fix: bind desktop login approval to the account and settle codes stash-aware

Approval is now recorded as the approving account's uid and re-verified
after the dialog resolves, so an account change mid-dialog or between a
transient failure and its retry can never redeem on a stale approval.
Settlement clears the preserved-query stash only when it still holds the
settling code, and the redemption runner drains the stash after each pass,
so a newer code stashed mid-flight survives and is processed immediately.

Author: benceruleanlu

src/platform/cloud/onboarding/desktopLoginRedemption.test.ts

@@ -8,7 +8,9 @@ import { createMemoryHistory, createRouter } from 'vue-router'
  * The code lives only in the preserved-query stash (the tracker strips it
  * from the URL at capture time); redemption fires from router.afterEach and
  * an auth watcher, so every test drives a real in-memory router:
- * - Redemption requires explicit user approval, asked once per code
+ * - Redemption requires explicit user approval, asked once per code and
+ *   account: an account change after approval (mid-dialog or before a retry)
+ *   must never redeem on the stale approval
  * - A valid code with an authenticated user is redeemed exactly once
  * - A session appearing without any navigation redeems via the auth watcher
  * - Terminal backend responses (400/403/404/409/410) drop the code with an
@@ -17,6 +19,8 @@ import { createMemoryHistory, createRouter } from 'vue-router'
  *   retry; once the per-code attempt budget is spent the code is dropped
  *   with an error toast
  * - Each distinct code gets its own approval and attempt budget
+ * - A newer code stashed while an older one is in flight survives the older
+ *   code's settlement and is processed right after it
  * - Unauthenticated sessions keep the stash for a later trigger
  *
  * The fake clock (installed for every test) keeps the retry timers scheduled
@@ -535,6 +539,118 @@ describe('installDesktopLoginRedemption', () => {
     expect(stashedCode()).toBeUndefined()
   })
 
+  it('re-asks for approval when the account changes after approval and redeems with the new account token', async () => {
+    const { trigger, seedStash, stashedCode } = await setup()
+    seedStash(VALID_CODE)
+    mockFetch
+      .mockResolvedValueOnce(new Response(null, { status: 500 }))
+      .mockResolvedValueOnce(okResponse())
+
+    // user-1 approves; the redeem fails transiently, keeping the code stashed.
+    await trigger()
+    expect(mockConfirm).toHaveBeenCalledTimes(1)
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    expect(stashedCode()).toBe(VALID_CODE)
+
+    // The session changes to user-2 before the retry: user-1's approval must
+    // not authorize redeeming with user-2's token.
+    mockAuthStore.currentUser = {
+      uid: 'user-2',
+      getIdToken: vi.fn().mockResolvedValue('second-user-token')
+    }
+
+    await vi.waitFor(() => expect(mockConfirm).toHaveBeenCalledTimes(2))
+    await vi.waitFor(() => expect(mockFetch).toHaveBeenCalledTimes(2))
+    expect(mockFetch).toHaveBeenLastCalledWith(
+      REDEEM_URL,
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: 'Bearer second-user-token'
+        })
+      })
+    )
+    expect(stashedCode()).toBeUndefined()
+  })
+
+  it('does not redeem when the session changes while the approval dialog is open', async () => {
+    const { trigger, seedStash, stashedCode } = await setup()
+    seedStash(VALID_CODE)
+    let approve!: (value: boolean) => void
+    mockConfirm.mockReturnValueOnce(
+      new Promise<boolean>((resolve) => {
+        approve = resolve
+      })
+    )
+    mockFetch.mockResolvedValue(okResponse())
+
+    await trigger()
+    await vi.waitFor(() => expect(mockConfirm).toHaveBeenCalledTimes(1))
+
+    // The session swaps to user-2 while user-1's dialog is still open; the
+    // approval that resolves now is ambiguous and must not redeem.
+    const secondUser = {
+      uid: 'user-2',
+      getIdToken: vi.fn().mockResolvedValue('second-user-token')
+    }
+    mockAuthStore.currentUser = secondUser
+    await flushRedemption()
+    approve(true)
+    await flushRedemption()
+
+    expect(mockFetch).not.toHaveBeenCalled()
+    expect(stashedCode()).toBe(VALID_CODE)
+
+    // The next trigger re-prompts under user-2 and redeems with its token.
+    await trigger()
+
+    expect(mockConfirm).toHaveBeenCalledTimes(2)
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    expect(mockFetch).toHaveBeenCalledWith(
+      REDEEM_URL,
+      expect.objectContaining({
+        headers: expect.objectContaining({
+          Authorization: 'Bearer second-user-token'
+        })
+      })
+    )
+    expect(stashedCode()).toBeUndefined()
+  })
+
+  it.for([
+    ['succeeds', () => okResponse()],
+    ['fails terminally', () => new Response(null, { status: 404 })]
+  ] as const)(
+    'processes a newer code stashed mid-flight after the older redemption %s',
+    async ([_label, firstResponse]) => {
+      const { trigger, seedStash, stashedCode } = await setup()
+      seedStash(VALID_CODE)
+      let resolveFirstFetch!: (response: Response) => void
+      mockFetch.mockReturnValueOnce(
+        new Promise<Response>((resolve) => {
+          resolveFirstFetch = resolve
+        })
+      )
+
+      await trigger()
+      await vi.waitFor(() => expect(mockFetch).toHaveBeenCalledTimes(1))
+
+      // A second code arrives while the first redemption is still in flight;
+      // settling the first must not clear it, and it must be processed
+      // without waiting for another navigation.
+      seedStash(SECOND_CODE)
+      mockFetch.mockResolvedValue(okResponse())
+      resolveFirstFetch(firstResponse())
+
+      await vi.waitFor(() => expect(mockFetch).toHaveBeenCalledTimes(2))
+      expect(mockConfirm).toHaveBeenCalledTimes(2)
+      expect(mockFetch).toHaveBeenLastCalledWith(
+        REDEEM_URL,
+        expect.objectContaining({ body: JSON.stringify({ code: SECOND_CODE }) })
+      )
+      expect(stashedCode()).toBeUndefined()
+    }
+  )
+
   it('coalesces concurrent triggers into one dialog and one request', async () => {
     const { router, seedStash } = await setup()
     seedStash(VALID_CODE)

