From 786ad0ff82e32c7731a1046f2dd9599bc309d71a Mon Sep 17 00:00:00 2001
From: DecDuck <declanahofmeyr@gmail.com>
Date: Fri, 1 Aug 2025 10:38:53 +1000
Subject: [PATCH 1/4] Translations update from Weblate (#107)

* Translated using Weblate (English (Australia))

Currently translated at 1.6% (6 of 375 strings)

Translation: Drop/Drop
Translate-URL: http://translate.droposs.org/projects/drop/drop/en_AU/

* Translated using Weblate (English (en_PIRATE))

Currently translated at 99.4% (373 of 375 strings)

Translation: Drop/Drop
Translate-URL: http://translate.droposs.org/projects/drop/drop/en_PIRATE/

* Translated using Weblate (English (en_PIRATE))

Currently translated at 99.4% (373 of 375 strings)

Translation: Drop/Drop
Translate-URL: http://translate.droposs.org/projects/drop/drop/en_PIRATE/

* Translated using Weblate (English (en_PIRATE))

Currently translated at 100.0% (375 of 375 strings)

Translation: Drop/Drop
Translate-URL: http://translate.droposs.org/projects/drop/drop/en_PIRATE/

---------

Co-authored-by: Weblate Translation Memory <noreply-mt-weblate-translation-memory@weblate.org>
---
 i18n/locales/en_au.json     | 18 ++++++++++++++++++
 i18n/locales/en_pirate.json | 27 +++++++++++++++++++++++++--
 2 files changed, 43 insertions(+), 2 deletions(-)

diff --git a/i18n/locales/en_au.json b/i18n/locales/en_au.json
index 27d8b005..4965c94d 100644
--- a/i18n/locales/en_au.json
+++ b/i18n/locales/en_au.json
@@ -1,5 +1,23 @@
 {
   "setup": {
     "welcome": "G'day."
+  },
+  "account": {
+    "devices": {
+      "subheader": "Manage the devices authorised to access your Drop account."
+    }
+  },
+  "auth": {
+    "callback": {
+      "authClient": "Authorise client?",
+      "authorize": "Authorise",
+      "authorizedClient": "Drop has successfully authorised the client. You may now close this window."
+    }
+  },
+  "library": {
+    "collection": {
+      "subheader": "Add a new collection to organise your games"
+    },
+    "subheader": "Organise your games into collections for easy access, and access all your games."
   }
 }
diff --git a/i18n/locales/en_pirate.json b/i18n/locales/en_pirate.json
index 36001dec..e93be77d 100644
--- a/i18n/locales/en_pirate.json
+++ b/i18n/locales/en_pirate.json
@@ -109,6 +109,25 @@
     "listItemPlaceholder": "list item, eh?"
   },
   "errors": {
+    "admin": {
+      "user": {
+        "delete": {
+          "desc": "Couldn't make {0} walk the plank!",
+          "title": "Couldn't make 'em walk the plank"
+        }
+      }
+    },
+    "auth": {
+      "disabled": "Ya' angered the Cap'n, give him a holler!",
+      "invalidInvite": "Boarding pass no longer valid, ya scallywag!",
+      "invalidPassState": "Cap'n's rolled snake eyes, see how he's doin'.",
+      "invalidUserOrPass": "Are ya lying to me about your username and password, ya dog?",
+      "inviteIdRequired": "Ya need to include the ID for your boarding pass, matey!",
+      "method": {
+        "signinDisabled": "No entrance through these parts, arr!"
+      },
+      "usernameTaken": "We already have a scallywag with that 'ere name of yours."
+    },
     "backHome": "{arrow} Back to yer safe harbor",
     "game": {
       "banner": {
@@ -203,7 +222,8 @@
       "discord": "Discord, argh!",
       "github": "GitHub, savvy?"
     },
-    "topSellers": "Top Plunderers"
+    "topSellers": "Top Plunderers",
+    "version": "Drop {version} {gitRef}"
   },
   "header": {
     "admin": {
@@ -401,7 +421,8 @@
         "cleanupSessionsDescription": "Cleans up expired sessions to save space and keep ye safe, ye dog!",
         "cleanupSessionsName": "Clean up sessions."
       },
-      "viewTask": "View {arrow}"
+      "viewTask": "View {arrow}",
+      "weeklyScheduledTitle": "Weekly chores"
     }
   },
   "title": "Drop",
@@ -439,6 +460,8 @@
         "title": "Passage"
       },
       "authoptionsHeader": "Passage Options",
+      "delete": "Scuttle!",
+      "deleteUser": "Make {0} walk the plank!",
       "description": "Manage the crew on yer Drop vessel, and set yer passage methods, savvy?",
       "displayNameHeader": "Scallywag Name",
       "emailHeader": "Salty Mail",

