merge: integrate secure remembered password

electron/api/routes/auth.ts

@@ -23,10 +23,15 @@ import {
 import { logger } from '../../utils/logger';
 import type { WorksSquareTokenPayload } from '../../services/works-square-session';
 import { normalizeModuleAccess } from '../../../shared/module-access';
+import {
+  getRememberedPasswordState,
+  updateRememberedPassword,
+} from '../../services/remembered-password';
 
 type PasswordLoginInput = {
   username?: unknown;
   password?: unknown;
+  rememberPassword?: unknown;
 };
 
 type MobileLoginInput = {
@@ -219,6 +224,7 @@ function sendUpstreamFailure(
 async function commitLoginPayload(
   res: ServerResponse,
   payload: unknown,
+  onCommitted?: () => Promise<void>,
 ): Promise<void> {
   if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
     sendJson(res, 502, { success: false, error: '登录服务返回了无效响应，请稍后重试。' });
@@ -228,6 +234,7 @@ async function commitLoginPayload(
     const session = await commitWorksSquareSessionFromTokenPayload(
       payload as WorksSquareTokenPayload,
     );
+    await onCommitted?.();
     sendJson(res, 200, {
       success: true,
       token: withoutRefreshToken(payload),
@@ -246,10 +253,11 @@ async function handlePasswordLogin(
   if (!await ensureRuntimeReadyForLogin(res, ctx)) return;
   const body = readExactJsonObject(
     await parseJsonBody<PasswordLoginInput>(req),
-    ['username', 'password'],
+    ['username', 'password', 'rememberPassword'],
   );
   const username = readRequiredString(body.username, 'username');
   const password = readRequiredString(body.password, 'password');
+  const rememberPassword = readOptionalBoolean(body.rememberPassword, false);
   const result = await fetchWorks('/api/auth/login', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -265,7 +273,17 @@ async function handlePasswordLogin(
     );
     return;
   }
-  await commitLoginPayload(res, result.payload);
+  await commitLoginPayload(res, result.payload, async () => {
+    await updateRememberedPassword(
+      rememberPassword ? { username, password } : null,
+    );
+  });
+}
+
+async function handleRememberedPassword(res: ServerResponse): Promise<void> {
+  const state = await getRememberedPasswordState();
+  res.setHeader('Cache-Control', 'no-store');
+  sendJson(res, 200, { success: true, ...state });
 }
 
 async function handleMobileLogin(
@@ -717,6 +735,11 @@ export async function handleAuthRoutes(
       return true;
     }
 
+    if (url.pathname === '/api/auth/remembered-password' && req.method === 'GET') {
+      await handleRememberedPassword(res);
+      return true;
+    }
+
     if (url.pathname === '/api/auth/mobile-login' && req.method === 'POST') {
       await handleMobileLogin(req, res, ctx);
       return true;

electron/main/index.ts

@@ -85,6 +85,7 @@ import {
   type WorksSquareSessionChangeReason,
 } from '../services/works-square-session';
 import { shouldUseSecureWorksSquareSessionPersistence } from '../services/works-square-session-persistence-policy';
+import { initializeRememberedPassword } from '../services/remembered-password';
 import { clearManagedWorksSquareRuntimeBestEffort } from '../services/works-square-runtime';
 import { getPort } from '../utils/config';
 import { initializeMeowaGameAssetsCredential } from '../api/routes/meowa-game-assets';
@@ -560,6 +561,9 @@ async function initialize(): Promise<void> {
   };
   registerIpcHandlers(undefined, opencodeManager, undefined, window, backgroundLifecycle, hostApiContext);
 
+  void initializeRememberedPassword({
+    secureStorage: useSecureWorksSquareSessionPersistence ? safeStorage : null,
+  });
   hostApiServer = startHostApiServer(hostApiContext);
 
