feat: complete device onboarding and mobile binding workflows

internal/app/app.go

@@ -36,6 +36,7 @@ import (
 	"data-terminal-cloud/internal/memorytool"
 	"data-terminal-cloud/internal/objectstore"
 	"data-terminal-cloud/internal/observability"
+	"data-terminal-cloud/internal/onboarding"
 	"data-terminal-cloud/internal/opsaccess"
 	"data-terminal-cloud/internal/opsconfig"
 	"data-terminal-cloud/internal/opsdevice"
@@ -130,7 +131,8 @@ func Run(ctx context.Context, serviceName string) error {
 	}
 	tokenVerifier := identity.NewOIDCVerifier(ctx, cfg.AuthIssuerURL, cfg.AuthJWKSURL, cfg.AuthAudience)
 	identityRepository := identity.NewRepository(databasePool)
-	var deviceVerifier *deviceauth.Verifier
+	var deviceVerifier httpapi.DeviceRequestVerifier
+	var onboardingService *onboarding.Service
 	var deviceRepository *device.Repository
 	var deviceTelemetryService *device.TelemetryService
 	var conversationCreator *orchestration.Service
@@ -344,6 +346,22 @@ func Run(ctx context.Context, serviceName string) error {
 	if err != nil {
 		return fmt.Errorf("create rate limiter: %w", err)
 	}
+	if (serviceName == "api" || serviceName == "worker") && cfg.Onboarding.MasterKey != "" {
+		var sms onboarding.SMSProvider
+		if cfg.Onboarding.SMSLoginEnabled {
+			sms, err = onboarding.NewHTTPSMSProvider(cfg.Onboarding.SMSGatewayURL, cfg.Onboarding.SMSGatewayToken)
+			if err != nil {
+				return err
+			}
+		}
+		onboardingService, err = onboarding.NewService(databasePool, redisClient, onboarding.Options{Enabled: cfg.Onboarding.Enabled, PauseClaims: cfg.Onboarding.PauseClaims, MasterKey: cfg.Onboarding.MasterKey, EntryURL: cfg.Onboarding.EntryURL, AllowLocalHTTP: cfg.Onboarding.AllowLocalHTTP, TrustedProxyCIDRs: cfg.Onboarding.TrustedProxyCIDRs, TokenVerifier: tokenVerifier, LegacyVerifier: deviceVerifier, ActivationEnabled: cfg.Onboarding.ActivationEnabled, ProviderMasterKey: cfg.VolcHardwareDeviceCredentialMasterKey, InstanceID: cfg.VolcHardwareInstanceID, ProductKey: cfg.VolcHardwareProductKey, ProductSecret: cfg.VolcHardwareProductSecret, BotID: cfg.VolcHardwareAgentBotID, Transport: cfg.VolcHardwareTransport, MinimumSDKVersion: cfg.VolcHardwareMinimumSDKVersion, SMS: sms, SMSLoginEnabled: cfg.Onboarding.SMSLoginEnabled, SelfSignupTenantIDs: cfg.Onboarding.SelfSignupTenantIDs, Logger: logger})
+		if err != nil {
+			return fmt.Errorf("create onboarding service: %w", err)
+		}
+		if serviceName == "api" {
+			deviceVerifier = onboardingService
+		}
+	}
 	if serviceName == "worker" {
 		webEventService = webevents.NewService(databasePool)
 		outbox.RegisterMetrics(databasePool)
@@ -354,6 +372,10 @@ func Run(ctx context.Context, serviceName string) error {
 			outbox.WorkerOptions{PollInterval: cfg.WorkerPollInterval},
 		)
 		outboxWorker.Register("platform.noop", func(context.Context, outbox.Event) error { return nil })
+		if onboardingService != nil {
+			outboxWorker.Register(onboarding.ActivationEvent, onboardingService.ProcessActivation)
+			go onboardingService.RunMaintenance(ctx)
+		}
 		alertWebhookProcessor, processorErr := alertnotification.NewProcessor(cfg.AlertWebhookURL, cfg.AlertWebhookSecret, cfg.AlertWebhookTimeout)
 		if processorErr != nil {
 			return fmt.Errorf("create alert webhook processor: %w", processorErr)
@@ -520,6 +542,7 @@ func Run(ctx context.Context, serviceName string) error {
 		}()
 	}
 	router := httpapi.NewRouter(httpapi.RouterOptions{
+		OnboardingService:                onboardingService,
 		ServiceName:                      serviceName,
 		Logger:                           logger,
 		RateLimiter:                      rateLimiterAdapter{limiter},