Fix desktop login flow

[Makisuo]

No description provided.

[railway-app]

🚅 Deployed to the hazel-pr-240 environment in hazel

Service	Status	Web	Updated (UTC)
api	✅ Success (View Logs)		Jan 18, 2026 at 11:28 pm
cluster	✅ Success (View Logs)		Jan 18, 2026 at 11:27 pm
electric-proxy	✅ Success (View Logs)		Jan 18, 2026 at 11:27 pm
docs	✅ Success (View Logs)		Jan 18, 2026 at 11:27 pm
otel-collector	✅ Success (View Logs)	Web	Jan 18, 2026 at 11:21 pm

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	hazel-app	504018d	Commit Preview URL Branch Preview URL	Jan 18 2026, 11:28 PM

[claude]

Claude finished @Makisuo's task —— View job

---

PR Review: Fix Desktop Login Flow

This is an excellent refactoring that significantly improves the desktop authentication architecture. The changes show thoughtful design and strong adherence to best practices.

Todo List:

• Analyze overall architecture changes and code organization
• Review security patterns in token handling and storage
• Examine error handling and user experience patterns
• Check adherence to Effect-TS best practices per CLAUDE.md
• Evaluate performance considerations and potential race conditions
• Assess test coverage needs
• Provide comprehensive feedback summary

---

🎯 Overall Assessment: Excellent

This refactoring transforms scattered auth logic into a clean, Effect-TS based architecture with proper error handling and security practices.

✅ Strengths

Architecture & Organization

• Clean service separation: TauriAuth, TokenStorage, TokenExchange are well-structured with clear responsibilities
• Proper Effect.Service usage: Follows CLAUDE.md guidelines with dependencies arrays and Default layers
• Atom-based state management: Uses Effect Atom correctly for reactive state with finalizers for cleanup
• File organization: New /services/desktop/ structure is much cleaner than scattered files

Security 🔒

• Encrypted token storage: Uses Tauri's encrypted store for sensitive data
• Nonce validation: Rust server validates one-time nonces to prevent CSRF attacks
• Dynamic ports: OAuth server uses dynamic port allocation (17900-17999 range)
• CORS protection: Proper CORS headers with specific origins
• Token expiration: Proper expiry handling with 5-minute refresh buffer
• Secure cleanup: Tokens are properly cleared on logout

Error Handling

• Comprehensive error types: desktop-auth-errors.ts provides excellent typed error coverage
• User-friendly messages: error-messages.ts maps technical errors to user-friendly text
• Effect-based error propagation: Proper use of Effect.fail and catchAll patterns
• Graceful failures: Callback page handles connection failures with retry logic

Code Quality

• Proper TypeScript: Excellent typing throughout, no any types
• Effect patterns: Correct use of Effect.gen, Effect.provide, and service layers
• Atom patterns: Proper finalizer usage, keepAlive for persistent atoms
• Race condition prevention: Uses Ref to prevent concurrent token refreshes

🔍 Minor Issues & Suggestions

Performance Considerations

1. Token refresh scheduling: desktopTokenSchedulerAtom:359-396 recreates fibers on every token change. Consider memoization based on expiry time.

2. Concurrent refresh protection: While isRefreshingRef prevents concurrent refreshes, consider using a Deferred to allow multiple callers to await the same refresh operation.

Error Handling Edge Cases

1. Network timeout handling: token-exchange.ts:11 uses 30-second timeout. Consider making this configurable for poor network conditions.

2. Token validation: No JWT signature validation before storage. Consider adding basic JWT structure validation.

Code Improvements

1. Magic numbers: desktop-auth.ts:53 has hardcoded 5-minute refresh buffer. Consider making this configurable.

2. Hardcoded URLs: Several files have hardcoded localhost URLs. Consider environment-based configuration.

Testing Gaps

• No visible tests for the new authentication flow
• OAuth server nonce validation logic needs unit tests
• Token refresh timing logic should be tested
• Error handling paths need coverage

🏛️ Architecture Adherence

Effect-TS Best Practices: ✅ Excellent

• Proper Effect.Service usage with dependencies
• Correct error modeling with Schema.TaggedError
• Good use of Effect.gen and Effect.provide
• Proper resource management with finalizers

Security Best Practices: ✅ Excellent

• No hardcoded secrets or tokens
• Proper encryption for token storage
• CSRF protection with nonces
• Defense in depth with URL validation

📊 Risk Assessment: Low

The refactoring improves security and maintainability while maintaining backward compatibility. The OAuth flow is well-designed and follows industry standards.

🎯 Recommendations

High Priority

1. Add unit tests for the core authentication flows
2. Add integration tests for the OAuth server nonce validation

Medium Priority

1. Make timeout values configurable
2. Add JWT structure validation
3. Consider adding telemetry/metrics for auth success/failure rates

Low Priority

1. Extract magic numbers to constants
2. Add JSDoc comments to public interfaces
3. Consider adding auth state persistence across app restarts

🚀 Conclusion

This is a high-quality refactoring that significantly improves the codebase. The new architecture is secure, maintainable, and follows Effect-TS patterns correctly. The comprehensive error handling and user experience improvements are particularly noteworthy.

Recommendation: ✅ Approve - This PR substantially improves the authentication system with excellent security practices and clean architecture.

