docs(integration): record remember password boundary
This commit is contained in:
@@ -12,18 +12,23 @@ The desktop client obtained tokens from Works Square but refreshed them directly
|
||||
|
||||
- Renderer sends authentication operations only to Electron Main.
|
||||
- Electron Main owns access/refresh tokens, encrypted persistence, refresh rotation, terminal failure cleanup, and the seven-day inactivity policy.
|
||||
- Optional remembered username/password data is a separate Electron Main record. Packaged builds encrypt it with OS-protected storage; it is never Renderer-persisted or stored by Works Square.
|
||||
- Desktop login, mobile login, refresh, and logout use fixed Works Square `/api/auth/*` endpoints.
|
||||
- Works Square owns the confidential upstream OAuth client configuration and proxies the lifecycle to the identity service.
|
||||
- The desktop bundle must not contain an OAuth client secret or call the custom identity service directly.
|
||||
- Logout and mobile login preserve remembered-password data. A successful password login with the option cleared removes the previous record; unavailable secure storage disables the option.
|
||||
|
||||
## Consequences
|
||||
|
||||
- The matching Works Square server endpoints must be deployed before this client is released.
|
||||
- OAuth credential rotation or upstream endpoint changes are server-side configuration changes rather than desktop releases.
|
||||
- A terminal refresh `400` or `401` still fails closed and clears the local session; transient failures preserve the established retry behavior.
|
||||
- Remembered-password persistence is convenience behavior rather than session authority. Its failure must not grant authentication or move password persistence to Works Square/Renderer.
|
||||
- Packaged Windows and signed macOS still require a smoke covering save, restart restore, unchecked-login clear, and the absence of a development Keychain prompt.
|
||||
|
||||
## Evidence
|
||||
|
||||
- Source commit: `dc776ff`
|
||||
- Integration merge: `f52c2c8`
|
||||
- Feature verification: 2,190 client tests passed, typecheck passed, Vite build passed, and lint reported no errors.
|
||||
- Remember-password source/integration: `990639f` / `2b9f84e`; 79 focused tests, typecheck, scoped lint, and Renderer/Main/Preload/utility build passed.
|
||||
|
||||
@@ -12,7 +12,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
| Host API | 校验本地项目请求并投影安全响应 | 发布 mutation 还必须通过 Renderer capability；Host token/base 不能单独触发发布 |
|
||||
| Project Configuration & Template | 保存不可变 `ProjectType`，原子生成新项目骨架 | 小游戏/小程序生成受控 Vite 模板；自定义保持最小项目空间 |
|
||||
| Project Release Builder | Main-owned 安全快照、本地 npm/Vite 构建、双归档与 artifact contract | 固定 npm 11.6.2；Vite 由项目 lockfile 锁定；产物与预检使用同一内存字节 |
|
||||
| Works Session | Main-owned 登录、刷新、注销与七天真实活动滑动续期 | 登录、刷新、注销统一经过 Works Square；轮换凭据由 Main 安全持有和持久化，客户端不携带 OAuth client secret |
|
||||
