@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/packages/identity/src/server/worker-router.js

@@ -1,4 +1,5 @@
-import { createCloudflareD1Adapter } from '../adapters/cloudflare-d1/index.js';
+import { createCloudflareD1Adapter, createIamCompatIdentityAdapter } from '../adapters/iam-compat/index.js';
+import { createPortableD1IdentityAdapter } from '../adapters/portable-d1/index.js';
 import { createIdentityService } from './identity-service.js';
 import { jsonResponse } from '../core/http-json.js';
 import { hashPassword } from '../core/password-crypto.js';
@@ -12,8 +13,31 @@ import { fetchCloudflareProfile } from '../providers/cloudflare/profile.js';
 import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
 import { IdentityRoutingError } from '../contracts/identity-store.js';
 import { resolveOAuthCredentialLane } from '../oauth/credentials.js';
+import {
+  GOOGLE_DESKTOP_LOGIN_EXCHANGE_PATH,
+  handleGoogleDesktopExchangeRequest,
+  handleGoogleDesktopLoginExchangeRequest,
+} from '../oauth/google-desktop-exchange.js';
 import { iamPlatformOAuthCallback, iamPlatformOAuthStart } from '../oauth/iam-platform.js';
 import { pkceChallenge, pkceVerifier, randomOAuthState } from '../oauth/pkce.js';
+import {
+  NATIVE_EXCHANGE_PATH,
+  finishOAuthLogin,
+  handleNativeExchangeRequest,
+  parseNativeStart,
+  sessionTypeForTransaction,
+} from '../oauth/native-handoff.js';
+
+function resolveIdentityAdapter(env, options = {}) {
+  if (options.adapter) return options.adapter;
+  const profile = String(options.identityProfile || env?.IDENTITY_ADAPTER_PROFILE || 'iam-compat')
+    .trim()
+    .toLowerCase();
+  if (profile === 'portable' || profile === 'portable-d1') {
+    return createPortableD1IdentityAdapter(env.DB);
+  }
+  return createIamCompatIdentityAdapter(env.DB);
+}
 
 function escapeHtml(value) {
   return String(value ?? '')
@@ -23,6 +47,10 @@ function escapeHtml(value) {
     .replace(/"/g, '"');
 }
 
+function resolveLoginPath(identity) {
+  return identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN) || '/auth/login';
+}
+
 function resolveKv(env) {
   return env?.SESSION_CACHE || env?.KV || null;
 }
@@ -46,7 +74,12 @@ function buildPasswordResetService(env, adapter, options = {}) {
       }
       const company = await adapter.getDefaultCompany().catch(() => null);
       const brand = company?.name || 'Your App';
-      const fromEmail = company?.supportEmail || 'hey@inneranimalmedia.com';
+      const fromEmail = company?.supportEmail;
+      if (!fromEmail) {
+        const err = new Error('email_not_configured');
+        err.code = 'email_not_configured';
+        throw err;
+      }
       const html = `<p>Hi ${escapeHtml(name)},</p><p>Your ${escapeHtml(brand)} verification code is:</p><p style="font-size:22px;font-weight:700;letter-spacing:4px;">${escapeHtml(code)}</p><p>Enter this on the reset page. Expires in 15 minutes.</p>`;
       const res = await fetch('https://api.resend.com/emails', {
         method: 'POST',
@@ -73,14 +106,15 @@ function buildPasswordResetService(env, adapter, options = {}) {
  * Worker fetch handler for identity API + auth page routing.
  * @param {Request} request
  * @param {{ DB: import('../adapters/cloudflare-d1/index.js').D1Database, ASSETS?: { fetch: (req: Request) => Promise<Response> }, [key: string]: unknown }} env
- * @param {{ identity?: ReturnType<typeof createIdentityService>, brandName?: string }} [options]
+ * @param {{ identity?: ReturnType<typeof createIdentityService>, brandName?: string, companySlug?: string }} [options]
+ *   companySlug — host-app portal branding key into D1 `company.slug` (never product-hardcoded here).
  */
 export async function handleIdentityWorkerRequest(request, env, options = {}) {
   const url = new URL(request.url);
   const path = url.pathname;
   const method = request.method.toUpperCase();
 
