feat(chromium): extract passwords from the account-synced store (#637)

Chromium keeps account-synced credentials in a separate "Login Data For Account" DB. Entries carry a Store field because the same credential can legitimately exist in both stores.

browser/chromium/profile_test.go

@@ -1,6 +1,7 @@
 package chromium
 
 import (
+	"database/sql"
 	"os"
 	"path/filepath"
 	"testing"
@@ -13,6 +14,19 @@ import (
 	"github.com/moond4rk/hackbrowserdata/types"
 )
 
+func createLoginDBAt(t *testing.T, path string, inserts ...string) {
+	t.Helper()
+	db, err := sql.Open("sqlite", path)
+	require.NoError(t, err)
+	defer db.Close()
+	_, err = db.Exec(loginsSchema)
+	require.NoError(t, err)
+	for _, stmt := range inserts {
+		_, err = db.Exec(stmt)
+		require.NoError(t, err)
+	}
+}
+
 // TestExtractCategory_CustomExtractor verifies that extractCategory dispatches
 // through a registered extractor instead of the default switch logic.
 func TestExtractCategory_CustomExtractor(t *testing.T) {
@@ -81,6 +95,74 @@ func TestAcquireFiles(t *testing.T) {
 	}
 }
 
+func TestExtractAndCountPasswords_MergesLocalAndAccountDatabases(t *testing.T) {
+	profileDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(profileDir, "Preferences"), []byte(`{}`), 0o600))
+	createLoginDBAt(t, filepath.Join(profileDir, "Login Data"),
+		insertLogin("https://local.example", "", "local-user", "", 13340000000000000))
+	createLoginDBAt(t, filepath.Join(profileDir, accountLoginData),
+		insertLogin("https://account.example", "", "account-user", "", 13360000000000000))
+
+	p := &profile{
+		profileDir:  profileDir,
+		browserName: "Chrome",
+		kind:        types.Chromium,
+		sourcePaths: resolveSourcePaths(chromiumSources, profileDir),
+	}
+	data := p.extract(masterkey.MasterKeys{}, []types.Category{types.Password})
+	require.Len(t, data.Passwords, 2)
+	assert.Equal(t, "account-user", data.Passwords[0].Username)
+	assert.Equal(t, types.PasswordStoreAccount, data.Passwords[0].Store)
+	assert.Equal(t, "local-user", data.Passwords[1].Username)
+	assert.Equal(t, types.PasswordStoreLocal, data.Passwords[1].Store)
+	assert.Equal(t, 2, p.count([]types.Category{types.Password})[types.Password])
+}
+
+// A credential synced to both stores is reported twice; the Store field is what tells them
+// apart, so it must survive the merge rather than being deduplicated away.
+func TestExtractPasswords_IdenticalCredentialInBothStoresKeepsBoth(t *testing.T) {
+	profileDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(profileDir, "Preferences"), []byte(`{}`), 0o600))
+	login := insertLogin("https://same.example", "", "same-user", "", 13340000000000000)
+	createLoginDBAt(t, filepath.Join(profileDir, "Login Data"), login)
+	createLoginDBAt(t, filepath.Join(profileDir, accountLoginData), login)
+
+	p := &profile{
+		profileDir:  profileDir,
+		browserName: "Chrome",
+		kind:        types.Chromium,
+		sourcePaths: resolveSourcePaths(chromiumSources, profileDir),
+	}
+	data := p.extract(masterkey.MasterKeys{}, []types.Category{types.Password})
+
+	require.Len(t, data.Passwords, 2)
+	stores := []string{data.Passwords[0].Store, data.Passwords[1].Store}
+	assert.ElementsMatch(t, []string{types.PasswordStoreLocal, types.PasswordStoreAccount}, stores)
+	assert.Equal(t, 2, p.count([]types.Category{types.Password})[types.Password])
+}
+
+// A profile that only ever synced passwords has no local DB, so the account DB wins candidate
+// resolution and must not also be picked up as a second source.
+func TestExtractAndCountPasswords_AccountDatabaseOnly(t *testing.T) {
+	profileDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(profileDir, "Preferences"), []byte(`{}`), 0o600))
+	createLoginDBAt(t, filepath.Join(profileDir, accountLoginData),
+		insertLogin("https://account.example", "", "account-user", "", 13360000000000000))
+
+	p := &profile{
+		profileDir:  profileDir,
+		browserName: "Chrome",
+		kind:        types.Chromium,
+		sourcePaths: resolveSourcePaths(chromiumSources, profileDir),
+	}
+	data := p.extract(masterkey.MasterKeys{}, []types.Category{types.Password})
+
+	require.Len(t, data.Passwords, 1)
+	assert.Equal(t, "account-user", data.Passwords[0].Username)
+	assert.Equal(t, types.PasswordStoreAccount, data.Passwords[0].Store)
+	assert.Equal(t, 1, p.count([]types.Category{types.Password})[types.Password])
+}
+
 func TestCountCategory(t *testing.T) {
 	t.Run("History", func(t *testing.T) {
 		path := setupHistoryDB(t)