feat: 支持使用 AUTHORIZATION_CODE 验证流 #5330

CiiLu · 2026-01-25T05:56:18Z

Resolves #5135
界面参考自 PrismLauncher

3gf8jv4dv · 2026-01-25T12:34:14Z

界面撑的太大了，标题栏不好点、拖动。

HMCL/src/main/resources/assets/lang/I18N.properties

HMCL/src/main/resources/assets/lang/I18N_zh.properties

3gf8jv4dv · 2026-01-25T12:44:26Z

「复制链接并打开浏览器」我只看到了浏览器出现，但剪贴板没有新的东西。

Co-authored-by: 3gf8jv4dv <3gf8jv4dv@gmail.com>

WhatDamon · 2026-01-25T14:05:02Z

此 PR 若未添加 OAuth 信息，可能会导致进入此界面后无法退出当前对话框

请考虑像 #5297 添加一个警告信息，并提供按钮能够让用户返回

WhatDamon · 2026-01-25T15:02:20Z

注意到 Prism Launcher 的逻辑是二维码包含登录所需的代码，内容为 https://www.microsoft.com/link?otc={登录代码}，而本 PR 的二维码则用于快速打开 https://www.microsoft.com/link

如果要比较，Prism Launcher 的体验相对会更好，但如果 HMCL 也这么干，则需要引入一个二维码生成库例如 ZXing (Apache 2.0) 或者 nayuki/QR-Code-generator (MIT) ，是否有必要在这一方面进行取舍 🤔

Glavo · 2026-01-26T11:31:05Z

注意到 Prism Launcher 的逻辑是二维码包含登录所需的代码，内容为 https://www.microsoft.com/link?otc={登录代码}，而本 PR 的二维码则用于快速打开 https://www.microsoft.com/link

如果要比较，Prism Launcher 的体验相对会更好，但如果 HMCL 也这么干，则需要引入一个二维码生成库例如 ZXing (Apache 2.0) 或者 nayuki/QR-Code-generator (MIT) ，是否有必要在这一方面进行取舍 🤔

可以分成两步实现，这个 PR 先专心更新到授权代码流，其他部分我之后研究一下。二维码库我之前就在考虑引入了。

3gf8jv4dv · 2026-01-26T17:47:20Z

microsoft_login.png 可以用 optipng 进一步压缩。
我试了下，参数 optipng -o7 -zm1-9 -strip all <filepath> 可以从 2,303 字节压到 701 字节。

3gf8jv4dv · 2026-01-26T17:49:50Z

HMCL/src/main/resources/assets/lang/I18N.properties

+account.methods.microsoft.manual=If the website fails to load, please visit %s manually in your browser.\n\
  \n\
  <b>If your internet connection is bad, it may cause web pages to load slowly or fail to load altogether. You may try again later or switch to a different internet connection.</b>


Suggested change

account.methods.microsoft.manual=If the website fails to load, please visit %s manually in your browser.\n\

\n\

<b>If your internet connection is bad, it may cause web pages to load slowly or fail to load altogether. You may try again later or switch to a different internet connection.</b>

account.methods.microsoft.manual=<b>If your internet connection is bad, it may cause web pages to load slowly or fail to load altogether.\nYou may try again later or switch to a different internet connection.</b>

Copilot

Pull request overview

This PR adds support for the AUTHORIZATION_CODE authentication flow for Microsoft accounts alongside the existing DEVICE flow, improving the user experience by offering a more streamlined browser-based login option while maintaining the device code flow for cross-device scenarios. This implementation is inspired by PrismLauncher's approach.

Changes:

Added dual authentication flow support (AUTHORIZATION_CODE and DEVICE) with concurrent execution
Replaced OAuthAccountLoginDialog with a new MicrosoftAccountLoginPane that displays both login options
Updated HTML success page with modern styling using the application's theme system
Enhanced localization strings to support the new two-flow UI

