Add an admin endpoint to check a session_code (#4234)

docs/admin.md

@@ -252,6 +252,37 @@ Content-Type: application/json
 }
 ```
 
+### POST /instances/:domain/session_code/check
+
+Checks that a session_code is valid for the given instance. Note that the
+session_code will be invalidated after that.
+
+#### Request
+
+```http
+POST /instances/alice.cozy.localhost/session_code/check HTTP/1.1
+Content-Type: application/json
+```
+
+```json
+{
+  "session_code": "L7oJ6BDQtdbLR5Vr5vTxTXLJ1pQzMXcD"
+}
+```
+
+#### Response
+
+```http
+HTTP/1.1 200 OK
+Content-Type: application/json
+```
+
+```json
+{
+  "valid": true
+}
+```
+
 ### POST /instances/:domain/email_verified_code
 
 Creates an email_verified_code that can be used on the given instance to avoid

web/instances/instances.go

@@ -1,3 +1,6 @@
+// Package instances is used for the admin endpoint to manage instances. It
+// covers a lot of things, from creating an instance to checking the FS
+// integrity.
 package instances
 
 import (
@@ -379,6 +382,30 @@ func createSessionCode(c echo.Context) error {
 	})
 }
 
+type checkSessionCodeArgs struct {
+	Code string `json:"session_code"`
+}
+
+func checkSessionCode(c echo.Context) error {
+	domain := c.Param("domain")
+	inst, err := lifecycle.GetInstance(domain)
+	if err != nil {
+		return err
+	}
+
+	var args checkSessionCodeArgs
+	if err := c.Bind(&args); err != nil {
+		return err
+	}
+
+	ok := inst.CheckAndClearSessionCode(args.Code)
+	if !ok {
+		return c.JSON(http.StatusForbidden, echo.Map{"valid": false})
+	}
+
+	return c.JSON(http.StatusOK, echo.Map{"valid": true})
+}
+
 func createEmailVerifiedCode(c echo.Context) error {
 	domain := c.Param("domain")
 	inst, err := lifecycle.GetInstance(domain)
@@ -684,6 +711,7 @@ func Routes(router *echo.Group) {
 	router.POST("/:domain/auth-mode", setAuthMode)
 	router.POST("/:domain/magic_link", createMagicLink)
 	router.POST("/:domain/session_code", createSessionCode)
+	router.POST("/:domain/session_code/check", checkSessionCode)
 	router.POST("/:domain/email_verified_code", createEmailVerifiedCode)
 	router.DELETE("/:domain/sessions", cleanSessions)