ENG-36 Support Intel build for mac, not just Apple Silicon

[github-actions]

This is an automated pull request to merge chas/intel-support into dev.
It was created by the [Auto Pull Request] action.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
app	Ready	Preview	Comment	Nov 6, 2025 8:13pm
portal	Ready	Preview	Comment	Nov 6, 2025 8:13pm

[comp-ai-code-review]

🔒 Comp AI - Security Review

🟡 Risk Level: MEDIUM

DeviceAgentAccordionItem.tsx places download tokens in URL query, uses tokenResponse without JSON validation, embeds unsanitized detectedOS in requests, and sends org/member IDs without client-side validation.

---

📦 Dependency Vulnerabilities

✅ No known vulnerabilities detected in dependencies.

---

🛡️ Code Security Analysis

View 1 file(s) with issues

🟡 apps/portal/src/app/(app)/(home)/[orgId]/components/tasks/DeviceAgentAccordionItem.tsx (MEDIUM Risk)

#	Issue	Risk Level
1	Download token included in URL query (exposed via Referer/logs)	MEDIUM
2	No validation of tokenResponse JSON before use	MEDIUM
3	detectedOS used unsanitized in download URL	MEDIUM
4	member IDs sent to API with no client-side validation	MEDIUM

Recommendations:

1. Avoid placing sensitive tokens in URL query parameters. Instead: (a) perform an authenticated POST to /api/download-agent that returns the file as a streamed response/blob, or (b) fetch the file via fetch() with the token passed in an Authorization header, then create a Blob and use URL.createObjectURL() + an to trigger the save. This prevents tokens from leaking via Referer headers, logs, or browser history.
2. Validate the tokenResponse JSON shape before use. After tokenResponse.ok, parse the JSON and assert the presence and type of token (e.g., typeof token === 'string' && token.length > 0) and handle the failure case explicitly instead of destructuring blindly.
3. Allowlist and validate detectedOS before embedding it in requests. Do not trust user agent parsing or client-controlled values. Example: const allowed = ['macos','macos-intel','windows']; if (!allowed.includes(detectedOS)) detectedOS = 'unknown'; and send only allowlisted values to the server.
4. Ensure the server fully validates and authorizes any request that uses orgId/employeeId from the client. Client-side values can be tampered with; the server must check that the authenticated user is permitted to request a token for that org/employee. Do not rely on client-side validation for access control.
5. Use short-lived, single-use download tokens on the server side and revoke them after use. Log token issuance and usage carefully on the server (not client) and avoid returning tokens that would permit unlimited downloads.
6. Set appropriate Referrer-Policy headers (e.g., no-referrer or strict-origin-when-cross-origin) and avoid exposing tokens via redirects. Consider Content-Disposition headers set by the server to provide the filename instead of setting download filenames client-side.
7. Consider additional protections: require CSRF protections where appropriate, mark cookies Secure/HttpOnly/SameSite if using cookies for auth, and ensure TLS is enforced for all endpoints.

---

💡 Recommendations

View 3 recommendation(s)

1. Avoid placing tokens in query strings: fetch the agent via a protected endpoint and pass the token in an Authorization header; receive the binary and trigger download via Blob + URL.createObjectURL() (or stream the response) instead of appending ?token=... to a link.
2. Validate tokenResponse JSON before use. Example: const json = await tokenResponse.json(); if (!json || typeof json.token !== 'string' || json.token.length===0) throw new Error('invalid token'); const token = json.token; do not destructure blindly from tokenResponse.body.
3. Allowlist and validate client-controlled fields before embedding them in requests. Example for detectedOS: const allowed = ['macos','macos-intel','windows']; detectedOS = allowed.includes(detectedOS) ? detectedOS : 'unknown'; also validate orgId/employeeId formats (regex or UUID check) on the client and ensure the server performs authoritative authorization checks.

---

Powered by Comp AI - AI that handles compliance for you. Reviewed Nov 6, 2025

[linear]

ENG-36 Support Intel build for mac, not just Apple Silicon

[claudfuen]

🎉 This PR is included in version 1.56.7 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