From 171f6ff59aefead8b9cb2648464c518970996300 Mon Sep 17 00:00:00 2001
From: AskaEth <i@yeij.top>
Date: Tue, 8 Sep 2026 20:56:06 +0800
Subject: [PATCH] =?UTF-8?q?fix(net):=20=E6=94=BE=E8=A1=8C=E6=98=8E?=
 =?UTF-8?q?=E6=96=87=20HTTP=EF=BC=8C=E4=BF=AE=E5=A4=8D=E8=87=AA=E9=83=A8?=
 =?UTF-8?q?=E7=BD=B2=E5=9C=B0=E5=9D=80=E6=8A=A5=E3=80=8C=E7=BD=91=E7=BB=9C?=
 =?UTF-8?q?=E4=B8=8D=E5=8F=AF=E7=94=A8=E3=80=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Android 9+ 默认禁止 cleartext，OkHttp 抛 UnknownServiceException 被映射为无网。新增 network_security_config.xml（放行 cleartext + 信任用户 CA），并给该异常单独的提示文案。
---
 app/src/main/AndroidManifest.xml                   |  1 +
 .../top/yeij/cyrene/core/auth/AuthManager.kt       |  1 +
 .../top/yeij/cyrene/core/error/CyreneError.kt      |  2 ++
 app/src/main/res/xml/network_security_config.xml   | 14 ++++++++++++++
 4 files changed, 18 insertions(+)
 create mode 100644 app/src/main/res/xml/network_security_config.xml

diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index eb51a12..9de6b57 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -6,6 +6,7 @@
         android:allowBackup="false"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.Cyrene">
diff --git a/app/src/main/kotlin/top/yeij/cyrene/core/auth/AuthManager.kt b/app/src/main/kotlin/top/yeij/cyrene/core/auth/AuthManager.kt
index 0c36b2a..de7253e 100644
--- a/app/src/main/kotlin/top/yeij/cyrene/core/auth/AuthManager.kt
+++ b/app/src/main/kotlin/top/yeij/cyrene/core/auth/AuthManager.kt
@@ -114,6 +114,7 @@ class AuthManager(private val store: SessionStore) {
         is SSLException -> CyreneError.Local(CyreneError.LocalKind.Tls)
         is SocketTimeoutException -> CyreneError.Local(CyreneError.LocalKind.Timeout)
         is ConnectException -> CyreneError.Local(CyreneError.LocalKind.ConnectFailed)
+        is java.net.UnknownServiceException -> CyreneError.Local(CyreneError.LocalKind.CleartextBlocked)
         is IOException -> CyreneError.Local(CyreneError.LocalKind.NoNetwork)
         else -> CyreneError.Local(CyreneError.LocalKind.Unknown)
     }
diff --git a/app/src/main/kotlin/top/yeij/cyrene/core/error/CyreneError.kt b/app/src/main/kotlin/top/yeij/cyrene/core/error/CyreneError.kt
index 4f16ff8..8c7d633 100644
--- a/app/src/main/kotlin/top/yeij/cyrene/core/error/CyreneError.kt
+++ b/app/src/main/kotlin/top/yeij/cyrene/core/error/CyreneError.kt
@@ -33,6 +33,7 @@ sealed interface CyreneError {
                 LocalKind.Tls -> "证书校验失败（自签证书暂不支持）"
                 LocalKind.Timeout -> "连接超时，服务器没有响应"
                 LocalKind.ConnectFailed -> "无法连接到服务器"
+                LocalKind.CleartextBlocked -> "系统禁止明文 HTTP 访问"
                 LocalKind.Parse -> "服务器返回的数据无法识别"
                 LocalKind.Unknown -> "发生未知错误"
             }
@@ -45,6 +46,7 @@ sealed interface CyreneError {
         Tls,
         Timeout,
         ConnectFailed,
+        CleartextBlocked,
         Parse,
         Unknown,
     }
diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
new file mode 100644
index 0000000..7fb2d8c
--- /dev/null
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  自部署场景：用户会把 App 指向自己局域网/本机的 HTTP 服务（如 http://192.168.x.x:8080、
+  http://127.0.0.1:10942），所以必须放行明文流量；同时信任用户安装的 CA，
+  便于自签证书的 HTTPS 部署。生产公网部署仍建议用 HTTPS。
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="true">
+        <trust-anchors>
+            <certificates src="system" />
+            <certificates src="user" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>