[MM-37984] Allow Desktop App to authenticate via external providers outside of the app on supported servers (#24140)

* [MM-37984] Allow Desktop App to authenticate via external providers outside of the app on supported servers

* PR feedback

* Add support for mattermost-dev protocol for development use

* Update server/channels/db/migrations/postgres/000110_create_desktop_tokens.up.sql

* Fix silly typo

* Update server/channels/db/migrations/postgres/000110_create_desktop_tokens.up.sql

* Remove storage of client token, only validate it on the client

* Update migrations

* Add concurrently create index

* Remove CONCURRENTLY for now

* Fix issue with changing history

* Remove old migration

* Use idempotent statement to drop old index

* Remove reference to old table

server/channels/store/opentracinglayer/opentracinglayer.go

@@ -26,6 +26,7 @@ type OpenTracingLayer struct {
 	CommandStore                    store.CommandStore
 	CommandWebhookStore             store.CommandWebhookStore
 	ComplianceStore                 store.ComplianceStore
+	DesktopTokensStore              store.DesktopTokensStore
 	DraftStore                      store.DraftStore
 	EmojiStore                      store.EmojiStore
 	FileInfoStore                   store.FileInfoStore
@@ -95,6 +96,10 @@ func (s *OpenTracingLayer) Compliance() store.ComplianceStore {
 	return s.ComplianceStore
 }
 
+func (s *OpenTracingLayer) DesktopTokens() store.DesktopTokensStore {
+	return s.DesktopTokensStore
+}
+
 func (s *OpenTracingLayer) Draft() store.DraftStore {
 	return s.DraftStore
 }
@@ -275,6 +280,11 @@ type OpenTracingLayerComplianceStore struct {
 	Root *OpenTracingLayer
 }
 
+type OpenTracingLayerDesktopTokensStore struct {
+	store.DesktopTokensStore
+	Root *OpenTracingLayer
+}
+
 type OpenTracingLayerDraftStore struct {
 	store.DraftStore
 	Root *OpenTracingLayer
@@ -3234,6 +3244,96 @@ func (s *OpenTracingLayerComplianceStore) Update(compliance *model.Compliance) (
 	return result, err
 }
 
+func (s *OpenTracingLayerDesktopTokensStore) Delete(token string) error {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "DesktopTokensStore.Delete")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	err := s.DesktopTokensStore.Delete(token)
+	if err != nil {
+		span.LogFields(spanlog.Error(err))
+		ext.Error.Set(span, true)
+	}
+
+	return err
+}
+
+func (s *OpenTracingLayerDesktopTokensStore) DeleteByUserId(userId string) error {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "DesktopTokensStore.DeleteByUserId")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	err := s.DesktopTokensStore.DeleteByUserId(userId)
+	if err != nil {
+		span.LogFields(spanlog.Error(err))
+		ext.Error.Set(span, true)
+	}
+
+	return err
+}
+
+func (s *OpenTracingLayerDesktopTokensStore) DeleteOlderThan(minCreatedAt int64) error {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "DesktopTokensStore.DeleteOlderThan")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	err := s.DesktopTokensStore.DeleteOlderThan(minCreatedAt)
+	if err != nil {
+		span.LogFields(spanlog.Error(err))
+		ext.Error.Set(span, true)
+	}
+
+	return err
+}
+
+func (s *OpenTracingLayerDesktopTokensStore) GetUserId(token string, minCreatedAt int64) (*string, error) {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "DesktopTokensStore.GetUserId")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	result, err := s.DesktopTokensStore.GetUserId(token, minCreatedAt)
+	if err != nil {
+		span.LogFields(spanlog.Error(err))
+		ext.Error.Set(span, true)
+	}
+
+	return result, err
+}
+
+func (s *OpenTracingLayerDesktopTokensStore) Insert(token string, createdAt int64, userId string) error {
+	origCtx := s.Root.Store.Context()
+	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "DesktopTokensStore.Insert")
+	s.Root.Store.SetContext(newCtx)
+	defer func() {
+		s.Root.Store.SetContext(origCtx)
+	}()
+
+	defer span.Finish()
+	err := s.DesktopTokensStore.Insert(token, createdAt, userId)
+	if err != nil {
+		span.LogFields(spanlog.Error(err))
+		ext.Error.Set(span, true)
+	}
+
+	return err
+}
+
 func (s *OpenTracingLayerDraftStore) Delete(userID string, channelID string, rootID string) error {
 	origCtx := s.Root.Store.Context()
 	span, newCtx := tracing.StartSpanWithParentByContext(s.Root.Store.Context(), "DraftStore.Delete")
@@ -12885,6 +12985,7 @@ func New(childStore store.Store, ctx context.Context) *OpenTracingLayer {
 	newStore.CommandStore = &OpenTracingLayerCommandStore{CommandStore: childStore.Command(), Root: &newStore}
 	newStore.CommandWebhookStore = &OpenTracingLayerCommandWebhookStore{CommandWebhookStore: childStore.CommandWebhook(), Root: &newStore}
 	newStore.ComplianceStore = &OpenTracingLayerComplianceStore{ComplianceStore: childStore.Compliance(), Root: &newStore}
+	newStore.DesktopTokensStore = &OpenTracingLayerDesktopTokensStore{DesktopTokensStore: childStore.DesktopTokens(), Root: &newStore}
 	newStore.DraftStore = &OpenTracingLayerDraftStore{DraftStore: childStore.Draft(), Root: &newStore}
 	newStore.EmojiStore = &OpenTracingLayerEmojiStore{EmojiStore: childStore.Emoji(), Root: &newStore}
 	newStore.FileInfoStore = &OpenTracingLayerFileInfoStore{FileInfoStore: childStore.FileInfo(), Root: &newStore}

