feat: Phase 1 WinAuth Go 移植完整实现

将原 C#/.NET WinAuth 移植为 Go + Gio GUI，覆盖 Phase 1 全部功能。核心模块： - internal/authenticator: TOTP (Google/Microsoft/Okta) + HOTP + BattleNet + Steam，含 enroll/sync/code 生成、Steam 交易确认轮询 - internal/config: YAML 配置 + 老版 WinAuth XML 导入（DPAPI + Password + Blowfish/PBKDF2 解密链） - internal/crypto: 现代加密 (WAGO1) + DPAPI 跨平台封装 + 老版 Blowfish ECB - internal/win32: 单实例 Mutex 锁 + 全局热键管理器 (RegisterHotKey + PeekMessage 泵) + SendInput Unicode 注入 + 剪贴板文本/CF_DIB 图像读写 + AttachThreadInput 焦点切换 - internal/hotkey: "Ctrl+Alt+G" 风格快捷键字符串解析/格式化 - internal/qr: gozxing 二维码解码 + otpauth:// URI 解析 - internal/i18n: en/zh-CN/de 三语 TOML UI 模块 (Gio)： - 主窗口：圆环倒计时进度条、复制按钮 + Toast 反馈、空列表占位、行分隔线 - 添加流程：vendor 菜单 + 各 vendor 独立对话框 + 二维码扫描入口（文件 / 剪贴板） - 设置：密码加密、老版 XML 导入、每条目热键配置 - Steam：注册向导（含 captcha/email/SMS 多步）+ 交易确认窗构建：Windows 主目标，非 Windows 平台所有 Win32 功能走 build-tag 桩实现。
2026-06-12 03:10:37 +08:00
commit c671f2115e
165 changed files with 10102 additions and 0 deletions
@@ -0,0 +1,154 @@
+package config
+
+import (
+	"encoding/hex"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.wxccs.org/iceking2nd/winauth-go/internal/crypto"
+)
+
+// TestParseLegacyEncryptionFlags covers the encrypted-attribute parsing
+// for the three letters WinAuth actually wrote, in every legal order
+// plus the empty / unknown-letter cases.
+func TestParseLegacyEncryptionFlags(t *testing.T) {
+	cases := map[string]LegacyPasswordType{
+		"":     LegacyPasswordNone,
+		"y":    LegacyPasswordExplicit,
+		"u":    LegacyPasswordUser,
+		"m":    LegacyPasswordMachine,
+		"yum":  LegacyPasswordExplicit | LegacyPasswordUser | LegacyPasswordMachine,
+		"YMU":  LegacyPasswordExplicit | LegacyPasswordUser | LegacyPasswordMachine,
+		" yu ": LegacyPasswordExplicit | LegacyPasswordUser,
+		"abc":  LegacyPasswordNone,
+	}
+	for in, want := range cases {
+		if got := parseLegacyEncryptionFlags(in); got != want {
+			t.Errorf("parseLegacyEncryptionFlags(%q) = %v, want %v", in, got, want)
+		}
+	}
+}
+
+// TestDecryptLegacyExplicitRoundTrip encrypts a known plaintext using
+// the helpers and round-trips it through decryptLegacySecretData to
+// catch any salt-layout / PBKDF2 / Blowfish drift.
+func TestDecryptLegacyExplicitRoundTrip(t *testing.T) {
+	plaintext := "ABCDEF1234\t6\tSHA1\t30"
+	password := []byte("hunter2")
+	salt := []byte{1, 2, 3, 4, 5, 6, 7, 8}
+
+	key := crypto.DerivePBKDF2SHA1(password, salt)
+	body, err := crypto.LegacyEncryptBlowfish([]byte(plaintext), key)
+	if err != nil {
+		t.Fatalf("encrypt: %v", err)
+	}
+	payload := hex.EncodeToString(salt) + body
+
+	got, err := decryptLegacySecretData(payload, LegacyPasswordExplicit, password)
+	if err != nil {
+		t.Fatalf("decrypt: %v", err)
+	}
+	if got != plaintext {
+		t.Errorf("round trip mismatch: got %q want %q", got, plaintext)
+	}
+}
+
+// TestDecryptLegacyExplicitWrongPassword verifies the printable-ASCII
+// heuristic flags a bad passphrase rather than returning garbage to the
+// caller. Two random passwords almost certainly produce non-printable
+// Blowfish output of length 8 or more.
