Reuse bb Connect authentication in desktop (#607)

## Summary

- exchange the stored bb Connect pairing credential for a short-lived
signed desktop session
- install the scoped HttpOnly cookie in Electron before opening
Connect-managed servers
- keep account ownership enforcement at the Connect gate, including
stale GitHub-session fallback

## Testing

- `pnpm exec turbo run test typecheck --filter=@bb/connect
--filter=bb-plugin-connect --filter=@bb/desktop`
- 296 focused tests passed across Connect worker, plugin, and desktop
- `git diff --check`

Author: SawyerHood

apps/connect/src/servers.test.ts

@@ -14,8 +14,10 @@ import {
 } from "@bb/connect-db";
 
 import {
+  createDesktopSessionCookie,
   listAccountServers,
   resolveAccountUserId,
+  verifyDesktopSessionCookie,
   verifyServerCredential,
 } from "./servers.js";
 import { verifyMachineCredential } from "./session.js";
@@ -46,8 +48,13 @@ afterEach(() => {
 const now = new Date("2026-07-01T12:00:00.000Z");
 
 async function sha256Hex(value: string): Promise<string> {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(value),
+  );
+  return [...new Uint8Array(digest)]
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
 }
 
 function seedUser(id: string): void {
@@ -86,6 +93,30 @@ function seedServer(over: {
     .run();
 }
 
+describe("desktop session cookie", () => {
+  it("round-trips account identity until expiry and rejects tampering", async () => {
+    const expiresAt = now.getTime() + 60_000;
+    const cookie = await createDesktopSessionCookie(
+      "acct-a",
+      "test-secret",
+      expiresAt,
+    );
+    await expect(
+      verifyDesktopSessionCookie(cookie, "test-secret", now.getTime()),
+    ).resolves.toBe("acct-a");
+    await expect(
+      verifyDesktopSessionCookie(cookie, "test-secret", expiresAt),
+    ).resolves.toBeNull();
+    await expect(
+      verifyDesktopSessionCookie(
+        `${cookie.slice(0, -1)}x`,
+        "test-secret",
+        now.getTime(),
+      ),
+    ).resolves.toBeNull();
+  });
+});
+
 describe("listAccountServers", () => {
   it("returns only the authenticated account's rows with live from last_seen_at", async () => {
     seedUser("acct-a");
@@ -239,7 +270,11 @@ describe("verifyServerCredential / resolveAccountUserId", () => {
       false,
       ["sign"],
     );
-    const sigBuf = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(token));
+    const sigBuf = await crypto.subtle.sign(
+      "HMAC",
+      key,
+      new TextEncoder().encode(token),
+    );
     const sig = btoa(String.fromCharCode(...new Uint8Array(sigBuf)));
     const cookieValue = `${token}.${sig}`;
 

apps/connect/src/servers.ts

@@ -14,6 +14,97 @@ import {
 import type { Env } from "./tunnel-do.js";
 