server/channels/store/retrylayer/retrylayer.go

@@ -29,6 +29,7 @@ type RetryLayer struct {
 	CommandStore                    store.CommandStore
 	CommandWebhookStore             store.CommandWebhookStore
 	ComplianceStore                 store.ComplianceStore
+	DesktopTokensStore              store.DesktopTokensStore
 	DraftStore                      store.DraftStore
 	EmojiStore                      store.EmojiStore
 	FileInfoStore                   store.FileInfoStore
@@ -98,6 +99,10 @@ func (s *RetryLayer) Compliance() store.ComplianceStore {
 	return s.ComplianceStore
 }
 
+func (s *RetryLayer) DesktopTokens() store.DesktopTokensStore {
+	return s.DesktopTokensStore
+}
+
 func (s *RetryLayer) Draft() store.DraftStore {
 	return s.DraftStore
 }
@@ -278,6 +283,11 @@ type RetryLayerComplianceStore struct {
 	Root *RetryLayer
 }
 
+type RetryLayerDesktopTokensStore struct {
+	store.DesktopTokensStore
+	Root *RetryLayer
+}
+
 type RetryLayerDraftStore struct {
 	store.DraftStore
 	Root *RetryLayer
@@ -3607,6 +3617,111 @@ func (s *RetryLayerComplianceStore) Update(compliance *model.Compliance) (*model
 
