chore: checkpoint 第一版

internal/deviceauth/identity.go

@@ -7,11 +7,14 @@ type contextKey string
 const identityKey contextKey = "device-identity"
 
 type Identity struct {
-	ID            string
-	PublicID      string
-	TenantID      string
-	Status        string
-	CredentialRef string
+	ID                   string
+	PublicID             string
+	TenantID             string
+	Status               string
+	ActivationState      string
+	VoiceRuntime         string
+	HardwareLicenseReady bool
+	CredentialRef        string
 }
 
 func WithIdentity(ctx context.Context, identity Identity) context.Context {

internal/deviceauth/repository.go

@@ -18,10 +18,10 @@ func NewRepository(pool *pgxpool.Pool) *Repository { return &Repository{pool: po
 func (r *Repository) FindByPublicID(ctx context.Context, publicID string) (Identity, error) {
 	var identity Identity
 	err := r.pool.QueryRow(ctx, `
-		SELECT id::text, public_id::text, tenant_id::text, status, credential_ref
-		FROM device
-		WHERE public_id = $1::uuid`, publicID,
-	).Scan(&identity.ID, &identity.PublicID, &identity.TenantID, &identity.Status, &identity.CredentialRef)
+		SELECT d.id::text,d.public_id::text,d.tenant_id::text,d.status,d.activation_state,d.credential_ref
+		FROM device d
+		WHERE d.public_id = $1::uuid`, publicID,
+	).Scan(&identity.ID, &identity.PublicID, &identity.TenantID, &identity.Status, &identity.ActivationState, &identity.CredentialRef)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return Identity{}, ErrDeviceNotFound
 	}

internal/deviceauth/verifier.go

@@ -13,6 +13,8 @@ import (
 	"net/http"
 	"strings"
 	"time"
+
+	"data-terminal-cloud/internal/deviceactivation"
 )
 
 const (
@@ -95,7 +97,7 @@ func (v *Verifier) Verify(request *http.Request) (Identity, error) {
 		}
 		return Identity{}, fmt.Errorf("lookup device identity: %w", err)
 	}
-	if identity.Status != "registered" || identity.TenantID == "" {
+	if identity.Status != "registered" || identity.TenantID == "" || !deviceactivation.AllowsDeviceAuthentication(identity.ActivationState) {
 		return Identity{}, ErrDeviceInactive
 	}
 	secret, err := v.secrets.Resolve(request.Context(), identity.CredentialRef)