Server 2.1.0: pair cars by QR code instead of typing the token

Modelled on the OAuth device authorization grant (RFC 8628) and on
only when APPROVAL_PASSWORD is set (at least 12 characters):

- POST /v1/pair/start opens a request for an installation and returns
  a short user code and the /pair URL for the car's QR code;
  POST /v1/pair/poll returns pending, the car's own token (once),
  denied or expired. Requests live 10 minutes, in memory.
- GET/POST /pair is a script-free approval page for the phone
  (strict CSP, no framing). Five wrong passwords lock approvals for a
  minute.
- Each car gets its own 43-character token; only its SHA-256 is stored
  (measurement "device"), and the device is persisted before the car
  can collect the token. Tokens are loaded at startup, so a restart
  keeps paired cars working; the server refuses to start if they cannot
  be loaded.
- GET /v1/devices and POST /v1/devices/{id}/revoke, authenticated with
  the approval password, list and revoke cars.
- The shared INGEST_TOKEN keeps working.

31 tests (race detector clean), govulncheck clean. Tested end to end
against InfluxDB 2.7.12: pairing, wrong password, single collection,
persistence across restarts, revocation (also across a restart), and
that InfluxDB holds only the hash.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

server/main.go

@@ -16,7 +16,10 @@ import (
 	"time"
 )
 
-const minIngestTokenLength = 24
+const (
+	minIngestTokenLength      = 24
+	minApprovalPasswordLength = 12
+)
 
 type config struct {
 	listenAddr      string
@@ -28,6 +31,8 @@ type config struct {
 	abrpAPIKey      string
 	abrpUserToken   string
 	abrpMinInterval time.Duration
+	approvalPass    string
+	publicURL       string
 }
 
 // loadConfig reads the environment and fails closed: a missing InfluxDB setting or a
@@ -42,6 +47,8 @@ func loadConfig(getenv func(string) string) (config, error) {
 		ingestToken:   getenv("INGEST_TOKEN"),
 		abrpAPIKey:    getenv("ABRP_API_KEY"),
 		abrpUserToken: getenv("ABRP_USER_TOKEN"),
+		approvalPass:  getenv("APPROVAL_PASSWORD"),
+		publicURL:     getenv("PUBLIC_URL"),
 	}
 	if c.listenAddr == "" {
 		c.listenAddr = ":8080"
@@ -57,6 +64,11 @@ func loadConfig(getenv func(string) string) (config, error) {
 	if len(c.ingestToken) < minIngestTokenLength {
 		return config{}, fmt.Errorf("INGEST_TOKEN must be at least %d characters", minIngestTokenLength)
 	}
+	// Pairing is optional; when it is on, its password guards token issuance and must not
+	// be guessable.
+	if c.approvalPass != "" && len(c.approvalPass) < minApprovalPasswordLength {
+		return config{}, fmt.Errorf("APPROVAL_PASSWORD must be at least %d characters", minApprovalPasswordLength)
+	}
 	c.abrpMinInterval = 5 * time.Second
 	if raw := getenv("ABRP_MIN_INTERVAL_SECONDS"); raw != "" {
 		seconds, err := strconv.ParseFloat(raw, 64)
@@ -84,7 +96,18 @@ func main() {
 		MinInterval: cfg.abrpMinInterval,
 		Client:      &http.Client{Timeout: 10 * time.Second},
 	}
-	api := &API{Store: store, IngestToken: cfg.ingestToken, Forwarder: forwarder}
+	// Paired cars' tokens must be known before the first request; starting without them
+	// would answer every paired car with 401, so a failed load stops the start instead.
+	loadCtx, cancelLoad := context.WithTimeout(context.Background(), 30*time.Second)
+	devices, err := store.LoadDevices(loadCtx)
+	cancelLoad()
+	if err != nil {
+		slog.Error("paired devices could not be loaded", "error", err)
+		os.Exit(1)
+	}
+	pairing := NewPairing(cfg.approvalPass, devices)
+	api := &API{Store: store, IngestToken: cfg.ingestToken, Forwarder: forwarder,
+		Pairing: pairing, PublicURL: cfg.publicURL}
 
 	srv := &http.Server{
 		Addr:              cfg.listenAddr,
@@ -98,7 +121,8 @@ func main() {
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 	go func() {
-		slog.Info("listening", "addr", cfg.listenAddr, "bucket", cfg.influxBucket, "abrp", forwarder.configured())
+		slog.Info("listening", "addr", cfg.listenAddr, "bucket", cfg.influxBucket,
+			"abrp", forwarder.configured(), "pairing", pairing.Enabled(), "pairedDevices", len(devices))
 		if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 			slog.Error("server failed", "error", err)
 			os.Exit(1)