-  const adapter = createCloudflareD1Adapter(env.DB);
+  const adapter = resolveIdentityAdapter(env, options);
   if (!options.identity && (!options.app?.id || !options.routeRegistry)) {
     throw new IdentityRoutingError(
       'AUTH_APP_UNRESOLVED',
@@ -115,6 +149,9 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     await adapter.logAuthEvent({
       userId: result.user.id, eventType: 'login', status: 'ok', provider: 'email', request,
     });
+    if (identity.isNativeSessionRequest(request)) {
+      return identity.buildNativeLoginSuccessResponse(result, body.next);
+    }
     return identity.buildLoginSuccessResponse(request, result.sessionId, body.next);
   }
 
@@ -128,6 +165,9 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     if (!result.ok) {
       return jsonResponse({ ok: false, error: result.error }, 400);
     }
+    if (identity.isNativeSessionRequest(request)) {
+      return identity.buildNativeLoginSuccessResponse(result, body.next);
+    }
     return identity.buildLoginSuccessResponse(request, result.sessionId, body.next);
   }
 
@@ -145,6 +185,7 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     if (!ctx) return jsonResponse({ ok: false, error: 'session_required' }, 401);
     return jsonResponse({
       ok: true,
+      authenticated: true,
       user: {
         id: ctx.user.id,
         email: ctx.user.email,
@@ -154,8 +195,21 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   }
 
   if (path === '/api/company' && method === 'GET') {
-    const slug = url.searchParams.get('slug') || undefined;
-    const company = slug ? await adapter.getCompanyBySlug(slug) : await adapter.getDefaultCompany();
+    // Portable: ?slug= → options.companySlug → env override → host match in company.meta.hosts → default
+    const slug = String(
+      url.searchParams.get('slug')
+        || options.companySlug
+        || env.IDENTITY_COMPANY_SLUG
+        || '',
+    ).trim() || undefined;
+    let company = null;
+    if (slug) {
+      company = await adapter.getCompanyBySlug(slug);
+    }
+    if (!company && typeof adapter.getCompanyByHost === 'function') {
+      company = await adapter.getCompanyByHost(url.hostname || request.headers.get('host'));
+    }
+    if (!company) company = await adapter.getDefaultCompany();
     if (!company) return jsonResponse({ ok: false, error: 'company_not_found' }, 404);
     return jsonResponse({ ok: true, company });
   }
@@ -218,9 +272,19 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   }
 
   // ── OAuth ────────────────────────────────────────────────────────────────
-  // Default: IAM_CLIENT_* (minted). Developer BYOK GOOGLE_*/GITHUB_* take the
-  // matching /api/oauth/{provider}/start button when set.
+  // Default: IAM_CLIENT_* (minted). Developer BYOK GOOGLE_*/GITHUB_*/CLOUDFLARE_*
+  // take the matching /api/oauth/{provider}/start button when set.
+  // Desktop PKCE: GOOGLE_DESKTOP_CLIENT_ID → POST /api/oauth/google/desktop-exchange.
   // Canonical platform id = inneranimalmedia (legacy /api/oauth/iam/* still accepted).
+  if (path === '/api/oauth/google/desktop-exchange') {
+    return handleGoogleDesktopExchangeRequest(request, env);
+  }
+  if (path === GOOGLE_DESKTOP_LOGIN_EXCHANGE_PATH) {
+    return handleGoogleDesktopLoginExchangeRequest(request, env, { adapter, identity });
+  }
+  if (path === NATIVE_EXCHANGE_PATH) {
+    return handleNativeExchangeRequest(request, { adapter, identity });
+  }
   if (path === '/api/oauth/inneranimalmedia/callback' || path === '/api/oauth/iam/callback') {
     if (method === 'GET') {
       return iamPlatformOAuthCallback(request, env, adapter, identity);
@@ -317,12 +381,23 @@ async function oauthStart(request, env, identity, adapter, provider, creds) {
     const redirectTo = identity.resolvePostLoginPath(
       url.searchParams.get('next') || url.searchParams.get('return_to'),
     );
+    const nativeStart = parseNativeStart(url, env);
+    if (nativeStart.error) {
+      return jsonResponse({ ok: false, error: nativeStart.error }, 400);
+    }
     await adapter.saveOAuthState({
       state,
       provider,
       codeVerifier,
       redirectTo,
       appId: identity.app?.id || null,
+      ...(nativeStart.native
+        ? {
+            clientType: nativeStart.clientType,
+            nativeChallenge: nativeStart.nativeChallenge,
+            nativeRedirect: nativeStart.nativeRedirect,
+          }
+        : {}),
     });
 
