From f3d8db52d21a162966b5e6984ed94d8f73f48c34 Mon Sep 17 00:00:00 2001
From: Admin <dmparrow@gmail.com>
Date: Thu, 24 Sep 2026 18:37:59 +0000
Subject: [PATCH] deploy: accept FieldLens desktop device-auth client

---
 apps/api/src/auth.ts   |  4 ++--
 apps/api/src/config.ts | 14 +++++++++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/apps/api/src/auth.ts b/apps/api/src/auth.ts
index d0afe20..52dbde3 100644
--- a/apps/api/src/auth.ts
+++ b/apps/api/src/auth.ts
@@ -33,7 +33,7 @@ export function rolesFromPayload(payload: JWTPayload) {
   return [...new Set([
     ...strings(resourceAccess?.[config.audience]?.roles),
     ...strings(resourceAccess?.[config.browserClientId]?.roles),
-    ...strings(resourceAccess?.[config.desktopClientId]?.roles),
+    ...config.desktopClientIds.flatMap((clientId) => strings(resourceAccess?.[clientId]?.roles)),
     ...strings(resourceAccess?.[config.machineClientId]?.roles),
   ])]
 }
@@ -48,7 +48,7 @@ function intendedForFieldLens(payload: JWTPayload) {
   const azp = typeof payload.azp === 'string' ? payload.azp : ''
   return audience.includes(config.audience)
     || azp === config.browserClientId
-    || azp === config.desktopClientId
+    || config.desktopClientIds.includes(azp)
     || azp === config.machineClientId
 }
 
diff --git a/apps/api/src/config.ts b/apps/api/src/config.ts
index ff6c3d4..acaa5bb 100644
--- a/apps/api/src/config.ts
+++ b/apps/api/src/config.ts
@@ -4,6 +4,14 @@ function required(name: string) {
   return value
 }
 
+function list(name: string, fallback: string[]) {
+  const raw = process.env[name]?.trim()
+  if (!raw) return fallback
+  return [...new Set(raw.split(',').map((value) => value.trim()).filter(Boolean))]
+}
+
+const desktopClientId = process.env.KEYCLOAK_DESKTOP_CLIENT_ID?.trim() || 'fieldlens-print'
+
 export const config = {
   port: Number(process.env.PORT ?? '3000'),
   databaseUrl: required('DATABASE_URL'),
@@ -11,7 +19,11 @@ export const config = {
   jwksUri: (process.env.KEYCLOAK_JWKS_URI ?? '').trim(),
   audience: process.env.KEYCLOAK_AUDIENCE?.trim() || 'fieldlens-api',
   browserClientId: process.env.KEYCLOAK_BROWSER_CLIENT_ID?.trim() || 'fieldlens',
-  desktopClientId: process.env.KEYCLOAK_DESKTOP_CLIENT_ID?.trim() || 'fieldlens-print',
+  desktopClientId,
+  desktopClientIds: list('KEYCLOAK_DESKTOP_CLIENT_IDS', [
+    desktopClientId,
+    'fieldlens-print-desktop',
+  ]),
   machineClientId: process.env.KEYCLOAK_MACHINE_CLIENT_ID?.trim() || 'fieldlens-integration',
   tenantId: process.env.FIELDLENS_TENANT_ID?.trim() || 'fieldlens-production',
   environment: process.env.FIELDLENS_ENV?.trim() || 'development',