE.md

@@ -0,0 +1,25 @@
+# Project Governance
+
+## Roles
+
+### Contributors
+
+Anyone who submits code, documentation, or participates in discussions. Contributors take ownership of problems they identify and follow the project's quality standards.
+
+### Maintainers
+
+Maintainers:
+
+1. Set scope and architectural direction.
+2. Review contributions (human or automated) against security and logic standards.
+3. Decide when the community is divided.
+
+## Decision making
+
+### Lazy consensus
+
+For routine changes, a proposal that draws no objection within two weeks is approved.
+
+### Maintainer approval
+
+Major architectural changes, high-risk automation integrations, or changes that affect business logic need explicit maintainer approval. A change must solve a real problem.

data/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 amkisko
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,162 @@
+# activeadmin-device_authorization
+
+[![Test Status](https://github.com/amkisko/activeadmin-device_authorization.rb/actions/workflows/test.yml/badge.svg)](https://github.com/amkisko/activeadmin-device_authorization.rb/actions/workflows/test.yml)
+
+RFC 8628-style device authorization for ActiveAdmin: public device/token endpoints, signed-in consent in the admin UI, and short-lived bearer access tokens.
+
+## Requirements
+
+- Ruby 3.4+
+- Rails 7.2.3.2+
+- ActiveAdmin 3.2+
+
+## Install
+
+From RubyGems after a release:
+
+```ruby
+# Gemfile
+gem "activeadmin-device_authorization"
+```
+
+From git:
+
+```ruby
+# Gemfile
+gem "activeadmin-device_authorization", github: "amkisko/activeadmin-device_authorization.rb"
+```
+
+Maintainers publish with `make release` (`usr/bin/release.rb`), which builds, pushes to RubyGems, tags the version, and creates a GitHub release.
+
+## Why these settings are configurable
+
+- `challenge_expires_in` (default 600s): RFC 8628 requires `expires_in` for device/user codes. The RFC example is 1800s; Doorkeeper device grant defaults to 300s. Always required; device codes must expire.
+- `poll_interval` (default 5s): RFC 8628 `interval`; clients must use 5 when omitted.
+- `slow_down_increment` (default 5s): RFC 8628 `slow_down` requires increasing the interval by 5s. Keep 5 unless you have a documented reason.
+- `access_token_absolute_ttl` (default 4h): Absolute bearer cap (RFC 6819 short-lived access tokens). Set to `nil` to disable absolute expiry.
+- `access_token_idle_ttl` (default 1h): Idle timeout after last successful use (common IdP pattern with an absolute max). Set to `nil` to disable idle expiry.
+- `access_token_default_absolute_ttl` / min / max / `choices`: Consent UI lifetime picker and clamp so a client cannot ask for longer than the host allows.
+- Both access TTLs `nil`: revoke-only. Allowed for low-risk hosts; not recommended for admin APIs that can read or act on customer data.
+- `user_code_*`: RFC 8628 end-user code shape (default 8 characters in groups of 4; ambiguous I/O omitted).
+- `grant_retention_period` / `token_retention_period`: Bounded cleanup of unused challenges and expired or revoked tokens.
+- Model class names: host keeps its own ActiveRecord models; the gem drives protocol against them.
+- Scope lists, labels, and audit callbacks: product-specific; stay in the host.
+- Rate-limit procs: host wires abuse limits; both are required before routes can be drawn.
+
+## Setup
+
+```ruby
+# config/initializers/active_admin_device_authorization.rb
+ActiveAdmin::DeviceAuthorization.configure do |config|
+  config.resource_owner_class_name = "AdminUser"
+  config.client_class_name = "DeviceAuthorizationClient"
+  config.grant_class_name = "DeviceAuthorizationGrant"
+  config.access_token_class_name = "DeviceAuthorizationAccessToken"
+  config.current_resource_owner = ->(controller) { controller.current_admin_user }
+
+  config.scopes = %w[api:read api:write]
+  config.default_scopes = %w[api:read api:write]
+  config.scope_labels = {
+    "api:read" => "API read",
+    "api:write" => "API write"
+  }
+
+  # Optional: disable idle expiry
+  # config.access_token_idle_ttl = nil
+
+  # Optional: never expire until revoke (not recommended for admin APIs)
+  # config.access_token_absolute_ttl = nil
+  # config.access_token_idle_ttl = nil
+
+  config.on_consent_approved = ->(resource_owner:, grant:) { }
+  config.on_token_issued = ->(resource_owner:, token:) { }
+
+  # These host methods must return exactly true to admit the request. They may
+  # render their own response and return anything else to stop processing.
+  config.rate_limit_device_authorization = lambda { |controller|
+    DeviceAuthorizationRateLimits.allow_challenge?(controller.request)
+  }
+  config.rate_limit_token = lambda { |controller|
+    DeviceAuthorizationRateLimits.allow_poll?(controller.request)
+  }
+end
+```
+
+```ruby
+# config/routes.rb (inside the admin namespace)
+namespace :admin do
+  ActiveAdmin::DeviceAuthorization::Routes.draw(self)
+  # Optional: Routes.draw(self, consent: :controller) serves the code-entry and
+  # consent pages from the gem instead of ActiveAdmin page actions.
