完善桌面端回归与安全边界复审

frontend/src-tauri/capabilities/default.json

@@ -16,7 +16,9 @@
         { "path": "$TEMP/ctms-desktop/**" }
       ]
     },
-    "notification:default",
+    "notification:allow-is-permission-granted",
+    "notification:allow-request-permission",
+    "notification:allow-notify",
     {
       "identifier": "opener:allow-open-path",
       "allow": [

frontend/src-tauri/src/credentials.rs

@@ -111,4 +111,17 @@ mod tests {
         assert!(credential_account("http://ctms.example.com").is_err());
         assert!(credential_account("http://localhost:8000").is_ok());
     }
+
+    #[test]
+    fn rejects_origins_with_embedded_credentials() {
+        assert!(credential_account("https://user:secret@ctms.example.com").is_err());
+    }
+
+    #[test]
+    fn account_does_not_expose_server_origin() {
+        let account = credential_account("https://ctms.example.com/path").unwrap();
+
+        assert!(!account.contains("ctms.example.com"));
+        assert!(!account.contains("https"));
+    }
 }