From b72e1ef7a45ea16bee1da6271daae70966fcc522 Mon Sep 17 00:00:00 2001
From: DecDuck <declanahofmeyr@gmail.com>
Date: Fri, 1 Aug 2025 13:11:56 +1000
Subject: [PATCH 2/4] Code-based authorization for Drop clients (#145)

* feat: code-based authorization

* fix: final touches

* fix: require session on code fetch endpoint

* feat: better error handling

* refactor: move auth send to client handler

* fix: lint
---
 assets/tailwindcss.css                        |   9 ++
 components/UserHeader/UserWidget.vue          |   5 +
 i18n/locales/en_us.json                       |   4 +
 .../{[id]/callback.vue => authorize/[id].vue} |  79 ++++++----
 pages/client/code/index.vue                   | 135 ++++++++++++++++++
 .../api/v1/client/auth/callback/index.post.ts |  10 +-
 server/api/v1/client/auth/code/index.get.ts   |  21 +++
 server/api/v1/client/auth/code/index.post.ts  |  35 +++++
 server/api/v1/client/auth/code/ws.get.ts      |  25 ++++
 .../client/auth/{callback => }/index.get.ts   |  12 +-
 server/api/v1/client/auth/initiate.post.ts    |  33 ++---
 server/internal/clients/handler.ts            |  77 +++++++++-
 server/internal/tasks/index.ts                |   1 +
 13 files changed, 395 insertions(+), 51 deletions(-)
 rename pages/client/{[id]/callback.vue => authorize/[id].vue} (78%)
 create mode 100644 pages/client/code/index.vue
 create mode 100644 server/api/v1/client/auth/code/index.get.ts
 create mode 100644 server/api/v1/client/auth/code/index.post.ts
 create mode 100644 server/api/v1/client/auth/code/ws.get.ts
 rename server/api/v1/client/auth/{callback => }/index.get.ts (71%)

diff --git a/assets/tailwindcss.css b/assets/tailwindcss.css
index 5c2596be..97cf5d42 100644
--- a/assets/tailwindcss.css
+++ b/assets/tailwindcss.css
@@ -2,3 +2,12 @@
 @plugin "@tailwindcss/typography";
 @plugin "@tailwindcss/forms";
 @config "../tailwind.config.js";
+
+@layer base {
+  input[type="number"]::-webkit-outer-spin-button,
+  input[type="number"]::-webkit-inner-spin-button,
+  input[type="number"] {
+    -webkit-appearance: none;
+    -moz-appearance: textfield !important;
+  }
+}
diff --git a/components/UserHeader/UserWidget.vue b/components/UserHeader/UserWidget.vue
index 35e238d9..cf75bba5 100644
--- a/components/UserHeader/UserWidget.vue
+++ b/components/UserHeader/UserWidget.vue
@@ -100,6 +100,11 @@ const navigation = computed<NavigationItem[]>(() =>
       route: "/account",
       prefix: "",
     },
+    {
+      label: "Authorize client",
+      route: "/client/code",
+      prefix: "",
+    },
   ].filter((e) => e !== undefined),
 );
 </script>
diff --git a/i18n/locales/en_us.json b/i18n/locales/en_us.json
index 58e16c9a..84097d88 100644
--- a/i18n/locales/en_us.json
+++ b/i18n/locales/en_us.json
@@ -38,6 +38,10 @@
       "requestedAccess": "\"{name}\" has requested access to your Drop account.",
       "success": "Successful!"
     },
+    "code": {
+      "title": "Connect your Drop client",
+      "description": "Use a code to connect your Drop client if you are unable to open a web browser on your device."
+    },
     "confirmPassword": "Confirm @:auth.password",
     "displayName": "Display Name",
     "email": "Email",
diff --git a/pages/client/[id]/callback.vue b/pages/client/authorize/[id].vue
similarity index 78%
rename from pages/client/[id]/callback.vue
rename to pages/client/authorize/[id].vue
index 71277b83..a3d2a9d1 100644
--- a/pages/client/[id]/callback.vue
+++ b/pages/client/authorize/[id].vue
@@ -1,7 +1,7 @@
 <template>
   <div
     v-if="completed"
-    class="min-h-full w-full flex items-center justify-center"
+    class="min-h-full w-full flex items-center justify-center py-10"
   >
     <div class="flex flex-col items-center">
       <CheckCircleIcon class="h-12 w-12 text-green-600" aria-hidden="true" />
@@ -14,7 +14,7 @@
             {{ $t("auth.callback.authorizedClient") }}
           </p>
 
