THU-507: Device ID standardization#856
Conversation
Semgrep Security ScanNo security issues found. |
raivieiraadriano92
temporarily deployed
to
preview
GitHub Actions
Inactive
PR Metrics
Updated Mon, 11 May 2026 20:45:24 GMT · run #1463 |
|
Preview environment deployed 🚀
Stack: Auto-destroys on PR close/merge. Login via the bundled Keycloak realm — |
raivieiraadriano92
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit f90df9d. Configure here.
| if (deviceId) { | ||
| request.headers.set('X-Device-ID', deviceId) | ||
| request.headers.set('X-Device-Name', getDeviceDisplayName()) | ||
| } |
There was a problem hiding this comment.
Device header logic duplicated across two files
Low Severity
The device identity header building logic (getDeviceId() + getDeviceDisplayName() → X-Device-ID / X-Device-Name) is independently implemented in both http.ts (the hook) and getAuthenticatedHeaders() in auth-token.ts. The PR describes getAuthenticatedHeaders() as the "single source of truth for authenticated headers," but http.ts reimplements the same logic with its own direct imports of getDeviceId and getDeviceDisplayName. If a new device header is added or a header name changes, both locations need updating independently, creating a risk of inconsistency.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit f90df9d. Configure here.
2 participants
Summary
X-Device-IDandX-Device-Nameheaders tocreateAuthenticatedClient()so every authenticated request to our backend includes device identity automatically (URL-prefix guard prevents headers from leaking to external APIs like Google/Microsoft OAuth)getAuthenticatedHeaders()insrc/lib/auth-token.tsas the single source of truth for authenticated headers, used by the PowerSync connector (which requires rawfetch())authHeaders()fromsrc/api/encryption.tsandbuildHeaders()fromsrc/db/powersync/connector.tsTest plan
X-Device-ID+X-Device-Namevia HTTP client hookgetAuthenticatedHeaders()getAuthenticatedHeaders(), and connector header verificationCloses THU-507
Note
Medium Risk
Touches request authentication/identity plumbing by auto-injecting
X-Device-ID/X-Device-Nameand centralizing header construction; mistakes could break backend auth flows or leak headers if the URL guard is wrong.Overview
Standardizes device identity propagation by automatically attaching
X-Device-IDandX-Device-Nameto authenticated requests made to the app backend (viacreateAuthenticatedClient), with a prefix/URL guard to avoid leaking these headers to external APIs.Centralizes raw-
fetchauth header creation ingetAuthenticatedHeaders()(used by the PowerSync connector) and removes duplicated per-API header builders from the encryption API client and PowerSync connector. Tests are updated/added to assert device header injection, external-API non-injection, and connector/encryption calls including the new headers.Reviewed by Cursor Bugbot for commit f90df9d. Bugbot is set up for automated code reviews on this repo. Configure here.