hide password + fix mac mkdir

Author: chrischungTW

.github/workflows/release.yml

@@ -75,6 +75,17 @@ jobs:
           PY
           cat version.json
 
+      - name: Write auth.json from secret
+        shell: bash
+        env:
+          AUTH_PASSWORD_HASH: ${{ secrets.AUTH_PASSWORD_HASH }}
+        run: |
+          if [ -z "$AUTH_PASSWORD_HASH" ]; then
+            echo "ERROR: AUTH_PASSWORD_HASH secret not set; aborting build." >&2
+            exit 1
+          fi
+          python -c "import json,os; json.dump({'password_sha256': os.environ['AUTH_PASSWORD_HASH']}, open('auth.json','w'))"
+
       - name: Fetch Chrome for Testing
         shell: bash
         run: python build/fetch_chrome.py --platform ${{ matrix.chrome_plat }}

.gitignore

@@ -19,6 +19,8 @@ build/work/
 .env
 .env.*
 !.env.example
+auth.json
+secrets/
 
 # OS
 .DS_Store

build/tixcraft.spec

@@ -37,6 +37,12 @@ datas += [
     (str(PROJECT_ROOT / "build" / "icons" / "icon.png"), "."),
 ]
 
+# auth.json holds the password hash. It's gitignored — CI writes it from the
+# AUTH_PASSWORD_HASH secret before invoking PyInstaller (see release.yml).
+_auth_file = PROJECT_ROOT / "auth.json"
+if _auth_file.exists():
+    datas.append((str(_auth_file), "."))
+
 ICON_ICNS = str(PROJECT_ROOT / "build" / "icons" / "icon.icns")
 ICON_ICO = str(PROJECT_ROOT / "build" / "icons" / "icon.ico")
 

src/ui/widgets/auth_dialog.py

@@ -1,21 +1,46 @@
 from __future__ import annotations
 import hashlib
+import json
+import os
 
 from PySide6.QtCore import Qt
 from PySide6.QtWidgets import (
     QDialog, QVBoxLayout, QHBoxLayout, QLabel, QLineEdit, QPushButton,
     QCheckBox,
 )
 
+from ...utils import paths
+
 
-_PASSWORD_SHA256 = "30fa18a448f91d5558499fcf9e5c8fccf9f736b31d874629f38cd65f8feedcee"
 _MAX_ATTEMPTS = 5
+_AUTH_FILE = "auth.json"
+
+
+def _load_password_hash() -> str:
+    """Load the expected SHA-256 hash from (in order):
+    1. env var AUTH_PASSWORD_HASH (for CI)
+    2. bundled / dev-tree auth.json (gitignored)
+    Returns empty string if missing -> verify() will always fail."""
+    env = os.environ.get("AUTH_PASSWORD_HASH", "").strip().lower()
+    if env:
+        return env
+    try:
+        path = paths.find_resource(_AUTH_FILE)
+        if path and path.exists():
+            with open(path, "r", encoding="utf-8") as f:
+                data = json.load(f)
+            return str(data.get("password_sha256", "")).strip().lower()
+    except Exception:
+        pass
+    return ""
 
 
 def verify(password: str) -> bool:
-    # strip leading/trailing whitespace defensively (full-width spaces too)
+    expected = _load_password_hash()
+    if not expected:
+        return False
     cleaned = password.strip().strip("　")
-    return hashlib.sha256(cleaned.encode("utf-8")).hexdigest() == _PASSWORD_SHA256
+    return hashlib.sha256(cleaned.encode("utf-8")).hexdigest().lower() == expected
 
 
 class AuthDialog(QDialog):

version.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.2.3",
+  "version": "0.2.4",
   "name": "準點搶",
   "publisher": "浩毅科技 HaoYi Tech",
   "copyright": "© 2026 浩毅科技 HaoYi Tech"