+func TestDecryptLegacyExplicitWrongPassword(t *testing.T) {
+	plaintext := "ABCDEF1234\t6\tSHA1\t30"
+	salt := []byte{9, 9, 9, 9, 9, 9, 9, 9}
+
+	key := crypto.DerivePBKDF2SHA1([]byte("correct"), salt)
+	body, err := crypto.LegacyEncryptBlowfish([]byte(plaintext), key)
+	if err != nil {
+		t.Fatalf("encrypt: %v", err)
+	}
+	payload := hex.EncodeToString(salt) + body
+
+	_, err = decryptLegacySecretData(payload, LegacyPasswordExplicit, []byte("wrong"))
+	if err == nil {
+		t.Fatal("expected wrong-password rejection, got nil")
+	}
+}
+
+// TestLooksLikeLegacyPlaintext covers the ASCII-printable heuristic.
+func TestLooksLikeLegacyPlaintext(t *testing.T) {
+	if !looksLikeLegacyPlaintext([]byte("ABC\t123|x")) {
+		t.Error("printable string should pass")
+	}
+	if looksLikeLegacyPlaintext([]byte{0x00, 0x01, 0x02}) {
+		t.Error("control bytes should fail")
+	}
+	if looksLikeLegacyPlaintext(nil) {
+		t.Error("empty buffer should fail")
+	}
+	// High bit / extended ASCII should also fail — WinAuth never wrote
+	// non-ASCII into <secretdata>.
+	if looksLikeLegacyPlaintext([]byte{0xff, 'A'}) {
+		t.Error("high bit should fail")
+	}
+}
+
+// TestLoadLegacyXMLPlaintext walks the full XML → Entry path with an
+// unencrypted Google entry and an encrypted entry the caller skipped
+// the password for; the encrypted one should be skipped and the
+// plaintext one returned.
+func TestLoadLegacyXMLPlaintext(t *testing.T) {
+	const sample = `<?xml version="1.0"?>
+<WinAuth version="3.5">
+  <authenticator>
+    <WinAuthAuthenticator type="GoogleAuthenticator">
+      <name>plain</name>
+      <authenticatordata encrypted="">
+        <secretdata>ABCDEF1234	6	SHA1	30</secretdata>
+        <servertimediff>0</servertimediff>
+      </authenticatordata>
+    </WinAuthAuthenticator>
+  </authenticator>
+</WinAuth>`
+
+	path := writeTempXML(t, sample)
+	cfg, err := LoadLegacyXML(path, nil)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if len(cfg.Entries) != 1 {
+		t.Fatalf("entries=%d, want 1", len(cfg.Entries))
+	}
+	if cfg.Entries[0].Vendor != "google" || cfg.Entries[0].Name != "plain" {
+		t.Errorf("entry mismatch: %+v", cfg.Entries[0])
+	}
+}
+
+func TestLoadLegacyXMLPasswordRequired(t *testing.T) {
+	const sample = `<?xml version="1.0"?>
+<WinAuth>
+  <authenticator>
+    <WinAuthAuthenticator type="GoogleAuthenticator">
+      <name>locked</name>
+      <authenticatordata encrypted="y">
+        <secretdata>0102030405060708abcdef</secretdata>
+      </authenticatordata>
+    </WinAuthAuthenticator>
+  </authenticator>
+</WinAuth>`
+	path := writeTempXML(t, sample)
+	if _, err := LoadLegacyXML(path, nil); err == nil ||
+		!strings.Contains(err.Error(), "password required") {
+		t.Fatalf("want password-required error, got %v", err)
+	}
+}
+
+func writeTempXML(t *testing.T, body string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "winauth.xml")
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	return path
+}