-          <Disclosure v-slot="{ open }" as="div" class="mt-8">
+          <Disclosure v-if="authToken" v-slot="{ open }" as="div" class="mt-8">
             <dt>
               <DisclosureButton
                 class="pb-2 flex w-full items-start justify-between text-left text-zinc-400"
@@ -155,38 +155,58 @@ import {
   XCircleIcon,
 } from "@heroicons/vue/16/solid";
 import { LockClosedIcon } from "@heroicons/vue/20/solid";
-import { CheckCircleIcon } from "@heroicons/vue/24/outline";
+import { CheckCircleIcon, CloudIcon } from "@heroicons/vue/24/outline";
 import { ChevronDownIcon, ChevronUpIcon } from "@heroicons/vue/24/solid";
+import type { FetchError } from "ofetch";
 
 const route = useRoute();
 const clientId = route.params.id;
 
-const clientData = await $dropFetch(
-  `/api/v1/client/auth/callback?id=${clientId}`,
-);
+const clientData = await $dropFetch(`/api/v1/client/auth?id=${clientId}`);
 
 const completed = ref(false);
 const error = ref();
 const authToken = ref<string | undefined>();
 
 async function authorize() {
-  const { redirect, token } = await $dropFetch("/api/v1/client/auth/callback", {
-    method: "POST",
-    body: { id: clientId },
+  switch (clientData.mode) {
+    case "callback": {
+      const { redirect, token } = await $dropFetch(
+        `/api/v1/client/auth/callback`,
+        {
+          method: "POST",
+          body: { id: clientId },
+        },
+      );
+      authToken.value = token;
+      window.location.replace(redirect);
+      return;
+    }
+    case "code": {
+      await $dropFetch("/api/v1/client/auth/code", {
+        method: "POST",
+        body: { id: clientId },
+      });
+      return;
+    }
+  }
+  throw createError({
+    statusCode: 500,
+    statusMessage: "Unknown client auth mode: " + clientData.mode,
+    fatal: true,
   });
-  authToken.value = token;
-  window.location.replace(redirect);
 }
 
-function authorize_wrapper() {
-  authorize()
-    .catch((e) => {
-      const errorMessage = e.statusMessage || "An unknown error occurred.";
-      error.value = errorMessage;
-    })
-    .then(() => {
-      completed.value = true;
-    });
+async function authorize_wrapper() {
+  try {
+    await authorize();
+  } catch (e) {
+    const errorMessage =
+      (e as FetchError)?.statusMessage || "An unknown error occurred.";
+    error.value = errorMessage;
+  } finally {
+    completed.value = true;
+  }
 }
 
 const scopes = [
@@ -198,20 +218,27 @@ const scopes = [
     icon: ArrowDownTrayIcon,
   },
   {
+    name: "Update your status",
+    description:
+      "The client will be able to update your status, and affect your playtime.",
+    href: "/docs/access/status",
+    icon: UserGroupIcon,
+  },
+  clientData.capabilities["peerAPI"] && {
     name: "Access the Drop network",
     description:
       "The client will be able to establish P2P connections with other users to enable features like download aggregation, Remote LAN play and P2P multiplayer.",
     href: "/docs/access/network",
     icon: LockClosedIcon,
   },
-  {
-    name: "Manage your account",
+  clientData.capabilities["cloudSaves"] && {
+    name: "Upload and sync cloud saves",
     description:
-      "The client will be able to change your account details, and friend statuses on your behalf.",
-    href: "/docs/access/account",
-    icon: UserGroupIcon,
+      "The client will be able to upload new cloud saves, and edit your existing ones.",
+    href: "/docs/access/cloud",
+    icon: CloudIcon,
   },
-];
+].filter((e) => e !== undefined);
 
