重要安全更新

src/pages/SettingsPage.tsx

@@ -146,6 +146,11 @@ function SettingsPage() {
   const [helloAvailable, setHelloAvailable] = useState(false)
   const [newPassword, setNewPassword] = useState('')
   const [confirmPassword, setConfirmPassword] = useState('')
+  const [oldPassword, setOldPassword] = useState('')
+  const [helloPassword, setHelloPassword] = useState('')
+  const [disableLockPassword, setDisableLockPassword] = useState('')
+  const [showDisableLockInput, setShowDisableLockInput] = useState(false)
+  const [isLockMode, setIsLockMode] = useState(false)
   const [isSettingHello, setIsSettingHello] = useState(false)
 
   // HTTP API 设置 state
@@ -184,14 +189,6 @@ function SettingsPage() {
     checkApiStatus()
   }, [])
 
-  async function sha256(message: string) {
-    const msgBuffer = new TextEncoder().encode(message)
-    const hashBuffer = await crypto.subtle.digest('SHA-256', msgBuffer)
-    const hashArray = Array.from(new Uint8Array(hashBuffer))
-    const hashHex = hashArray.map(b => b.toString(16).padStart(2, '0')).join('')
-    return hashHex
-  }
-
   useEffect(() => {
     loadConfig()
     loadAppVersion()
@@ -281,8 +278,10 @@ function SettingsPage() {
 
       const savedAuthEnabled = await window.electronAPI.auth.verifyEnabled()
       const savedAuthUseHello = await configService.getAuthUseHello()
+      const savedIsLockMode = await window.electronAPI.auth.isLockMode()
       setAuthEnabled(savedAuthEnabled)
       setAuthUseHello(savedAuthUseHello)
+      setIsLockMode(savedIsLockMode)
 
       if (savedPath) setDbPath(savedPath)
       if (savedWxid) setWxid(savedWxid)
@@ -1931,6 +1930,10 @@ function SettingsPage() {
   )
 
   const handleSetupHello = async () => {
+    if (!helloPassword) {
+      showMessage('请输入当前密码以开启 Hello', false)
+      return
+    }
     setIsSettingHello(true)
     try {
       const challenge = new Uint8Array(32)
@@ -1948,8 +1951,10 @@ function SettingsPage() {
       })
 
       if (credential) {
+        // 存储密码作为 Hello Secret，以便 Hello 解锁时能派生密钥
+        await window.electronAPI.auth.setHelloSecret(helloPassword)
         setAuthUseHello(true)
-        await configService.setAuthUseHello(true)
+        setHelloPassword('')
         showMessage('Windows Hello 设置成功', true)
       }
     } catch (e: any) {
@@ -1967,18 +1972,40 @@ function SettingsPage() {
       return
     }
 
-    // 简单的保存逻辑，实际上应该先验证旧密码，但为了简化流程，这里直接允许覆盖
-    // 因为能进入设置页面说明已经解锁了
     try {
-      const hash = await sha256(newPassword)
-      await configService.setAuthPassword(hash)
-      await configService.setAuthEnabled(true)
-      setAuthEnabled(true)
-      setNewPassword('')
-      setConfirmPassword('')
-      showMessage('密码已更新', true)
+      const lockMode = await window.electronAPI.auth.isLockMode()
+
+      if (authEnabled && lockMode) {
+        // 已开启应用锁且已是 lock: 模式 → 修改密码
+        if (!oldPassword) {
+          showMessage('请输入旧密码', false)
+          return
+        }
+        const result = await window.electronAPI.auth.changePassword(oldPassword, newPassword)
+        if (result.success) {
+          setNewPassword('')
+          setConfirmPassword('')
+          setOldPassword('')
+          showMessage('密码已更新', true)
+        } else {
+          showMessage(result.error || '密码更新失败', false)
+        }
+      } else {
+        // 未开启应用锁，或旧版 safe: 模式 → 开启/升级为 lock: 模式
+        const result = await window.electronAPI.auth.enableLock(newPassword)
+        if (result.success) {
+          setAuthEnabled(true)
+          setIsLockMode(true)
+          setNewPassword('')
+          setConfirmPassword('')
+          setOldPassword('')
+          showMessage('应用锁已开启', true)
+        } else {
+          showMessage(result.error || '开启失败', false)
+        }
+      }
     } catch (e: any) {
-      showMessage('密码更新失败', false)
+      showMessage('操作失败', false)
     }
   }
 