 }
 
+func (s *RetryLayerDesktopTokensStore) Delete(token string) error {
+
+	tries := 0
+	for {
+		err := s.DesktopTokensStore.Delete(token)
+		if err == nil {
+			return nil
+		}
+		if !isRepeatableError(err) {
+			return err
+		}
+		tries++
+		if tries >= 3 {
+			err = errors.Wrap(err, "giving up after 3 consecutive repeatable transaction failures")
+			return err
+		}
+		timepkg.Sleep(100 * timepkg.Millisecond)
+	}
+
+}
+
+func (s *RetryLayerDesktopTokensStore) DeleteByUserId(userId string) error {
+
+	tries := 0
+	for {
+		err := s.DesktopTokensStore.DeleteByUserId(userId)
+		if err == nil {
+			return nil
+		}
+		if !isRepeatableError(err) {
+			return err
+		}
+		tries++
+		if tries >= 3 {
+			err = errors.Wrap(err, "giving up after 3 consecutive repeatable transaction failures")
+			return err
+		}
+		timepkg.Sleep(100 * timepkg.Millisecond)
+	}
+
+}
+
+func (s *RetryLayerDesktopTokensStore) DeleteOlderThan(minCreatedAt int64) error {
+
+	tries := 0
+	for {
+		err := s.DesktopTokensStore.DeleteOlderThan(minCreatedAt)
+		if err == nil {
+			return nil
+		}
+		if !isRepeatableError(err) {
+			return err
+		}
+		tries++
+		if tries >= 3 {
+			err = errors.Wrap(err, "giving up after 3 consecutive repeatable transaction failures")
+			return err
+		}
+		timepkg.Sleep(100 * timepkg.Millisecond)
+	}
+
+}
+
+func (s *RetryLayerDesktopTokensStore) GetUserId(token string, minCreatedAt int64) (*string, error) {
+
+	tries := 0
+	for {
+		result, err := s.DesktopTokensStore.GetUserId(token, minCreatedAt)
+		if err == nil {
+			return result, nil
+		}
+		if !isRepeatableError(err) {
+			return result, err
+		}
+		tries++
+		if tries >= 3 {
+			err = errors.Wrap(err, "giving up after 3 consecutive repeatable transaction failures")
+			return result, err
+		}
+		timepkg.Sleep(100 * timepkg.Millisecond)
+	}
+
+}
+
+func (s *RetryLayerDesktopTokensStore) Insert(token string, createdAt int64, userId string) error {
+
+	tries := 0
+	for {
+		err := s.DesktopTokensStore.Insert(token, createdAt, userId)
+		if err == nil {
+			return nil
+		}
+		if !isRepeatableError(err) {
+			return err
+		}
+		tries++
+		if tries >= 3 {
+			err = errors.Wrap(err, "giving up after 3 consecutive repeatable transaction failures")
+			return err
+		}
+		timepkg.Sleep(100 * timepkg.Millisecond)
+	}
+
+}
+
 func (s *RetryLayerDraftStore) Delete(userID string, channelID string, rootID string) error {
 
 	tries := 0
@@ -14684,6 +14799,7 @@ func New(childStore store.Store) *RetryLayer {
 	newStore.CommandStore = &RetryLayerCommandStore{CommandStore: childStore.Command(), Root: &newStore}
 	newStore.CommandWebhookStore = &RetryLayerCommandWebhookStore{CommandWebhookStore: childStore.CommandWebhook(), Root: &newStore}
 	newStore.ComplianceStore = &RetryLayerComplianceStore{ComplianceStore: childStore.Compliance(), Root: &newStore}
+	newStore.DesktopTokensStore = &RetryLayerDesktopTokensStore{DesktopTokensStore: childStore.DesktopTokens(), Root: &newStore}
 	newStore.DraftStore = &RetryLayerDraftStore{DraftStore: childStore.Draft(), Root: &newStore}
 	newStore.EmojiStore = &RetryLayerEmojiStore{EmojiStore: childStore.Emoji(), Root: &newStore}
 	newStore.FileInfoStore = &RetryLayerFileInfoStore{FileInfoStore: childStore.FileInfo(), Root: &newStore}

server/channels/store/retrylayer/retrylayer_test.go

@@ -59,6 +59,7 @@ func genStore() *mocks.Store {
 	mock.On("PostAcknowledgement").Return(&mocks.PostAcknowledgementStore{})
 	mock.On("PostPersistentNotification").Return(&mocks.PostPersistentNotificationStore{})
 	mock.On("TrueUpReview").Return(&mocks.TrueUpReviewStore{})
+	mock.On("DesktopTokens").Return(&mocks.DesktopTokensStore{})
 	return mock
 }
 

