Merge pull request #245 from itsmeakhil/feat/tauri-desktop-v2

Feat/tauri desktop v2

Author: itsmeakhil

.gitignore

@@ -74,4 +74,6 @@ apps/desktop/src-tauri/target/release/
 .claude
 /docs
 
-.superpowers
+.superpowers/apps/desktop/node_modules
+/apps/desktop/src-tauri/target
+/apps/desktop/node_modules

apps/api-runner/node_modules/.bin/tsc

@@ -8,6 +8,7 @@
 
 from app.core.limiter import limiter
 from app.core import audit
+from app.core.config import get_settings
 
 from app.api.routes.auth.cookie_attach import attach_auth_cookies, clear_auth_cookies
 from app.api.routes.auth.schema import (
@@ -80,8 +81,16 @@ async def create_session(
 
     access = create_access_token(uid)
     raw_refresh = new_refresh_token()
-    await set_refresh_token_hash(uid, hash_refresh_token(raw_refresh))
-    attach_auth_cookies(response, access, raw_refresh)
+    settings = get_settings()
+    refresh_days = (
+        settings.LONG_LIVED_REFRESH_TOKEN_EXPIRE_DAYS
+        if payload.long_lived
+        else settings.REFRESH_TOKEN_EXPIRE_DAYS
+    )
+    await set_refresh_token_hash(
+        uid, hash_refresh_token(raw_refresh), long_lived=payload.long_lived
+    )
+    attach_auth_cookies(response, access, raw_refresh, refresh_days=refresh_days)
 
     doc = await get_user_doc(uid)
     if not doc:
@@ -132,10 +141,20 @@ async def refresh_session(
             detail="Invalid refresh token.",
         )
 
+    # Preserve the session's long-lived flag across rotation so desktop
+    # sessions keep their 60-day cookie TTL on every refresh.
+    user_doc = await get_user_doc(uid)
+    long_lived = bool(user_doc.get("refresh_long_lived", False)) if user_doc else False
+    settings = get_settings()
+    refresh_days = (
+        settings.LONG_LIVED_REFRESH_TOKEN_EXPIRE_DAYS
+        if long_lived
+        else settings.REFRESH_TOKEN_EXPIRE_DAYS
+    )
     new_raw = new_refresh_token()
-    await set_refresh_token_hash(uid, hash_refresh_token(new_raw))
+    await set_refresh_token_hash(uid, hash_refresh_token(new_raw), long_lived=long_lived)
     access = create_access_token(uid)
-    attach_auth_cookies(response, access, new_raw)
+    attach_auth_cookies(response, access, new_raw, refresh_days=refresh_days)
     audit.set_action("auth.token_refresh")
     audit.set_entity("user", uid)
     audit.set_summary("Refreshed session")
@@ -300,6 +319,26 @@ async def session_check(_uid: Annotated[str, Depends(get_current_uid)]) -> OkRes
     return OkResponse(ok=True)
 
 
+@router.post(
+    "/desktop-token",
+    summary="Mint a Firebase custom token for the desktop-app sign-in handoff",
+)
+async def desktop_token(uid: Annotated[str, Depends(get_current_uid)]) -> dict:
+    # The web session (browser) mints a short-lived Firebase custom token which
+    # is handed to the desktop app via the mydevtools:// deep link; the app
+    # signs in with it and runs the normal session exchange.
+    from app.core.firebase import get_firebase_app
+
+    try:
+        from firebase_admin import auth as firebase_auth
+    except Exception:  # pragma: no cover - firebase_admin always present in prod
+        raise HTTPException(status_code=503, detail="Firebase unavailable")
+    get_firebase_app()
+    token_bytes = firebase_auth.create_custom_token(uid)
+    token = token_bytes.decode("utf-8") if isinstance(token_bytes, bytes) else token_bytes
+    return {"token": token}
+
+
 # ── Master-password vault ─────────────────────────────────────────────────────
 
