release.ps1: release token encrypted with DPAPI (-SaveToken), MSCO_NO_RELEASE=1 skips uploads

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

release.ps1

@@ -2,23 +2,52 @@
 # Läuft nach dem Release-Build von selbst (MSCO.csproj bzw. MSCO.Launcher.csproj) - oder von Hand:
 #   powershell -ExecutionPolicy Bypass -File release.ps1 -Product mod -File bin\Release\MSCO.dll
 #
-# Braucht den Release-Token des Keymasters (RELEASE_TOKEN in dessen .env), lokal als Umgebungsvariable
+# Braucht den Release-Token des Keymasters (RELEASE_TOKEN in dessen .env), lokal verschlüsselt in
-# MSCO_RELEASE_TOKEN oder in %AppData%\MSCO\release-token.txt. Ohne Token wird nichts hochgeladen.
+# %AppData%\MSCO\release-token.dpapi (Windows DPAPI, nur dein Windows-Konto kann ihn lesen - anlegen mit
+# "release.ps1 -SaveToken"), sonst als Umgebungsvariable MSCO_RELEASE_TOKEN. Ohne Token wird nichts hochgeladen.
+# MSCO_NO_RELEASE=1 schaltet das Hochladen ab (Test-Builds).
 # Gibt es die Version auf dem Keymaster schon, passiert nichts - also einfach die Version erhöhen und bauen.
 param(
-    [Parameter(Mandatory = $true)][ValidateSet("mod", "launcher", "installer")][string]$Product,
+    [ValidateSet("mod", "launcher", "installer")][string]$Product,
-    [Parameter(Mandatory = $true)][string]$File,
+    [string]$File,
+    [switch]$SaveToken,
     [string]$Version = "",
     [string]$Changelog = ""
 )
 $ErrorActionPreference = "Stop"
 $here = Split-Path -Parent $MyInvocation.MyCommand.Path
 
+Add-Type -AssemblyName System.Security
+$entropy = [Text.Encoding]::UTF8.GetBytes("MSCO release token v1")
+$scope = [Security.Cryptography.DataProtectionScope]::CurrentUser
+$tokenDpapi = Join-Path $env:APPDATA "MSCO\release-token.dpapi"
+
+# Token einmal verschlüsselt ablegen: fragt verdeckt danach (oder nimmt MSCO_RELEASE_TOKEN)
+if ($SaveToken) {
+    $plain = $env:MSCO_RELEASE_TOKEN
+    if (-not $plain) {
+        $secure = Read-Host "Release token" -AsSecureString
+        $plain = [Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure))
+    }
+    if (-not $plain -or $plain.Length -lt 24) { Write-Host "Token too short - nothing saved"; exit 1 }
+    New-Item -ItemType Directory -Force (Split-Path $tokenDpapi) | Out-Null
+    $enc = [Security.Cryptography.ProtectedData]::Protect([Text.Encoding]::UTF8.GetBytes($plain), $entropy, $scope)
+    [IO.File]::WriteAllBytes($tokenDpapi, $enc)
+    Write-Host "Release token saved encrypted in $tokenDpapi"
+    exit 0
+}
+if (-not $Product -or -not $File) { Write-Host "Usage: release.ps1 -Product mod|launcher|installer -File <file>  |  release.ps1 -SaveToken"; exit 1 }
+
+if ($env:MSCO_NO_RELEASE -eq "1") { Write-Host "MSCO release: MSCO_NO_RELEASE=1 - not uploading."; exit 0 }
 $token = $env:MSCO_RELEASE_TOKEN
+if (-not $token -and (Test-Path $tokenDpapi)) {
+    try { $token = [Text.Encoding]::UTF8.GetString([Security.Cryptography.ProtectedData]::Unprotect([IO.File]::ReadAllBytes($tokenDpapi), $entropy, $scope)) }
+    catch { Write-Host "MSCO release: $tokenDpapi cannot be decrypted (other Windows user/PC?) - not uploading."; exit 0 }
+}
 $tokenFile = Join-Path $env:APPDATA "MSCO\release-token.txt"
 if (-not $token -and (Test-Path $tokenFile)) { $token = (Get-Content $tokenFile -Raw).Trim() }
 if (-not $token) {
-    Write-Host "MSCO release: no release token (MSCO_RELEASE_TOKEN or $tokenFile) - not uploading."
+    Write-Host "MSCO release: no release token ($tokenDpapi or MSCO_RELEASE_TOKEN) - not uploading."
     exit 0
 }
 $keymaster = if ($env:MSCO_KEYMASTER) { $env:MSCO_KEYMASTER.TrimEnd("/") } else { "https://msco.mbm.wtf" }