feat: implement native OS keyring for site logins

- Replaced plaintext local storage password fields with keyring v3 OS native integration.
- Tauri backend securely sets, gets, and deletes credentials via system keychains.
- Dynamic password injection occurs seamlessly on download start and metadata parsing.

apps/desktop/src-tauri/Cargo.lock

@@ -1949,6 +1949,16 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "keyring"
+version = "3.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
+dependencies = [
+ "log",
+ "zeroize",
+]
+
 [[package]]
 name = "leb128fmt"
 version = "0.1.0"
@@ -3813,6 +3823,7 @@ dependencies = [
 name = "tauri-app"
 version = "0.1.0"
 dependencies = [
+ "keyring",
  "regex",
  "reqwest 0.12.28",
  "serde",

apps/desktop/src-tauri/Cargo.toml

@@ -28,4 +28,5 @@ regex = "1.10"
 reqwest = "0.12"
 tauri-plugin-notification = "2.3.3"
 sysinfo = "0.39.3"
+keyring = "3"
 

apps/desktop/src-tauri/src/lib.rs

@@ -902,6 +902,26 @@ fn get_free_space(app_handle: tauri::AppHandle, path: String) -> Result<String,
     }
 }
 
+#[tauri::command]
+fn set_keychain_password(id: String, password: String) -> Result<(), String> {
+    let entry = keyring::Entry::new("com.firelink.app", &id).map_err(|e| e.to_string())?;
+    entry.set_password(&password).map_err(|e| e.to_string())?;
+    Ok(())
+}
+
+#[tauri::command]
+fn get_keychain_password(id: String) -> Result<String, String> {
+    let entry = keyring::Entry::new("com.firelink.app", &id).map_err(|e| e.to_string())?;
+    entry.get_password().map_err(|e| e.to_string())
+}
+
+#[tauri::command]
+fn delete_keychain_password(id: String) -> Result<(), String> {
+    let entry = keyring::Entry::new("com.firelink.app", &id).map_err(|e| e.to_string())?;
+    let _ = entry.delete_credential(); // Ignore error if it doesn't exist
+    Ok(())
+}
+
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
     tauri::Builder::default()
@@ -915,7 +935,8 @@ pub fn run() {
             greet, test_ytdlp, test_aria2c, test_ffmpeg, test_deno, open_file, show_in_folder,
             start_download, start_media_download, pause_download, fetch_metadata, fetch_media_metadata,
             update_dock_badge, set_prevent_sleep, get_free_space, perform_system_action,
-            request_automation_permission, open_automation_settings
+            request_automation_permission, open_automation_settings,
+            set_keychain_password, get_keychain_password, delete_keychain_password
         ])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");

apps/desktop/src/components/AddDownloadsModal.tsx

@@ -326,12 +326,20 @@ export const AddDownloadsModal = () => {
             const { mediaCookieSource } = settingsStore;
             const browserArg = mediaCookieSource !== 'none' ? mediaCookieSource : null;
             const login = getSiteLogin(url, settingsStore);
+            let keychainPassword = null;
+            if (login) {
+              try {
+                keychainPassword = await invoke<string>('get_keychain_password', { id: login.id });
+              } catch (e) {
+                console.warn("Could not fetch keychain password:", e);
+              }
+            }
 
             const jsonStr = await invoke<string>('fetch_media_metadata', { 
               url, 
               cookieBrowser: browserArg,
               username: login?.username || null,
-              password: login?.password || null
+              password: keychainPassword
             });
             const mediaData = parseMediaFormats(jsonStr);
             if (mediaData && mediaData.formats.length > 0) {
@@ -351,10 +359,18 @@ export const AddDownloadsModal = () => {
           } else {
             const settingsStore = useSettingsStore.getState();
             const login = getSiteLogin(url, settingsStore);
+            let keychainPassword = null;
+            if (login) {
+              try {
+                keychainPassword = await invoke<string>('get_keychain_password', { id: login.id });
+              } catch (e) {
+                console.warn("Could not fetch keychain password:", e);
+              }
+            }
             const meta = await invoke<{filename: string, size: string, size_bytes: number}>('fetch_metadata', { 
               url,
               username: login?.username || null,
-              password: login?.password || null
+              password: keychainPassword
             });
             updatedItems[i] = { url, file: meta.filename, size: meta.size, sizeBytes: meta.size_bytes, status: 'Ready' };
           }

apps/desktop/src/components/SettingsView.tsx

@@ -116,17 +116,27 @@ export default function SettingsView() {
     }
   };
 
-  const handleAddLogin = () => {
+  const handleAddLogin = async () => {
     if (!loginPattern.trim() || !loginUser.trim()) {
       setLoginError("Please enter a URL pattern and a username.");
       return;
     }
     const id = crypto.randomUUID();
+    
+    if (loginPass) {
+      try {
+        await invoke('set_keychain_password', { id, password: loginPass });
+      } catch (e) {
+        console.error("Failed to save password to keychain:", e);
+        setLoginError("Failed to save password securely.");
+        return;
+      }
+    }
+
     settings.addSiteLogin({
       id,
       urlPattern: loginPattern.trim(),
-      username: loginUser.trim(),
+      username: loginUser.trim()
-      password: loginPass
     });
     setLoginPattern('');
     setLoginUser('');
@@ -534,7 +544,12 @@ export default function SettingsView() {
                         <p className="text-text-secondary text-xs">User: {login.username}</p>
                       </div>
                       <button
-                        onClick={() => {
+                        onClick={async () => {
+                          try {
+                            await invoke('delete_keychain_password', { id: login.id });
+                          } catch (e) {
+                            console.warn("Could not delete password from keychain:", e);
+                          }
                           settings.removeSiteLogin(login.id);
                           showToast("Deleted credential");
                         }}

apps/desktop/src/store/useDownloadStore.ts

@@ -291,6 +291,14 @@ export const useDownloadStore = create<DownloadState>((set, get) => ({
       try {
         const settings = useSettingsStore.getState();
         const login = getSiteLogin(item.url, settings);
+        let keychainPassword = null;
+        if (login) {
+          try {
+            keychainPassword = await invoke<string>('get_keychain_password', { id: login.id });
+          } catch (e) {
+            console.warn("Could not fetch keychain password for login:", e);
+          }
+        }
         
         const destPath = item.destination || 
                          (settings.downloadDirectories && settings.downloadDirectories[item.category]) || 
@@ -311,7 +319,7 @@ export const useDownloadStore = create<DownloadState>((set, get) => ({
             formatSelector: item.mediaFormatSelector || null,
             speedLimit,
             username: item.username || (login ? login.username : null),
-            password: item.password || (login ? login.password : null)
+            password: item.password || keychainPassword
           });
         } else {
           const speedLimit = effectiveSpeedLimit(
@@ -327,7 +335,7 @@ export const useDownloadStore = create<DownloadState>((set, get) => ({
             connections: item.connections || settings.perServerConnections || null,
             speedLimit,
             username: item.username || (login ? login.username : null),
-            password: item.password || (login ? login.password : null),
+            password: item.password || keychainPassword,
             headers: item.headers || null,
             userAgent: settings.customUserAgent || null,
             maxTries: settings.maxAutomaticRetries,

apps/desktop/src/store/useSettingsStore.ts

@@ -5,7 +5,6 @@ export interface SiteLogin {
   id: string;
   urlPattern: string;
   username: string;
-  password?: string;
 }
 
 export type AppFontSize = 'small' | 'standard' | 'large';