@pixelbyte-software/pixcode 1.54.9 → 1.54.11

package/server/services/public-api-manifest.js

@@ -1,181 +1,181 @@
-const API_GROUPS = [
-  { id: 'auth', title: 'Authentication', basePath: '/api/auth', scopes: ['auth:read', 'auth:write'] },
-  { id: 'projects', title: 'Projects', basePath: '/api/projects', scopes: ['projects:read', 'projects:write'] },
-  { id: 'sessions', title: 'Sessions and messages', basePath: '/api/sessions', scopes: ['sessions:read', 'sessions:write'] },
-  { id: 'providers', title: 'CLI providers', basePath: '/api/providers', scopes: ['providers:read', 'providers:write'] },
-  { id: 'terminal', title: 'Visible terminal sessions', basePath: '/api/shell/sessions', scopes: ['terminal:launch'] },
-  { id: 'orchestration', title: 'Orchestration runs', basePath: '/api/orchestration', scopes: ['orchestration:read', 'orchestration:write'] },
-  { id: 'notifications', title: 'Notifications', basePath: '/api/settings/notifications', scopes: ['notifications:read', 'notifications:write'] },
-  { id: 'files', title: 'Files', basePath: '/api/projects/:projectName/files', scopes: ['files:read', 'files:write'] },
-  { id: 'git', title: 'Source control', basePath: '/api/git', scopes: ['git:read', 'git:write'] },
-  { id: 'settings', title: 'Settings and API keys', basePath: '/api/settings', scopes: ['settings:read', 'settings:write'] },
-  { id: 'updates', title: 'Update status', basePath: '/api/update', scopes: ['updates:read', 'updates:write'] },
-  { id: 'diagnostics', title: 'Diagnostics', basePath: '/api/diagnostics', scopes: ['diagnostics:read'] },
-  { id: 'remote', title: 'Remote connection', basePath: '/api/remote', scopes: ['remote:read', 'remote:write'] },
-  { id: 'telegram', title: 'Telegram control', basePath: '/api/telegram', scopes: ['telegram:read', 'telegram:write'] },
-  { id: 'webhooks', title: 'Outbound webhooks', basePath: '/api/webhooks', scopes: ['webhooks:read', 'webhooks:write'] },
-  { id: 'plugins', title: 'Plugins and MCP tools', basePath: '/api/plugins', scopes: ['plugins:read', 'plugins:write'] },
-];
-
-const API_SCOPES = Array.from(new Set(API_GROUPS.flatMap((group) => group.scopes))).sort();
-
-export function buildPublicApiManifest({ baseUrl = '' } = {}) {
-  const origin = String(baseUrl || '').replace(/\/+$/, '');
-  return {
-    name: 'Pixcode Public API',
-    version: '1.38',
-    baseUrl: origin || null,
-    auth: {
-      transports: ['Authorization: Bearer <px_api_key>', 'X-API-Key: <px_api_key>', '?apiKey=<px_api_key>'],
-      websocket: 'Pass the same px_ API key as the token query parameter.',
-    },
-    apiKey: {
-      prefix: 'px_',
-      scopes: API_SCOPES,
-      revocable: true,
-      manageableAt: '/api/settings/api-keys',
-    },
-    groups: API_GROUPS,
-    examples: [
-      {
-        title: 'List projects',
-        curl: `curl -H "X-API-Key: px_your_key" ${origin || 'http://127.0.0.1:3001'}/api/projects`,
-      },
-      {
-        title: 'Fetch diagnostics bundle',
-        curl: `curl -H "X-API-Key: px_your_key" ${origin || 'http://127.0.0.1:3001'}/api/diagnostics/bundle`,
-      },
-      {
-        title: 'Read the mobile remote control room',
-        curl: `curl -H "X-API-Key: px_your_key" ${origin || 'http://127.0.0.1:3001'}/api/remote/control-room`,
-      },
-      {
-        title: 'Register an outbound webhook',
-        curl: `curl -X POST -H "Content-Type: application/json" -H "X-API-Key: px_your_key" -d '{"name":"CI listener","url":"https://example.com/pixcode","events":["run.completed","approval.needed"]}' ${origin || 'http://127.0.0.1:3001'}/api/webhooks`,
-      },
-    ],
-  };
-}
-
-export function buildTypeScriptSdkStarter({ baseUrl = '' } = {}) {