| Works Session & Remembered Password | Main-owned 登录、刷新、注销、七天真实活动滑动续期与可选密码回填 | 登录、刷新、注销统一经过 Works Square；轮换凭据由 Main 安全持有和持久化。记住密码使用独立的 packaged-only OS 加密记录，不进入 Renderer 持久状态或 Works Square；客户端不携带 OAuth client secret |
|
||||
| Module Access Policy | Main-owned `/api/auth/me` projection → Renderer auth state → module chooser/router | Renderer 只接收 Code/Canvas/Learning/Robot 四个布尔值；缺失对象或字段默认开启，服务端 `design` 映射客户端 `painting` |
|
||||
| Submission Binding | 保存云端已接受的精确 app/version/review/hash 绑定 | schema v2 只记录成功提交；旧中间态迁移为 `legacy_retired`，不恢复后台任务 |
|
||||
| Play URL Projection | 校验服务端公共播放地址 | 只接受同源 HTTPS 和精确 `/apps/{app_id}/`；优先 `play_url`，`runtime_url` 仅一版本回退 |
|
||||
@@ -35,6 +35,7 @@ Makelore 是 Electron 桌面客户端。Renderer 负责项目操作与状态展
|
||||
## Important Boundaries
|
||||
|
||||
- Renderer 只能通过 Main Host API 发起认证操作。Electron Main 是 access/refresh token 的唯一客户端所有者；登录、刷新、注销统一经过 Works Square 固定路由，客户端不得直连 one-feel/custom 身份服务，也不得保存 confidential OAuth client secret。
|
||||
- 可选的记住密码记录属于 Electron Main 的独立本机边界，只能在正式安装包且 OS 凭据加密可用时落盘；Renderer 不得持久化账号密码，Works Square 不得接收记住标志或新增密码持久化。
|
||||
- Code、Canvas、Learning 与 Robot 是四个已启用顶层产品模块；Robot 仍是唯一硬件产品模块，不存在单独 Hardware 卡片。
|
||||
- 每个登录用户可由 Works `module_access` 关闭任意顶层模块入口。Main 只投影四个布尔值；被关闭卡片置灰不可点，根/深层/别名路由在 `MainLayout` 和模块初始化前拦截。Code provider 必须等待 auth policy hydration，而全局 `/settings` 不属于 Code policy guard。
|
||||
- 模块入口策略是用户交互与客户端初始化边界，不是服务端 API 授权。终止性 `/api/auth/me` `401` 必须清理 Main 和 Renderer 会话；各模块 API 仍须独立强制认证与授权。
|
||||
|
||||
@@ -4,6 +4,15 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
|
||||
|
||||
## Integrated Through
|
||||
|
||||
- Remember-password source commit `990639f` from feature task
|
||||
`20260820-makelore-remember-password-b63e1c` was merged into local `main` as
|
||||
`2b9f84e` by integration task `20260820-integrate-remember-password-5d7e3a1c`.
|
||||
Password login now offers an optional Main-owned remembered credential: packaged
|
||||
builds encrypt the username and password through OS-protected storage, Renderer
|
||||
persistence and Works Square never receive that record, and unavailable secure
|
||||
storage disables the option. Logout and SMS login preserve it; a successful
|
||||
unchecked password login clears it. Packaged Windows and signed macOS smoke remain
|
||||
pending.
|
||||
- OpenCode Session model and partner hot-add source commit `c0163bc` from feature task
|
||||
`20260820-session-model-agent-hotfix-6e4c9a2f` is integrated on local `main` by task
|
||||
`20260820-integrate-session-model-hotfix-7b3e91c4`. Page selection and `/models` /
|
||||
@@ -101,6 +110,8 @@ AI 绘画的一个 Workspace 可包含多条 Conversation。消息、Brief、Quo
|
||||
|
||||
Canvas 侧栏提供“获取灵感”进入 Prompt Museum。列表、筛选、分页、详情、作者/来源/许可证和图片地址全部由服务端经 Main-owned Host API 提供，客户端不打包静态数据集；服务端相对媒体只允许固定 `/api/image-prompt-museum/{entry}/media/{thumbnail|number}` 形状，并由 Main 注入 Works Bearer、执行一次 401 刷新、可信 raster MIME 与 10 MiB 上限后转为 Renderer data URL；credential-free HTTPS CDN 图片保持直连。图片失败只显示卡片内占位，不阻断卡片或详情；缺少来源 URL 时显示纯文本。“使用此 Prompt”只把原文带回当前 Canvas 输入框，不自动发送。该模块不是投稿、点赞、评论或排行榜社区。客户端契约已就绪，但不据此宣称 Works Square 内容后台和生产数据已经部署。`pnpm run dev` 现在默认使用云端 Canvas 适配器，本地适配器只能通过显式开发命令启用；产品 UI 只保留中文。
