@openchambery/web 2.0.0-beta.33 → 2.0.0-beta.35

package/server/lib/client-auth/remote-clients.test.js

@@ -1,4 +1,4 @@
-import { describe, expect, it } from 'bun:test';
+import { describe, expect, it } from 'vitest';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -17,6 +17,47 @@ const createRuntime = async () => {
 };
 
 describe('remote client auth runtime', () => {
+  it('persists renamed labels without changing credentials, metadata or revocation', async () => {
+    const { dir, runtime } = await createRuntime();
+    try {
+      const created = await runtime.createClient({ label: 'Phone', devicePlatform: 'iOS', usesRelay: true });
+      const renamed = await runtime.renameClient(created.client.id, '  Work phone  ');
+      expect(renamed).toEqual({ ...created.client, label: 'Work phone' });
+      expect('tokenHash' in renamed).toBe(false);
+      const reopened = createRemoteClientAuthRuntime({ fsPromises: fs, path, crypto, storePath: path.join(dir, 'remote-clients.json') });
+      expect(await reopened.listClients()).toEqual([renamed]);
+      expect((await reopened.authenticateBearerToken(created.token))?.clientId).toBe(created.client.id);
+      await Promise.all([
+        runtime.renameClient(created.client.id, 'Archived phone'),
+        runtime.revokeClient(created.client.id),
+      ]);
+      expect(await runtime.authenticateBearerToken(created.token)).toBe(null);
+      expect((await runtime.listClients())[0]).toMatchObject({ label: 'Archived phone', revokedAt: expect.any(String) });
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects invalid labels and failed writes without committing a new name', async () => {
+    const { dir, runtime } = await createRuntime();
+    try {
+      const created = await runtime.createClient({ label: 'Phone' });
+      for (const label of [undefined, null, 42, '', '  ', 'x'.repeat(81)]) {
+        await expect(runtime.renameClient(created.client.id, label)).rejects.toMatchObject({ status: 400 });
+      }
+      expect(await runtime.renameClient('missing', 'Name')).toBe(null);
+      const failing = createRemoteClientAuthRuntime({
+        fsPromises: { ...fs, writeFile: async () => { throw new Error('Write failed'); } },
+        path, crypto, storePath: path.join(dir, 'remote-clients.json'),
+      });
+      await expect(failing.renameClient(created.client.id, 'New name')).rejects.toThrow('Write failed');
+      expect(await runtime.listClients()).toEqual([created.client]);
+      expect((await runtime.authenticateBearerToken(created.token))?.ok).toBe(true);
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
   it('creates, authenticates, lists, and revokes client tokens', async () => {
     const { dir, runtime } = await createRuntime();
     try {

package/server/lib/opencode/DOCUMENTATION.md

@@ -25,6 +25,7 @@ This module provides OpenCode server integration utilities for the web server ru
 - `packages/web/server/lib/opencode/provider-catalog.js`: fail-closed projection for the safe provider catalog response.
 - `packages/web/server/lib/opencode/cli-options.js`: CLI/environment option parsing for server startup arguments.
 - `packages/web/server/lib/opencode/core-routes.js`: server status/system routes, auth/access guard routes, and settings utility route registration.
+  - `PATCH /api/client-auth/clients/:id` edits the stored device label (trimmed, 1–80 characters), returning `{ client }` without credentials. Owner UI sessions and local/paired desktop clients can edit any device; other client tokens can edit only themselves. Missing devices return 404, invalid labels 400, unauthorized targets 403. Renaming shares the client store mutation queue and preserves token identity, metadata and revocation. Web, Electron and mobile use the web `ClientAuthAPI`; VS Code does not expose client management.
 - `packages/web/server/lib/opencode/shutdown-runtime.js`: graceful shutdown orchestration runtime for watcher/session/terminal/process/server teardown.
 - `packages/web/server/lib/opencode/server-startup-runtime.js`: server listen/startup flow and process/signal handler orchestration runtime.
 - `packages/web/server/lib/opencode/static-routes-runtime.js`: static asset/SPA fallback route registration and manifest route wiring. The SPA fallback sends `index.html` relative to `root`, so deep links keep working when the install lives under a dot directory.

package/server/lib/opencode/core-routes.js

@@ -822,6 +822,23 @@ export const registerAuthAndAccessRoutes = (app, dependencies) => {
     });
   });
 
