chore: checkpoint 第一版

internal/deviceauth/verifier.go

@@ -13,6 +13,8 @@ import (
 	"net/http"
 	"strings"
 	"time"
+
+	"data-terminal-cloud/internal/deviceactivation"
 )
 
 const (
@@ -95,7 +97,7 @@ func (v *Verifier) Verify(request *http.Request) (Identity, error) {
 		}
 		return Identity{}, fmt.Errorf("lookup device identity: %w", err)
 	}
-	if identity.Status != "registered" || identity.TenantID == "" {
+	if identity.Status != "registered" || identity.TenantID == "" || !deviceactivation.AllowsDeviceAuthentication(identity.ActivationState) {
 		return Identity{}, ErrDeviceInactive
 	}
 	secret, err := v.secrets.Resolve(request.Context(), identity.CredentialRef)