-  const origin = String(baseUrl || 'http://127.0.0.1:3001').replace(/\/+$/, '');
-  return `export type PixcodeRun = {
-  id: string;
-  workflowId: string;
-  status: 'queued' | 'running' | 'completed' | 'failed' | 'canceled';
-};
-
-export class PixcodeClient {
-  constructor(
-    private readonly apiKey: string,
-    private readonly baseUrl = '${origin}',
-  ) {}
-
-  private async request<T>(path: string, init: RequestInit = {}): Promise<T> {
-    const response = await fetch(new URL(path, this.baseUrl), {
-      ...init,
-      headers: {
-        'Content-Type': 'application/json',
-        'X-API-Key': this.apiKey,
-        ...(init.headers || {}),
-      },
-    });
-    if (!response.ok) throw new Error(\`Pixcode API \${response.status}: \${await response.text()}\`);
-    return response.json() as Promise<T>;
-  }
-
-  projects() {
-    return this.request<{ projects: unknown[] }>('/api/projects');
-  }
-
-  controlRoom() {
-    return this.request<{ success: true; controlRoom: unknown }>('/api/remote/control-room');
-  }
-
-  approvals() {
-    return this.request<{ pendingApprovals: unknown[] }>('/api/orchestration/workflows/approvals');
-  }
-
-  decideApproval(approvalId: string, allow: boolean) {
-    return this.request(\`/api/orchestration/workflows/approvals/\${encodeURIComponent(approvalId)}\`, {
-      method: 'POST',
-      body: JSON.stringify({ allow, source: 'api' }),
-    });
-  }
-
-  startWorkflow(workflowId: string, input: string, metadata: Record<string, unknown> = {}) {
-    return this.request<PixcodeRun>(\`/api/orchestration/workflows/\${encodeURIComponent(workflowId)}/runs\`, {
-      method: 'POST',
-      body: JSON.stringify({ input, metadata }),
-    });
-  }
-}
-`;
-}
-
-export function buildCurlCookbook({ baseUrl = '' } = {}) {
-  const origin = String(baseUrl || 'http://127.0.0.1:3001').replace(/\/+$/, '');
-  return {
-    title: 'Pixcode Public API Cookbook',
-    variables: {
-      PIXCODE_URL: origin,
-      PIXCODE_API_KEY: 'px_your_key',
-    },
-    examples: [
-      {
-        title: 'List projects',
-        command: `curl -H "X-API-Key: $PIXCODE_API_KEY" "$PIXCODE_URL/api/projects"`,
-      },
-      {
-        title: 'Read the mobile control room',
-        command: `curl -H "X-API-Key: $PIXCODE_API_KEY" "$PIXCODE_URL/api/remote/control-room"`,
-      },
-      {
-        title: 'List pending approvals',
-        command: `curl -H "X-API-Key: $PIXCODE_API_KEY" "$PIXCODE_URL/api/orchestration/workflows/approvals"`,
-      },
-      {
-        title: 'Approve a pending action',
-        command: `curl -X POST -H "Content-Type: application/json" -H "X-API-Key: $PIXCODE_API_KEY" -d '{"allow":true,"source":"api"}' "$PIXCODE_URL/api/orchestration/workflows/approvals/approval_id"`,
-      },
-      {
-        title: 'Create a webhook',
-        command: `curl -X POST -H "Content-Type: application/json" -H "X-API-Key: $PIXCODE_API_KEY" -d '{"name":"CI listener","url":"https://example.com/pixcode","events":["run.completed","run.failed","approval.needed"]}' "$PIXCODE_URL/api/webhooks"`,
-      },
-    ],
-  };
-}
-
-export function buildOpenApiFragment(options = {}) {
-  const manifest = buildPublicApiManifest(options);
-  return {
-    openapi: '3.1.0',
-    info: {
-      title: manifest.name,
-      version: manifest.version,
-    },
-    security: [{ PixcodeApiKey: [] }],
-    components: {
-      securitySchemes: {
-        PixcodeApiKey: {
-          type: 'apiKey',
-          in: 'header',
-          name: 'X-API-Key',
-          description: 'Pixcode px_ API key. Keys are revocable and can carry scopes.',
-        },
-      },
-    },
-    paths: Object.fromEntries(
