J3vb/OwnCord
1
0
Fork 0
mirror of https://github.com/J3vb/OwnCord.git synced 2026-09-03 03:50:00 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix: gate credential persistence on rememberPassword checkbox (BUG-135)

Browse Source 
wirePostAuth always called saveCredential regardless of the "Remember
password" checkbox state, leaving the session token in Windows
Credential Manager even when the user opted out. Added rememberPassword
parameter to wirePostAuth and skip saveCredential when false.
This commit is contained in:
J3vb
2026-04-02 13:01:10 +02:00
parent 5dc6fe61b1
commit 9d9f635c2d
1 changed files with 29 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Client/tauri-client/src/main.ts
+29 -15
View File
@@ -216,7 +216,13 @@ function renderPage(pageId: "connect" | "main"): void {
appEl!.textContent = "";
// Shared helper for post-auth WS connect + overlay flow
function wirePostAuth(host: string, token: string, username: string, password?: string): void {
function wirePostAuth(
host: string,
token: string,
username: string,
password?: string,
rememberPassword = true,
): void {
log.info("Post-auth wiring", { host, username });
api.setConfig({ token });
// Store token in authStore so the dispatcher's auth_ok handler has it
@@ -227,17 +233,19 @@ function renderPage(pageId: "connect" | "main"): void {
dispatcherCleanup = wireDispatcher(ws);
log.info("Dispatcher wired, connecting WS");
// Save credential for auto-reconnect. Warn user if it fails.
saveCredential(host, username, token, password)
.then((ok) => {
if (!ok) {
log.warn("Credential save failed — auto-login will not work for this server");
setTransientError("Could not save credentials — auto-login won't work");
}
})
.catch(() => {
// saveCredential already catches internally; this is defence-in-depth
});
// BUG-135: Only persist credentials when the user opted in.
if (rememberPassword) {
saveCredential(host, username, token, password)
.then((ok) => {
if (!ok) {
log.warn("Credential save failed — auto-login will not work for this server");
setTransientError("Could not save credentials — auto-login won't work");
}
})
.catch(() => {
// saveCredential already catches internally; this is defence-in-depth
});
}
const unsubState = ws.onStateChange((wsState) => {
log.debug("WS state change", { state: wsState });
@@ -321,7 +329,7 @@ function renderPage(pageId: "connect" | "main"): void {
const remember = connectPage.getRememberPassword();
const savedPassword = remember ? password : undefined;
ensureProfileExists(host, username, remember);
wirePostAuth(host, result.token, username, savedPassword);
wirePostAuth(host, result.token, username, savedPassword, remember);
}
},
async onRegister(host, username, password, inviteCode) {
@@ -330,7 +338,7 @@ function renderPage(pageId: "connect" | "main"): void {
const remember = connectPage.getRememberPassword();
const savedPassword = remember ? password : undefined;
ensureProfileExists(host, username, remember);
wirePostAuth(host, result.token, username, savedPassword);
wirePostAuth(host, result.token, username, savedPassword, remember);
},
async onTotpSubmit(code) {
if (!pendingTotpPartialToken) {
@@ -343,7 +351,13 @@ function renderPage(pageId: "connect" | "main"): void {
const remember = connectPage.getRememberPassword();
const savedPassword = remember ? connectPage.getPassword() : undefined;
ensureProfileExists(pendingTotpHost, pendingTotpUsername, remember);
wirePostAuth(pendingTotpHost, result.token, pendingTotpUsername, savedPassword);
wirePostAuth(
pendingTotpHost,
result.token,
pendingTotpUsername,
savedPassword,
remember,
);
}
} finally {
// Clear sensitive partial token immediately after use (success or failure)