+end
+```
+
+OAuth controller paths are absolute (`/active_admin/device_authorization/...`) so nesting under `namespace :admin` does not invent `Admin::ActiveAdmin::...` constants. Consent defaults to the ActiveAdmin page (`device_auth#...`).
+
+`access_token_absolute_ttl` is the hard ceiling. Consent `min` / `max` / `default` / `choices` must sit inside that ceiling; `clamp_absolute_ttl` uses `min(access_token_max_absolute_ttl, access_token_absolute_ttl)`.
+
+Consent and token callbacks run after their database commit. A callback exception is reported through `Rails.error` and does not hide the committed decision or issued token from the caller. Use a durable host-side job or outbox when delivery must be retried.
+
+RFC 8628 `slow_down` raises the required poll interval by `slow_down_increment` when the grant stores `poll_interval_seconds`. Without that column, the server still returns `slow_down` against the base `poll_interval` only.
+
+### Host responsibilities
+
+The gem does not replace host security controls. Before production traffic:
+
+- Wire both `rate_limit_device_authorization` and `rate_limit_token`. Route mounting fails unless both are callable. Each request continues only when its limiter returns exactly `true`. Load-test the policies you choose.
+- Set `verification_base_url` to the host's trusted HTTPS origin in production. When it is unset, verification links use `request.base_url`, so the host must enforce HTTPS and reject untrusted `Host` headers.
+- Schedule `bundle exec rake active_admin:device_authorization:retention` at the cadence required by the host retention policy. Token retention deletes rows past `token_retention_period` after absolute expiry, revoke, or idle expiry (when idle TTL is enabled). Do not rely on absolute expiry alone when absolute TTL is nil (far-future sentinel).
+- Implement host models and indexes that match the contract below, including uniqueness and foreign keys.
+- Authenticate bearer tokens in the host API (see Bearer validation contract). The gem issues and expires tokens; it does not install API authentication middleware.
+
+### Host model contract
+
+- Client: `enabled` scope, `find_by!(client_id:)`, `allows_scopes?(scopes)`
+- Grant: `create!`, `exists?(user_code:)`, `lock.find_by(...)`, `pending?`, `mark_expired_if_needed!`, `requested_scopes` / `granted_scopes`, `last_poll_at`, optional `absolute_ttl_seconds`, optional `poll_interval_seconds` (raised after each `slow_down`), `has_one` access token
+- Access token: `create!` with digest, scopes, `absolute_expires_at`, `last_used_at`; optional `revoked_at`
+- Associations named from configured class names (`DeviceAuthorizationClient` -> `device_authorization_client`, and so on)
+- Grant states `pending`, `approved`, `denied`, and `expired`; only `pending` may transition to a terminal state, and an approved grant may have at most one access token
+- Unique indexes for client IDs, user codes, token digests, each client/device-code-digest pair, and the access token's grant foreign key; foreign keys for the grant, client, and resource owner associations
+- Indexes that support expiry, revoke, idle-use, and challenge-retention queries
+
+### Bearer validation contract
+
+The gem issues and expires tokens, but it does not install authentication in the host API. For every protected request, the host must digest the presented bearer value with `ActiveAdmin::DeviceAuthorization.config.digest`, find the matching token through the allowed client or resource-owner relation, reject it when `AccessTokenExpiry#expired?` is true, enforce its scopes, and update `last_used_at` only after successful authentication. A missing, revoked, expired, or out-of-scope token must fail closed.
+
+Register the ActiveAdmin page after configuration:
+
+```ruby
+ActiveAdmin::DeviceAuthorization::Page.register!
+```
+
+## Protocol
+
+1. `POST /admin/oauth/device_authorization` with `client_id` and `scope`
+2. Open `verification_uri` / `verification_uri_complete` while signed in as an admin user
+3. Approve or deny (optional host `before_approve` / `on_approve_step_up` for step-up second factor before Approve; Deny is ungated)
+4. Poll `POST /admin/oauth/token` with `grant_type=urn:ietf:params:oauth:grant-type:device_code`
+
+## Development
+
+```bash
+bundle install
+bundle exec appraisal install
+make lint
+make test
+```
+
+Matrixed Rails versions use [Appraisal](https://github.com/thoughtbot/appraisal): `gemfiles/rails72.gemfile`, `rails8ruby34.gemfile`, and `rails8ruby4.gemfile`. Run `bundle exec appraisal rspec` to execute RSpec in each gemfile context.
+
+[Trunk](https://docs.trunk.io) config lives in `.trunk/`; CI can run `trunk` via `.github/workflows/_trunk_check.yml`. Releases: `make release` or `usr/bin/release.rb`.
+
+## Security
+
+Report vulnerabilities to security@kiskolabs.com. See [SECURITY.md](SECURITY.md).
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/amkisko/activeadmin-device_authorization.rb
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](LICENSE.md).

