refactor: harden client runtime and exports

scripts/test_secure_session_store.gd

@@ -0,0 +1,40 @@
+extends SceneTree
+
+const SecureSessionStore = preload("res://_Core/security/SecureSessionStore.gd")
+const TEST_PATH: String = "user://whaletown-secure-session-test.json"
+const TEST_TOKEN: String = "refresh-token-test-value"
+
+func _init() -> void:
+	var store: RefCounted = SecureSessionStore.new()
+	store.call("clear", TEST_PATH)
+	var saved := bool(store.call("save_refresh_token", TEST_PATH, TEST_TOKEN))
+	if not saved:
+		print("安全持久化在当前平台不可用，已按仅内存策略跳过")
+		quit()
+		return
+	var loaded := str(store.call("load_refresh_token", TEST_PATH))
+	if loaded != TEST_TOKEN:
+		push_error("安全会话存储往返测试失败")
+		quit(1)
+		return
+	var payload_variant: Variant = JSON.parse_string(FileAccess.get_file_as_string(TEST_PATH))
+	if not (payload_variant is Dictionary):
+		push_error("安全会话存储测试载荷解析失败")
+		quit(1)
+		return
+	var payload: Dictionary = payload_variant
+	payload["mac"] = Marshalls.raw_to_base64(PackedByteArray([1, 2, 3, 4]))
+	var tampered_file := FileAccess.open(TEST_PATH, FileAccess.WRITE)
+	if tampered_file == null:
+		push_error("安全会话存储篡改测试无法写入")
+		quit(1)
+		return
+	tampered_file.store_string(JSON.stringify(payload))
+	tampered_file.close()
+	var tampered_token := str(store.call("load_refresh_token", TEST_PATH))
+	if not tampered_token.is_empty() or FileAccess.file_exists(TEST_PATH):
+		push_error("安全会话存储未拒绝被篡改载荷")
+		quit(1)
+		return
+	print("安全会话存储往返与篡改检测测试通过")
+	quit()