timescale.info#407 · Desktop sign-in approval shows the request's details and asks for the code
- timeline-app
- pull request
- packages
- security
## Summary Hardens the browser page that approves the desktop app's sign-in (`/connect/desktop/ `), along the lines of RFC 8628 §5.4: - **Request details.** When the desktop app starts signing in (`POST /api/auth/device/start`), the server records the time, client address and `User-Agent` (three new columns on `oc_device_logins`, kept only for the request's ten minutes). A new `GET /api/auth/device/request?userCode=…` returns them to the approval page, with whether the address matches the browser's. - **Clear warning.** The page says "Approve only if you just started signing in on your own computer", shows the details, and adds a further warning when the request came from a different address than the browser. - **Code typed, not pre-filled.** The page no longer shows or fills in the code from its link. The person types the code their desktop app shows (case, spaces and dashes are ignored), and **Approve connection** is enabled only when it matches. Typing was chosen over a "the code matches" checkbox because a checkbox is easy to tick without looking. Typing means reading the code off the desktop app's own window. - **Browser sessions only.** Approving, and reading the details, need a browser (`web`) session. Desktop sessions and API keys are refused (403). The existing checks stay: CSRF, a sign-in within five minutes, the per-address rate limit and the ten-minute expiry. - **Email.** Each approval queues a security notice to the account's confirmed address, with the time and address the request started from, using `AccountSecurity.notify` inside the approving transaction. The User-Agent is left out of the email because the requester chooses it. - **Legacy link.** The editor's old `/#desktop/ ` approval dialog is removed, and that link now redirects to the approval page. ## Compatibility The desktop protocol is unchanged: `start`/`poll` requests and responses, `verificationUri` (still `/connect/desktop/ `, which released apps validate) and the poll interval all stay the same. Released desktop apps keep working. Their status line says "Confirm code …", and this build's says "Enter code …". The schema change is `ADD COLUMN IF NOT EXISTS` in `schema.sql`. Requests pending during an upgrade show no address, and the page treats that as a different address. ## Docs `docs/authentication.md`, `docs/guide.md`, the OpenAPI description (new operation and `DeviceSignInRequest` schema; approve is now browser-session only), and the page's README. ## Tests - `test/postgres.mjs`: details returned (address, User-Agent, times, `sameAddress`), 401 signed out, 400 after approval, a desktop session refused for both the lookup and approval, and the approval email delivered with the address. Passed locally against PostgreSQL. - `test/account-security-postgres.mjs`, `test/openapi-postgres.mjs`, `npm test` (402 tests), `npm run typecheck`, `test/next-platform.mjs`, `npm run build`: passed locally. - New `test/device-approval-live-postgres.mjs` (added to CI), which drives the page in Chromium. I couldn't run it locally because Playwright's Chromium download wouldn't finish here, so CI is its first run.