Sign in to T5DE's hub and report presence and community outfits

Co-Authored-By: Claude Opus 5.5 <[email protected]>

internal/hub/protect_windows.go

@@ -0,0 +1,31 @@
+package hub
+
+import (
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+// protect encrypts the refresh token for the Windows user (DPAPI), so other accounts on the machine can't use it.
+func protect(data []byte) ([]byte, error) {
+	in := windows.DataBlob{Size: uint32(len(data)), Data: unsafe.SliceData(data)}
+	var out windows.DataBlob
+	if err := windows.CryptProtectData(&in, windows.StringToUTF16Ptr("T5DE hub sign-in"), nil, 0, nil, windows.CRYPTPROTECT_UI_FORBIDDEN, &out); err != nil {
+		return nil, err
+	}
+	defer windows.LocalFree(windows.Handle(unsafe.Pointer(out.Data)))
+	return append([]byte(nil), unsafe.Slice(out.Data, out.Size)...), nil
+}
+
+func unprotect(data []byte) ([]byte, error) {
+	if len(data) == 0 {
+		return nil, nil
+	}
+	in := windows.DataBlob{Size: uint32(len(data)), Data: unsafe.SliceData(data)}
+	var out windows.DataBlob
+	if err := windows.CryptUnprotectData(&in, nil, nil, 0, nil, windows.CRYPTPROTECT_UI_FORBIDDEN, &out); err != nil {
+		return nil, err
+	}
+	defer windows.LocalFree(windows.Handle(unsafe.Pointer(out.Data)))
+	return append([]byte(nil), unsafe.Slice(out.Data, out.Size)...), nil
+}