 useHead({
   title: "Authorize",
diff --git a/pages/client/code/index.vue b/pages/client/code/index.vue
new file mode 100644
index 00000000..266f03ca
--- /dev/null
+++ b/pages/client/code/index.vue
@@ -0,0 +1,135 @@
+<template>
+  <div class="w-full h-max min-h-[30vw] flex items-center justify-center">
+    <div class="text-center">
+      <h1 class="text-2xl font-bold text-zinc-100">
+        {{ $t("auth.code.title") }}
+      </h1>
+      <p class="mt-1 max-w-sm text-zinc-400 mx-auto">
+        {{ $t("auth.code.description") }}
+      </p>
+      <div v-if="!loading" class="mt-8 flex flex-row gap-4">
+        <input
+          v-for="i in codeLength"
+          ref="codeElements"
+          :key="i"
+          v-model="code[i - 1]"
+          class="uppercase w-16 h-16 appearance-none text-center bg-zinc-900 rounded-xl border-zinc-700 focus:border-blue-600 text-2xl text-bold font-display text-zinc-100"
+          type="text"
+          pattern="\d*"
+          :placeholder="placeholder[i - 1]"
+          @keydown="(v) => keydown(i - 1, v)"
+          @input="() => input(i - 1)"
+          @focusin="() => select(i - 1)"
+          @paste="(v) => paste(i - 1, v)"
+        />
+      </div>
+      <div v-else class="mt-8 flex items-center justify-center">
+        <svg
+          aria-hidden="true"
+          class="size-12 text-transparent animate-spin fill-white"
+          viewBox="0 0 100 101"
+          fill="none"
+          xmlns="http://www.w3.org/2000/svg"
+        >
+          <path
+            d="M100 50.5908C100 78.2051 77.6142 100.591 50 100.591C22.3858 100.591 0 78.2051 0 50.5908C0 22.9766 22.3858 0.59082 50 0.59082C77.6142 0.59082 100 22.9766 100 50.5908ZM9.08144 50.5908C9.08144 73.1895 27.4013 91.5094 50 91.5094C72.5987 91.5094 90.9186 73.1895 90.9186 50.5908C90.9186 27.9921 72.5987 9.67226 50 9.67226C27.4013 9.67226 9.08144 27.9921 9.08144 50.5908Z"
+            fill="currentColor"
+          />
+          <path
+            d="M93.9676 39.0409C96.393 38.4038 97.8624 35.9116 97.0079 33.5539C95.2932 28.8227 92.871 24.3692 89.8167 20.348C85.8452 15.1192 80.8826 10.7238 75.2124 7.41289C69.5422 4.10194 63.2754 1.94025 56.7698 1.05124C51.7666 0.367541 46.6976 0.446843 41.7345 1.27873C39.2613 1.69328 37.813 4.19778 38.4501 6.62326C39.0873 9.04874 41.5694 10.4717 44.0505 10.1071C47.8511 9.54855 51.7191 9.52689 55.5402 10.0491C60.8642 10.7766 65.9928 12.5457 70.6331 15.2552C75.2735 17.9648 79.3347 21.5619 82.5849 25.841C84.9175 28.9121 86.7997 32.2913 88.1811 35.8758C89.083 38.2158 91.5421 39.6781 93.9676 39.0409Z"
+            fill="currentFill"
+          />
+        </svg>
+      </div>
+
+      <div
+        v-if="error"
+        class="mt-8 rounded-md bg-red-600/10 p-4 max-w-sm mx-auto"
+      >