@@ -2037,39 +2064,73 @@ function SettingsPage() {
       <div className="form-group">
         <div style={{ display: 'flex', justifyContent: 'space-between', alignItems: 'center' }}>
           <div>
-            <label>启用应用锁</label>
-            <span className="form-hint">每次启动应用时需要验证密码</span>
+            <label>应用锁状态</label>
+            <span className="form-hint">{
+              isLockMode ? '已开启' :
+              authEnabled ? '旧版模式 — 请重新设置密码以升级为新模式提高安全性' :
+              '未开启 — 请设置密码以开启'
+            }</span>
           </div>
-          <label className="switch">
-            <input
-              type="checkbox"
-              checked={authEnabled}
-              onChange={async (e) => {
-                const enabled = e.target.checked
-                if (enabled) {
-                  // 检查是否已设置密码，未设置则阻止开启
-                  const storedHash = await configService.getAuthPassword()
-                  if (!storedHash) {
-                    showMessage('请先设置密码再启用应用锁', false)
-                    return
-                  }
-                }
-                setAuthEnabled(enabled)
-                await configService.setAuthEnabled(enabled)
-              }}
-            />
-            <span className="switch-slider" />
-          </label>
+          {authEnabled && !showDisableLockInput && (
+            <button
+              className="btn btn-secondary btn-sm"
+              onClick={() => setShowDisableLockInput(true)}
+            >
+              关闭应用锁
+            </button>
+          )}
         </div>
+        {showDisableLockInput && (
+          <div style={{ marginTop: 10, display: 'flex', gap: 10 }}>
+            <input
+              type="password"
+              className="field-input"
+              placeholder="输入当前密码以关闭"
+              value={disableLockPassword}
+              onChange={e => setDisableLockPassword(e.target.value)}
+              style={{ flex: 1 }}
+            />
+            <button
+              className="btn btn-primary btn-sm"
+              disabled={!disableLockPassword}
+              onClick={async () => {
+                const result = await window.electronAPI.auth.disableLock(disableLockPassword)
+                if (result.success) {
+                  setAuthEnabled(false)
+                  setAuthUseHello(false)
+                  setIsLockMode(false)
+                  setShowDisableLockInput(false)
+                  setDisableLockPassword('')
+                  showMessage('应用锁已关闭', true)
+                } else {
+                  showMessage(result.error || '关闭失败', false)
+                }
+              }}
+            >确认</button>
+            <button
+              className="btn btn-secondary btn-sm"
+              onClick={() => { setShowDisableLockInput(false); setDisableLockPassword('') }}
+            >取消</button>
+          </div>
+        )}
       </div>
 
       <div className="divider" />
 
       <div className="form-group">
-        <label>重置密码</label>
-        <span className="form-hint">设置新的启动密码</span>
+        <label>{isLockMode ? '修改密码' : '设置密码并开启应用锁'}</label>
+        <span className="form-hint">{isLockMode ? '修改应用锁密码（需要旧密码验证）' : '设置密码后将自动开启应用锁'}</span>
 
         <div style={{ marginTop: 10, display: 'flex', flexDirection: 'column', gap: 10 }}>
+          {isLockMode && (
+            <input
+              type="password"
+              className="field-input"
+              placeholder="旧密码"
+              value={oldPassword}
+              onChange={e => setOldPassword(e.target.value)}
+            />
+          )}
           <input
             type="password"
             className="field-input"
@@ -2086,7 +2147,9 @@ function SettingsPage() {
               onChange={e => setConfirmPassword(e.target.value)}
               style={{ flex: 1 }}
             />
-            <button className="btn btn-primary" onClick={handleUpdatePassword} disabled={!newPassword}>更新</button>
+            <button className="btn btn-primary" onClick={handleUpdatePassword} disabled={!newPassword}>
+              {isLockMode ? '更新' : '开启'}
+            </button>
           </div>
         </div>
       </div>
@@ -2098,23 +2161,39 @@ function SettingsPage() {
           <div>
             <label>Windows Hello</label>
             <span className="form-hint">使用面容、指纹快速解锁</span>
-            {!helloAvailable && <div className="form-hint warning" style={{ color: '#ff4d4f' }}> 当前设备不支持 Windows Hello</div>}
+            {!authEnabled && <div className="form-hint warning" style={{ color: '#ff4d4f' }}>请先开启应用锁</div>}
+            {!helloAvailable && authEnabled && <div className="form-hint warning" style={{ color: '#ff4d4f' }}>当前设备不支持 Windows Hello</div>}
           </div>
 
           <div>
             {authUseHello ? (
-              <button className="btn btn-secondary btn-sm" onClick={() => setAuthUseHello(false)}>关闭</button>
+              <button className="btn btn-secondary btn-sm" onClick={async () => {
+                await window.electronAPI.auth.clearHelloSecret()
+                setAuthUseHello(false)
+                showMessage('Windows Hello 已关闭', true)
+              }}>关闭</button>
             ) : (
               <button
                 className="btn btn-secondary btn-sm"
                 onClick={handleSetupHello}
-                disabled={!helloAvailable || isSettingHello}
+                disabled={!helloAvailable || isSettingHello || !authEnabled || !helloPassword}
               >
                 {isSettingHello ? '设置中...' : '开启与设置'}
               </button>
             )}
           </div>
         </div>
+        {!authUseHello && authEnabled && (
+          <div style={{ marginTop: 10 }}>
+            <input
+              type="password"
+              className="field-input"
+              placeholder="输入当前密码以开启 Hello"
+              value={helloPassword}
+              onChange={e => setHelloPassword(e.target.value)}
+            />
+          </div>
+        )}
       </div>
     </div>
   )