 const SESSION_COOKIE = "__Secure-better-auth.session_token";
+export const DESKTOP_SESSION_COOKIE = "__Secure-bb-connect.desktop_session";
+export const DESKTOP_SESSION_TTL_MS = 60 * 60 * 1000;
+
+function bytesToBase64Url(bytes: Uint8Array): string {
+  return btoa(String.fromCharCode(...bytes))
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/=+$/g, "");
+}
+
+function stringToBase64Url(value: string): string {
+  return bytesToBase64Url(new TextEncoder().encode(value));
+}
+
+function base64UrlToString(value: string): string | null {
+  try {
+    const base64 = value.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+    return new TextDecoder().decode(
+      Uint8Array.from(atob(padded), (character) => character.charCodeAt(0)),
+    );
+  } catch {
+    return null;
+  }
+}
+
+async function signDesktopSessionPayload(
+  payload: string,
+  secret: string,
+): Promise<string> {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  const signature = await crypto.subtle.sign(
+    "HMAC",
+    key,
+    new TextEncoder().encode(payload),
+  );
+  return bytesToBase64Url(new Uint8Array(signature));
+}
+
+export async function createDesktopSessionCookie(
+  userId: string,
+  secret: string,
+  expiresAt: number,
+): Promise<string> {
+  const payload = stringToBase64Url(JSON.stringify({ expiresAt, userId }));
+  return `${payload}.${await signDesktopSessionPayload(payload, secret)}`;
+}
+
+export async function verifyDesktopSessionCookie(
+  cookieValue: string,
+  secret: string,
+  now: number = Date.now(),
+): Promise<string | null> {
+  const dot = cookieValue.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const payload = cookieValue.slice(0, dot);
+  const signature = cookieValue.slice(dot + 1);
+  const expected = await signDesktopSessionPayload(payload, secret);
+  if (signature.length !== expected.length) return null;
+  let mismatch = 0;
+  for (let index = 0; index < signature.length; index += 1) {
+    mismatch |= signature.charCodeAt(index) ^ expected.charCodeAt(index);
+  }
+  if (mismatch !== 0) return null;
+
+  const decoded = base64UrlToString(payload);
+  if (decoded === null) return null;
+  try {
+    const value: unknown = JSON.parse(decoded);
+    if (
+      typeof value !== "object" ||
+      value === null ||
+      !("userId" in value) ||
+      typeof value.userId !== "string" ||
+      !("expiresAt" in value) ||
+      typeof value.expiresAt !== "number" ||
+      value.expiresAt <= now
+    ) {
+      return null;
+    }
+    return value.userId;
+  } catch {
+    return null;
+  }
+}
 
 const serverCredentialCache = new Map<
   string,
@@ -22,8 +113,13 @@ const serverCredentialCache = new Map<
 const SERVER_CRED_TTL_MS = 20_000;
 
 async function sha256Hex(value: string): Promise<string> {
-  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, "0")).join("");
+  const digest = await crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(value),
+  );
+  return [...new Uint8Array(digest)]
+    .map((b) => b.toString(16).padStart(2, "0"))
+    .join("");
 }
 
 /**
@@ -145,12 +241,19 @@ export async function handleListAccountServers(
   if (request.method !== "GET") {
     return new Response(JSON.stringify({ error: "method_not_allowed" }), {
       status: 405,
-      headers: { "content-type": "application/json; charset=utf-8", allow: "GET" },
+      headers: {
+        "content-type": "application/json; charset=utf-8",
+        allow: "GET",
+      },
     });
   }
 
   const db = drizzle(env.DB, { schema });
-  const userId = await resolveAccountUserId(request, env.BETTER_AUTH_SECRET, db);
+  const userId = await resolveAccountUserId(
+    request,
+    env.BETTER_AUTH_SECRET,
+    db,
+  );
   if (!userId) {
     return new Response(JSON.stringify({ error: "unauthorized" }), {
       status: 401,
@@ -164,3 +267,51 @@ export async function handleListAccountServers(
     headers: { "content-type": "application/json; charset=utf-8" },
   });
 }
+
+/** Exchange a durable pairing credential for a short-lived browser session. */
+export async function handleCreateDesktopSession(
+  request: Request,
+  env: Env,
+): Promise<Response> {
+  if (request.method !== "POST") {
+    return new Response(JSON.stringify({ error: "method_not_allowed" }), {
+      status: 405,
+      headers: {
+        "content-type": "application/json; charset=utf-8",
+        allow: "POST",
+      },
+    });
+  }
+  const db = drizzle(env.DB, { schema });
+  const userId = await resolveAccountUserId(
+    request,
+    env.BETTER_AUTH_SECRET,
+    db,
+  );
+  if (!userId) {
+    return new Response(JSON.stringify({ error: "unauthorized" }), {
+      status: 401,
+      headers: { "content-type": "application/json; charset=utf-8" },
+    });
+  }
+  const expiresAt = Date.now() + DESKTOP_SESSION_TTL_MS;
+  const value = await createDesktopSessionCookie(
+    userId,
+    env.BETTER_AUTH_SECRET,
+    expiresAt,
+  );
+  return new Response(
+    JSON.stringify({
+      cookie: {
+        domain: `.${env.BASE_DOMAIN}`,
+        expiresAt,
+        name: DESKTOP_SESSION_COOKIE,
+        value,
+      },
+    }),
+    {
+      status: 200,
+      headers: { "content-type": "application/json; charset=utf-8" },
+    },
+  );
+}