     const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
@@ -367,91 +442,99 @@ async function oauthStart(request, env, identity, adapter, provider, creds) {
 
 async function oauthCallback(request, env, identity, adapter, provider, creds) {
   const url = new URL(request.url);
-  const code = url.searchParams.get('code');
-  const state = url.searchParams.get('state');
-  const err = url.searchParams.get('error');
-  if (err || !code || !state) {
-    await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'oauth_failed' } });
-    return Response.redirect(`${url.origin}${loginPath()}?error=oauth_failed`, 302);
-  }
-  const saved = await adapter.consumeOAuthState(state);
-  if (!saved || saved.provider !== provider) {
-    await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'state_mismatch' } });
-    return Response.redirect(`${url.origin}${loginPath()}?error=state_mismatch`, 302);
-  }
-  const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
-  let token;
-  let profile;
-  if (provider === 'google') {
-    token = await exchangeGoogleCode({
-      code,
-      codeVerifier: saved.code_verifier,
-      clientId: creds.clientId,
-      clientSecret: creds.clientSecret,
-      redirectUri,
-    });
-    if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
+  const login = resolveLoginPath(identity);
+  try {
+    const code = url.searchParams.get('code');
+    const state = url.searchParams.get('state');
+    const err = url.searchParams.get('error');
+    if (err || !code || !state) {
+      await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'oauth_failed' } });
+      return Response.redirect(`${url.origin}${login}?error=oauth_failed`, 302);
     }
-    profile = await fetchGoogleProfile(token.access_token);
-  } else if (provider === 'cloudflare') {
-    token = await exchangeCloudflareCode({
-      code,
-      codeVerifier: saved.code_verifier,
-      clientId: creds.clientId,
-      clientSecret: creds.clientSecret,
-      redirectUri,
-    });
-    if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
+    const saved = await adapter.consumeOAuthState(state);
+    if (!saved || saved.provider !== provider) {
+      await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'state_mismatch' } });
+      return Response.redirect(`${url.origin}${login}?error=state_mismatch`, 302);
     }
-    profile = await fetchCloudflareProfile(token.access_token);
-  } else {
-    token = await exchangeGithubCode({
-      code,
-      codeVerifier: saved.code_verifier,
-      clientId: creds.clientId,
-      clientSecret: creds.clientSecret,
-      redirectUri,
-    });
-    if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
+    const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
+    let token;
+    let profile;
+    if (provider === 'google') {
+      token = await exchangeGoogleCode({
+        code,
+        codeVerifier: saved.code_verifier,
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        redirectUri,
+      });
+      if (!token?.access_token) {
+        return Response.redirect(`${url.origin}${login}?error=token_exchange_failed`, 302);
+      }
+      profile = await fetchGoogleProfile(token.access_token);
+    } else if (provider === 'cloudflare') {
+      token = await exchangeCloudflareCode({
+        code,
+        codeVerifier: saved.code_verifier,
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        redirectUri,
+      });
+      if (!token?.access_token) {
+        return Response.redirect(`${url.origin}${login}?error=token_exchange_failed`, 302);
+      }
+      profile = await fetchCloudflareProfile(token.access_token);
+    } else {
+      token = await exchangeGithubCode({
+        code,
+        codeVerifier: saved.code_verifier,
+        clientId: creds.clientId,
+        clientSecret: creds.clientSecret,
+        redirectUri,
+      });
+      if (!token?.access_token) {
+        return Response.redirect(`${url.origin}${login}?error=token_exchange_failed`, 302);
+      }
+      profile = await fetchGithubProfile(token.access_token);
+    }
+    if (!profile) {
+      return Response.redirect(`${url.origin}${login}?error=userinfo_failed`, 302);
     }
-    profile = await fetchGithubProfile(token.access_token);
-  }
-  if (!profile) {
-    return Response.redirect(`${url.origin}${loginPath()}?error=userinfo_failed`, 302);
-  }
 