-      manifest.groups.map((group) => [
-        group.basePath,
-        {
-          get: {
-            summary: group.title,
-            'x-pixcode-group': group.id,
-            'x-pixcode-scopes': group.scopes,
-          },
-        },
-      ]),
-    ),
-  };
-}
+const API_GROUPS = [
+  { id: 'auth', title: 'Authentication', basePath: '/api/auth', scopes: ['auth:read', 'auth:write'] },
+  { id: 'projects', title: 'Projects', basePath: '/api/projects', scopes: ['projects:read', 'projects:write'] },
+  { id: 'sessions', title: 'Sessions and messages', basePath: '/api/sessions', scopes: ['sessions:read', 'sessions:write'] },
+  { id: 'providers', title: 'CLI providers', basePath: '/api/providers', scopes: ['providers:read', 'providers:write'] },
+  { id: 'terminal', title: 'Visible terminal sessions', basePath: '/api/shell/sessions', scopes: ['terminal:launch'] },
+  { id: 'orchestration', title: 'Orchestration runs', basePath: '/api/orchestration', scopes: ['orchestration:read', 'orchestration:write'] },
+  { id: 'notifications', title: 'Notifications', basePath: '/api/settings/notifications', scopes: ['notifications:read', 'notifications:write'] },
+  { id: 'files', title: 'Files', basePath: '/api/projects/:projectName/files', scopes: ['files:read', 'files:write'] },
+  { id: 'git', title: 'Source control', basePath: '/api/git', scopes: ['git:read', 'git:write'] },
+  { id: 'settings', title: 'Settings and API keys', basePath: '/api/settings', scopes: ['settings:read', 'settings:write'] },
+  { id: 'updates', title: 'Update status', basePath: '/api/update', scopes: ['updates:read', 'updates:write'] },
+  { id: 'diagnostics', title: 'Diagnostics', basePath: '/api/diagnostics', scopes: ['diagnostics:read'] },
+  { id: 'remote', title: 'Remote connection', basePath: '/api/remote', scopes: ['remote:read', 'remote:write'] },
+  { id: 'telegram', title: 'Telegram control', basePath: '/api/telegram', scopes: ['telegram:read', 'telegram:write'] },
+  { id: 'webhooks', title: 'Outbound webhooks', basePath: '/api/webhooks', scopes: ['webhooks:read', 'webhooks:write'] },
+  { id: 'plugins', title: 'Plugins and MCP tools', basePath: '/api/plugins', scopes: ['plugins:read', 'plugins:write'] },
+];
+
+const API_SCOPES = Array.from(new Set(API_GROUPS.flatMap((group) => group.scopes))).sort();
+
+export function buildPublicApiManifest({ baseUrl = '' } = {}) {
+  const origin = String(baseUrl || '').replace(/\/+$/, '');
+  return {
+    name: 'Pixcode Public API',
+    version: '1.38',
+    baseUrl: origin || null,
+    auth: {
+      transports: ['Authorization: Bearer <px_api_key>', 'X-API-Key: <px_api_key>', '?apiKey=<px_api_key>'],
+      websocket: 'Pass the same px_ API key as the token query parameter.',
+    },
+    apiKey: {
+      prefix: 'px_',
+      scopes: API_SCOPES,
+      revocable: true,
+      manageableAt: '/api/settings/api-keys',
+    },
+    groups: API_GROUPS,
+    examples: [
+      {
+        title: 'List projects',
+        curl: `curl -H "X-API-Key: px_your_key" ${origin || 'http://127.0.0.1:3001'}/api/projects`,
+      },
+      {
+        title: 'Fetch diagnostics bundle',
+        curl: `curl -H "X-API-Key: px_your_key" ${origin || 'http://127.0.0.1:3001'}/api/diagnostics/bundle`,
+      },
+      {
+        title: 'Read the mobile remote control room',
+        curl: `curl -H "X-API-Key: px_your_key" ${origin || 'http://127.0.0.1:3001'}/api/remote/control-room`,
+      },
+      {
+        title: 'Register an outbound webhook',
+        curl: `curl -X POST -H "Content-Type: application/json" -H "X-API-Key: px_your_key" -d '{"name":"CI listener","url":"https://example.com/pixcode","events":["run.completed","approval.needed"]}' ${origin || 'http://127.0.0.1:3001'}/api/webhooks`,