   // Register update handlers

electron/services/remembered-password.ts

@@ -0,0 +1,171 @@
+import { NIANCODE_AUTH_GATEWAY_URL } from '../../shared/auth-public';
+import { logger } from '../utils/logger';
+import type { WorksSquareSecureStorage } from './works-square-session';
+
+const STORE_SCHEMA_VERSION = 1;
+
+export type RememberedPassword = Readonly<{
+  username: string;
+  password: string;
+}>;
+
+export interface RememberedPasswordPersistence {
+  load(): Promise<unknown>;
+  save(credentials: RememberedPassword | null): Promise<void>;
+}
+
+export type RememberedPasswordState = Readonly<{
+  available: boolean;
+  credentials: RememberedPassword | null;
+}>;
+
+let persistence: RememberedPasswordPersistence | null = null;
+let rememberedPassword: RememberedPassword | null = null;
+let initialization: Promise<void> = Promise.resolve();
+
+function normalizeCredentials(value: unknown): RememberedPassword | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const candidate = value as Record<string, unknown>;
+  if (
+    typeof candidate.username !== 'string'
+    || !candidate.username.trim()
+    || typeof candidate.password !== 'string'
+    || !candidate.password
+  ) {
+    return null;
+  }
+  return {
+    username: candidate.username.trim(),
+    password: candidate.password,
+  };
+}
+
+async function createElectronPersistence(
+  safeStorage: WorksSquareSecureStorage,
+): Promise<RememberedPasswordPersistence | null> {
+  const usesUnprotectedLinuxBackend = process.platform === 'linux'
+    && safeStorage.getSelectedStorageBackend() === 'basic_text';
+  if (!safeStorage.isEncryptionAvailable() || usesUnprotectedLinuxBackend) {
+    logger.warn('[remembered-password] OS credential encryption is unavailable; persistence disabled');
+    return null;
+  }
+
+  const { default: Store } = await import('electron-store');
+  type EncryptedPasswordRecord = {
+    version: number;
+    authBase: string;
+    ciphertext: string;
+  };
+  const storeOptions = {
+    name: 'remembered-password',
+    configFileMode: 0o600,
+  } as const;
+  let store: Store<{ record?: EncryptedPasswordRecord }>;
+  try {
+    store = new Store<{ record?: EncryptedPasswordRecord }>(storeOptions);
+  } catch (error) {
+    logger.warn('[remembered-password] Invalid credential store config; discarding it', error);
+    store = new Store<{ record?: EncryptedPasswordRecord }>({
+      ...storeOptions,
+      clearInvalidConfig: true,
+    });
+  }
+
+  return {
+    async load() {
+      const record = store.get('record');
+      if (!record) return null;
+      if (
+        record.version !== STORE_SCHEMA_VERSION
+        || record.authBase !== NIANCODE_AUTH_GATEWAY_URL
+      ) {
+        store.delete('record');
+        return null;
+      }
+      return JSON.parse(
+        safeStorage.decryptString(Buffer.from(record.ciphertext, 'base64')),
+      ) as unknown;
+    },
+    async save(credentials) {
+      if (!credentials) {
+        store.delete('record');
+        return;
+      }
+      const ciphertext = safeStorage.encryptString(JSON.stringify(credentials));
+      store.set('record', {
+        version: STORE_SCHEMA_VERSION,
+        authBase: NIANCODE_AUTH_GATEWAY_URL,
+        ciphertext: ciphertext.toString('base64'),
+      });
+    },
+  };
+}
+
+export function initializeRememberedPassword(
+  options: {
+    persistence?: RememberedPasswordPersistence;
+    secureStorage?: WorksSquareSecureStorage | null;
+  } = {},
+): Promise<void> {
+  initialization = (async () => {
+    rememberedPassword = null;
+    try {
+      persistence = options.persistence
+        ?? (options.secureStorage ? await createElectronPersistence(options.secureStorage) : null);
+    } catch (error) {
+      logger.warn('[remembered-password] Failed to initialize secure credential persistence', error);
+      persistence = null;
+      return;
+    }
+    if (!persistence) return;
+
+    try {
+      const loaded = await persistence.load();
+      const normalized = normalizeCredentials(loaded);
+      if (loaded && !normalized) {
+        await persistence.save(null);
+      }
+      rememberedPassword = normalized;
+    } catch (error) {
+      logger.warn('[remembered-password] Failed to restore credentials; discarding the record', error);
+      try {
+        await persistence.save(null);
+      } catch (clearError) {
+        logger.warn('[remembered-password] Failed to discard unreadable credentials', clearError);
+        persistence = null;
+      }
+    }
+  })();
+  return initialization;
+}
+
+export async function getRememberedPasswordState(): Promise<RememberedPasswordState> {
+  await initialization;
+  return {
+    available: persistence !== null,
+    credentials: rememberedPassword ? { ...rememberedPassword } : null,
+  };
+}
+
+export async function updateRememberedPassword(
+  credentials: RememberedPassword | null,
+): Promise<boolean> {
+  await initialization;
+  if (!persistence) return false;
+  const normalized = credentials ? normalizeCredentials(credentials) : null;
+  if (credentials && !normalized) return false;
+  try {
+    await persistence.save(normalized);
+    rememberedPassword = normalized;
+    return true;
+  } catch (error) {
+    logger.warn('[remembered-password] Failed to update secure credentials', error);
+    return false;
+  }
+}
+
+export function resetRememberedPasswordForTests(): void {
+  persistence = null;
+  rememberedPassword = null;
+  initialization = Promise.resolve();
+}