feat: align shared app foundations

lib/common/storage/secure_identity_storage.dart

@@ -1,21 +1,98 @@
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 import 'package:hooks_riverpod/hooks_riverpod.dart';
+import 'package:shared_preferences/shared_preferences.dart';
 
-const _jwtKey = 'jwt_token';
+import 'storage_keys.dart';
+import 'storage_service.dart';
+
+abstract interface class SecureKeyValueStorage {
+  Future<String?> read(String key);
+  Future<void> write(String key, String value);
+  Future<void> delete(String key);
+}
+
+class FlutterSecureKeyValueStorage implements SecureKeyValueStorage {
+  const FlutterSecureKeyValueStorage();
+
+  static const _storage = FlutterSecureStorage();
+
+  @override
+  Future<String?> read(String key) => _storage.read(key: key);
+  @override
+  Future<void> write(String key, String value) =>
+      _storage.write(key: key, value: value);
+  @override
+  Future<void> delete(String key) => _storage.delete(key: key);
+}
 
 /// Sensitive identity values stay behind one injectable storage boundary.
+/// Legacy plaintext preferences are migrated only after a secure write works.
 class SecureIdentityStorage {
-  SecureIdentityStorage({FlutterSecureStorage? storage})
-    : _storage = storage ?? const FlutterSecureStorage();
+  SecureIdentityStorage(
+    this._preferences, {
+    SecureKeyValueStorage secureStorage = const FlutterSecureKeyValueStorage(),
+  }) : _storage = secureStorage;
 
-  final FlutterSecureStorage _storage;
+  static const _accessTokenKey = 'access_token';
+  static const _legacySecureJwtKey = 'jwt_token';
 
-  Future<void> saveJwt(String token) =>
-      _storage.write(key: _jwtKey, value: token);
-  Future<void> clearJwt() => _storage.delete(key: _jwtKey);
-  Future<String?> readJwt() => _storage.read(key: _jwtKey);
+  final SharedPreferences _preferences;
+  final SecureKeyValueStorage _storage;
+
+  Future<String?> restoreAccessToken() async {
+    final current = _normalized(await _storage.read(_accessTokenKey));
+    final legacyPreferences = _normalized(
+      _preferences.getString(storageLegacyAccessToken),
+    );
+    final legacySecure = current == null
+        ? _normalized(await _storage.read(_legacySecureJwtKey))
+        : null;
+    final token = current ?? legacyPreferences ?? legacySecure;
+    if (current == null && token != null) {
+      await _storage.write(_accessTokenKey, token);
+    }
+    await _storage.delete(_legacySecureJwtKey);
+    await _preferences.remove(storageLegacyAccessToken);
+    if (token == null) {
+      await _preferences.remove(storageAuthSessionActive);
+    } else {
+      await _preferences.setBool(storageAuthSessionActive, true);
+    }
+    return token;
+  }
+
+  Future<String?> readJwt() async {
+    final token = _normalized(await _storage.read(_accessTokenKey));
+    if (token == null || _preferences.containsKey(storageLegacyAccessToken)) {
+      return restoreAccessToken();
+    }
+    return token;
+  }
+
+  Future<void> saveJwt(String token) async {
+    final normalized = _normalized(token);
+    if (normalized == null) {
+      throw ArgumentError.value(token, 'token', 'must not be empty');
+    }
+    await _storage.write(_accessTokenKey, normalized);
+    await _storage.delete(_legacySecureJwtKey);
+    await _preferences.remove(storageLegacyAccessToken);
+    await _preferences.setBool(storageAuthSessionActive, true);
+  }
+
+  Future<void> clearJwt() async {
+    await _storage.delete(_accessTokenKey);
+    await _storage.delete(_legacySecureJwtKey);
+    await _preferences.remove(storageLegacyAccessToken);
+    await _preferences.remove(storageAuthSessionActive);
+  }
 }
 
 final secureIdentityStorageProvider = Provider<SecureIdentityStorage>(
-  (ref) => SecureIdentityStorage(),
+  (ref) => SecureIdentityStorage(StorageService.to.preferences),
 );
+
+String? _normalized(String? value) {
+  final normalized = value?.trim() ?? '';
+  return normalized.isEmpty ? null : normalized;
+}

lib/common/storage/storage_keys.dart

@@ -8,6 +8,11 @@ const storageJinzhiPurityPresets = 'jinzhi_purity_presets';
 const storageJinzhiPriceColorMode = 'jinzhi_price_color_mode';
 const storageJinzhiMockLoggedIn = 'jinzhi_mock_logged_in';
 
+// Previous builds could persist credentials in SharedPreferences. These keys
+// exist only for one-time migration into secure storage.
+const storageLegacyAccessToken = 'access_token';
+const storageAuthSessionActive = 'auth_session_active';
+
 // 设备/广告标识。由各自的 SDK/ATT 流程写入，DeviceHeaderService 读出注入
 // header；未写入则为空、注入时被过滤。
 const storageDeviceToken = 'device_token'; // 推送 token

lib/common/storage/storage_service.dart

@@ -6,6 +6,8 @@ class StorageService {
   static StorageService? _instance;
   static StorageService get to => _instance!;
 
+  SharedPreferences get preferences => _prefs;
+
   static Future<StorageService> get instance async {
     if (_instance != null) return _instance!;
     final prefs = await SharedPreferences.getInstance();
@@ -17,4 +19,6 @@ class StorageService {
   Future<void> setBool(String key, bool v) => _prefs.setBool(key, v);
   String? getString(String key) => _prefs.getString(key);
   Future<void> setString(String key, String v) => _prefs.setString(key, v);
+  bool containsKey(String key) => _prefs.containsKey(key);
+  Future<void> remove(String key) => _prefs.remove(key);
 }