improve mobile sync security

src/types/desktopRemote.ts

@@ -1,4 +1,6 @@
-export const DESKTOP_REMOTE_PROTOCOL_VERSION = 2;
+export const DESKTOP_REMOTE_PROTOCOL_VERSION = 3;
+export type DesktopRemoteCredentialScope = 'control' | 'sync';
+export type DesktopRemoteSecurityUpgradeState = 'none' | 'repair-required';
 
 export type DesktopRemotePlaybackState = 'stopped' | 'playing' | 'paused' | 'loading';
 export type DesktopRemoteRepeatMode = 'none' | 'one' | 'all';
@@ -22,8 +24,14 @@ export interface DesktopRemoteIdentity {
 }
 
 export interface DesktopRemoteConnection extends DesktopRemoteIdentity {
+  protocolVersion: 3;
   id: string;
   baseUrl: string;
+  certificateFingerprint: string;
+  scopes: DesktopRemoteCredentialScope[];
+  credentialIssuedAt: number;
+  credentialRotatedAt: number;
+  securityUpgradeState: DesktopRemoteSecurityUpgradeState;
   deviceId: string | null;
   pairedAt: number;
   lastConnectedAt: number | null;
@@ -77,7 +85,11 @@ export interface DesktopRemotePairingClaim {
   identity: DesktopRemoteIdentity | null;
 }
 
-export type DesktopRemotePinPairingRequest = DesktopRemotePairingClaim;
+export interface DesktopRemotePinPairingRequest extends DesktopRemotePairingClaim {
+  attemptId: string;
+  certificateFingerprint: string;
+  protocolVersion: 3;
+}
 
 export type DesktopRemotePairingState =
   | 'pending'
@@ -90,6 +102,11 @@ export interface DesktopRemotePairingStatus {
   state: DesktopRemotePairingState;
   expiresAt: number;
   token?: string;
+  controlToken?: string;
+  syncToken?: string;
+  issuedAt?: number;
+  scopes?: DesktopRemoteCredentialScope[];
+  certificateFingerprint?: string;
   deviceId?: string | null;
   identity?: DesktopRemoteIdentity | null;
 }
@@ -97,11 +114,16 @@ export interface DesktopRemotePairingStatus {
 export interface DesktopRemotePairingInput {
   baseUrl: string;
   ticket: string;
+  endpointUuid: string;
+  protocolVersion: 3;
+  certificateFingerprint: string;
 }
 
 export interface DesktopRemoteDiscoveredDesktop extends DesktopRemoteIdentity {
   name: string;
   baseUrl: string;
+  certificateFingerprint: string;
+  transport: 'https';
   address: string;
   port: number;
   lastSeenAt: number;