-  let normalized;
-  if (provider === 'google') {
-    normalized = { subject: profile.sub, email: profile.email, name: profile.name };
-  } else if (provider === 'cloudflare') {
-    normalized = { subject: String(profile.sub), email: profile.email, name: profile.name || profile.email };
-  } else {
-    normalized = { subject: String(profile.id), email: profile.email, name: profile.name || profile.login };
-  }
+    let normalized;
+    if (provider === 'google') {
+      normalized = { subject: profile.sub, email: profile.email, name: profile.name };
+    } else if (provider === 'cloudflare') {
+      const subject = profile.sub || profile.email;
+      if (!subject) {
+        return Response.redirect(`${url.origin}${login}?error=userinfo_incomplete`, 302);
+      }
+      normalized = { subject: String(subject), email: profile.email, name: profile.name || profile.email };
+    } else {
+      normalized = { subject: String(profile.id), email: profile.email, name: profile.name || profile.login };
+    }
 
-  const result = await identity.provisionOAuthUser({
-    provider,
-    providerSubject: normalized.subject,
-    email: normalized.email,
-    displayName: normalized.name,
-  });
-  await adapter.logAuthEvent({
-    userId: result.authUserId, eventType: 'login', status: 'ok', provider, request,
-  });
+    const result = await identity.provisionOAuthUser({
+      provider,
+      providerSubject: normalized.subject,
+      email: normalized.email,
+      displayName: normalized.name,
+      sessionType: sessionTypeForTransaction(saved),
+    });
+    await adapter.logAuthEvent({
+      userId: result.authUserId, eventType: 'login', status: 'ok', provider, request,
+      metadata: { session_type: sessionTypeForTransaction(saved) },
+    });
 
-  const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
-  const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-  const globeUrl = `${url.origin}${loginPath()}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
-  return new Response(null, {
-    status: 302,
-    headers: {
-      Location: globeUrl,
-      'Set-Cookie': res.headers.get('Set-Cookie') || '',
-    },
-  });
+    return finishOAuthLogin({ request, env, identity, adapter, saved, result, loginPath: login });
+  } catch (error) {
+    const message = String(error?.message || error || 'oauth_callback_failed');
+    console.error('oauth_callback_failed', provider, message);
+    const loginUrl = new URL(login, url.origin);
+    loginUrl.searchParams.set('error', 'oauth_callback_failed');
+    loginUrl.searchParams.set('provider', provider);
+    loginUrl.searchParams.set('detail', message.slice(0, 120));
+    return Response.redirect(loginUrl.toString(), 302);
+  }
 }
 
-export { createIdentityService, createCloudflareD1Adapter };
+export { createIdentityService, createCloudflareD1Adapter, createIamCompatIdentityAdapter, createPortableD1IdentityAdapter };

package/packages/identity/tests/auth-config.test.mjs

@@ -2,6 +2,7 @@ import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
 import {
   AGENTSAM_AUTH_CONTRACT,
+  PLATFORM_ACCOUNT_ISSUER,
   buildApiAuthorizationHeaders,
   resolveApiKey,
   resolveBridgeKey,
@@ -23,8 +24,8 @@ describe('auth configuration contract', () => {
     assert.equal(resolveIamOrigin({ IAM_ORIGIN: 'https://legacy.example.test/' }), 'https://legacy.example.test');
   });
 
