Repository navigation
Enforce paired-device leases on every Remote Desktop path #25
Description
Release blocker
Remote Desktop pairing and signed leases are not enforced on the active capture, input, and WebRTC signaling paths. After the shared gateway bearer-token check, those routes accept arbitrary session identifiers and reach native capture/control without validating a trusted device or active signed lease. The iOS control view also does not establish a signed session before using those paths.
This contradicts the documented per-device pairing boundary and blocks OTA, TestFlight, and App Store distribution.
Required behavior
- Require an approved device and active signed lease for frame capture, input injection, and signaling.
- Validate the same lease at the gateway and native-host boundaries.
- Make the iOS client establish its session through nonce/signature verification before capture or control.
- End access after expiry, revocation, app lock/background timeout, or explicit disconnect.
Regression coverage
- Unpaired bearer-token clients receive 403 for frame, input, and signaling.
- Valid paired-device leases succeed.
- Expired, revoked, replayed, arbitrary, and mismatched sessions fail.
- Native RPC entry points cannot bypass lease validation.
- WebRTC and HTTP fallback paths enforce the same policy.
Activity
codepilotios commentedon Jul 17, 2026
Triage update (2026-07-17): confirmed as a critical cross-stack authorization defect. Gateway frame capture and signaling accept caller-supplied session identifiers without proving an approved device or active signed lease; native signaling/input paths do not consistently validate against the lease store; and the iOS control view begins Remote Desktop traffic without first establishing the signed session.
Draft PR #26 records the reproduction, proposed labels, verification, and escalation. No partial fix was attempted because safe remediation must cover iOS session establishment, gateway routing, native RPC validation, expiry/revocation, and HTTP/WebRTC parity together.
Keep OTA, TestFlight, and App Store distribution containing Remote Desktop blocked until the issue authorization regression coverage passes.
codepilotios commentedon Jul 18, 2026
Containment update (2026-07-18): draft security PR #22 now disables the native Remote Desktop host and makes the public remote-control routes unavailable. If merged, that safely removes the exposed path, but it does not implement the paired-device signed-lease behavior or regression coverage required by this issue. Keep Remote Desktop disabled and the distribution blocker in place until those requirements pass.