Remove Keychain dependency for recovery build

README.md

@@ -7,9 +7,8 @@ A fast, cross-platform desktop client for the Nextcloud Notes app, inspired by `
 - macOS-first desktop experience with Windows/Linux builds available.
 - Fast startup from a local IndexedDB cache.
 - Incremental sync using the Nextcloud Notes API `pruneBefore` and chunk cursor support.
-- Safe credential storage via Electron `safeStorage` when available; renderer code never receives the stored app password.
+- No credential persistence in the recovery build: app passwords stay in memory only and must be entered each launch.
 - ETag-aware updates to avoid overwriting newer server changes.
-- Hardened Electron shell with context isolation, renderer sandboxing, blocked permission prompts, denied window popups, and a content security policy.
 
 ## Development
 

electron/main.cjs

@@ -1,13 +1,7 @@
-const { app, BrowserWindow, ipcMain, safeStorage } = require('electron')
+const { app, BrowserWindow, ipcMain } = require('electron')
-const fs = require('fs')
 const path = require('path')
 
 const isDev = !app.isPackaged
-const credentialFileName = 'credentials.enc'
-
-function userDataPath(fileName) {
-  return path.join(app.getPath('userData'), fileName)
-}
 
 function normalizeBaseUrl(baseUrl) {
   const trimmed = String(baseUrl || '').trim().replace(/\/+$/, '')
@@ -23,32 +17,6 @@ function authHeader(username, password) {
   return `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`
 }
 
-function readCredentials() {
-  const filePath = userDataPath(credentialFileName)
-  if (!fs.existsSync(filePath)) return null
-  if (!safeStorage.isEncryptionAvailable()) return null
-  try {
-    const encrypted = fs.readFileSync(filePath)
-    return JSON.parse(safeStorage.decryptString(encrypted))
-  } catch {
-    clearCredentials()
-    return null
-  }
-}
-
-function writeCredentials(credentials) {
-  if (!safeStorage.isEncryptionAvailable()) {
-    throw new Error('Secure credential storage is not available on this system. Unlock macOS Keychain and try again.')
-  }
-  const encrypted = safeStorage.encryptString(JSON.stringify(credentials))
-  fs.writeFileSync(userDataPath(credentialFileName), encrypted)
-}
-
-function clearCredentials() {
-  const filePath = userDataPath(credentialFileName)
-  if (fs.existsSync(filePath)) fs.unlinkSync(filePath)
-}
-
 async function request(credentials, method, apiPath, { query, body, etag } = {}) {
   const baseUrl = normalizeBaseUrl(credentials.baseUrl)
   const url = new URL(baseUrl + notesApiPath(apiPath))
@@ -154,7 +122,7 @@ app.on('window-all-closed', () => {
   if (process.platform !== 'darwin') app.quit()
 })
 
-ipcMain.handle('credentials:get', () => readCredentials())
+ipcMain.handle('credentials:get', () => null)
 ipcMain.handle('credentials:save', async (_event, credentials) => {
   const normalized = {
     baseUrl: normalizeBaseUrl(credentials.baseUrl),
@@ -163,11 +131,9 @@ ipcMain.handle('credentials:save', async (_event, credentials) => {
   }
   if (!normalized.username || !normalized.password) throw new Error('Username and app password are required')
   await request(normalized, 'GET', '/settings')
-  writeCredentials(normalized)
   return { baseUrl: normalized.baseUrl, username: normalized.username }
 })
 ipcMain.handle('credentials:clear', () => {
-  clearCredentials()
   return true
 })
 ipcMain.handle('notes:sync', (_event, { credentials, pruneBefore }) => syncNotes(credentials, pruneBefore))

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "nextcloud-notes-desktop",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "nextcloud-notes-desktop",
-      "version": "0.1.4",
+      "version": "0.1.5",
       "dependencies": {
         "react": "^18.3.1",
         "react-dom": "^18.3.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nextcloud-notes-desktop",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": true,
   "description": "Fast cross-platform desktop client for Nextcloud Notes",
   "author": {
@@ -54,10 +54,6 @@
     },
     "mac": {
       "category": "public.app-category.productivity",
-      "hardenedRuntime": true,
-      "gatekeeperAssess": false,
-      "entitlements": "build/entitlements.mac.plist",
-      "entitlementsInherit": "build/entitlements.mac.plist",
       "target": [
         {
           "target": "dmg",