src/platform/cloud/onboarding/desktopLoginRedemption.ts

@@ -36,33 +36,42 @@ const REDEEM_TIMEOUT_MS = 10_000
 
 interface CodeRedemptionState {
   attempts: number
-  approved: boolean
+  approvedUserUid: string | null
   settled: boolean
 }
 
 // Keyed by code so a different code arriving later gets its own approval and
 // attempt budget, while retries of the same code reuse both.
 const codeStates = new Map<string, CodeRedemptionState>()
 
-// Coalesces concurrent triggers (afterEach can burst) into one redemption.
-let inFlight: Promise<void> | null = null
+// Coalesces concurrent triggers (afterEach can burst) into one drain.
+let draining = false
 
 let authWatcherInstalled = false
 
 function getCodeState(code: string): CodeRedemptionState {
   const existing = codeStates.get(code)
   if (existing) return existing
-  const fresh = { attempts: 0, approved: false, settled: false }
+  const fresh = { attempts: 0, approvedUserUid: null, settled: false }
   codeStates.set(code, fresh)
   return fresh
 }
 
-function settle(state: CodeRedemptionState): void {
+// A newer code can be stashed while an older one is mid-redemption; settling
+// the older one must not wipe it.
+function clearStashIfHolds(code: string): void {
+  if (getPreservedQueryParam(NAMESPACE, DESKTOP_LOGIN_CODE_KEY) === code) {
+    clearPreservedQuery(NAMESPACE)
+  }
+}
+
+function settle(code: string, state: CodeRedemptionState): void {
   state.settled = true
-  clearPreservedQuery(NAMESPACE)
+  clearStashIfHolds(code)
 }
 
 function handleTransientFailure(
+  code: string,
   state: CodeRedemptionState,
   reason: string
 ): void {
@@ -78,7 +87,7 @@ function handleTransientFailure(
   // The budget is spent on a sign-in the user explicitly approved: drop the
   // stash so reloads never retry a dead code, and tell the user instead of
   // failing silently.
-  settle(state)
+  settle(code, state)
   useToastStore().add({
     severity: 'error',
     summary: t('desktopLogin.failedSummary'),
@@ -89,23 +98,28 @@ function handleTransientFailure(
 