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
HMCLCore/src/main/java/org/jackhuang/hmcl/auth/OAuth.java	Added flow type parameter to openBrowser callback to differentiate between flows
HMCLCore/src/main/java/org/jackhuang/hmcl/auth/microsoft/MicrosoftService.java	Modified authenticate method to accept OAuth.GrantFlow parameter
HMCLCore/src/main/java/org/jackhuang/hmcl/auth/microsoft/MicrosoftAccount.java	Updated constructor to use GrantFlow instead of CharacterSelector
HMCLCore/src/main/java/org/jackhuang/hmcl/auth/microsoft/MicrosoftAccountFactory.java	Changed create method to pass GrantFlow from additionalData parameter
HMCL/src/main/java/org/jackhuang/hmcl/ui/account/MicrosoftAccountLoginPane.java	New dialog that runs both auth flows concurrently and displays both login options
HMCL/src/main/java/org/jackhuang/hmcl/ui/account/OAuthAccountLoginDialog.java	Removed old single-flow login dialog
HMCL/src/main/java/org/jackhuang/hmcl/ui/account/CreateAccountPane.java	Updated to use new MicrosoftAccountLoginPane
HMCL/src/main/java/org/jackhuang/hmcl/ui/account/AccountListPage.java	Updated to use new MicrosoftAccountLoginPane
HMCL/src/main/java/org/jackhuang/hmcl/ui/DialogController.java	Updated to use new MicrosoftAccountLoginPane for credential refresh
HMCL/src/main/java/org/jackhuang/hmcl/game/OAuthServer.java	Split openBrowser events into separate handlers for each flow type
HMCL/src/main/resources/assets/microsoft_auth.html	Enhanced success page with modern Material Design styling
HMCL/src/main/resources/assets/lang/*.properties	Added localization for new two-flow login interface
HMCL/src/main/resources/assets/img/microsoft_login.png	Added QR code placeholder image for device flow
HMCL/src/main/java/org/jackhuang/hmcl/ui/versions/Versions.java	Minor whitespace formatting

Comments suppressed due to low confidence (1)

HMCL/src/main/java/org/jackhuang/hmcl/ui/account/MicrosoftAccountLoginPane.java:329

Extra blank line at the end of the file. The file should end with a single newline character.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-27T12:32:07Z

HMCLCore/src/main/java/org/jackhuang/hmcl/auth/microsoft/MicrosoftAccount.java

 import org.jackhuang.hmcl.auth.yggdrasil.YggdrasilService;
 import org.jackhuang.hmcl.util.javafx.BindingMapping;

+import java.awt.*;


Unused import 'java.awt.*' should be removed. This import was added but is not used anywhere in the file.

Suggested change

import java.awt.*;

Copilot · 2026-01-27T12:32:07Z

HMCL/src/main/java/org/jackhuang/hmcl/ui/account/CreateAccountPane.java

            lblErrorMessage.setText("");
            lblErrorMessage.setVisible(true);
+            actions.setVisible(true);
+            actions.setVisible(true);


Duplicate line: 'actions.setVisible(false);' is called twice consecutively. One of these lines should be removed.

Suggested change

actions.setVisible(true);

Copilot · 2026-01-27T12:32:08Z

HMCLCore/src/main/java/org/jackhuang/hmcl/auth/microsoft/MicrosoftAccountFactory.java


 import org.jackhuang.hmcl.auth.AccountFactory;
 import org.jackhuang.hmcl.auth.AuthenticationException;
 import org.jackhuang.hmcl.auth.CharacterSelector;


The import 'org.jackhuang.hmcl.auth.CharacterSelector' is no longer used in this file and should be removed. The CharacterSelector parameter was replaced with OAuth.GrantFlow in the create method.

Copilot · 2026-01-27T12:32:08Z

HMCL/src/main/java/org/jackhuang/hmcl/ui/account/MicrosoftAccountLoginPane.java

+        ExceptionalConsumer<Exception, Exception> onFail = (e) -> runInFX(() -> {
+            if (!(e instanceof CancellationException)) {
+                errHintPane.setText(Accounts.localizeErrorMessage(e));
+                errHintPane.setVisible(true);
+                authMethodsContentBox.setVisible(false);
+                loginButtonSpinner.hideSpinner();
+            }
+        });


The error handler doesn't hide the spinner when a CancellationException occurs. While this might be intentional (since the tasks are being cancelled), it could leave the UI in an inconsistent state if cancelAllTasks is called while an error is being displayed. Consider explicitly hiding the spinner in the cancelAllTasks method to ensure consistent UI state.

Copilot · 2026-01-27T12:32:08Z

HMCL/src/main/java/org/jackhuang/hmcl/ui/account/MicrosoftAccountLoginPane.java

+            } catch (AuthenticationException e) {
+                errHintPane.setText(Accounts.localizeErrorMessage(e));
+                errHintPane.setVisible(true);
+                loginButtonSpinner.showSpinner();


Error handling issue: When loginCallback.accept(account.logIn()) throws an AuthenticationException on line 306, the code sets errHintPane visibility to true and shows the spinner on line 310, but it doesn't call cancelAllTasks(). This means the other background task (browser or device) continues running unnecessarily. Consider calling cancelAllTasks() before returning to clean up properly.

