feat: 移植忽略 SSL 证书错误选项（设置开关 + 重建 HTTP 客户端）

apps/app-frontend/src/components/ui/settings/ResourceManagementSettings.vue

@@ -253,6 +253,15 @@ const messages = defineMessages({
 		defaultMessage:
 			'When CurseForge does not provide a download address, derive its CDN address and try downloading the file automatically. Disable this to use the manual download workflow.',
 	},
+	ignoreSslErrors: {
+		id: 'app.settings.resources.ignore-ssl-errors',
+		defaultMessage: 'Ignore SSL certificate errors',
+	},
+	ignoreSslErrorsDescription: {
+		id: 'app.settings.resources.ignore-ssl-errors-description',
+		defaultMessage:
+			'Skip TLS certificate validation for launcher network requests. Only enable this if you trust your network and understand the security risk.',
+	},
 	mojangAuthService: {
 		id: 'app.settings.resources.mojang-auth-service',
 		defaultMessage: 'Mojang authentication service',
@@ -923,6 +932,15 @@ function validateMinecraftDirectory(value) {
 					/>
 				</template>
 			</SettingsRow>
+			<SettingsRow>
+				<template #label>{{ formatMessage(messages.ignoreSslErrors) }}</template>
+				<template #description>
+					{{ formatMessage(messages.ignoreSslErrorsDescription) }}
+				</template>
+				<template #control>
+					<Toggle id="ignore-ssl-errors" v-model="settings.ignore_ssl_errors" />
+				</template>
+			</SettingsRow>
 		</SettingsSection>
 
 		<SettingsSection v-if="props.scope === 'content-downloads'">

apps/app-frontend/src/helpers/settings.ts

@@ -151,6 +151,7 @@ export type AppSettings = {
 	curseforge_source: DownloadSourceMode
 	bypass_curseforge_download_restrictions: boolean
 	mojang_auth_source: DownloadSourceMode
+	ignore_ssl_errors: boolean
 
 	theme: ColorTheme
 	accent_color: AccentColorSetting
@@ -241,6 +242,7 @@ function normalizeDownloadSettings(settings: AppSettings & LegacyMirrorSettings)
 		usesLegacyDefaults || !hasLegacySettings ? 'auto' : legacySource(settings.use_curseforge_mirror)
 	settings.bypass_curseforge_download_restrictions ??= true
 	settings.mojang_auth_source ??= 'auto'
+	settings.ignore_ssl_errors ??= false
 	settings.terracotta_public_nodes ??= ['wss://center.node.1tmc.top']
 	settings.feature_flags ??= { ...DEFAULT_FEATURE_FLAGS }
 	for (const [key, value] of Object.entries(DEFAULT_FEATURE_FLAGS)) {

apps/app-frontend/src/locales/zh-CN/index.json

@@ -7219,6 +7219,12 @@
   "app.settings.resources.curseforge-restriction-bypass-description": {
     "message": "当 CurseForge 不提供下载地址时，根据文件信息推导其 CDN 地址并尝试自动下载。关闭后将使用手动下载流程。"
   },
+  "app.settings.resources.ignore-ssl-errors": {
+    "message": "忽略 SSL 证书错误"
+  },
+  "app.settings.resources.ignore-ssl-errors-description": {
+    "message": "跳过启动器网络请求的 TLS 证书校验。仅当你信任当前网络并了解其安全风险时才启用。"
+  },
   "app.settings.resources.database-backups": {
     "message": "应用数据库备份"
   },

apps/app-frontend/src/locales/zh-TW/index.json

@@ -6827,6 +6827,12 @@
   "app.settings.resources.curseforge-restriction-bypass-description": {
     "message": "當 CurseForge 不提供下載地址時，根據檔案資訊推導其 CDN 地址並嘗試自動下載。關閉後將使用手動下載流程。"
   },
+  "app.settings.resources.ignore-ssl-errors": {
+    "message": "忽略 SSL 憑證錯誤"
+  },
+  "app.settings.resources.ignore-ssl-errors-description": {
+    "message": "跳過啟動器網路請求的 TLS 憑證檢查。僅當你信任目前網路並了解其安全風險時才啟用。"
+  },
   "app.settings.resources.database-backups": {
     "message": "應用程式資料庫備份"
   },

apps/app/src/api/settings.rs

@@ -33,7 +33,9 @@ pub async fn settings_set(
     app: tauri::AppHandle<impl Runtime>,
     settings: Settings,
 ) -> Result<()> {
-    settings::set(settings).await?;
+    settings::set(settings.clone()).await?;
+    let state = State::get().await?;
+    state.update_http_client_for_settings(&settings).await?;
     let _ = app.emit("settings", ());
     Ok(())
 }

packages/app-lib/migrations/20261002010000_add-ignore-ssl-errors.sql

@@ -0,0 +1 @@
+ALTER TABLE settings ADD COLUMN ignore_ssl_errors INTEGER NOT NULL DEFAULT 0;