+      },
+    ],
+  };
+}
+
+export function buildTypeScriptSdkStarter({ baseUrl = '' } = {}) {
+  const origin = String(baseUrl || 'http://127.0.0.1:3001').replace(/\/+$/, '');
+  return `export type PixcodeRun = {
+  id: string;
+  workflowId: string;
+  status: 'queued' | 'running' | 'completed' | 'failed' | 'canceled';
+};
+
+export class PixcodeClient {
+  constructor(
+    private readonly apiKey: string,
+    private readonly baseUrl = '${origin}',
+  ) {}
+
+  private async request<T>(path: string, init: RequestInit = {}): Promise<T> {
+    const response = await fetch(new URL(path, this.baseUrl), {
+      ...init,
+      headers: {
+        'Content-Type': 'application/json',
+        'X-API-Key': this.apiKey,
+        ...(init.headers || {}),
+      },
+    });
+    if (!response.ok) throw new Error(\`Pixcode API \${response.status}: \${await response.text()}\`);
+    return response.json() as Promise<T>;
+  }
+
+  projects() {
+    return this.request<{ projects: unknown[] }>('/api/projects');
+  }
+
+  controlRoom() {
+    return this.request<{ success: true; controlRoom: unknown }>('/api/remote/control-room');
+  }
+
+  approvals() {
+    return this.request<{ pendingApprovals: unknown[] }>('/api/orchestration/workflows/approvals');
+  }
+
+  decideApproval(approvalId: string, allow: boolean) {
+    return this.request(\`/api/orchestration/workflows/approvals/\${encodeURIComponent(approvalId)}\`, {
+      method: 'POST',
+      body: JSON.stringify({ allow, source: 'api' }),
+    });
+  }
+
+  startWorkflow(workflowId: string, input: string, metadata: Record<string, unknown> = {}) {
+    return this.request<PixcodeRun>(\`/api/orchestration/workflows/\${encodeURIComponent(workflowId)}/runs\`, {
+      method: 'POST',
+      body: JSON.stringify({ input, metadata }),
+    });
+  }
+}
+`;
+}
+
+export function buildCurlCookbook({ baseUrl = '' } = {}) {
+  const origin = String(baseUrl || 'http://127.0.0.1:3001').replace(/\/+$/, '');
+  return {
+    title: 'Pixcode Public API Cookbook',
+    variables: {
+      PIXCODE_URL: origin,
+      PIXCODE_API_KEY: 'px_your_key',
+    },
+    examples: [
+      {
+        title: 'List projects',
+        command: `curl -H "X-API-Key: $PIXCODE_API_KEY" "$PIXCODE_URL/api/projects"`,
+      },
+      {
+        title: 'Read the mobile control room',
+        command: `curl -H "X-API-Key: $PIXCODE_API_KEY" "$PIXCODE_URL/api/remote/control-room"`,
+      },
+      {
+        title: 'List pending approvals',
+        command: `curl -H "X-API-Key: $PIXCODE_API_KEY" "$PIXCODE_URL/api/orchestration/workflows/approvals"`,
+      },
+      {
+        title: 'Approve a pending action',
+        command: `curl -X POST -H "Content-Type: application/json" -H "X-API-Key: $PIXCODE_API_KEY" -d '{"allow":true,"source":"api"}' "$PIXCODE_URL/api/orchestration/workflows/approvals/approval_id"`,
+      },
+      {
+        title: 'Create a webhook',
+        command: `curl -X POST -H "Content-Type: application/json" -H "X-API-Key: $PIXCODE_API_KEY" -d '{"name":"CI listener","url":"https://example.com/pixcode","events":["run.completed","run.failed","approval.needed"]}' "$PIXCODE_URL/api/webhooks"`,
+      },
+    ],
+  };
+}
+
+export function buildOpenApiFragment(options = {}) {
+  const manifest = buildPublicApiManifest(options);
+  return {
+    openapi: '3.1.0',
+    info: {
+      title: manifest.name,
+      version: manifest.version,
+    },
+    security: [{ PixcodeApiKey: [] }],
+    components: {
+      securitySchemes: {
+        PixcodeApiKey: {
+          type: 'apiKey',
+          in: 'header',
+          name: 'X-API-Key',