-  it('defaults issuer when neither IAM_OAUTH_ISSUER nor IAM_ORIGIN exists', () => {
-    assert.equal(resolveIamOrigin({}), 'https://inneranimalmedia.com');
+  it('falls back to the canonical platform account issuer when env is unset', () => {
+    assert.equal(resolveIamOrigin({}), PLATFORM_ACCOUNT_ISSUER);
   });
 
   it('resolves only AGENTSAM_API_KEY for delegated account API auth', () => {

package/packages/identity/tests/chatgpt-provider.test.mjs

@@ -0,0 +1,75 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  ChatGptProvider,
+  createChatGptCmsAuthHost,
+  normalizeChatGptIdentity,
+  readChatGptUserFromHeaders,
+  chatGPTSignInPath,
+  CHATGPT_USER_EMAIL_HEADER,
+  CHATGPT_USER_FULL_NAME_HEADER,
+  CHATGPT_USER_FULL_NAME_ENCODING_HEADER,
+  CHATGPT_PERCENT_ENCODED_UTF8,
+} from '../src/providers/chatgpt/index.js';
+import {
+  listStockSignInOptions,
+  getStockSignInOption,
+  CMS_STOCK_SIGN_IN_IDS,
+} from '../src/contracts/sign-in-options.js';
+import { getIdentityProvider, listIdentityProviders } from '../src/providers/index.js';
+import { IdentityProviders } from '../src/contracts/provider.js';
+
+describe('chatgpt identity provider', () => {
+  it('reads hosted headers without leaking raw oai keys into normalized identity', () => {
+    const user = readChatGptUserFromHeaders({
+      [CHATGPT_USER_EMAIL_HEADER]: 'Sam@Example.com',
+      [CHATGPT_USER_FULL_NAME_HEADER]: 'Sam%20Primeaux',
+      [CHATGPT_USER_FULL_NAME_ENCODING_HEADER]: CHATGPT_PERCENT_ENCODED_UTF8,
+    });
+    assert.equal(user?.email, 'sam@example.com');
+    assert.equal(user?.fullName, 'Sam Primeaux');
+
+    const normalized = normalizeChatGptIdentity({
+      email: user.email,
+      name: user.fullName,
+      sub: user.email,
+    });
+    assert.equal(normalized.provider, 'chatgpt');
+    assert.equal(normalized.subject, 'sam@example.com');
+    assert.equal(normalized.name, 'Sam Primeaux');
+    assert.equal(normalized.raw?.source, 'chatgpt_hosted');
+    assert.ok(!JSON.stringify(normalized).includes('oai-authenticated'));
+  });
+
+  it('registers chatgpt on the identity provider registry', () => {
+    assert.equal(ChatGptProvider.id, 'chatgpt');
+    assert.ok(IdentityProviders.includes('chatgpt'));
+    assert.equal(getIdentityProvider('chatgpt')?.id, 'chatgpt');
+    assert.ok(listIdentityProviders().some((p) => p.id === 'chatgpt'));
+  });
+
+  it('CmsAuthHost allows when headers present and challenges when missing', async () => {
+    const host = createChatGptCmsAuthHost({ cmsBase: '/cms' });
+    const denied = await host.authorizeCmsAccess({ path: '/cms', headers: {} });
+    assert.equal(denied.allowed, false);
+    assert.ok(String(denied.challengeUrl).startsWith('/signin-with-chatgpt'));
+
+    const allowed = await host.authorizeCmsAccess({
+      path: '/cms',
+      headers: { [CHATGPT_USER_EMAIL_HEADER]: 'editor@example.com' },
+    });
+    assert.equal(allowed.allowed, true);
+    assert.equal(allowed.principal?.email, 'editor@example.com');
+    assert.equal(allowed.principal?.provider, 'chatgpt');
+  });
+
+  it('stock sign-in catalog includes cloudflare, google, iam, chatgpt', () => {
+    const ids = listStockSignInOptions().map((o) => o.id);
+    assert.deepEqual(ids, ['cloudflare', 'google', 'inneranimalmedia', 'chatgpt']);
+    assert.deepEqual([...CMS_STOCK_SIGN_IN_IDS], ids);
+    assert.equal(getStockSignInOption('iam')?.id, 'inneranimalmedia');
+    assert.equal(getStockSignInOption('openai')?.id, 'chatgpt');
+    assert.equal(getStockSignInOption('chatgpt')?.kind, 'hosted_headers');
+    assert.ok(chatGPTSignInPath('/cms').includes('return_to='));
+  });
+});

