feat: implement device management endpoints

[layertwo]

Summary

• New DeviceManager service for device CRUD in the auth DynamoDB table
• 4 new endpoints: register device, list devices, list attached clients, notify (no-op)
• Session Hawk middleware now injects hawk_token_id for device-session correlation
• Send Tab deferred to future PR

Endpoints

Method	Path	Purpose
POST	/v1/account/device	Register or update a device
GET	/v1/account/devices	List devices (supports filterIdleDevicesTimestamp)
GET	/v1/account/attached_clients	List connected services
POST	/v1/account/devices/notify	Accept push notifications (no-op)

Context

Firefox calls these 4 endpoints during every sync cycle. They were returning 403 because they weren't implemented. While sync works without them, the errors cause noisy logs and prevent device registration (needed for Send Tab later).

Test plan

• 1002 tests pass, 100% coverage
• black, isort, flake8 clean
• Deploy and verify no more 403s on device endpoints
• Verify device appears in Firefox sync settings

[github-actions]

Diff for stage: DefaultStage

Diff for stack: GitHubOidcStack - 0 to add, 1 to update, 0 to destroy 🟡

Details

Resources
[~] Custom::AWSCDKOpenIdConnectProvider GitHubOidcProvider7EBF861F
 ├─ [~] CodeHash
 │   ├─ [-] 62fa02efcaa700e1c247e1d3cc2aa0cd07a0808a9a3e3d2230e51f57a02233fb
 │   └─ [+] d75c48c9f82cde63e9bf414df335e84e8ac24f11eb34889be255b702aec71e50
 └─ [~] RejectUnauthorized
[~] AWS::Lambda::Function CustomAWSCDKOpenIdConnectProviderCustomResourceProviderHandlerF2C543E0
 ├─ [~] Code
 │   └─ [~] .S3Key:
 │       ├─ [-] 62fa02efcaa700e1c247e1d3cc2aa0cd07a0808a9a3e3d2230e51f57a02233fb.zip
 │       └─ [+] d75c48c9f82cde63e9bf414df335e84e8ac24f11eb34889be255b702aec71e50.zip
 └─ [~] Metadata
     └─ [~] .aws:asset:path:
         ├─ [-] asset.62fa02efcaa700e1c247e1d3cc2aa0cd07a0808a9a3e3d2230e51f57a02233fb
         └─ [+] asset.d75c48c9f82cde63e9bf414df335e84e8ac24f11eb34889be255b702aec71e50

Diff for stack: Service-prod - 0 to add, 0 to update, 0 to destroy ✅

Details

Resources
[~] AWS::Lambda::Function AuthApiHandlerED50ACFA
 ├─ [~] Code
 │   └─ [~] .S3Key:
 │       ├─ [-] 5174e8eb39d2a8923c1463ac8268cc0ba8191e0dbc87557af1d142a35d5b5988.zip
 │       └─ [+] 61dce01fd53c44c40e667bd8b0d495ecfe2c0bf3e7aa815d976dc2dea640468e.zip
 └─ [~] Metadata
     └─ [~] .aws:asset:path:
         ├─ [-] asset.5174e8eb39d2a8923c1463ac8268cc0ba8191e0dbc87557af1d142a35d5b5988
         └─ [+] asset.61dce01fd53c44c40e667bd8b0d495ecfe2c0bf3e7aa815d976dc2dea640468e
[~] AWS::Lambda::Function TokenApiHandler2E66DB25
 ├─ [~] Code
 │   └─ [~] .S3Key:
 │       ├─ [-] 5174e8eb39d2a8923c1463ac8268cc0ba8191e0dbc87557af1d142a35d5b5988.zip
 │       └─ [+] 61dce01fd53c44c40e667bd8b0d495ecfe2c0bf3e7aa815d976dc2dea640468e.zip
 └─ [~] Metadata
     └─ [~] .aws:asset:path:
         ├─ [-] asset.5174e8eb39d2a8923c1463ac8268cc0ba8191e0dbc87557af1d142a35d5b5988
         └─ [+] asset.61dce01fd53c44c40e667bd8b0d495ecfe2c0bf3e7aa815d976dc2dea640468e
[~] AWS::Lambda::Function ProfileApiHandler9B65A298
 ├─ [~] Code
 │   └─ [~] .S3Key:
 │       ├─ [-] 5174e8eb39d2a8923c1463ac8268cc0ba8191e0dbc87557af1d142a35d5b5988.zip
 │       └─ [+] 61dce01fd53c44c40e667bd8b0d495ecfe2c0bf3e7aa815d976dc2dea640468e.zip
 └─ [~] Metadata
     └─ [~] .aws:asset:path:
         ├─ [-] asset.5174e8eb39d2a8923c1463ac8268cc0ba8191e0dbc87557af1d142a35d5b5988
         └─ [+] asset.61dce01fd53c44c40e667bd8b0d495ecfe2c0bf3e7aa815d976dc2dea640468e
[~] AWS::Lambda::Function ApiHandler5E7490E8
 ├─ [~] Code
 │   └─ [~] .S3Key:
 │       ├─ [-] 5174e8eb39d2a8923c1463ac8268cc0ba8191e0dbc87557af1d142a35d5b5988.zip
 │       └─ [+] 61dce01fd53c44c40e667bd8b0d495ecfe2c0bf3e7aa815d976dc2dea640468e.zip
 └─ [~] Metadata
     └─ [~] .aws:asset:path:
         ├─ [-] asset.5174e8eb39d2a8923c1463ac8268cc0ba8191e0dbc87557af1d142a35d5b5988
         └─ [+] asset.61dce01fd53c44c40e667bd8b0d495ecfe2c0bf3e7aa815d976dc2dea640468e
[~] AWS::Lambda::Function ChannelApiHandler02759D57
 ├─ [~] Code
 │   └─ [~] .S3Key:
 │       ├─ [-] 0823488cf4518e58ff22331aa868f9110776de70f7cba2b156f42954b11061e8.zip
 │       └─ [+] c57f3f60d974052ab670829f75267201e439864ef969e852054809342a2cfefd.zip
 └─ [~] Metadata
     └─ [~] .aws:asset:path:
         ├─ [-] asset.0823488cf4518e58ff22331aa868f9110776de70f7cba2b156f42954b11061e8
         └─ [+] asset.c57f3f60d974052ab670829f75267201e439864ef969e852054809342a2cfefd

No Changes for stack: Frontend-prod ✅
No Changes for stack: Monitoring-prod ✅

Generated for commit 6ef2c93 at 2026-03-03T04:10:27.836Z

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
lambda/src/environment
service_provider.py
lambda/src/middlewares
hawk_auth.py
lambda/src/routes/auth
account_attached_clients.py
account_device.py
account_devices.py
account_devices_notify.py
lambda/src/services
device_manager.py
fxa_token_manager.py
Project Total

This report was generated by python-coverage-comment-action