+          description: 'Pixcode px_ API key. Keys are revocable and can carry scopes.',
+        },
+      },
+    },
+    paths: Object.fromEntries(
+      manifest.groups.map((group) => [
+        group.basePath,
+        {
+          get: {
+            summary: group.title,
+            'x-pixcode-group': group.id,
+            'x-pixcode-scopes': group.scopes,
+          },
+        },
+      ]),
+    ),
+  };
+}

package/server/services/qr-login.js

@@ -1,126 +1,126 @@
-import crypto from 'node:crypto';
-
-import { appConfigDb, userDb } from '../database/db.js';
-
-const CONFIG_KEY = 'qr_login_settings';
-const DEFAULT_SETTINGS = Object.freeze({
-  enabled: false,
-  ttlSeconds: 300,
-});
-const MIN_TTL_SECONDS = 60;
-const MAX_TTL_SECONDS = 15 * 60;
-const qrLoginTokens = new Map();
-
-function clampTtl(value) {
-  const parsed = Number.parseInt(String(value || ''), 10);
-  if (!Number.isFinite(parsed)) return DEFAULT_SETTINGS.ttlSeconds;
-  return Math.min(MAX_TTL_SECONDS, Math.max(MIN_TTL_SECONDS, parsed));
-}
-
-function normalizeSettings(value = {}) {
-  const raw = value && typeof value === 'object' ? value : {};
-  return {
-    enabled: raw.enabled === true,
-    ttlSeconds: clampTtl(raw.ttlSeconds),
-  };
-}
-
-function readStoredSettings() {
-  const raw = appConfigDb.get(CONFIG_KEY);
-  if (!raw) return { ...DEFAULT_SETTINGS };
-  try {
-    return normalizeSettings(JSON.parse(raw));
-  } catch {
-    return { ...DEFAULT_SETTINGS };
-  }
-}
-
-function cleanupExpiredTokens() {
-  const now = Date.now();
-  for (const [token, entry] of qrLoginTokens.entries()) {
-    if (!entry || entry.expiresAtMs <= now) {
-      qrLoginTokens.delete(token);
-    }
-  }
-}
-
-function appendQrLoginToken(baseUrl, token) {
-  const url = new URL(baseUrl);
-  url.searchParams.set('qrLoginToken', token);
-  return url.toString();
-}
-
-export function getQrLoginSettings() {
-  return readStoredSettings();
-}
-
-export function saveQrLoginSettings(input = {}) {
-  const settings = normalizeSettings(input);
-  appConfigDb.set(CONFIG_KEY, JSON.stringify(settings));
-  if (!settings.enabled) {
-    qrLoginTokens.clear();
-  }
-  return settings;
-}
-
-export function createQrLoginToken({ userId, baseUrl }) {
-  const settings = readStoredSettings();
-  if (!settings.enabled) {
-    const error = new Error('QR login is disabled.');
-    error.code = 'QR_LOGIN_DISABLED';
-    throw error;
-  }
-  const user = userDb.getUserById(userId);
-  if (!user) {
-    const error = new Error('QR login user was not found.');
-    error.code = 'QR_LOGIN_USER_NOT_FOUND';
-    throw error;
-  }
-
-  cleanupExpiredTokens();
-  const token = crypto.randomBytes(32).toString('base64url');
-  const expiresAtMs = Date.now() + settings.ttlSeconds * 1000;
-  qrLoginTokens.set(token, {
-    userId: user.id,
-    createdAtMs: Date.now(),
-    expiresAtMs,
-  });
-
-  return {
-    token,
-    expiresAt: new Date(expiresAtMs).toISOString(),
-    ttlSeconds: settings.ttlSeconds,
-    qrUrl: baseUrl ? appendQrLoginToken(baseUrl, token) : null,
-  };
-}
-
-export function consumeQrLoginToken(token) {
-  const settings = readStoredSettings();
-  if (!settings.enabled) {
-    const error = new Error('QR login is disabled.');
-    error.code = 'QR_LOGIN_DISABLED';
-    throw error;
-  }
-  if (!token || typeof token !== 'string') {
-    const error = new Error('QR login token is required.');
-    error.code = 'QR_LOGIN_TOKEN_REQUIRED';
-    throw error;
-  }
-
-  cleanupExpiredTokens();
-  const entry = qrLoginTokens.get(token);
-  qrLoginTokens.delete(token);
-  if (!entry) {
-    const error = new Error('QR login token is invalid or expired.');
-    error.code = 'QR_LOGIN_INVALID';
