# Task: Route Makelore auth lifecycle through Works Square

## Identity

- Task ID: 20260819-square-auth-proxy-client-8c4f2a
- Mode: Feature
- Branch: codex/20260819-square-auth-proxy-client-8c4f2a-square-auth-proxy-client
- Worktree: D:\Datas\OthersProjects\makelore-square-auth-proxy-8c4f2a
- Base commit: 1907924203a1a998182c8e44e8884682ef216d95
- Owner: codex-root
- Status: Ready for Integration

## Scope

- Route Works Square access-token refresh through `POST /api/auth/refresh` instead of calling the one-feel OAuth endpoint from Electron Main.
- Route remote logout through `POST /api/auth/logout` on Works Square while preserving Main-owned session cleanup behavior.
- Update focused session and auth-route regression tests, including rotated refresh-token persistence.

## Intent And Constraints

- Login, refresh, and logout must share the Works Square authentication boundary.
- Do not embed the deployed `custom` OAuth client secret in Makelore.
- Preserve Main ownership of tokens, the seven-day inactivity policy, refresh single-flight behavior, fail-closed persistence semantics, and local runtime cleanup.
- Do not change unrelated browser/OAuth-provider integrations.

## Outcome

- Electron Main now refreshes managed Works Square sessions with `POST https://square.nianxx.cn/api/auth/refresh` and a JSON refresh-token payload. It no longer sends an OAuth Basic credential or calls the one-feel token endpoint directly.
- Main-owned logout now calls `POST https://square.nianxx.cn/api/auth/logout` with the current Main access token, while retaining the existing local session, secure persistence, event-session, provider-key, and runtime cleanup behavior.
- Removed the now-unused Electron auth configuration module that embedded the legacy `app` client secret and password encryption key.
- Preserved refresh-token rotation, single-flight behavior, terminal 400/401 clearing, transient-error retention, and persistence-before-return semantics.

## Verification

- Red phase: focused tests failed in five expected places because refresh and logout still targeted `biz.nianxx.cn` with the legacy method/credential contract.
- `pnpm exec vitest run tests/unit/works-square-session.test.ts tests/unit/auth-routes.test.ts`: 56 passed.
- Focused session/auth compatibility suite: 86 passed across five test files.
- Full `pnpm exec vitest run`: 184 test files and 2190 tests passed.
- `pnpm run typecheck`: passed.
- `pnpm run lint:check`: passed with 0 errors and 7 pre-existing React warnings in unrelated files.
- `pnpm run build:vite`: passed for Renderer, Electron Main, preload, and utility worker.
- Full `pnpm run build` stopped before compilation because the required Learning Player artifact/source was not supplied; the subsequent direct Vite production build passed.
- `git diff --check`: passed. Source scan found no direct one-feel refresh/logout URL, Basic auth header, embedded client secret, or deleted auth-config import under `electron/`.

## Follow-ups

- Deploy the Works Square refresh/logout endpoints before distributing a Makelore build containing this client change.
- Supply the separately managed Learning Player artifact when producing the final packaged installer.

## Promotion Candidates

- Target canonical document: `.project-docs/20-architecture/data-flow.md` and the authentication decision index.
  Proposal: record Works Square as the required boundary for the complete desktop authentication lifecycle (login, refresh, and logout), with confidential OAuth clients owned only by Works Square.
  Evidence: focused request-contract tests, full 2190-test client suite, typecheck, lint, and production Vite build.
  Future impact: new desktop authentication operations must be added to Square rather than embedding service credentials or direct one-feel calls in Makelore.
  Semantic conflicts: none; this completes the proxy work explicitly deferred by the integrated native-login task.
  Human confirmation required: no; the user explicitly selected the unified Square boundary.