+        <div class="flex">
+          <div class="flex-shrink-0">
+            <XCircleIcon class="h-5 w-5 text-red-600" aria-hidden="true" />
+          </div>
+          <div class="ml-3">
+            <h3 class="text-sm font-medium text-red-600">
+              {{ error }}
+            </h3>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { XCircleIcon } from "@heroicons/vue/24/solid";
+import { FetchError } from "ofetch";
+
+const codeLength = 7;
+const placeholder = "1A2B3C4";
+const codeElements = useTemplateRef("codeElements");
+const code = ref<string[]>([]);
+
+const router = useRouter();
+const loading = ref(false);
+const error = ref<string | undefined>(undefined);
+
+function keydown(index: number, event: KeyboardEvent) {
+  if (event.key === "Backspace" && !code.value[index] && index > 0) {
+    codeElements.value![index - 1].focus();
+  }
+}
+
+function input(index: number) {
+  if (codeElements.value === null) return;
+  const v = code.value[index] ?? "";
+  if (v.length > 1) code.value[index] = v[0];
+
+  if (!(index + 1 >= codeElements.value.length) && v) {
+    codeElements.value[index + 1].focus();
+  }
+
+  if (!(index - 1 < 0) && !v) {
+    codeElements.value[index - 1].focus();
+  }
+
+  console.log(index, codeLength - 1);
+  if (index == codeLength - 1) {
+    const assembledCode = code.value.join("");
+    if (assembledCode.length == codeLength) {
+      complete(assembledCode);
+    }
+  }
+}
+
+function select(index: number) {
+  if (!codeElements.value) return;
+  if (index >= codeElements.value.length) return;
+  codeElements.value[index].select();
+}
+
+function paste(index: number, event: ClipboardEvent) {
+  const newCode = event.clipboardData!.getData("text/plain");
+  for (let i = 0; i < newCode.length && i < codeLength; i++) {
+    code.value[i] = newCode[i];
+    codeElements.value![i].focus();
+  }
+  event.preventDefault();
+}
+
+async function complete(code: string) {
+  loading.value = true;
+  try {
+    const clientId = await $dropFetch(`/api/v1/client/auth/code?code=${code}`);
+    router.push(`/client/authorize/${clientId}`);
+  } catch (e) {
+    if (e instanceof FetchError) {
+      error.value =
+        e.statusMessage ?? e.message ?? "An unknown error occurred.";
+    } else {
+      error.value = (e as string)?.toString();
+    }
+  }
+  loading.value = false;
+}
+</script>
diff --git a/server/api/v1/client/auth/callback/index.post.ts b/server/api/v1/client/auth/callback/index.post.ts
index b08a57bf..bc63be70 100644
--- a/server/api/v1/client/auth/callback/index.post.ts
+++ b/server/api/v1/client/auth/callback/index.post.ts
@@ -8,13 +8,19 @@ export default defineEventHandler(async (h3) => {
   const body = await readBody(h3);
   const clientId = await body.id;
 