data/SECURITY.md

@@ -0,0 +1,25 @@
+# SECURITY
+
+## Reporting a Vulnerability
+
+Email security details to: security@kiskolabs.com
+
+Send the report only to that address. Include description, steps to reproduce, potential impact, and a suggested fix when you have one.
+
+### Response Timeline
+
+- We will acknowledge receipt of your report.
+- We will provide an initial assessment.
+- We will keep you informed of our progress and resolution timeline.
+
+### Disclosure Policy
+
+- We will work with you to understand and resolve the issue.
+- We will credit you for the discovery unless you prefer to remain anonymous.
+- We will publish a security advisory after the vulnerability is patched.
+- We will coordinate public disclosure with you.
+
+## Automation Security
+
+- Keep production credentials, API keys, and personal data out of prompts sent to third-party models or automation services.
+- Verify automated dependencies.

data/activeadmin-device_authorization.gemspec

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require_relative "lib/active_admin/device_authorization/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "activeadmin-device_authorization"
+  spec.version = ActiveAdmin::DeviceAuthorization::VERSION
+  spec.authors = ["Andrei Makarov"]
+  spec.email = ["contact@kiskolabs.com"]
+
+  spec.summary = "RFC 8628 device authorization for ActiveAdmin bearer access"
+  spec.description = "Configurable device authorization grant, ActiveAdmin consent UI, and short-lived bearer tokens for admin APIs."
+  spec.license = "MIT"
+  spec.platform = Gem::Platform::RUBY
+  spec.required_ruby_version = ">= 3.4.0"
+
+  repository_url = "https://github.com/amkisko/activeadmin-device_authorization.rb"
+
+  spec.homepage = repository_url
+  spec.metadata = {
+    "homepage_uri" => repository_url,
+    "source_code_uri" => "#{repository_url}/tree/main",
+    "changelog_uri" => "#{repository_url}/blob/main/CHANGELOG.md",
+    "bug_tracker_uri" => "#{repository_url}/issues",
+    "documentation_uri" => "#{repository_url}#readme",
+    "allowed_push_host" => "https://rubygems.org",
+    "rubygems_mfa_required" => "true"
+  }
+
+  spec.files = Dir.chdir(__dir__) do
+    %w[
+      CHANGELOG.md
+      CODE_OF_CONDUCT.md
+      CONTRIBUTING.md
+      GOVERNANCE.md
+      LICENSE.md
+      README.md
+      SECURITY.md
+      activeadmin-device_authorization.gemspec
+    ].select { |path| File.file?(path) } +
+      Dir["{app,config,lib,sig}/**/*"]
+  end
+
+  spec.require_paths = ["lib"]
+
+  spec.add_dependency "activeadmin", ">= 3.2"
+  spec.add_dependency "rails", ">= 7.2.3.2"
+
+  spec.add_development_dependency "appraisal", "~> 2"
+  spec.add_development_dependency "bundler", ">= 2"
+  spec.add_development_dependency "bundler-audit", "~> 0.9"
+  spec.add_development_dependency "polyrun", ">= 2.2.0"
+  spec.add_development_dependency "rake", "~> 13"
+  spec.add_development_dependency "rbs", "~> 4"
+  spec.add_development_dependency "rspec", "~> 3"
+  spec.add_development_dependency "rubocop-rspec", "~> 3.8"
+  spec.add_development_dependency "rubocop-thread_safety", "~> 0.7"
+  spec.add_development_dependency "standard", "~> 1.52"
+  spec.add_development_dependency "standard-custom", "~> 1.0"
+  spec.add_development_dependency "standard-performance", "~> 1.8"
