P1 — implement the server-side SmartThings OAuth, device and event provider #202

New issue

Open

opened 2026-08-24 06:24:55 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-08-24 06:24:55 +00:00

(Migrated from github.com)

Parent: #194
Depends on: #158, #195
Integrates with: #150, #151, #152, #159

Goal

Implement SmartThings as a principal-scoped Zara server provider using current official production mechanisms; Android may host account-linking UX but never owns refresh credentials.

Required implementation

API Access App and OAuth 2.0 authorization/code flow;
scoped permissions and explicit consent;
encrypted server-side access/refresh credential lifecycle and refresh;
REST location/device/state/command/scene/routine operations supported by the selected API;
signed webhook verification before parsing/dispatch;
subscription and event lifecycle;
bounded retry/backoff/idempotency;
disconnect, cleanup and revocation;
typed provider/capability results and principal-scoped device aliases/semantic mappings.

Security

Prevent cross-principal token/device access, redirect/state/PKCE confusion as applicable, webhook replay/forgery, SSRF, secret logging, overbroad scopes, duplicate side effects and Android credential authority.

Tests

Use local fake servers and signed fixtures for OAuth success/failure/refresh/revocation, webhook validation/replay, pagination, rate limits, stale devices, command idempotency, provider outage and two-principal isolation. No CI dependence on a live SmartThings account.

Acceptance

Zara can discover and control authorized SmartThings resources server-side and deliver scoped event updates while secrets remain server-owned and revocable.

Parent: #194 Depends on: #158, #195 Integrates with: #150, #151, #152, #159 ## Goal Implement SmartThings as a principal-scoped Zara server provider using current official production mechanisms; Android may host account-linking UX but never owns refresh credentials. ## Required implementation - API Access App and OAuth 2.0 authorization/code flow; - scoped permissions and explicit consent; - encrypted server-side access/refresh credential lifecycle and refresh; - REST location/device/state/command/scene/routine operations supported by the selected API; - signed webhook verification before parsing/dispatch; - subscription and event lifecycle; - bounded retry/backoff/idempotency; - disconnect, cleanup and revocation; - typed provider/capability results and principal-scoped device aliases/semantic mappings. ## Security Prevent cross-principal token/device access, redirect/state/PKCE confusion as applicable, webhook replay/forgery, SSRF, secret logging, overbroad scopes, duplicate side effects and Android credential authority. ## Tests Use local fake servers and signed fixtures for OAuth success/failure/refresh/revocation, webhook validation/replay, pagination, rate limits, stale devices, command idempotency, provider outage and two-principal isolation. No CI dependence on a live SmartThings account. ## Acceptance Zara can discover and control authorized SmartThings resources server-side and deliver scoped event updates while secrets remain server-owned and revocable.