server/channels/store/sqlstore/desktop_tokens_store.go

@@ -0,0 +1,123 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package sqlstore
+
+import (
+	"database/sql"
+
+	"github.com/mattermost/mattermost/server/v8/channels/store"
+	"github.com/mattermost/mattermost/server/v8/einterfaces"
+	sq "github.com/mattermost/squirrel"
+	"github.com/pkg/errors"
+)
+
+type SqlDesktopTokensStore struct {
+	*SqlStore
+	metrics einterfaces.MetricsInterface
+}
+
+func newSqlDesktopTokensStore(sqlStore *SqlStore, metrics einterfaces.MetricsInterface) store.DesktopTokensStore {
+	return &SqlDesktopTokensStore{
+		SqlStore: sqlStore,
+		metrics:  metrics,
+	}
+}
+
+func (s *SqlDesktopTokensStore) GetUserId(token string, minCreateAt int64) (*string, error) {
+	query := s.getQueryBuilder().
+		Select("UserId").
+		From("DesktopTokens").
+		Where(sq.And{
+			sq.Eq{"Token": token},
+			sq.GtOrEq{"CreateAt": minCreateAt},
+		})
+
+	dt := struct{ UserId string }{}
+	err := s.GetReplicaX().GetBuilder(&dt, query)
+
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, store.NewErrNotFound("DesktopTokens", token)
+		}
+		return nil, errors.Wrapf(err, "No token for %s", token)
+	}
+
+	return &dt.UserId, nil
+}
+
+func (s *SqlDesktopTokensStore) Insert(token string, createAt int64, userId string) error {
+	builder := s.getQueryBuilder().
+		Insert("DesktopTokens").
+		Columns("Token", "CreateAt", "UserId").
+		Values(token, createAt, userId)
+
+	query, args, err := builder.ToSql()
+
+	if err != nil {
+		return errors.Wrap(err, "insert_desktoptokens_tosql")
+	}
+
+	if _, err = s.GetMasterX().Exec(query, args...); err != nil {
+		return errors.Wrap(err, "failed to insert token row")
+	}
+
+	return nil
+}
+
+func (s *SqlDesktopTokensStore) Delete(token string) error {
+	builder := s.getQueryBuilder().
+		Delete("DesktopTokens").
+		Where(sq.Eq{
+			"Token": token,
+		})
+
+	query, args, err := builder.ToSql()
+
+	if err != nil {
+		return errors.Wrap(err, "delete_desktoptokens_tosql")
+	}
+
+	if _, err = s.GetMasterX().Exec(query, args...); err != nil {
+		return errors.Wrap(err, "failed to delete token row")
+	}
+	return nil
+}
+
+func (s *SqlDesktopTokensStore) DeleteByUserId(userId string) error {
+	builder := s.getQueryBuilder().
+		Delete("DesktopTokens").
+		Where(sq.Eq{
+			"UserId": userId,
+		})
+
+	query, args, err := builder.ToSql()
+
+	if err != nil {
+		return errors.Wrap(err, "delete_by_userid_desktoptokens_tosql")
+	}
+
+	if _, err = s.GetMasterX().Exec(query, args...); err != nil {
+		return errors.Wrap(err, "failed to delete token row")
+	}
+	return nil
+}
+
+func (s *SqlDesktopTokensStore) DeleteOlderThan(minCreateAt int64) error {
+	builder := s.getQueryBuilder().
+		Delete("DesktopTokens").
+		Where(sq.Lt{
+			"CreateAt": minCreateAt,
+		})
+
+	query, args, err := builder.ToSql()
+
+	if err != nil {
+		return errors.Wrap(err, "delete_old_desktoptokens_tosql")
+	}
+
+	if _, err = s.GetMasterX().Exec(query, args...); err != nil {
+		return errors.Wrap(err, "failed to delete token row")
+	}
+	return nil
+}

server/channels/store/sqlstore/desktop_tokens_store_test.go

@@ -0,0 +1,14 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package sqlstore
+
+import (
+	"testing"
+
+	"github.com/mattermost/mattermost/server/v8/channels/store/storetest"
+)
+
+func TestDesktopTokensStore(t *testing.T) {
+	StoreTestWithSqlStore(t, storetest.TestDesktopTokensStore)
+}

server/channels/store/sqlstore/store.go

@@ -108,6 +108,7 @@ type SqlStoreStores struct {
 	postAcknowledgement        store.PostAcknowledgementStore
 	postPersistentNotification store.PostPersistentNotificationStore
 	trueUpReview               store.TrueUpReviewStore
+	desktopTokens              store.DesktopTokensStore
 }
 
