Feat/desktop oauth pkce

controlplane/src/auth/middleware.ts

@@ -57,16 +57,37 @@ export async function authenticate(
     return authenticateWithCfAccеss(request, env);
   }
 
-  // Fall back to dev auth if enabled
+  // Fall back to dev auth if enabled. Dev-auth is header-spoofable, and on
+  // desktop a process inside the sandbox VM can reach the control plane — so when
+  // a per-boot SURFACE_TOKEN is provisioned, only honor dev-auth for requests
+  // from the trusted host frontend (matching X-Orcabot-Surface). No token
+  // (cloud, local dev, older builds) = unchanged behavior.
   const devAuthEnabled = env.DEV_AUTH_ENABLED === 'true';
-  if (devAuthEnabled) {
+  if (devAuthEnabled && devAuthSurfaceTrusted(request, env)) {
     return authenticateDevMоde(request, env);
   }
 
   // No auth method available
   return { user: null, isAuthenticated: false };
 }
 
+/**
+ * Desktop trust boundary: dev-auth is header-spoofable and the sandbox VM can
+ * reach the control plane. When a per-boot SURFACE_TOKEN is provisioned, only
+ * the host frontend (which sends the matching X-Orcabot-Surface header) may use
+ * dev-auth. When unset (cloud / local dev / older builds), enforcement is off.
+ */
+function devAuthSurfaceTrusted(request: Request, env: Env): boolean {
+  const expected = env.SURFACE_TOKEN;
+  if (!expected) return true;
+  // Header for fetch/XHR; query param for top-level browser navigations (OAuth
+  // connect opened in the OS browser), which can't set custom headers.
+  const got =
+    request.headers.get('X-Orcabot-Surface') ||
+    new URL(request.url).searchParams.get('surface');
+  return got === expected;
+}
+
 // Production: Cloudflare Access JWT validation
 async function authenticateWithCfAccеss(
   request: Request,

controlplane/src/index.ts

@@ -61,7 +61,7 @@ export { ASRStreamProxy } from './asr/ASRStreamProxy';
 
 // CORS headers (base - origin is added dynamically)
 const CORS_METHODS = 'GET, POST, PUT, PATCH, DELETE, OPTIONS';
-const CORS_ALLOWED_HEADERS = 'Content-Type, X-User-ID, X-User-Email, X-User-Name';
+const CORS_ALLOWED_HEADERS = 'Content-Type, X-User-ID, X-User-Email, X-User-Name, X-Orcabot-Surface';
 
 /**
  * Parse allowed origins from env. Returns null if all origins allowed (dev mode).
@@ -1267,6 +1267,11 @@ async function handleRequest(request: Request, env: EnvWithBindings, ctx: Pick<E
     if (authError && env.DEV_AUTH_ENABLED !== 'true') {
       return authError;
     }
+    // embed-check makes a server-side GET of a caller-supplied URL — an
+    // exfil/SSRF-shaped surface. A leaked PAT (full user authority) must not be
+    // able to drive it, and private hosts are already blocked below.
+    const patError = rejectPatAuth(auth);
+    if (patError) return patError;
 
     const targetUrlParam = url.searchParams.get('url');
     if (!targetUrlParam) {
@@ -2011,6 +2016,8 @@ async function handleRequest(request: Request, env: EnvWithBindings, ctx: Pick<E
       'POST google/drive/sync/large': integrations.syncGооgleDriveLargeFiles,
       'GET github/connect': integrations.cоnnectGithub,
       'GET github/callback': (request, env) => integrations.callbackGithub(request, env),
+      'POST github/device/start': integrations.deviceStartGithub,
+      'POST github/device/poll': integrations.devicePollGithub,
       'GET github': integrations.getGithubIntegratiоn,
       'GET github/repos': integrations.getGithubRepоs,
       'GET github/history': integrations.getGithubRepoHistory,

controlplane/src/integration-policies/token-refresh.ts

@@ -218,17 +218,19 @@ async function refreshOAuthToken(
   } else if (provider === 'teams' || provider === 'outlook' || provider === 'onedrive' || provider === 'outlook_calendar') {
     const clientId = env.MICROSOFT_CLIENT_ID || env.ONEDRIVE_CLIENT_ID;
     const clientSecret = env.MICROSOFT_CLIENT_SECRET || env.ONEDRIVE_CLIENT_SECRET;
-    if (!clientId || !clientSecret) {
+    // Desktop public client: PKCE-issued tokens refresh with no secret.
+    const isPublicClient = env.OAUTH_PUBLIC_CLIENT === 'true';
+    if (!clientId || (!isPublicClient && !clientSecret)) {
       console.error(`[token-refresh] Microsoft OAuth not configured for ${provider} refresh (userIntegrationId=${userIntegrationId})`);
       return null;
     }
     tokenUrl = 'https://login.microsoftonline.com/common/oauth2/v2.0/token';
     body = new URLSearchParams({
       client_id: clientId,
-      client_secret: clientSecret,
       grant_type: 'refresh_token',
       refresh_token: refreshToken,
     });
+    if (!isPublicClient) body.set('client_secret', clientSecret!);
   } else {
     // Browser and other providers don't use OAuth refresh
     console.warn(`[token-refresh] OAuth refresh not supported for provider: ${provider}`);