 

apps/api-runner/node_modules/.bin/tsserver

@@ -4,10 +4,16 @@
 from app.core.config import get_settings
 
 
-def attach_auth_cookies(response: Response, access: str, refresh_plain: str) -> None:
+def attach_auth_cookies(
+    response: Response,
+    access: str,
+    refresh_plain: str,
+    refresh_days: int | None = None,
+) -> None:
     settings = get_settings()
     access_max = settings.ACCESS_TOKEN_EXPIRE_MINUTES * 60
-    refresh_max = settings.REFRESH_TOKEN_EXPIRE_DAYS * 24 * 3600
+    days = refresh_days if refresh_days is not None else settings.REFRESH_TOKEN_EXPIRE_DAYS
+    refresh_max = days * 24 * 3600
     common: dict = {
         "httponly": True,
         "secure": settings.AUTH_COOKIE_SECURE,

apps/backend/app/api/routes/auth/api.py

@@ -7,6 +7,8 @@ class SessionRequest(BaseModel):
 
     id_token: str = Field(min_length=1)
     check_revoked: bool = True
+    # Desktop app requests a long-lived (60-day) refresh cookie.
+    long_lived: bool = False
 
 
 class SocialLinks(BaseModel):

apps/backend/app/api/routes/auth/cookie_attach.py

@@ -83,12 +83,20 @@ async def update_user_profile(uid: str, updates: dict[str, Any]) -> None:
     await bump_version(ns="auth_user", uid=uid)
 
 
-async def set_refresh_token_hash(uid: str, token_hash: str) -> None:
+async def set_refresh_token_hash(
+    uid: str, token_hash: str, long_lived: bool = False
+) -> None:
     now = create_timestamp()
     await db_manager.update_one(
         USERS,
         {"_id": uid},
-        {"$set": {"refresh_token_hash": token_hash, "updated_at": now}},
+        {
+            "$set": {
+                "refresh_token_hash": token_hash,
+                "refresh_long_lived": long_lived,
+                "updated_at": now,
+            }
+        },
     )
     await bump_version(ns="auth_user", uid=uid)
 

apps/backend/app/api/routes/auth/schema.py

@@ -37,3 +37,4 @@ class ConnectionOut(BaseModel):
     name: str
     createdAt: int
     lastUsedAt: int
+    updatedAt: int

apps/backend/app/api/routes/auth/users_repo.py

@@ -17,6 +17,9 @@
 def _doc_to_out(doc: dict[str, Any], *, connection_id: str) -> ConnectionOut:
     created_at = int(doc.get("createdAt", 0)) or create_timestamp()
     last_used_at = int(doc.get("lastUsedAt", 0)) or created_at
+    # Content-edit clock for sync LWW. Falls back to lastUsedAt for legacy docs
+    # written before updatedAt existed.
+    updated_at = int(doc.get("updatedAt", 0)) or last_used_at
     return ConnectionOut(
         id=connection_id,
         userId=str(doc.get("created_by", "")),
@@ -25,6 +28,7 @@ def _doc_to_out(doc: dict[str, Any], *, connection_id: str) -> ConnectionOut:
         name=str(doc.get("name", "")),
         createdAt=created_at,
         lastUsedAt=last_used_at,
+        updatedAt=updated_at,
     )
 
 
@@ -52,6 +56,7 @@ async def create_connection(ctx: WorkspaceContext, body: ConnectionCreate) -> Co
         "name": body.name or "My Connection",
         "createdAt": ts,
         "lastUsedAt": ts,
+        "updatedAt": ts,
     }
     try:
         await db_manager.insert_one(NOSQL_CONNECTIONS, doc)
@@ -69,7 +74,9 @@ async def update_connection(ctx: WorkspaceContext, connection_id: str, body: Con
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Connection not found.")
 
     ts = create_timestamp()
-    patch: dict[str, Any] = {"lastUsedAt": ts}
+    # updatedAt is the sync LWW clock — it advances on every content edit (unlike
+    # lastUsedAt, which also moves on a bare connect/touch).
+    patch: dict[str, Any] = {"lastUsedAt": ts, "updatedAt": ts}
     if body.encryptedData is not None:
         patch["encryptedData"] = body.encryptedData
     if body.iv is not None:

apps/backend/app/api/routes/nosql/schema.py

@@ -39,3 +39,4 @@ class RedisConnectionOut(BaseModel):
     name: str
     createdAt: int
     lastUsedAt: int
+    updatedAt: int