feat(desktop): isolate platform accounts per desktop client

Scope desktop media accounts by the authenticated desktop client_id so
the same user logging in from Mac and Windows no longer sees a shared
account list. The list, identity lookup, upsert, patch, tombstone and
async health sink paths now all require matching client_id, and the
active uniqueness index moves from (workspace, platform, uid) to
(workspace, client, platform, uid).

Also strengthen the desktop client_id seed: when the OS machine id is
unavailable, fall back to a hashed fingerprint of stable hardware MAC
addresses before the random installation id, so the same hardware
keeps the same client across reinstalls.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/desktop-client/src/main/device-id.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron/main', () => ({
+  app: {
+    getPath: () => '/tmp/geo-rankly-test-user-data',
+  },
+}))
+
+import { resolveDesktopClientID } from './device-id'
+
+describe('desktop device client id', () => {
+  it('is stable for the same hardware and account scope', () => {
+    const scope = {
+      tenant_id: 1,
+      workspace_id: 2,
+      user_id: 3,
+    }
+
+    expect(resolveDesktopClientID(scope)).toBe(resolveDesktopClientID(scope))
+  })
+
+  it('keeps different account scopes separate on the same hardware', () => {
+    const base = resolveDesktopClientID({
+      tenant_id: 1,
+      workspace_id: 2,
+      user_id: 3,
+    })
+
+    expect(
+      resolveDesktopClientID({
+        tenant_id: 1,
+        workspace_id: 2,
+        user_id: 4,
+      }),
+    ).not.toBe(base)
+    expect(
+      resolveDesktopClientID({
+        tenant_id: 1,
+        workspace_id: 5,
+        user_id: 3,
+      }),
+    ).not.toBe(base)
+  })
+
+  it('rejects missing account scope instead of generating a random id', () => {
+    expect(() =>
+      resolveDesktopClientID({
+        tenant_id: 1,
+        workspace_id: 0,
+        user_id: 3,
+      }),
+    ).toThrow('desktop_client_id_scope_invalid')
+  })
+})

apps/desktop-client/src/main/device-id.ts

@@ -1,7 +1,8 @@
 import { execFileSync } from 'node:child_process'
 import { createHash, randomUUID } from 'node:crypto'
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { hostname } from 'node:os'
+import { hostname, networkInterfaces } from 'node:os'
+import type { NetworkInterfaceInfo } from 'node:os'
 import { join } from 'node:path'
 
 import { app } from 'electron/main'
@@ -44,7 +45,16 @@ export function resolveDesktopClientID(scope: DesktopClientIDScope): string {
 
 function stableMachineIdentitySeed(): string {
   const machineID = resolveOSMachineID()
-  return machineID ? `machine:${machineID}` : `installation:${resolvePersistedInstallationID()}`
+  if (machineID) {
+    return `machine:${machineID}`
+  }
+
+  const networkFingerprint = resolveNetworkHardwareFingerprint()
+  if (networkFingerprint) {
+    return `network:${networkFingerprint}`
+  }
+
+  return `installation:${resolvePersistedInstallationID()}`
 }
 
 function resolveOSMachineID(): string | null {
@@ -113,6 +123,49 @@ function normalizeMachineID(value: string | null): string | null {
   return createHash('sha256').update(normalized).digest('hex')
 }
 
+function resolveNetworkHardwareFingerprint(): string | null {
+  const macs = Object.values(networkInterfaces())
+    .flatMap((items) => items ?? [])
+    .filter(isStableHardwareNetworkInterface)
+    .map((item) => normalizeMacAddress(item.mac))
+    .filter((mac): mac is string => Boolean(mac))
+
+  const uniqueMacs = [...new Set(macs)].sort()
+  if (!uniqueMacs.length) {
+    return null
+  }
+
+  return createHash('sha256').update(uniqueMacs.join('|')).digest('hex')
+}
+
+function isStableHardwareNetworkInterface(item: NetworkInterfaceInfo): boolean {
+  const mac = normalizeMacAddress(item.mac)
+  if (!mac || item.internal) {
+    return false
+  }
+
+  const bytes = mac.split(':').map((part) => Number.parseInt(part, 16))
+  if (bytes.length !== 6 || bytes.some((byte) => !Number.isFinite(byte))) {
+    return false
+  }
+
+  const firstByte = bytes[0] ?? 0
+  const isMulticast = (firstByte & 0x01) === 0x01
+  const isLocallyAdministered = (firstByte & 0x02) === 0x02
+  return !isMulticast && !isLocallyAdministered
+}
+
+function normalizeMacAddress(value: string | undefined): string | null {
+  const normalized = (value ?? '').trim().toLowerCase()
+  if (!normalized || normalized === '00:00:00:00:00:00') {
+    return null
+  }
+  if (!/^[0-9a-f]{2}(:[0-9a-f]{2}){5}$/.test(normalized)) {
+    return null
+  }
+  return normalized
+}
+
 function resolvePersistedInstallationID(): string {
   const existing = readPersistedInstallationID()
   if (existing) {