feat(auth): add CLI auth endpoints (start, poll, approve)

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-Claude)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Author: fullstackjam

src/routes/api/auth/cli/approve/+server.ts

@@ -0,0 +1,53 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { getCurrentUser, generateId } from '$lib/server/auth';
+
+export const POST: RequestHandler = async ({ platform, cookies, request }) => {
+	const env = platform?.env;
+	if (!env) return json({ error: 'Platform env not available' }, { status: 500 });
+
+	const user = await getCurrentUser(request, cookies, env.DB, env.JWT_SECRET);
+	if (!user) return json({ error: 'Unauthorized' }, { status: 401 });
+
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		return json({ error: 'Invalid request body' }, { status: 400 });
+	}
+
+	const { code } = body;
+	if (!code || typeof code !== 'string') {
+		return json({ error: 'Code is required' }, { status: 400 });
+	}
+
+	const row = await env.DB.prepare(
+		"SELECT * FROM cli_auth_codes WHERE code = ? AND status = 'pending' AND expires_at > datetime('now')"
+	)
+		.bind(code)
+		.first<{ id: string }>();
+
+	if (!row) return json({ error: 'Invalid or expired code' }, { status: 400 });
+
+	const tokenId = generateId();
+	const tokenValue = 'obt_' + crypto.randomUUID().replace(/-/g, '');
+
+	try {
+		await env.DB.prepare(
+			`INSERT INTO api_tokens (id, user_id, token, name, expires_at)
+			VALUES (?, ?, ?, 'cli', datetime('now', '+90 days'))`
+		)
+			.bind(tokenId, user.id, tokenValue)
+			.run();
+
+		await env.DB.prepare(
+			"UPDATE cli_auth_codes SET user_id = ?, token_id = ?, status = 'approved' WHERE id = ?"
+		)
+			.bind(user.id, tokenId, row.id)
+			.run();
+	} catch (e) {
+		return json({ error: 'Database error: ' + (e as Error).message }, { status: 500 });
+	}
+
+	return json({ success: true });
+};

src/routes/api/auth/cli/poll/+server.ts

@@ -0,0 +1,47 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = async ({ platform, url }) => {
+	const env = platform?.env;
+	if (!env) return json({ error: 'Platform env not available' }, { status: 500 });
+
+	const code_id = url.searchParams.get('code_id');
+	if (!code_id) return json({ error: 'code_id is required' }, { status: 400 });
+
+	const row = await env.DB.prepare('SELECT * FROM cli_auth_codes WHERE id = ?')
+		.bind(code_id)
+		.first<{ id: string; code: string; user_id: string | null; token_id: string | null; status: string; expires_at: string }>();
+
+	if (!row) return json({ status: 'expired' });
+
+	if (row.expires_at < new Date().toISOString()) {
+		return json({ status: 'expired' });
+	}
+
+	if (row.status === 'pending') {
+		return json({ status: 'pending' });
+	}
+
+	if (row.status === 'approved' && row.token_id && row.user_id) {
+		const token = await env.DB.prepare('SELECT * FROM api_tokens WHERE id = ?')
+			.bind(row.token_id)
+			.first<{ id: string; token: string; expires_at: string }>();
+
+		const user = await env.DB.prepare('SELECT username FROM users WHERE id = ?')
+			.bind(row.user_id)
+			.first<{ username: string }>();
+
+		await env.DB.prepare("UPDATE cli_auth_codes SET status = 'used' WHERE id = ?")
+			.bind(code_id)
+			.run();
+
+		return json({
+			status: 'approved',
+			token: token?.token,
+			username: user?.username,
+			expires_at: token?.expires_at
+		});
+	}
+
+	return json({ status: 'expired' });
+};

src/routes/api/auth/cli/start/+server.ts

@@ -0,0 +1,35 @@
+import { json } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
+import { generateId } from '$lib/server/auth';
+
+export const POST: RequestHandler = async ({ platform, request }) => {
+	const env = platform?.env;
+	if (!env) return json({ error: 'Platform env not available' }, { status: 500 });
+
+	let body;
+	try {
+		body = await request.json();
+	} catch {
+		return json({ error: 'Invalid request body' }, { status: 400 });
+	}
+
+	const { code } = body;
+	if (!code || typeof code !== 'string') {
+		return json({ error: 'Code is required' }, { status: 400 });
+	}
+
+	const code_id = generateId();
+
+	try {
+		await env.DB.prepare(
+			`INSERT INTO cli_auth_codes (id, code, status, expires_at)
+			VALUES (?, ?, 'pending', datetime('now', '+10 minutes'))`
+		)
+			.bind(code_id, code)
+			.run();
+	} catch (e) {
+		return json({ error: 'Database error: ' + (e as Error).message }, { status: 500 });
+	}
+
+	return json({ code_id });
+};