 // A leaked link carrying a code must not silently bind the victim's session
 // to an attacker's desktop app: redemption requires explicit approval.
-// Approval is per code — retries of the same code reuse it, but a different
-// code arriving later must be approved on its own.
-async function confirmRedemption(state: CodeRedemptionState): Promise<boolean> {
-  if (state.approved) return true
+// Approval is per code *and* account — retries of the same code under the
+// same account reuse it, but a different code, or the same code under a
+// different account, must be approved on its own.
+async function confirmRedemption(
+  state: CodeRedemptionState,
+  uid: string
+): Promise<boolean> {
+  if (state.approvedUserUid === uid) return true
   const confirmed = await useDialogService().confirm({
     title: t('desktopLogin.confirmSummary'),
     message: t('desktopLogin.confirmMessage')
   })
-  state.approved = confirmed === true
-  return state.approved
+  if (confirmed !== true) return false
+  state.approvedUserUid = uid
+  return true
 }
 
 async function redeemCode(code: string): Promise<void> {
   const state = getCodeState(code)
   if (state.settled) {
     // A later navigation can re-capture an already-settled code; drop it.
-    clearPreservedQuery(NAMESPACE)
+    clearStashIfHolds(code)
     return
   }
 
@@ -114,22 +128,29 @@ async function redeemCode(code: string): Promise<void> {
   const user = useAuthStore().currentUser
   if (!user) return
 
-  if (!(await confirmRedemption(state))) {
+  if (!(await confirmRedemption(state, user.uid))) {
     // Declined/dismissed: drop the code without an error.
-    settle(state)
+    settle(code, state)
     return
   }
 
+  // The session can change while the dialog is open or between a transient
+  // failure and its retry: approval binds the code to one account, so redeem
+  // only while that exact account is still active. On mismatch the code stays
+  // stashed and the next trigger re-prompts under the now-current account.
+  const approvedUser = useAuthStore().currentUser
+  if (!approvedUser || approvedUser.uid !== state.approvedUserUid) return
+
   state.attempts++
 
   // Fetch the token straight from the Firebase user: authStore.getIdToken()
   // surfaces failures through a modal error dialog, which this background
   // flow must not trigger.
   let idToken: string
   try {
-    idToken = await user.getIdToken()
+    idToken = await approvedUser.getIdToken()
   } catch {
-    handleTransientFailure(state, 'could not get id token')
+    handleTransientFailure(code, state, 'could not get id token')
     return
   }
 
@@ -148,6 +169,7 @@ async function redeemCode(code: string): Promise<void> {
     })
   } catch (error) {
     handleTransientFailure(
+      code,
       state,
       error instanceof Error && error.name === 'TimeoutError'
         ? 'request timed out'
@@ -157,7 +179,7 @@ async function redeemCode(code: string): Promise<void> {
   }
 
   if (response.ok) {
-    settle(state)
+    settle(code, state)
     useToastStore().add({
       severity: 'success',
       summary: t('desktopLogin.successSummary'),
@@ -168,7 +190,7 @@ async function redeemCode(code: string): Promise<void> {
   }
 
   if (TERMINAL_REDEEM_STATUSES.has(response.status)) {
-    settle(state)
+    settle(code, state)
     useToastStore().add({
       severity: 'error',
       summary: t('desktopLogin.expiredSummary'),
@@ -178,25 +200,35 @@ async function redeemCode(code: string): Promise<void> {
     return
   }
 
-  handleTransientFailure(state, `status ${response.status}`)
+  handleTransientFailure(code, state, `status ${response.status}`)
 }
 
 async function redeemPendingDesktopLoginCode(): Promise<void> {
   // Never rejects: the triggers fire-and-forget this and must not be derailed
   // by a redemption failure.
+  if (draining) return
+  draining = true
   try {
-    const code = getPreservedQueryParam(NAMESPACE, DESKTOP_LOGIN_CODE_KEY)
-    if (!code) return
-    if (!DESKTOP_LOGIN_CODE_PATTERN.test(code)) {
-      clearPreservedQuery(NAMESPACE)
-      return
+    // A newer code can replace the stashed one while an older redemption is
+    // mid-flight (its trigger lands here while draining and returns), so after
+    // each pass process whatever the stash holds now. A pass that leaves its
+    // own code stashed — a transient failure awaiting its retry timer, or an
+    // account mismatch awaiting the next trigger — ends the drain.
+    let processedCode: string | undefined
+    for (;;) {
+      const code = getPreservedQueryParam(NAMESPACE, DESKTOP_LOGIN_CODE_KEY)
+      if (!code || code === processedCode) return
+      if (!DESKTOP_LOGIN_CODE_PATTERN.test(code)) {
+        clearPreservedQuery(NAMESPACE)
+        return
+      }
+      processedCode = code
+      await redeemCode(code)
     }
-    inFlight ??= redeemCode(code).finally(() => {
-      inFlight = null
-    })
-    await inFlight
   } catch (error) {
     console.error('[DesktopLoginRedemption] Redemption failed:', error)
+  } finally {
+    draining = false
   }
 }