 type SqlStore struct {
@@ -229,6 +230,7 @@ func New(settings model.SqlSettings, metrics einterfaces.MetricsInterface) (*Sql
 	store.stores.postAcknowledgement = newSqlPostAcknowledgementStore(store)
 	store.stores.postPersistentNotification = newSqlPostPersistentNotificationStore(store)
 	store.stores.trueUpReview = newSqlTrueUpReviewStore(store)
+	store.stores.desktopTokens = newSqlDesktopTokensStore(store, metrics)
 
 	store.stores.preference.(*SqlPreferenceStore).deleteUnusedFeatures()
 
@@ -1080,6 +1082,10 @@ func (ss *SqlStore) TrueUpReview() store.TrueUpReviewStore {
 	return ss.stores.trueUpReview
 }
 
+func (ss *SqlStore) DesktopTokens() store.DesktopTokensStore {
+	return ss.stores.desktopTokens
+}
+
 func (ss *SqlStore) DropAllTables() {
 	if ss.DriverName() == model.DatabaseDriverPostgres {
 		ss.masterX.Exec(`DO

server/channels/store/store.go

@@ -87,6 +87,7 @@ type Store interface {
 	PostAcknowledgement() PostAcknowledgementStore
 	PostPersistentNotification() PostPersistentNotificationStore
 	TrueUpReview() TrueUpReviewStore
+	DesktopTokens() DesktopTokensStore
 }
 
 type RetentionPolicyStore interface {
@@ -650,6 +651,14 @@ type TokenStore interface {
 	RemoveAllTokensByType(tokenType string) error
 }
 
+type DesktopTokensStore interface {
+	GetUserId(token string, minCreatedAt int64) (*string, error)
+	Insert(token string, createdAt int64, userId string) error
+	Delete(token string) error
+	DeleteByUserId(userId string) error
+	DeleteOlderThan(minCreatedAt int64) error
+}
+
 type EmojiStore interface {
 	Save(emoji *model.Emoji) (*model.Emoji, error)
 	Get(ctx context.Context, id string, allowFromCache bool) (*model.Emoji, error)