---

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	31.54%	557 / 1766
🔵	Statements	32.04%	587 / 1832
🔵	Functions	16.43%	94 / 572
🔵	Branches	12.07%	78 / 646

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
apps/web/src/atoms/desktop-auth.ts	11.76%	0%	0%	12.21%	98, 119-188, 201-248, 258-282, 292-293, 307-348, 360-395, 407-416
apps/web/src/lib/auth-fetch.ts	13.33%	0%	0%	14.28%	16-25, 34-42, 54-86
apps/web/src/lib/rpc-auth-middleware.ts	11.11%	0%	0%	12.5%	15-23
apps/web/src/lib/tauri.ts	40%	0%	0%	44.44%	16, 24, 41-45
apps/web/src/lib/services/desktop/tauri-auth.ts	4.91%	0%	0%	5%	39-46, 53-62, 69-201
apps/web/src/lib/services/desktop/token-exchange.ts	3.12%	0%	0%	3.12%	17-155
apps/web/src/lib/services/desktop/token-storage.ts	9.52%	0%	0%	9.52%	25-227
packages/domain/src/desktop-auth-errors.ts	100%	100%	100%	100%
packages/domain/src/index.ts	100%	100%	100%	100%
packages/domain/src/http/auth.ts	100%	100%	100%	100%

Generated in workflow #1304 for commit 504018d by the Vitest Coverage Report Action

[claude]

Claude finished @Makisuo's task —— View job

---

PR Review: Fix Desktop Login Flow

This is an excellent refactoring that significantly improves the desktop authentication architecture. The changes show thoughtful design and strong adherence to best practices.

Todo List:

• Analyze overall architecture changes and code organization
• Review security patterns in token handling and storage
• Examine error handling and user experience patterns
• Check adherence to Effect-TS best practices per CLAUDE.md
• Evaluate performance considerations and potential race conditions
• Assess test coverage needs
• Provide comprehensive feedback summary

---

🎯 Overall Assessment: Excellent

This refactoring transforms scattered auth logic into a clean, Effect-TS based architecture with proper error handling and security practices.

✅ Strengths

Architecture & Organization

• Clean service separation: TauriAuth, TokenStorage, TokenExchange are well-structured with clear responsibilities
• Proper Effect.Service usage: Follows CLAUDE.md guidelines with dependencies arrays and Default layers
• Atom-based state management: Uses Effect Atom correctly for reactive state with finalizers for cleanup
• File organization: New /services/desktop/ structure is much cleaner than scattered files

Security 🔒

• Encrypted token storage: Uses Tauri's encrypted store for sensitive data
• Nonce validation: Rust server validates one-time nonces to prevent CSRF attacks
• Dynamic ports: OAuth server uses dynamic port allocation (17900-17999 range)
• CORS protection: Proper CORS headers with specific origins
• Token expiration: Proper expiry handling with 5-minute refresh buffer
• Secure cleanup: Tokens are properly cleared on logout

Error Handling

• Comprehensive error types: desktop-auth-errors.ts provides excellent typed error coverage
• User-friendly messages: error-messages.ts maps technical errors to user-friendly text
• Effect-based error propagation: Proper use of Effect.fail and catchAll patterns
• Graceful failures: Callback page handles connection failures with retry logic

Code Quality

• Proper TypeScript: Excellent typing throughout, no any types
• Effect patterns: Correct use of Effect.gen, Effect.provide, and service layers
• Atom patterns: Proper finalizer usage, keepAlive for persistent atoms
• Race condition prevention: Uses Ref to prevent concurrent token refreshes

🔍 Minor Issues & Suggestions

Performance Considerations

1. Token refresh scheduling: desktopTokenSchedulerAtom:359-396 recreates fibers on every token change. Consider memoization based on expiry time.

2. Concurrent refresh protection: While isRefreshingRef prevents concurrent refreshes, consider using a Deferred to allow multiple callers to await the same refresh operation.

Error Handling Edge Cases

1. Network timeout handling: token-exchange.ts:11 uses 30-second timeout. Consider making this configurable for poor network conditions.

2. Token validation: No JWT signature validation before storage. Consider adding basic JWT structure validation.

Code Improvements

1. Magic numbers: desktop-auth.ts:53 has hardcoded 5-minute refresh buffer. Consider making this configurable.

2. Hardcoded URLs: Several files have hardcoded localhost URLs. Consider environment-based configuration.

Testing Gaps

• No visible tests for the new authentication flow
• OAuth server nonce validation logic needs unit tests
• Token refresh timing logic should be tested
• Error handling paths need coverage

🏛️ Architecture Adherence

Effect-TS Best Practices: ✅ Excellent

• Proper Effect.Service usage with dependencies
• Correct error modeling with Schema.TaggedError
• Good use of Effect.gen and Effect.provide
• Proper resource management with finalizers

Security Best Practices: ✅ Excellent

• No hardcoded secrets or tokens
• Proper encryption for token storage
• CSRF protection with nonces
• Defense in depth with URL validation

📊 Risk Assessment: Low

The refactoring improves security and maintainability while maintaining backward compatibility. The OAuth flow is well-designed and follows industry standards.

🎯 Recommendations

High Priority

1. Add unit tests for the core authentication flows
2. Add integration tests for the OAuth server nonce validation

Medium Priority

1. Make timeout values configurable
2. Add JWT structure validation
3. Consider adding telemetry/metrics for auth success/failure rates

Low Priority

1. Extract magic numbers to constants
2. Add JSDoc comments to public interfaces
3. Consider adding auth state persistence across app restarts

🚀 Conclusion

This is a high-quality refactoring that significantly improves the codebase. The new architecture is secure, maintainable, and follows Effect-TS patterns correctly. The comprehensive error handling and user experience improvements are particularly noteworthy.

Recommendation: ✅ Approve - This PR substantially improves the authentication system with excellent security practices and clean architecture.

---