packages/app-lib/src/state/mod.rs

@@ -608,7 +608,11 @@ impl State {
         config: &crate::util::proxy::ProxyConfig,
     ) -> crate::Result<()> {
         let _update = self.configured_http_client_update.lock().await;
-        let client = crate::util::fetch::build_configured_client(config)?;
+        let settings = Settings::get(&self.pool).await?;
+        let client = crate::util::fetch::build_configured_client(
+            config,
+            settings.ignore_ssl_errors,
+        )?;
         crate::state::proxy_settings::set(&self.pool, config).await?;
         *self.configured_http_client.write() = client;
         Ok(())
@@ -618,6 +622,21 @@ impl State {
         self.configured_http_client.read().clone()
     }
 
+    /// 在设置变更（如忽略 SSL 证书开关）后重建 HTTP 客户端。
+    pub(crate) async fn update_http_client_for_settings(
+        &self,
+        settings: &Settings,
+    ) -> crate::Result<()> {
+        let _update = self.configured_http_client_update.lock().await;
+        let proxy = crate::state::proxy_settings::get(&self.pool).await?;
+        let client = crate::util::fetch::build_configured_client(
+            &proxy,
+            settings.ignore_ssl_errors,
+        )?;
+        *self.configured_http_client.write() = client;
+        Ok(())
+    }
+
     pub(crate) fn auto_prefers_mirror(&self) -> bool {
         self.auto_prefers_mirror.load(Ordering::Relaxed)
     }
@@ -839,7 +858,10 @@ impl State {
         let auto_prefers_mirror = settings.auto_prefers_mirror();
         let proxy_config = proxy_settings::get(&pool).await?;
         let configured_http_client =
-            crate::util::fetch::build_configured_client(&proxy_config)?;
+            crate::util::fetch::build_configured_client(
+                &proxy_config,
+                settings.ignore_ssl_errors,
+            )?;
 
         tracing::info!("Initializing directories");
         DirectoryInfo::move_launcher_directory(
@@ -955,7 +977,7 @@ pub(crate) async fn test_state(
     let file_watcher = instances::watcher::init_watcher().await?;
     let proxy_config = proxy_settings::get(&pool).await?;
     let configured_http_client =
-        crate::util::fetch::build_configured_client(&proxy_config)?;
+        crate::util::fetch::build_configured_client(&proxy_config, false)?;
 
     Ok(Arc::new(State {
         directories,

packages/app-lib/src/state/settings.rs

@@ -116,8 +116,9 @@ pub struct Settings {
     pub curseforge_source: DownloadSourceMode,
     #[serde(default = "default_true")]
     pub bypass_curseforge_download_restrictions: bool,
-    #[serde(default)]
     pub mojang_auth_source: DownloadSourceMode,
+    #[serde(default)]
+    pub ignore_ssl_errors: bool,
     #[serde(default, rename = "use_minecraft_mirror", skip_serializing)]
     legacy_use_minecraft_mirror: Option<bool>,
     #[serde(default, rename = "use_modrinth_mirror", skip_serializing)]
@@ -313,6 +314,11 @@ impl Settings {
         )
         .fetch_one(exec)
         .await?;
+        let ignore_ssl_errors: bool = sqlx::query_scalar(
+            "SELECT ignore_ssl_errors FROM settings WHERE id = 0",
+        )
+        .fetch_one(exec)
+        .await?;
         let settings = Self {
             max_concurrent_downloads: res.max_concurrent_downloads as usize,
             max_concurrent_writes: res.max_concurrent_writes as usize,
@@ -331,6 +337,7 @@ impl Settings {
                 &res.curseforge_source,
             ),
             bypass_curseforge_download_restrictions,
+            ignore_ssl_errors,
             mojang_auth_source: DownloadSourceMode::from_string(
                 &res.mojang_auth_source,
             ),
@@ -640,6 +647,10 @@ impl Settings {
         .bind(self.bypass_curseforge_download_restrictions)
         .execute(exec)
         .await?;
+        sqlx::query("UPDATE settings SET ignore_ssl_errors = ? WHERE id = 0")
+            .bind(self.ignore_ssl_errors)
+            .execute(exec)
+            .await?;
         sqlx::query("UPDATE settings SET mc_memory_optimize = ? WHERE id = 0")
             .bind(self.memory.optimize_before_launch)
             .execute(exec)

packages/app-lib/src/util/fetch.rs

@@ -1462,9 +1462,13 @@ pub fn build_proxied_client(
 
 pub(crate) fn build_configured_client(
     proxy: &crate::util::proxy::ProxyConfig,
+    ignore_ssl_errors: bool,
 ) -> crate::Result<reqwest::Client> {
     proxy
-        .apply(reqwest_client_builder())?
+        .apply(
+            reqwest_client_builder()
+                .danger_accept_invalid_certs(ignore_ssl_errors),
+        )?
         .build()
         .map_err(Into::into)
 }