server/channels/store/storetest/desktop_tokens_store.go

@@ -0,0 +1,110 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package storetest
+
+import (
+	"testing"
+
+	"github.com/mattermost/mattermost/server/v8/channels/store"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDesktopTokensStore(t *testing.T, ss store.Store, s SqlStore) {
+	t.Run("GetUserId", func(t *testing.T) { testGetUserId(t, ss) })
+	t.Run("Insert", func(t *testing.T) { testInsert(t, ss) })
+	t.Run("Delete", func(t *testing.T) { testDeleteToken(t, ss) })
+	t.Run("DeleteByUserId", func(t *testing.T) { testDeleteByUserId(t, ss) })
+	t.Run("DeleteOlderThan", func(t *testing.T) { testDeleteOlderThan(t, ss) })
+}
+
+func testGetUserId(t *testing.T, ss store.Store) {
+	err := ss.DesktopTokens().Insert("token_with_id", 1000, "user_id")
+	require.NoError(t, err)
+
+	t.Run("get user id", func(t *testing.T) {
+		userId, err := ss.DesktopTokens().GetUserId("token_with_id", 1000)
+		assert.NoError(t, err)
+		assert.Equal(t, "user_id", *userId)
+	})
+
+	t.Run("get user id - expired", func(t *testing.T) {
+		userId, err := ss.DesktopTokens().GetUserId("token_with_id", 10000)
+		assert.Error(t, err)
+		assert.IsType(t, &store.ErrNotFound{}, err)
+		assert.Nil(t, userId)
+	})
+}
+
+func testInsert(t *testing.T, ss store.Store) {
+	t.Run("insert", func(t *testing.T) {
+		err := ss.DesktopTokens().Insert("token", 1000, "user_id")
+		assert.NoError(t, err)
+	})
+
+	t.Run("insert - token too long", func(t *testing.T) {
+		err := ss.DesktopTokens().Insert(
+			"this token is way way way WAAAAAAAAAAAAAY WAAAAAAAAAAAAAY WAAAAAAAAAAAAAY TOO LONG",
+			1000,
+			"user_id",
+		)
+		assert.Error(t, err)
+	})
+}
+
+func testDeleteToken(t *testing.T, ss store.Store) {
+	err := ss.DesktopTokens().Insert("deleteable_token", 3000, "user_id")
+	require.NoError(t, err)
+
+	t.Run("delete", func(t *testing.T) {
+		userId, err := ss.DesktopTokens().GetUserId("deleteable_token", 3000)
+		assert.NoError(t, err)
+		assert.Equal(t, "user_id", *userId)
+
+		err = ss.DesktopTokens().Delete("deleteable_token")
+		assert.NoError(t, err)
+
+		_, err = ss.DesktopTokens().GetUserId("deleteable_token", 3000)
+		assert.Error(t, err)
+	})
+}
+
+func testDeleteByUserId(t *testing.T, ss store.Store) {
+	err := ss.DesktopTokens().Insert("deleteable_token_2", 4000, "deleteable_user_id")
+	require.NoError(t, err)
+
+	t.Run("delete by user id", func(t *testing.T) {
+		userId, err := ss.DesktopTokens().GetUserId("deleteable_token_2", 3000)
+		assert.NoError(t, err)
+		assert.Equal(t, "deleteable_user_id", *userId)
+
+		err = ss.DesktopTokens().DeleteByUserId("deleteable_user_id")
+		assert.NoError(t, err)
+
+		_, err = ss.DesktopTokens().GetUserId("deleteable_token_2", 3000)
+		assert.Error(t, err)
+	})
+}
+
+func testDeleteOlderThan(t *testing.T, ss store.Store) {
+	err := ss.DesktopTokens().Insert("deleteable_token_old", 1000, "deleteable_user_id")
+	require.NoError(t, err)
+	err = ss.DesktopTokens().Insert("deleteable_token_new", 5000, "deleteable_user_id")
+	require.NoError(t, err)
+
+	t.Run("delete older than", func(t *testing.T) {
+		_, err := ss.DesktopTokens().GetUserId("deleteable_token_old", 1000)
+		assert.NoError(t, err)
+		_, err = ss.DesktopTokens().GetUserId("deleteable_token_new", 5000)
+		assert.NoError(t, err)
+
+		err = ss.DesktopTokens().DeleteOlderThan(2000)
+		assert.NoError(t, err)
+
+		_, err = ss.DesktopTokens().GetUserId("deleteable_token_old", 1000)
+		assert.Error(t, err)
+		_, err = ss.DesktopTokens().GetUserId("deleteable_token_new", 5000)
+		assert.NoError(t, err)
+	})
+}

server/channels/store/storetest/mocks/DesktopTokensStore.go

@@ -0,0 +1,109 @@
+// Code generated by mockery v2.23.2. DO NOT EDIT.
+
+// Regenerate this file using `make store-mocks`.
+
+package mocks
+
+import mock "github.com/stretchr/testify/mock"
+
+// DesktopTokensStore is an autogenerated mock type for the DesktopTokensStore type
+type DesktopTokensStore struct {
+	mock.Mock
+}
+
+// Delete provides a mock function with given fields: token
+func (_m *DesktopTokensStore) Delete(token string) error {
+	ret := _m.Called(token)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string) error); ok {
+		r0 = rf(token)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// DeleteByUserId provides a mock function with given fields: userId
+func (_m *DesktopTokensStore) DeleteByUserId(userId string) error {
+	ret := _m.Called(userId)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string) error); ok {
+		r0 = rf(userId)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// DeleteOlderThan provides a mock function with given fields: minCreatedAt
+func (_m *DesktopTokensStore) DeleteOlderThan(minCreatedAt int64) error {
+	ret := _m.Called(minCreatedAt)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(int64) error); ok {
+		r0 = rf(minCreatedAt)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+// GetUserId provides a mock function with given fields: token, minCreatedAt
+func (_m *DesktopTokensStore) GetUserId(token string, minCreatedAt int64) (*string, error) {
+	ret := _m.Called(token, minCreatedAt)
+
+	var r0 *string
+	var r1 error
+	if rf, ok := ret.Get(0).(func(string, int64) (*string, error)); ok {
+		return rf(token, minCreatedAt)
+	}
+	if rf, ok := ret.Get(0).(func(string, int64) *string); ok {
+		r0 = rf(token, minCreatedAt)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*string)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(string, int64) error); ok {
+		r1 = rf(token, minCreatedAt)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Insert provides a mock function with given fields: token, createdAt, userId
+func (_m *DesktopTokensStore) Insert(token string, createdAt int64, userId string) error {
+	ret := _m.Called(token, createdAt, userId)
+
+	var r0 error
+	if rf, ok := ret.Get(0).(func(string, int64, string) error); ok {
+		r0 = rf(token, createdAt, userId)
+	} else {
+		r0 = ret.Error(0)
+	}
+
+	return r0
+}
+
+type mockConstructorTestingTNewDesktopTokensStore interface {
+	mock.TestingT
+	Cleanup(func())
+}
+
+// NewDesktopTokensStore creates a new instance of DesktopTokensStore. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+func NewDesktopTokensStore(t mockConstructorTestingTNewDesktopTokensStore) *DesktopTokensStore {
+	mock := &DesktopTokensStore{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}