|
||||
|
||||
密码登录提供可选“记住密码”。该记录与七天登录会话分离，只在正式安装包且系统安全存储可用时由 Electron Main 加密落盘；Renderer 仅在登录页内存中接收回填，不写 Zustand/localStorage，Works Square 也不持久化桌面密码。退出登录和短信登录不删除记录，成功的未勾选密码登录会清除旧记录。未打包开发版禁用该选项，避免未签名 Electron 调试进程触发 macOS 钥匙串。
|
||||
|
||||
Makelore 在会话恢复、登录和刷新后由 Electron Main 请求 Works `/api/auth/me`，Renderer 只获得 Code、Canvas、Learning、Robot 四个布尔权限。缺失 `module_access` 或任一字段时默认开启；服务端 `design` 显式映射客户端 `painting`。被关闭的模块卡片置灰且不可点击，根路由、深层路由和别名路由均在 `MainLayout` 或模块初始化前阻断。Code provider 等待认证权限加载完成；权限查询返回终止性 `401` 时同时清理 Main 和 Renderer 会话。`/settings` 是全局设置，不受 Code 入口策略阻断。该机制只是客户端入口策略，不代替服务端 API 授权。
|
||||
|
||||
AI 学习现在是已启用的运营精选项目目录，并继续受登录和 `module_access.learning` 控制。Renderer 通过 Main-owned Host API 获取分页项目卡片和 README 详情；Markdown 支持 GFM、禁用原始 HTML。服务端发布时只校验图片 URL 为无凭据、默认端口、无 fragment 且当前 DNS 结果全部为公网地址的 HTTPS URL，保留地址而不下载、识别格式、转码或镜像；客户端仅为 README 图片节点启用直连，因此 SVG 和 Electron 支持的其他格式可直接显示，单图失败不阻断详情。封面和历史发布媒体继续走受控路径。详情页的下载按钮打开系统保存对话框；Main 将 ZIP 流式写入临时文件，只允许最多五跳同 Works origin 重定向，不校验 `Content-Length`、`archiveBytes`、实际流字节数或客户端大小上限，校验 SHA-256 和 ZIP 签名后原子保存，Renderer 只接收 `saved` 或 `cancelled`。课程生成、进度、本地课程库、OpenMAIC player、Agent、ASR、课堂 runtime、Learning IPC 和 player artifact 打包已删除且没有兼容读取路径；历史课程数据保留但不再读取。服务端和客户端源码契约已完成，不代表生产部署或真实账号安装包联调已经完成。
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
# Task: Integrate remember password into main
|
||||
|
||||
## Identity
|
||||
|
||||
- Task ID: 20260820-integrate-remember-password-5d7e3a1c
|
||||
- Mode: Integration
|
||||
- Branch: main
|
||||
- Worktree: D:\Datas\OthersProjects\makelore
|
||||
- Base commit: 460268586bddbbf75a557012ec872851fca555a5
|
||||
- Owner: codex
|
||||
- Status: Blocked
|
||||
|
||||
## Scope
|
||||
|
||||
- Integrate verified remember-password source commit `990639f` into local `main`.
|
||||
- Reconcile the source task's accepted authentication promotion candidates into canonical current-state, architecture, ADR, and domain documents.
|
||||
- Preserve the pre-existing untracked packaging task record without modifying or committing it.
|
||||
|
||||
## Intent And Constraints
|
||||
|
||||
- Keep remembered credentials separate from the existing seven-day Works Square session.
|
||||
- Keep password persistence Main-owned and OS-encrypted in packaged builds; do not persist passwords in Renderer or Works Square.
|
||||
- Preserve logout/SMS retention and successful unchecked-password-login clearing semantics.
|
||||
- Merge only to local `main`; do not push.
|
||||
|
||||
## Outcome
|
||||
|
||||
- Source feature commit `990639f` was created from the completed isolated feature worktree.
|
||||
- Merged the source branch into local `main` as merge commit `2b9f84e` without conflicts; README auto-merged with the already integrated Session-model documentation.
