feat(account): wire premium accounts end to end

Merged
MP
4mo ago
+6464-692

Summary

  • validate account add/update operations through the real plugin adapter while keeping secrets in the OS keyring
  • persist only typed account state and opaque account references in SQLite
  • select enabled, valid, hoster-compatible accounts during link analysis without issuing a token
  • resolve one-shot premium URLs only inside the native download engine, with typed JIT rotation and atomic account-reference updates
  • expose authentication, expiry, quota, cooldown, and missing-credential states to the Accounts UI
  • harden plugin URL handling against credential leakage, redirects, proxies, DNS rebinding, private IPv4/IPv6, and NAT64 SSRF

Acceptance coverage

Covers MAT-132 R01–R06: real validation, secret boundaries, eligible-account selection, dedicated credential host function, observable typed failures, and integration scenarios for success/missing/expired/quota/cooldown/rotation.

Verification

  • cargo fmt --all -- --check
  • cargo clippy --workspace --all-targets -- -D warnings
  • cargo test --workspace --all-targets: 1,606 passed, 5 ignored; app-state wiring passed
  • npx oxlint .
  • npm run build
  • npx vitest run: 87 files, 719 tests passed
  • pre-push gates: knip, cargo-deny, Rust tests, TypeScript typecheck and Vitest all passed
  • independent APEX logic/security/final verification: PASS

Dependency and rollout

Depends on https://github.com/mpiton/vortex-mod-1fichier/pull/3 and its immutable v1.1.0 release assets. This PR deliberately leaves registry/registry.toml on the currently published 1fichier v1.0.0 entry. Update the registry only after v1.1.0 exists and its WASM + manifest checksums can be verified.

The SQLite migration is additive. The principal runtime risk is account-state concurrency during JIT rotation; regression tests cover pause/delete races, CAS account_ref updates, orphan prevention, and no row resurrection.

Linear: https://linear.app/mpiton/issue/MAT-132/lot-2-brancher-les-comptes-premium-de-bout-en-bout

Summary by cubic

End-to-end premium account wiring: real plugin-backed validation with typed status, secrets in the OS keyring, eligible-account selection and rotation, and just‑in‑time premium URL resolution inside the native engine with stronger network safety. Covers MAT-132 R01–R06 and updates the registry to vortex-mod-1fichier v1.1.0.

  • New Features

    • Real plugin validator with typed outcomes; auto‑validate on add/update; Accounts UI listens to account events and shows valid/missing/invalid/expired/quota/cooldown with deadline wakeups.
    • Persisted account state: status and cooldown_until; store only account metadata; secrets remain in the keyring; per‑account operation locks; prevent deleting accounts still referenced by downloads.
    • Premium flow: select enabled, valid, hoster‑compatible accounts during link analysis without issuing tokens; LinkGrabber passes moduleName and accountId to download_start while keeping only the source URL in IPC and persistence.
    • Just‑in‑time resolution and rotation: the engine asks a cancellable resolver right before connecting; direct URLs never leave the native runtime; atomic compare‑and‑set updates the download’s opaque account_ref on quota/cooldown with account-exhausted events.
    • Network and plugin hardening: HTTPS‑only for plugin URLs, DNS answer pinning, redirect/private IP/NAT64 SSRF blocking; credentials bound to the selected plugin with isolated slots across reloads; hoster JSON parsed at the adapter boundary; sensitive diagnostics redacted.

  • Migration

    • Additive SQLite changes: accounts.status, accounts.cooldown_until, downloads.account_ref (opaque string).
    • No manual action; existing accounts start as unverified.

Summary by CodeRabbit

  • New Features
    • Added premium source resolution for account-scoped downloads, including hoster link extraction and account rotation with typed premium associations.
    • Extended account validation/status reporting (invalid, missing credential, expired, cooldown, quota exhaustion) and updated the Accounts UI to react to lifecycle/validation events.
  • Security
    • Hardened premium networking and plugin URL access (HTTPS-only, blocked local/private targets, pinned DNS, safer redirects, and redacted sensitive diagnostics).
  • Bug Fixes
    • Improved per-account and per-download concurrency handling, rotation/cooldown/quota persistence, and resolver cancellation to avoid late commits.
  • Changed
    • Updated UI/data contracts to remove credential references and use localized, typed account status.
    • Updated the 1fichier plugin to version 1.1.0.