package/packages/identity/tests/google-desktop-identity-login.test.mjs

@@ -0,0 +1,210 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  handleGoogleDesktopLoginExchangeRequest,
+} from '../src/oauth/google-desktop-exchange.js';
+
+const DESKTOP_ID = 'desktop-client.apps.googleusercontent.com';
+
+function request(body) {
+  return new Request('https://agentsam.test/api/oauth/google/desktop-login-exchange', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify(body),
+  });
+}
+
+test('desktop identity handoff requires GOOGLE_DESKTOP_CLIENT_ID, not web client', async () => {
+  const response = await handleGoogleDesktopLoginExchangeRequest(
+    request({
+      access_token: 'access',
+      id_token: 'id-token',
+      client_id: 'web-client.apps.googleusercontent.com',
+    }),
+    {
+      GOOGLE_DESKTOP_CLIENT_ID: DESKTOP_ID,
+      GOOGLE_CLIENT_ID: 'web-client.apps.googleusercontent.com',
+      GOOGLE_CLIENT_SECRET: 'web-secret',
+    },
+    {
+      identity: {},
+      adapter: {},
+    },
+  );
+  assert.equal(response.status, 403);
+  assert.equal((await response.json()).error, 'google_desktop_client_id_required');
+});
+
+test('desktop identity validates token audience and provisions AgentSam desktop session', async () => {
+  const calls = [];
+  const identity = {
+    async provisionOAuthUser(input) {
+      calls.push(input);
+      return {
+        authUserId: 'au_1',
+        sessionId: 'sess_desktop_1',
+        session: { expires_at: '2026-10-29T00:00:00.000Z' },
+      };
+    },
+  };
+  const adapter = {
+    async findUserById() {
+      return { id: 'au_1', email: 'sam@example.com', display_name: 'Sam' };
+    },
+    async logAuthEvent() {},
+  };
+
+  const response = await handleGoogleDesktopLoginExchangeRequest(
+    request({
+      access_token: 'transient-access-token',
+      id_token: 'transient-id-token',
+      client_id: DESKTOP_ID,
+    }),
+    { GOOGLE_DESKTOP_CLIENT_ID: DESKTOP_ID },
+    {
+      identity,
+      adapter,
+      fetchImpl: async (url) => {
+        const parsed = new URL(String(url));
+        assert.equal(parsed.hostname, 'oauth2.googleapis.com');
+        assert.equal(parsed.searchParams.get('id_token'), 'transient-id-token');
+        return Response.json({
+          aud: DESKTOP_ID,
+          iss: 'https://accounts.google.com',
+          exp: String(Math.floor(Date.now() / 1000) + 300),
+          sub: 'google-user-1',
+          email: 'sam@example.com',
+          email_verified: 'true',
+        });
+      },
+      fetchProfile: async (accessToken) => {
+        assert.equal(accessToken, 'transient-access-token');
+        return {
+          sub: 'google-user-1',
+          email: 'sam@example.com',
+          name: 'Sam',
+        };
+      },
+    },
+  );
+
+  assert.equal(response.status, 200);
+  const body = await response.json();
+  assert.equal(body.session_id, 'sess_desktop_1');
+  assert.equal(body.authenticated, true);
+  assert.equal(body.exchange_mode, 'desktop_public_pkce_native_exchange');
+  assert.equal(body.user.email, 'sam@example.com');
+  assert.equal('access_token' in body, false);
+  assert.equal('id_token' in body, false);
+  assert.equal('refresh_token' in body, false);
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].provider, 'google');
+  assert.equal(calls[0].sessionType, 'desktop');
+});
+
+
+
+test('desktop identity exchanges PKCE code server-side and uses provider-issued installed-app secret when required', async () => {