|
||||
- Promoted the accepted remembered-password boundary into `current-state.md`, `system-overview.md`, ADR-004, and `business-rules.md`.
|
||||
- Preserved `.project-docs/30-worklog/tasks/20260819-package-learning-off-115-9c4d.md` untouched and untracked.
|
||||
|
||||
## Verification
|
||||
|
||||
- Source verification: 79 focused tests, typecheck, scoped ESLint, and Vite Renderer/Main/Preload/utility build passed.
|
||||
- Integrated local `main`: 4 focused test files / 79 tests passed.
|
||||
- Integrated local `main`: `pnpm run typecheck` passed.
|
||||
- Integrated local `main`: scoped ESLint passed with zero errors.
|
||||
- Integrated local `main`: Renderer/Main/Preload/utility `pnpm run build:vite` passed with existing dynamic-import and large-chunk advisory warnings only.
|
||||
- `git diff --check` passed with line-ending conversion notices only.
|
||||
- Required project-docs structure check passed.
|
||||
- Task-aware documentation drift is blocked by two read-only foreign task records: the pre-existing, explicitly preserved untracked `.project-docs/30-worklog/tasks/20260819-package-learning-off-115-9c4d.md`, and the source task record `.project-docs/30-worklog/tasks/20260820-makelore-remember-password-b63e1c.md` introduced unchanged by merge commit `2b9f84e`. The integration did not modify either record. The checker also lists the expected merged source files as non-document changes.
|
||||
|
||||
## Follow-ups
|
||||
|
||||
- Run packaged Windows and signed macOS smoke for OS-protected save, restart prefill, successful unchecked-login clear, and no development Keychain prompt.
|
||||
- Resolve the repository's integration drift-check handling for unchanged source task records and decide the separately owned untracked packaging record before this integration ownership can be completed and released cleanly.
|
||||
|
||||
## Promotion Candidates
|
||||
|
||||
- Applied all accepted source candidates; none remain pending.
|
||||
@@ -20,6 +20,7 @@
|
||||
- 已发布作品优先读取 `play_url`，只有字段缺失时才使用一个客户端版本的 `runtime_url` 回退。公共播放 URL 必须是 Works Square 同源 HTTPS、无 userinfo/loopback、精确 `/apps/{encodeURIComponent(app_id)}/`、无 query/fragment，且上游明确 `playable === true` 并提供非空版本名；否则按不可播放处理。
|
||||
- `works-cloud-deploy.json` 仅是已安装客户端的数据兼容文件名，不表示客户端仍提供 cloud deployment coordinator。
|
||||
- Works Square 会话按真实键盘、鼠标或触摸活动滑动续期，连续 7 天未使用才要求重新授权。
|
||||
- “记住密码”是独立于七天会话的可选桌面凭据记录：只能由 Electron Main 在正式安装包中通过可用的系统安全存储加密落盘，账号密码不得进入 Renderer 持久状态、日志或 Works Square 持久化。退出登录和短信登录保留记录；只有成功的未勾选密码登录清除旧记录。系统安全存储不可用或未打包开发版必须禁用该选项。
|
||||
- 运营端可按用户关闭 Code、Canvas、Learning 或 Robot 客户端入口，默认全开。Makelore 通过 Main-owned `/api/auth/me` 只消费四布尔安全投影；缺失 `module_access` 或字段按开启处理，服务端 `design` 对应现有客户端 `painting`。
|
||||
- 关闭的模块卡片必须置灰且无法点击；其根路由、深层路由和别名路由必须在 `MainLayout` 或模块初始化前阻断。Code provider 只能在 auth policy hydration 完成且 Code 已开启时初始化；`/settings` 是全局设置，不得随 Code 关闭而失去访问。
|
||||
- 模块置灰/路由阻断不是 API 授权边界。每个 Works/模块服务端 API 仍必须独立执行身份与权限检查；`/api/auth/me` 返回终止性 `401` 时必须清理 Main 和 Renderer 会话，不得以默认全开继续。
|
||||
|
||||
Reference in New Issue
Block a user