+  app.patch('/api/client-auth/clients/:id', express.json({ limit: '64kb' }), async (req, res, next) => {
+    await runWithClientManagementAuth(req, res, next, async (authContext) => {
+      if (authContext.type === 'client') {
+        const actingClient = await clientRecordFromAuthContext(authContext);
+        if (!canManageRemoteClients(actingClient)) {
+          const clientId = clientIdFromAuthContext(authContext);
+          if (!clientId || clientId !== req.params?.id) {
+            return res.status(403).json({ error: 'Client tokens can only rename themselves' });
+          }
+        }
+      }
+      const client = await remoteClientAuthRuntime.renameClient(req.params?.id, req.body?.label);
+      if (!client) return res.status(404).json({ error: 'Client not found' });
+      res.json({ client });
+    });
+  });
+
   app.delete('/api/client-auth/clients/:id', async (req, res, next) => {
     await runWithClientManagementAuth(req, res, next, async (authContext) => {
       if (authContext.type === 'client') {

package/server/lib/opencode/core-routes.test.js

@@ -51,6 +51,12 @@ const createClientAuthDependencies = (options = {}) => {
         clients.push(client);
         return { client, token: 'oc_client_secret' };
       },
+      renameClient: vi.fn(async (id, label) => {
+        const client = clients.find((entry) => entry.id === id);
+        if (!client) return null;
+        client.label = label.trim();
+        return client;
+      }),
       revokeClient: async (id) => {
         const client = clients.find((entry) => entry.id === id);
         if (!client) return { revoked: false };
@@ -1334,6 +1340,43 @@ describe('core-routes', () => {
 describe('client auth routes', () => {
   const createDependencies = createClientAuthDependencies;
 
+  it.each(['session', 'desktop-local', 'desktop', 'mobile'])('scopes device renaming for %s', async (kind) => {
+    const app = express();
+    let authContext = { type: 'session' };
+    const dependencies = createDependencies({ resolveAuthContext: async () => authContext });
+    registerAuthAndAccessRoutes(app, dependencies);
+    const own = (await request(app).post('/api/client-auth/clients').send({ label: 'Own', clientKind: kind })).body.client;
+    const other = (await request(app).post('/api/client-auth/clients').send({ label: 'Other' })).body.client;
+    if (kind !== 'session') authContext = { type: 'client', clientId: own.id, client: own };
+
+    await request(app).patch(`/api/client-auth/clients/${own.id}`).send({ label: 'Renamed own' }).expect(200);
+    dependencies.remoteClientAuthRuntime.renameClient.mockClear();
+    const response = await request(app).patch(`/api/client-auth/clients/${other.id}`).send({ label: 'Renamed other', clientKind: 'desktop-local' });
+    expect(response.status).toBe(kind === 'mobile' ? 403 : 200);
+    if (kind === 'mobile') {
+      expect(dependencies.remoteClientAuthRuntime.renameClient).not.toHaveBeenCalled();
+    } else {
+      expect(response.body.client).toEqual({ ...other, label: 'Renamed other' });
+      expect(dependencies.remoteClientAuthRuntime.renameClient).toHaveBeenCalledWith(other.id, 'Renamed other');
+      await request(app).patch('/api/client-auth/clients/missing').send({ label: 'Name' }).expect(404);
+    }
+  });
+
+  it('requires authentication and propagates rename failures', async () => {
+    const app = express();
+    const dependencies = createDependencies({ resolveAuthContext: async () => null });
+    dependencies.uiAuthController.requireSessionAuth = (_req, res) => res.status(401).json({ error: 'Unauthorized' });
+    registerAuthAndAccessRoutes(app, dependencies);
+    await request(app).patch('/api/client-auth/clients/other').send({ label: 'Name' }).expect(401);
+    expect(dependencies.remoteClientAuthRuntime.renameClient).not.toHaveBeenCalled();
+
+    dependencies.uiAuthController.resolveAuthContext.mockResolvedValue({ type: 'session' });
+    dependencies.remoteClientAuthRuntime.renameClient.mockRejectedValue(Object.assign(new Error('Invalid label'), { status: 400 }));
+    await request(app).patch('/api/client-auth/clients/other').send({ label: '' }).expect(400);
+    dependencies.remoteClientAuthRuntime.renameClient.mockRejectedValue(new Error('Write failed'));
+    await request(app).patch('/api/client-auth/clients/other').send({ label: 'Name' }).expect(500);
+  });
+
   it('creates, lists, and revokes remote client tokens', async () => {
     const app = express();
     const dependencies = createDependencies();