-  const data = await clientHandler.fetchClientMetadata(clientId);
-  if (!data)
+  const client = await clientHandler.fetchClient(clientId);
+  if (!client)
     throw createError({
       statusCode: 400,
       statusMessage: "Invalid or expired client ID.",
     });
 
+  if (client.userId != user.userId)
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Not allowed to authorize this client.",
+    });
+
   const token = await clientHandler.generateAuthToken(clientId);
 
   return {
diff --git a/server/api/v1/client/auth/code/index.get.ts b/server/api/v1/client/auth/code/index.get.ts
new file mode 100644
index 00000000..74bc6e87
--- /dev/null
+++ b/server/api/v1/client/auth/code/index.get.ts
@@ -0,0 +1,21 @@
+import clientHandler from "~/server/internal/clients/handler";
+import sessionHandler from "~/server/internal/session";
+
+export default defineEventHandler(async (h3) => {
+  const user = await sessionHandler.getSession(h3);
+  if (!user) throw createError({ statusCode: 403 });
+
+  const query = getQuery(h3);
+  const code = query.code?.toString()?.toUpperCase();
+  if (!code)
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Code required in query params.",
+    });
+
+  const clientId = await clientHandler.fetchClientIdByCode(code);
+  if (!clientId)
+    throw createError({ statusCode: 400, statusMessage: "Invalid code." });
+
+  return clientId;
+});
diff --git a/server/api/v1/client/auth/code/index.post.ts b/server/api/v1/client/auth/code/index.post.ts
new file mode 100644
index 00000000..593b773b
--- /dev/null
+++ b/server/api/v1/client/auth/code/index.post.ts
@@ -0,0 +1,35 @@
+import clientHandler from "~/server/internal/clients/handler";
+import sessionHandler from "~/server/internal/session";
+
+export default defineEventHandler(async (h3) => {
+  const user = await sessionHandler.getSession(h3);
+  if (!user) throw createError({ statusCode: 403 });
+
+  const body = await readBody(h3);
+  const clientId = await body.id;
+
+  const client = await clientHandler.fetchClient(clientId);
+  if (!client)
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Invalid or expired client ID.",
+    });
+
+  if (client.userId != user.userId)
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Not allowed to authorize this client.",
+    });
+
+  if (!client.peer)
+    throw createError({
+      statusCode: 500,
+      statusMessage: "No client listening for authorization.",
+    });
+
+  const token = await clientHandler.generateAuthToken(clientId);
+
+  await clientHandler.sendAuthToken(clientId, token);
+
+  return;
+});
diff --git a/server/api/v1/client/auth/code/ws.get.ts b/server/api/v1/client/auth/code/ws.get.ts
new file mode 100644
index 00000000..637d8df4
--- /dev/null
+++ b/server/api/v1/client/auth/code/ws.get.ts
@@ -0,0 +1,25 @@
+import type { FetchError } from "ofetch";
+import clientHandler from "~/server/internal/clients/handler";
+
+export default defineWebSocketHandler({
+  async open(peer) {
+    try {
+      const h3 = { headers: peer.request?.headers ?? new Headers() };
+      const code = h3.headers.get("Authorization");
+      if (!code)
+        throw createError({
+          statusCode: 400,
+          statusMessage: "Code required in Authorization header.",
+        });
+      await clientHandler.connectCodeListener(code, peer);
+    } catch (e) {
+      peer.send(
+        JSON.stringify({
+          type: "error",
+          value: (e as FetchError)?.statusMessage,
+        }),
+      );
+      peer.close();
+    }
+  },
+});
diff --git a/server/api/v1/client/auth/callback/index.get.ts b/server/api/v1/client/auth/index.get.ts
similarity index 71%
rename from server/api/v1/client/auth/callback/index.get.ts
rename to server/api/v1/client/auth/index.get.ts
index d9545347..92cf16c5 100644
--- a/server/api/v1/client/auth/callback/index.get.ts
+++ b/server/api/v1/client/auth/index.get.ts
@@ -13,14 +13,20 @@ export default defineEventHandler(async (h3) => {
       statusMessage: "Provide client ID in request params as 'id'",
     });
 
-  const data = await clientHandler.fetchClientMetadata(providedClientId);
-  if (!data)
+  const client = await clientHandler.fetchClient(providedClientId);
+  if (!client)
     throw createError({
       statusCode: 404,
       statusMessage: "Request not found.",
     });
 
+  if (client.userId && user.userId !== client.userId)
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Client already claimed.",
+    });
+
   await clientHandler.attachUserId(providedClientId, user.userId);
 
-  return data;
+  return client.data;
 });
diff --git a/server/api/v1/client/auth/initiate.post.ts b/server/api/v1/client/auth/initiate.post.ts
index b03ac7d7..64186b5e 100644
--- a/server/api/v1/client/auth/initiate.post.ts
+++ b/server/api/v1/client/auth/initiate.post.ts
@@ -1,3 +1,5 @@
+import { type } from "arktype";
+import { readDropValidatedBody, throwingArktype } from "~/server/arktype";
 import type {
   CapabilityConfiguration,
   InternalClientCapability,
@@ -5,23 +7,23 @@ import type {
 import capabilityManager, {
   validCapabilities,
 } from "~/server/internal/clients/capabilities";
-import clientHandler from "~/server/internal/clients/handler";
+import clientHandler, { AuthMode } from "~/server/internal/clients/handler";
 import { parsePlatform } from "~/server/internal/utils/parseplatform";
 
+const ClientAuthInitiate = type({
+  name: "string",
+  platform: "string",
+  capabilities: "object",
+  mode: type.valueOf(AuthMode).default(AuthMode.Callback),
+}).configure(throwingArktype);
+
 export default defineEventHandler(async (h3) => {
-  const body = await readBody(h3);
+  const body = await readDropValidatedBody(h3, ClientAuthInitiate);
 
-  const name = body.name;
   const platformRaw = body.platform;
   const capabilities: Partial<CapabilityConfiguration> =
     body.capabilities ?? {};
 
-  if (!name || !platformRaw)
-    throw createError({
-      statusCode: 400,
-      statusMessage: "Missing name or platform in body",
-    });
-
   const platform = parsePlatform(platformRaw);
   if (!platform)
     throw createError({
@@ -29,12 +31,6 @@ export default defineEventHandler(async (h3) => {
       statusMessage: "Invalid or unsupported platform",
     });
 