+  spec.add_development_dependency "standard-rspec", "~> 0.3"
+end

data/app/controllers/active_admin/device_authorization/application_controller.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module DeviceAuthorization
+    class ApplicationController < ActionController::Base
+      protect_from_forgery with: :exception
+    end
+  end
+end

data/app/controllers/active_admin/device_authorization/consents_controller.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module DeviceAuthorization
+    # Thin HTML consent actions when the host does not use the ActiveAdmin page.
+    # Prefer ActiveAdmin::DeviceAuthorization::Page.register! for the AA layout.
+    class ConsentsController < ApplicationController
+      before_action :authenticate_resource_owner!
+      before_action :load_grant!, except: :index
+
+      def index
+        user_code = UserCode.normalize(params[:user_code])
+        if user_code.present?
+          redirect_to send(
+            :"#{ActiveAdmin::DeviceAuthorization.config.path_namespace}_device_auth_grant_path",
+            user_code
+          )
+          return
+        end
+
+        render layout: false
+      end
+
+      def show
+        @grant.mark_expired_if_needed!
+        render layout: false
+      end
+
+      def approve
+        config = ActiveAdmin::DeviceAuthorization.config
+        if config.before_approve && !config.before_approve.call(self)
+          return
+        end
+
+        Consent.new(
+          grant: @grant,
+          resource_owner: current_resource_owner,
+          scopes: Array(params[:scopes]),
+          absolute_ttl_seconds: params[:absolute_ttl_seconds]
+        ).approve!
+        redirect_to after_consent_path, notice: I18n.t("active_admin.device_authorization.approved")
+      rescue Consent::Error => error
+        redirect_to after_consent_path,
+          alert: I18n.t("active_admin.device_authorization.error.#{error.message}", default: error.message)
+      end
+
+      def deny
+        Consent.new(
+          grant: @grant,
+          resource_owner: current_resource_owner,
+          scopes: @grant.requested_scopes,
+          absolute_ttl_seconds: ActiveAdmin::DeviceAuthorization.config.access_token_default_absolute_ttl
+        ).deny!
+        redirect_to after_consent_path, notice: I18n.t("active_admin.device_authorization.denied")
+      rescue Consent::Error => error
+        redirect_to after_consent_path,
+          alert: I18n.t("active_admin.device_authorization.error.#{error.message}", default: error.message)
+      end
+
+      private
+
+      def authenticate_resource_owner!
+        return if current_resource_owner
+
+        head :unauthorized
+      end
+
+      def current_resource_owner
+        @current_resource_owner ||= ActiveAdmin::DeviceAuthorization.config.current_resource_owner.call(self)
+      end
+
+      def load_grant!
+        @grant = ActiveAdmin::DeviceAuthorization.config.grant_class
+          .find_by!(user_code: UserCode.normalize(params[:user_code]))
+      end
+
+      def after_consent_path
+        config = ActiveAdmin::DeviceAuthorization.config
+        "/#{config.path_namespace}/#{config.verification_path}/#{@grant.user_code}"
+      end
+    end
+  end
+end

