Module desktop 

Sign-in of the TeamCraft desktop app through the browser.

 desktop app                         browser (signed in, e.g. via SSO)        server
 ─────────────────────────────────────────────────────────────────────────────────────
 verifier, state; listen on 127.0.0.1:<port>
 open /desktop/authorize?port&state&challenge&device ──▶ confirmation page
                                                  "Allow" ──▶ one-time code (5 min)
 ◀── 303 http://127.0.0.1:<port>/callback?code&state ──────────────────────
 POST /api/v1/desktop/token {code, verifier} ──────────────────────────────▶ token

The app never sees a password, so single sign-on works unchanged. The code alone is useless: it is bound to the PKCE challenge of the app that started the sign-in (RFC 7636, S256) and valid once for five minutes.

Structs

AuthorizeRequest

A validated sign-in request of the desktop app.

DesktopToken

Result of a successful code exchange.

Constants

TOKEN_DAYS

The personal access token of a desktop sign-in expires after this many days without use; every use renews it (a sliding lifetime). It keeps the full scope: the app reads, uploads, checks in and reviews like the web UI. A copy left on an unused computer dies within a month, an app in daily use never has to sign in again.

Functions

approve

The user allowed the sign-in: stores a one-time code and returns the callback URL that hands it to the app.

challenge_of

PKCE S256: base64url(SHA-256(verifier)).

exchange

Exchanges a one-time code plus the PKCE verifier for a personal access token. Every failure looks the same to the caller. The token expires after TOKEN_DAYS without use – for a single sign-on user after sso_idle_days if that is shorter (TEAMCRAFT_OIDC_TOKEN_IDLE_DAYS).

purge_expired

Removes expired codes (housekeeping).