-  if (!capabilities || typeof capabilities !== "object")
-    throw createError({
-      statusCode: 400,
-      statusMessage: "Capabilities must be an array",
-    });
-
   const capabilityIterable = Object.entries(capabilities) as Array<
     [InternalClientCapability, object]
   >;
@@ -64,11 +60,12 @@ export default defineEventHandler(async (h3) => {
       statusMessage: "Invalid capability configuration.",
     });
 
-  const clientId = await clientHandler.initiate({
-    name,
+  const result = await clientHandler.initiate({
+    name: body.name,
     platform,
     capabilities,
+    mode: body.mode,
   });
 
-  return `/client/${clientId}/callback`;
+  return result;
 });
diff --git a/server/internal/clients/handler.ts b/server/internal/clients/handler.ts
index 5ab748e0..eaae288f 100644
--- a/server/internal/clients/handler.ts
+++ b/server/internal/clients/handler.ts
@@ -7,11 +7,18 @@ import type {
   InternalClientCapability,
 } from "./capabilities";
 import capabilityManager from "./capabilities";
+import type { PeerImpl } from "../tasks";
+
+export enum AuthMode {
+  Callback = "callback",
+  Code = "code",
+}
 
 export interface ClientMetadata {
   name: string;
   platform: Platform;
   capabilities: Partial<CapabilityConfiguration>;
+  mode: AuthMode;
 }
 
 export class ClientHandler {
@@ -22,8 +29,10 @@ export class ClientHandler {
       data: ClientMetadata;
       userId?: string;
       authToken?: string;
+      peer?: PeerImpl;
     }
   >();
+  private codeClientMap = new Map<string, string>();
 
   async initiate(metadata: ClientMetadata) {
     const clientId = randomUUID();
@@ -32,14 +41,61 @@ export class ClientHandler {
       data: metadata,
       timeout: setTimeout(
         () => {
-          if (this.temporaryClientTable.has(clientId))
+          const client = this.temporaryClientTable.get(clientId);
+          if (client) {
+            if (client.peer) {
+              client.peer.send(
+                JSON.stringify({ type: "error", value: "Request timed out." }),
+              );
+              client.peer.close();
+            }
             this.temporaryClientTable.delete(clientId);
+          }
+
+          const code = this.codeClientMap
+            .entries()
+            .find(([_, v]) => v === clientId);
+          if (code) this.codeClientMap.delete(code[0]);
         },
         1000 * 60 * 10,
       ), // 10 minutes
     });
 
-    return clientId;
+    switch (metadata.mode) {
+      case AuthMode.Callback:
+        return `/client/authorize/${clientId}`;
+      case AuthMode.Code: {
+        const code = randomUUID()
+          .replaceAll(/-/g, "")
+          .slice(0, 7)
+          .toUpperCase();
+        this.codeClientMap.set(code, clientId);
+        return code;
+      }
+    }
+  }
+
+  async connectCodeListener(code: string, peer: PeerImpl) {
+    const clientId = this.codeClientMap.get(code);
+    if (!clientId)
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Invalid or unknown code.",
+      });
+    const metadata = this.temporaryClientTable.get(clientId);
+    if (!metadata)
+      throw createError({ statusCode: 500, statusMessage: "Broken code." });
+    if (metadata.peer)
+      throw createError({
+        statusCode: 400,
+        statusMessage: "Pre-existing listener for this code.",
+      });
+    metadata.peer = peer;
+    this.temporaryClientTable.set(clientId, metadata);
+  }
+
+  async fetchClientIdByCode(code: string) {
+    return this.codeClientMap.get(code);
   }
 
   async fetchClientMetadata(clientId: string) {
@@ -68,6 +124,23 @@ export class ClientHandler {
     return token;
   }
 
