feat(desktop): implement phase 2 native capabilities

backend/app/main.py

@@ -10,7 +10,7 @@ from fastapi.middleware.cors import CORSMiddleware
 from sqlalchemy import text
 
 from app.api.v1.router import api_router
-from app.core.config import settings
+from app.core.config import get_cors_allowed_origins, settings
 from app.core.exceptions import register_exception_handlers
 from app.core.login_crypto import validate_login_crypto_configuration
 from app.crud.user import ensure_admin_exists
@@ -116,10 +116,19 @@ def create_app() -> FastAPI:
 
     app.add_middleware(
         CORSMiddleware,
-        allow_origins=["*"],
+        allow_origins=get_cors_allowed_origins(),
         allow_credentials=True,
         allow_methods=["*"],
-        allow_headers=["*"],
+        allow_headers=[
+            "Accept",
+            "Authorization",
+            "Content-Type",
+            "X-CTMS-Client-Type",
+            "X-CTMS-Client-Version",
+            "X-CTMS-Client-Platform",
+            "X-CTMS-Build-Channel",
+            "X-CTMS-Build-Commit",
+        ],
     )
 
     @app.middleware("http")
@@ -269,6 +278,11 @@ def _enqueue_security_access_log(request, path: str, status_code: int, started_a
             "elapsed_ms": round((time.perf_counter() - started_at) * 1000, 2),
             "client_ip": _resolve_client_ip(request),
             "user_agent": request.headers.get("user-agent"),
+            "client_type": request.headers.get("x-ctms-client-type"),
+            "client_version": request.headers.get("x-ctms-client-version"),
+            "client_platform": request.headers.get("x-ctms-client-platform"),
+            "build_channel": request.headers.get("x-ctms-build-channel"),
+            "build_commit": request.headers.get("x-ctms-build-commit"),
             "auth_status": auth_status,
             "user_identifier": user_identifier,
         }