server/channels/store/storetest/mocks/Store.go

@@ -187,6 +187,22 @@ func (_m *Store) Context() context.Context {
 	return r0
 }
 
+// DesktopTokens provides a mock function with given fields:
+func (_m *Store) DesktopTokens() store.DesktopTokensStore {
+	ret := _m.Called()
+
+	var r0 store.DesktopTokensStore
+	if rf, ok := ret.Get(0).(func() store.DesktopTokensStore); ok {
+		r0 = rf()
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(store.DesktopTokensStore)
+		}
+	}
+
+	return r0
+}
+
 // Draft provides a mock function with given fields:
 func (_m *Store) Draft() store.DraftStore {
 	ret := _m.Called()

server/channels/store/storetest/store.go

@@ -61,6 +61,7 @@ type Store struct {
 	PostAcknowledgementStore        mocks.PostAcknowledgementStore
 	PostPersistentNotificationStore mocks.PostPersistentNotificationStore
 	TrueUpReviewStore               mocks.TrueUpReviewStore
+	DesktopTokensStore              mocks.DesktopTokensStore
 }
 
 func (s *Store) SetContext(context context.Context)                { s.context = context }
@@ -103,6 +104,7 @@ func (s *Store) ChannelMemberHistory() store.ChannelMemberHistoryStore {
 	return &s.ChannelMemberHistoryStore
 }
 func (s *Store) TrueUpReview() store.TrueUpReviewStore   { return &s.TrueUpReviewStore }
+func (s *Store) DesktopTokens() store.DesktopTokensStore { return &s.DesktopTokensStore }
 func (s *Store) NotifyAdmin() store.NotifyAdminStore     { return &s.NotifyAdminStore }
 func (s *Store) Group() store.GroupStore                 { return &s.GroupStore }
 func (s *Store) LinkMetadata() store.LinkMetadataStore   { return &s.LinkMetadataStore }
@@ -177,5 +179,6 @@ func (s *Store) AssertExpectations(t mock.TestingT) bool {
 		&s.PostPriorityStore,
 		&s.PostAcknowledgementStore,
 		&s.PostPersistentNotificationStore,
+		&s.DesktopTokensStore,
 	)
 }

server/channels/store/timerlayer/timerlayer.go

@@ -26,6 +26,7 @@ type TimerLayer struct {
 	CommandStore                    store.CommandStore
 	CommandWebhookStore             store.CommandWebhookStore
 	ComplianceStore                 store.ComplianceStore
+	DesktopTokensStore              store.DesktopTokensStore
 	DraftStore                      store.DraftStore
 	EmojiStore                      store.EmojiStore
 	FileInfoStore                   store.FileInfoStore
@@ -95,6 +96,10 @@ func (s *TimerLayer) Compliance() store.ComplianceStore {
 	return s.ComplianceStore
 }
 