data/app/controllers/active_admin/device_authorization/device_authorizations_controller.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module DeviceAuthorization
+    class DeviceAuthorizationsController < ApplicationController
+      include JsonResponse
+
+      skip_forgery_protection
+      before_action :enforce_rate_limit
+
+      def create
+        return if performed?
+
+        config = ActiveAdmin::DeviceAuthorization.config
+        base_url = config.verification_base_url.presence || request.base_url
+        result = DeviceAuthorizationRequest.new(
+          client_id: params.require(:client_id),
+          scopes: params[:scope].to_s.split(/\s+/),
+          verification_base_url: base_url,
+          config: config
+        ).call
+
+        render_oauth_json(
+          {
+            device_code: result.device_code,
+            user_code: result.user_code,
+            verification_uri: result.verification_uri,
+            verification_uri_complete: result.verification_uri_complete,
+            expires_in: result.expires_in,
+            interval: result.interval
+          },
+          status: :ok
+        )
+      rescue ActiveRecord::RecordNotFound
+        render_oauth_json({error: "invalid_client"}, status: :bad_request)
+      rescue DeviceAuthorizationRequest::Error => error
+        render_oauth_json({error: error.message}, status: :bad_request)
+      end
+
+      private
+
+      def enforce_rate_limit
+        limiter = ActiveAdmin::DeviceAuthorization.config.rate_limit_device_authorization
+        allowed = limiter.respond_to?(:call) && limiter.call(self) == true
+        return if performed? || allowed
+
+        render_oauth_json({error: "slow_down"}, status: :too_many_requests)
+      end
+    end
+  end
+end

data/app/controllers/active_admin/device_authorization/json_response.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module DeviceAuthorization
+    module JsonResponse
+      extend ActiveSupport::Concern
+
+      included do
+        rescue_from ActionController::ParameterMissing, with: :respond_with_invalid_request
+      end
+
+      private
+
+      def respond_with_invalid_request(_error)
+        render_oauth_json({error: "invalid_request"}, status: :bad_request)
+      end
+
+      def render_oauth_json(payload, status:)
+        response.set_header("Cache-Control", "no-store")
+        response.set_header("Pragma", "no-cache")
+        render json: payload, status: status
+      end
+    end
+  end
+end

data/app/controllers/active_admin/device_authorization/tokens_controller.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module DeviceAuthorization
+    class TokensController < ApplicationController
+      include JsonResponse
+
+      skip_forgery_protection
+      before_action :enforce_rate_limit
+
+      def create
+        return if performed?
+
+        unless params[:grant_type].to_s == TokenExchange::GRANT_TYPE
+          return render_oauth_json({error: "unsupported_grant_type"}, status: :bad_request)
+        end
+
+        payload = TokenExchange.new(
+          client_id: params.require(:client_id),
+          device_code: params.require(:device_code)
+        ).call
+
+        render_oauth_json(payload, status: :ok)
+      rescue TokenExchange::Error => error
+        render_oauth_json({error: error.code}, status: error.http_status)
+      end
+
+      private
+
+      def enforce_rate_limit
+        limiter = ActiveAdmin::DeviceAuthorization.config.rate_limit_token
+        allowed = limiter.respond_to?(:call) && limiter.call(self) == true
+        return if performed? || allowed
+
+        render_oauth_json({error: "slow_down"}, status: :too_many_requests)
+      end
+    end
+  end
+end