feat(desktop): support remote runtime headers

packages/ui/src/lib/runtime-auth.test.ts

@@ -2,9 +2,12 @@ import { describe, expect, test } from 'bun:test';
 import {
   buildRuntimeAuthHeaders,
   clearRuntimeAuthCredentialProvider,
+  clearRuntimeUrlAuthToken,
   getRuntimeBearerTokenSync,
+  refreshRuntimeUrlAuthToken,
   setRuntimeAuthCredentialProvider,
   setRuntimeBearerToken,
+  setRuntimeExtraHeaders,
 } from './runtime-auth';
 
 describe('runtime auth headers', () => {
@@ -60,4 +63,56 @@ describe('runtime auth headers', () => {
       }
     }
   });
+
+  test('adds runtime extra headers without overriding bearer authorization', async () => {
+    try {
+      setRuntimeBearerToken('runtime-token');
+      setRuntimeExtraHeaders({
+        'CF-Access-Client-Id': 'client-id',
+        Authorization: 'Bearer proxy-token',
+      });
+
+      const headers = await buildRuntimeAuthHeaders();
+
+      expect(headers.get('CF-Access-Client-Id')).toBe('client-id');
+      expect(headers.get('Authorization')).toBe('Bearer runtime-token');
+    } finally {
+      setRuntimeExtraHeaders(null);
+      clearRuntimeAuthCredentialProvider();
+    }
+  });
+
+  test('sends runtime extra headers when minting URL auth tokens', async () => {
+    const previousFetch = globalThis.fetch;
+    let seenUrl = '';
+    let seenHeaders = new Headers();
+    try {
+      clearRuntimeUrlAuthToken();
+      setRuntimeBearerToken('runtime-token');
+      setRuntimeExtraHeaders({
+        'CF-Access-Client-Id': 'client-id',
+        Authorization: 'Bearer proxy-token',
+      });
+      globalThis.fetch = (async (input: RequestInfo | URL, init?: RequestInit) => {
+        seenUrl = String(input);
+        seenHeaders = new Headers(init?.headers);
+        return new Response(JSON.stringify({ token: 'url-token', expiresAt: Date.now() + 60_000 }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        });
+      }) as typeof fetch;
+
+      const token = await refreshRuntimeUrlAuthToken('https://runtime.example');
+
+      expect(token).toBe('url-token');
+      expect(seenUrl).toBe('https://runtime.example/auth/url-token');
+      expect(seenHeaders.get('CF-Access-Client-Id')).toBe('client-id');
+      expect(seenHeaders.get('Authorization')).toBe('Bearer runtime-token');
+    } finally {
+      globalThis.fetch = previousFetch;
+      clearRuntimeUrlAuthToken();
+      setRuntimeExtraHeaders(null);
+      clearRuntimeAuthCredentialProvider();
+    }
+  });
 });