+  const identity = {
+    async provisionOAuthUser() {
+      return {
+        authUserId: 'au_code',
+        sessionId: 'sess_code',
+        session: { expires_at: '2026-10-29T00:00:00.000Z' },
+      };
+    },
+  };
+  const adapter = {
+    async findUserById() {
+      return { id: 'au_code', email: 'code@example.com', display_name: 'Code User' };
+    },
+    async logAuthEvent() {},
+  };
+
+  let tokenExchangeSeen = false;
+  let tokenInfoSeen = false;
+  const response = await handleGoogleDesktopLoginExchangeRequest(
+    request({
+      code: 'one-time-code',
+      code_verifier: 'v'.repeat(64),
+      redirect_uri: 'http://127.0.0.1:43123/callback',
+      client_id: DESKTOP_ID,
+    }),
+    {
+      GOOGLE_DESKTOP_CLIENT_ID: DESKTOP_ID,
+      GOOGLE_DESKTOP_CLIENT_SECRET: 'desktop-provider-secret',
+    },
+    {
+      identity,
+      adapter,
+      fetchImpl: async (url, init = {}) => {
+        const parsed = new URL(String(url));
+        if (parsed.pathname === '/token') {
+          tokenExchangeSeen = true;
+          const form = new URLSearchParams(String(init.body || ''));
+          assert.equal(form.get('client_id'), DESKTOP_ID);
+          assert.equal(form.get('client_secret'), 'desktop-provider-secret');
+          assert.equal(form.get('code'), 'one-time-code');
+          assert.equal(form.get('code_verifier'), 'v'.repeat(64));
+          return Response.json({
+            access_token: 'server-exchanged-access',
+            id_token: 'server-exchanged-id',
+          });
+        }
+        if (parsed.pathname === '/tokeninfo') {
+          tokenInfoSeen = true;
+          assert.equal(parsed.searchParams.get('id_token'), 'server-exchanged-id');
+          return Response.json({
+            aud: DESKTOP_ID,
+            iss: 'https://accounts.google.com',
+            exp: String(Math.floor(Date.now() / 1000) + 300),
+            sub: 'google-code-user',
+            email: 'code@example.com',
+            email_verified: 'true',
+          });
+        }
+        throw new Error('unexpected_google_url:' + parsed.toString());
+      },
+      fetchProfile: async (accessToken) => {
+        assert.equal(accessToken, 'server-exchanged-access');
+        return {
+          sub: 'google-code-user',
+          email: 'code@example.com',
+          name: 'Code User',
+        };
+      },
+    },
+  );
+
+  assert.equal(response.status, 200);
+  const body = await response.json();
+  assert.equal(body.authenticated, true);
+  assert.equal(body.session_id, 'sess_code');
+  assert.equal(tokenExchangeSeen, true);
+  assert.equal(tokenInfoSeen, true);
+});
+
+test('desktop identity rejects a Google token minted for another client', async () => {
+  const response = await handleGoogleDesktopLoginExchangeRequest(
+    request({
+      access_token: 'access',
+      id_token: 'id-token',
+      client_id: DESKTOP_ID,
+    }),
+    { GOOGLE_DESKTOP_CLIENT_ID: DESKTOP_ID },
+    {
+      identity: {},
+      adapter: {},
+      fetchImpl: async () => Response.json({
+        aud: 'another-client.apps.googleusercontent.com',
+        iss: 'https://accounts.google.com',
+        exp: String(Math.floor(Date.now() / 1000) + 300),
+        sub: 'google-user-1',
+        email: 'sam@example.com',
+        email_verified: 'true',
+      }),
+    },
+  );
+  assert.equal(response.status, 401);
+  assert.equal((await response.json()).error, 'google_id_token_audience_mismatch');
+});