-    throw error;
-  }
-
-  const user = userDb.getUserById(entry.userId);
-  if (!user) {
-    const error = new Error('QR login user was not found.');
-    error.code = 'QR_LOGIN_USER_NOT_FOUND';
-    throw error;
-  }
-  return user;
-}
+import crypto from 'node:crypto';
+
+import { appConfigDb, userDb } from '../database/db.js';
+
+const CONFIG_KEY = 'qr_login_settings';
+const DEFAULT_SETTINGS = Object.freeze({
+  enabled: false,
+  ttlSeconds: 300,
+});
+const MIN_TTL_SECONDS = 60;
+const MAX_TTL_SECONDS = 15 * 60;
+const qrLoginTokens = new Map();
+
+function clampTtl(value) {
+  const parsed = Number.parseInt(String(value || ''), 10);
+  if (!Number.isFinite(parsed)) return DEFAULT_SETTINGS.ttlSeconds;
+  return Math.min(MAX_TTL_SECONDS, Math.max(MIN_TTL_SECONDS, parsed));
+}
+
+function normalizeSettings(value = {}) {
+  const raw = value && typeof value === 'object' ? value : {};
+  return {
+    enabled: raw.enabled === true,
+    ttlSeconds: clampTtl(raw.ttlSeconds),
+  };
+}
+
+function readStoredSettings() {
+  const raw = appConfigDb.get(CONFIG_KEY);
+  if (!raw) return { ...DEFAULT_SETTINGS };
+  try {
+    return normalizeSettings(JSON.parse(raw));
+  } catch {
+    return { ...DEFAULT_SETTINGS };
+  }
+}
+
+function cleanupExpiredTokens() {
+  const now = Date.now();
+  for (const [token, entry] of qrLoginTokens.entries()) {
+    if (!entry || entry.expiresAtMs <= now) {
+      qrLoginTokens.delete(token);
+    }
+  }
+}
+
+function appendQrLoginToken(baseUrl, token) {
+  const url = new URL(baseUrl);
+  url.searchParams.set('qrLoginToken', token);
+  return url.toString();
+}
+
+export function getQrLoginSettings() {
+  return readStoredSettings();
+}
+
+export function saveQrLoginSettings(input = {}) {
+  const settings = normalizeSettings(input);
+  appConfigDb.set(CONFIG_KEY, JSON.stringify(settings));
+  if (!settings.enabled) {
+    qrLoginTokens.clear();
+  }
+  return settings;
+}
+
+export function createQrLoginToken({ userId, baseUrl }) {
+  const settings = readStoredSettings();
+  if (!settings.enabled) {
+    const error = new Error('QR login is disabled.');
+    error.code = 'QR_LOGIN_DISABLED';
+    throw error;
+  }
+  const user = userDb.getUserById(userId);
+  if (!user) {
+    const error = new Error('QR login user was not found.');
+    error.code = 'QR_LOGIN_USER_NOT_FOUND';
+    throw error;
+  }
+
+  cleanupExpiredTokens();
+  const token = crypto.randomBytes(32).toString('base64url');
+  const expiresAtMs = Date.now() + settings.ttlSeconds * 1000;
+  qrLoginTokens.set(token, {
+    userId: user.id,
+    createdAtMs: Date.now(),
+    expiresAtMs,
+  });
+
+  return {
+    token,
+    expiresAt: new Date(expiresAtMs).toISOString(),
+    ttlSeconds: settings.ttlSeconds,
+    qrUrl: baseUrl ? appendQrLoginToken(baseUrl, token) : null,
+  };
+}
+
+export function consumeQrLoginToken(token) {
+  const settings = readStoredSettings();
+  if (!settings.enabled) {
+    const error = new Error('QR login is disabled.');
+    error.code = 'QR_LOGIN_DISABLED';
+    throw error;
+  }
+  if (!token || typeof token !== 'string') {
+    const error = new Error('QR login token is required.');
+    error.code = 'QR_LOGIN_TOKEN_REQUIRED';
+    throw error;
+  }
+
+  cleanupExpiredTokens();
+  const entry = qrLoginTokens.get(token);
+  qrLoginTokens.delete(token);
+  if (!entry) {
+    const error = new Error('QR login token is invalid or expired.');
+    error.code = 'QR_LOGIN_INVALID';
+    throw error;
+  }
+
+  const user = userDb.getUserById(entry.userId);
+  if (!user) {
+    const error = new Error('QR login user was not found.');
+    error.code = 'QR_LOGIN_USER_NOT_FOUND';
+    throw error;
+  }
+  return user;
+}