Code-based authorization for Drop clients (#145)

* feat: code-based authorization

* fix: final touches

* fix: require session on code fetch endpoint

* feat: better error handling

* refactor: move auth send to client handler

* fix: lint

server/api/v1/client/auth/index.get.ts

@@ -0,0 +1,32 @@
+import clientHandler from "~/server/internal/clients/handler";
+import sessionHandler from "~/server/internal/session";
+
+export default defineEventHandler(async (h3) => {
+  const user = await sessionHandler.getSession(h3);
+  if (!user) throw createError({ statusCode: 403 });
+
+  const query = getQuery(h3);
+  const providedClientId = query.id?.toString();
+  if (!providedClientId)
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Provide client ID in request params as 'id'",
+    });
+
+  const client = await clientHandler.fetchClient(providedClientId);
+  if (!client)
+    throw createError({
+      statusCode: 404,
+      statusMessage: "Request not found.",
+    });
+
+  if (client.userId && user.userId !== client.userId)
+    throw createError({
+      statusCode: 400,
+      statusMessage: "Client already claimed.",
+    });
+
+  await clientHandler.attachUserId(providedClientId, user.userId);
+
+  return client.data;
+});