Suggested change

loginButtonSpinner.showSpinner();

loginButtonSpinner.showSpinner();

cancelAllTasks();

Copilot · 2026-01-27T12:32:09Z

HMCLCore/src/main/java/org/jackhuang/hmcl/auth/OAuth.java

+         * @param authorizationCode
+         * @param url               OAuth url.
         */
-        void openBrowser(String url) throws IOException;
+        void openBrowser(GrantFlow authorizationCode, String url) throws IOException;


The parameter name 'authorizationCode' is misleading. It should be named 'grantFlow' or 'flow' since it represents the type of grant flow being used (AUTHORIZATION_CODE or DEVICE), not an actual authorization code value. This makes the API confusing for developers who might expect this to be a code string.

Copilot · 2026-01-27T12:32:09Z

HMCL/src/main/java/org/jackhuang/hmcl/ui/account/MicrosoftAccountLoginPane.java

+        browserTaskExecuter = Task.supplyAsync(() -> Accounts.FACTORY_MICROSOFT.create(null, null, null, null, OAuth.GrantFlow.AUTHORIZATION_CODE))
+                .whenComplete(Schedulers.javafx(), onSuccess, onFail)
+                .executor(true);
+
+        deviceTaskExecuter = Task.supplyAsync(() -> Accounts.FACTORY_MICROSOFT.create(null, null, null, null, OAuth.GrantFlow.DEVICE))
+                .whenComplete(Schedulers.javafx(), onSuccess, onFail)
+                .executor(true);
+    }


Potential race condition: When either browser or device flow succeeds, it cancels all tasks and calls onLoginCompleted. However, if both flows complete nearly simultaneously, onLoginCompleted could be called twice. The second call might interfere with account management operations. Consider adding a flag to ensure onLoginCompleted is only executed once, or synchronize access to prevent concurrent execution.

Copilot · 2026-01-27T12:32:09Z

HMCL/src/main/java/org/jackhuang/hmcl/ui/account/CreateAccountPane.java

+            vbox.getChildren().addAll(new MicrosoftAccountLoginPane(true));
+            btnAccept.setOnAction(e -> {
+                fireEvent(new DialogCloseEvent());
+                Controllers.dialog(new MicrosoftAccountLoginPane());
            });


The Microsoft account creation flow creates a MicrosoftAccountLoginPane with bodyonly=true and embeds it in the CreateAccountPane, but then the btnAccept action closes the CreateAccountPane and opens a new full MicrosoftAccountLoginPane dialog. This creates a confusing UX where users see a preview/hint of the login interface, then clicking "Log in" closes that dialog and opens a new one with the actual login functionality. Consider either showing the full functional login pane directly in CreateAccountPane, or removing the embedded preview pane to avoid confusion.

CiiLu added 27 commits January 25, 2026 11:52

update

1c802d2

update

e773c71

update

3e356f2

update

8b97f89

update

39ec4a2

update

a8f3d52

update

50b274f

update

b392f4b

update

0c7234e

update

e3ccda8

update

8cdb521

update

1fa870f

update

9a0be36

update

fa28740

update

88dc715

update

ce27514

update

34cf012

update

9cc8f4a

update

ffa97b0

update

3b03e26

update

a479b79

update

b209c3b

update

fda6c73

update

ecae0b0

update

2ccf290

update

334a12d

update

3720127

CiiLu marked this pull request as ready for review January 25, 2026 11:56

3gf8jv4dv reviewed Jan 25, 2026

View reviewed changes

CiiLu and others added 2 commits January 25, 2026 20:56

Apply suggestions from code review

e253b5b

Co-authored-by: 3gf8jv4dv <3gf8jv4dv@gmail.com>

update

3a9c72b

update

7da9d9b

3gf8jv4dv reviewed Jan 26, 2026

View reviewed changes

Glavo requested a review from Copilot January 27, 2026 12:23

Copilot started reviewing on behalf of Glavo January 27, 2026 12:24 View session

Copilot AI reviewed Jan 27, 2026

View reviewed changes

	loginButtonSpinner.showSpinner();
	loginButtonSpinner.showSpinner();
	cancelAllTasks();

feat: 支持使用 AUTHORIZATION_CODE 验证流 #5330

Are you sure you want to change the base?

feat: 支持使用 AUTHORIZATION_CODE 验证流 #5330

Uh oh!

Conversation

CiiLu commented Jan 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

3gf8jv4dv commented Jan 25, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

3gf8jv4dv commented Jan 25, 2026

Uh oh!

WhatDamon commented Jan 25, 2026

Uh oh!

WhatDamon commented Jan 25, 2026

Uh oh!

Glavo commented Jan 26, 2026

Uh oh!

3gf8jv4dv commented Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

3gf8jv4dv Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

CiiLu commented Jan 25, 2026 •

edited

Loading

3gf8jv4dv commented Jan 26, 2026 •

edited

Loading