+func (s *TimerLayer) DesktopTokens() store.DesktopTokensStore {
+	return s.DesktopTokensStore
+}
+
 func (s *TimerLayer) Draft() store.DraftStore {
 	return s.DraftStore
 }
@@ -275,6 +280,11 @@ type TimerLayerComplianceStore struct {
 	Root *TimerLayer
 }
 
+type TimerLayerDesktopTokensStore struct {
+	store.DesktopTokensStore
+	Root *TimerLayer
+}
+
 type TimerLayerDraftStore struct {
 	store.DraftStore
 	Root *TimerLayer
@@ -2968,6 +2978,86 @@ func (s *TimerLayerComplianceStore) Update(compliance *model.Compliance) (*model
 	return result, err
 }
 
+func (s *TimerLayerDesktopTokensStore) Delete(token string) error {
+	start := time.Now()
+
+	err := s.DesktopTokensStore.Delete(token)
+
+	elapsed := float64(time.Since(start)) / float64(time.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if err == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("DesktopTokensStore.Delete", success, elapsed)
+	}
+	return err
+}
+
+func (s *TimerLayerDesktopTokensStore) DeleteByUserId(userId string) error {
+	start := time.Now()
+
+	err := s.DesktopTokensStore.DeleteByUserId(userId)
+
+	elapsed := float64(time.Since(start)) / float64(time.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if err == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("DesktopTokensStore.DeleteByUserId", success, elapsed)
+	}
+	return err
+}
+
+func (s *TimerLayerDesktopTokensStore) DeleteOlderThan(minCreatedAt int64) error {
+	start := time.Now()
+
+	err := s.DesktopTokensStore.DeleteOlderThan(minCreatedAt)
+
+	elapsed := float64(time.Since(start)) / float64(time.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if err == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("DesktopTokensStore.DeleteOlderThan", success, elapsed)
+	}
+	return err
+}
+
+func (s *TimerLayerDesktopTokensStore) GetUserId(token string, minCreatedAt int64) (*string, error) {
+	start := time.Now()
+
+	result, err := s.DesktopTokensStore.GetUserId(token, minCreatedAt)
+
+	elapsed := float64(time.Since(start)) / float64(time.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if err == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("DesktopTokensStore.GetUserId", success, elapsed)
+	}
+	return result, err
+}
+
+func (s *TimerLayerDesktopTokensStore) Insert(token string, createdAt int64, userId string) error {
+	start := time.Now()
+
+	err := s.DesktopTokensStore.Insert(token, createdAt, userId)
+
+	elapsed := float64(time.Since(start)) / float64(time.Second)
+	if s.Root.Metrics != nil {
+		success := "false"
+		if err == nil {
+			success = "true"
+		}
+		s.Root.Metrics.ObserveStoreMethodDuration("DesktopTokensStore.Insert", success, elapsed)
+	}
+	return err
+}
+
 func (s *TimerLayerDraftStore) Delete(userID string, channelID string, rootID string) error {
 	start := time.Now()
 
@@ -11613,6 +11703,7 @@ func New(childStore store.Store, metrics einterfaces.MetricsInterface) *TimerLay
 	newStore.CommandStore = &TimerLayerCommandStore{CommandStore: childStore.Command(), Root: &newStore}
 	newStore.CommandWebhookStore = &TimerLayerCommandWebhookStore{CommandWebhookStore: childStore.CommandWebhook(), Root: &newStore}
 	newStore.ComplianceStore = &TimerLayerComplianceStore{ComplianceStore: childStore.Compliance(), Root: &newStore}
+	newStore.DesktopTokensStore = &TimerLayerDesktopTokensStore{DesktopTokensStore: childStore.DesktopTokens(), Root: &newStore}
 	newStore.DraftStore = &TimerLayerDraftStore{DraftStore: childStore.Draft(), Root: &newStore}
 	newStore.EmojiStore = &TimerLayerEmojiStore{EmojiStore: childStore.Emoji(), Root: &newStore}
 	newStore.FileInfoStore = &TimerLayerFileInfoStore{FileInfoStore: childStore.FileInfo(), Root: &newStore}