+  async sendAuthToken(clientId: string, token: string) {
+    const client = this.temporaryClientTable.get(clientId);
+    if (!client)
+      throw createError({
+        statusCode: 500,
+        statusMessage: "Corrupted code, please restart the process.",
+      });
+    if (!client.peer)
+      throw createError({
+        statusCode: 400,
+        statusMessage: "Client has not connected yet. Please try again later.",
+      });
+    await client.peer.send(
+      JSON.stringify({ type: "token", value: `${clientId}/${token}` }),
+    );
+  }
+
   async fetchClientMetadataByToken(token: string) {
     return this.temporaryClientTable
       .entries()
diff --git a/server/internal/tasks/index.ts b/server/internal/tasks/index.ts
index bb79301c..8e75da1b 100644
--- a/server/internal/tasks/index.ts
+++ b/server/internal/tasks/index.ts
@@ -445,6 +445,7 @@ export type TaskMessage = {
 
 export type PeerImpl = {
   send: (message: string) => void;
+  close: () => void;
 };
 
 export interface BuildTask {

From 72c972a2a79559b80c1ef9c5fc16fad3b12d6a89 Mon Sep 17 00:00:00 2001
From: DecDuck <declanahofmeyr@gmail.com>
Date: Fri, 1 Aug 2025 14:00:10 +1000
Subject: [PATCH 3/4] Fix for undeleted games from library sources (#148)

* fix: casade delete for games and library sources

* fix: add bug workaround

* fix: lint
---
 .../20250801035031_add_delete_casacde/migration.sql   | 11 +++++++++++
 prisma/models/content.prisma                          |  2 +-
 server/plugins/05.library-init.ts                     |  8 ++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)
 create mode 100644 prisma/migrations/20250801035031_add_delete_casacde/migration.sql

diff --git a/prisma/migrations/20250801035031_add_delete_casacde/migration.sql b/prisma/migrations/20250801035031_add_delete_casacde/migration.sql
new file mode 100644
index 00000000..645377ad
--- /dev/null
+++ b/prisma/migrations/20250801035031_add_delete_casacde/migration.sql
@@ -0,0 +1,11 @@
+-- DropForeignKey
+ALTER TABLE "Game" DROP CONSTRAINT "Game_libraryId_fkey";
+
+-- DropIndex
+DROP INDEX "GameTag_name_idx";
+
+-- CreateIndex
+CREATE INDEX "GameTag_name_idx" ON "GameTag" USING GIST ("name" gist_trgm_ops(siglen=32));
+
+-- AddForeignKey
+ALTER TABLE "Game" ADD CONSTRAINT "Game_libraryId_fkey" FOREIGN KEY ("libraryId") REFERENCES "Library"("id") ON DELETE CASCADE ON UPDATE CASCADE;
diff --git a/prisma/models/content.prisma b/prisma/models/content.prisma
index 587f2a60..3ab28be6 100644
--- a/prisma/models/content.prisma
+++ b/prisma/models/content.prisma
@@ -36,7 +36,7 @@ model Game {
   // These fields will not be optional in the next version
   // Any game without a library ID will be assigned one at startup, based on the defaults
   libraryId   String?
-  library     Library? @relation(fields: [libraryId], references: [id])
+  library     Library? @relation(fields: [libraryId], references: [id], onDelete: Cascade, onUpdate: Cascade)
   libraryPath String
 
   collections CollectionEntry[]
diff --git a/server/plugins/05.library-init.ts b/server/plugins/05.library-init.ts
index bba60901..9891b51e 100644
--- a/server/plugins/05.library-init.ts
+++ b/server/plugins/05.library-init.ts
@@ -61,6 +61,14 @@ export default defineNitroPlugin(async () => {
     });
   }
 
+  // Delete all games that don't have a library provider after the legacy handler
+  // (leftover from a bug)
+  await prisma.game.deleteMany({
+    where: {
+      libraryId: null,
+    },
+  });
+
   for (const library of libraries) {
     const constructor = libraryConstructors[library.backend];
     try {

From 7d9525084d75b00d84e8373823b9e9988ad56bed Mon Sep 17 00:00:00 2001
From: DecDuck <declanahofmeyr@gmail.com>
Date: Fri, 1 Aug 2025 14:02:44 +1000
Subject: [PATCH 4/4] feat: bump version (#150)

---
 package.json              | 2 +-
 server/internal/consts.ts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 3a06bab8..9f1e07a1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "drop",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "private": true,
   "type": "module",
   "license": "AGPL-3.0-or-later",
diff --git a/server/internal/consts.ts b/server/internal/consts.ts
index 63e6284d..e7ab1cb7 100644
--- a/server/internal/consts.ts
+++ b/server/internal/consts.ts
@@ -1 +1 @@
-export const DROP_VERSION = "0.3.0";
+export const DROP_VERSION = "0.3.1";