feat(clients): let connections optionally associate with a machine

Expose inbound_clients.machine_id in the Connections page (chip on
cards, picker + inline create in the side panel), make machine
selection skippable during OAuth consent, and fix the inline create
form defaulting the icon so the save button isn't stuck disabled.
Also drop the hostname autofill in that form since it misleadingly
suggested the local machine's hostname for remote connections.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Author: crimsonsunset

apps/desktop/src-tauri/src/commands/oauth.rs

@@ -483,6 +483,7 @@ pub async fn get_oauth_clients(
             created_at: client.created_at,
             reports_roots: client.reports_roots,
             roots_capability_known: client.roots_capability_known,
+            machine_id: client.machine_id.map(|id| id.to_string()),
         })
         .collect();
 
@@ -568,6 +569,11 @@ pub struct OAuthClientInfo {
     /// "Reports workspace" (`reports_roots = true`) or "Rootless"
     /// (`reports_roots = false`).
     pub roots_capability_known: bool,
+
+    /// Machine this client is tagged with, if any (see `machines.rs`
+    /// commands for assignment). `None` means untagged/global.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub machine_id: Option<String>,
 }
 
 /// Request to update client settings.
@@ -639,6 +645,7 @@ pub async fn update_oauth_client(
         created_at: updated_client.created_at,
         reports_roots: updated_client.reports_roots,
         roots_capability_known: updated_client.roots_capability_known,
+        machine_id: updated_client.machine_id.map(|id| id.to_string()),
     })
 }
 

apps/desktop/src-tauri/src/services/admin_server.rs

@@ -305,6 +305,7 @@ impl GatewayRuntime for DesktopGatewayRuntime {
                     "created_at": client.created_at,
                     "reports_roots": client.reports_roots,
                     "roots_capability_known": client.roots_capability_known,
+                    "machine_id": client.machine_id.map(|id| id.to_string()),
                 })
             })
             .collect::<Vec<_>>();

apps/desktop/src/components/OAuthConsentModal.tsx

@@ -282,12 +282,14 @@ export function OAuthConsentModal() {
 
   /**
    * Create or pick a machine, link it to the client, then approve OAuth consent.
+   * Machine assignment is optional: leaving the picker on "No machine" (and not
+   * mid-way through creating a new one) just approves without tagging a machine.
    */
   const handleNameAndAllow = async () => {
     if (modalState.type !== 'name-machine') return;
     const { details, machines } = modalState;
 
-    let machineId = selectedMachineId;
+    let machineId: string | null = selectedMachineId || null;
     if (creatingMachine) {
       const missingField = getMissingMachineProfileField({
         name: machineName,
@@ -298,10 +300,7 @@ export function OAuthConsentModal() {
         setProcessError(t(`oauthConsent.nameMachine.${missingField}Required`));
         return;
       }
-    } else if (!machineId) {
-      setProcessError(t('oauthConsent.nameMachine.nameRequired'));
-      return;
-    } else {
+    } else if (machineId) {
       const selected = machines.find((machine) => machine.id === machineId);
       if (selected && !isMachineRowComplete(selected)) {
         setProcessError(t('oauthConsent.nameMachine.profileIncomplete'));
@@ -324,7 +323,9 @@ export function OAuthConsentModal() {
         machineId = created.id;
       }
 
-      await setClientMachineId(details.clientId, machineId);
+      if (machineId) {
+        await setClientMachineId(details.clientId, machineId);
+      }
       await finishApproval(details);
     } catch (err) {
       console.error('[OAuth] Failed to name machine and approve:', err);
@@ -334,6 +335,28 @@ export function OAuthConsentModal() {
     }
   };
 
+  /**
+   * Skip machine assignment entirely and approve, regardless of whatever the
+   * picker/create sub-form currently holds. The one-tap escape hatch for
+   * "I don't care which machine this is" or getting unstuck mid-create.
+   */
+  const handleSkipMachine = async () => {
+    if (modalState.type !== 'name-machine') return;
+    const { details } = modalState;
+
+    setIsProcessing(true);
+    setProcessError(null);
+
+    try {
+      await finishApproval(details);
+    } catch (err) {
+      console.error('[OAuth] Failed to skip machine and approve:', err);
+      setProcessError(String(err));
+    } finally {
+      setIsProcessing(false);
+    }
+  };
+
   const handleDeny = async () => {
     if (modalState.type !== 'consent' && modalState.type !== 'name-machine') return;
     const { details } = modalState;
@@ -438,9 +461,13 @@ export function OAuthConsentModal() {
     const { details, machines } = modalState;
     const createDraft = { name: machineName, icon: machineIcon, hostname: machineHostname };
     const selectedMachine = machines.find((machine) => machine.id === selectedMachineId);
+    // Machine assignment is optional — picking nothing is valid (approves
+    // untagged). Only an in-progress "create new machine" sub-form or an
+    // incomplete existing machine profile blocks submission.
     const canSubmit = creatingMachine
       ? isMachineProfileComplete(createDraft)
-      : selectedMachineId.length > 0 && selectedMachine != null && isMachineRowComplete(selectedMachine);
+      : selectedMachineId.length === 0 ||
+        (selectedMachine != null && isMachineRowComplete(selectedMachine));
 
     return (
       <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 backdrop-blur-sm">
@@ -559,6 +586,14 @@ export function OAuthConsentModal() {
                 <X className="mr-2 h-4 w-4" />
                 {t('oauthConsent.deny')}
               </Button>
+              <button
+                type="button"
+                onClick={() => void handleSkipMachine()}
+                disabled={isProcessing || !approveReady}
+                className="text-center text-xs text-[rgb(var(--muted))] transition-colors hover:text-[rgb(var(--foreground))] disabled:opacity-50"
+              >
+                {t('oauthConsent.nameMachine.skipBtn')}
+              </button>
             </div>
           </CardContent>
         </Card>