| """ |
| 注册流程引擎 |
| 从 main.py 中提取并重构的注册流程 |
| """ |
|
|
| import re |
| import json |
| import time |
| import random |
| import logging |
| import secrets |
| import string |
| import uuid |
| from typing import Optional, Dict, Any, Tuple, Callable, List |
| from dataclasses import dataclass |
| from datetime import datetime |
|
|
| from curl_cffi import requests as cffi_requests |
|
|
| from .openai.oauth import OAuthManager, OAuthStart, _decode_jwt_segment, _jwt_claims_no_verify, generate_oauth_url_no_prompt |
| from .http_client import OpenAIHTTPClient, HTTPClientError |
| from ..services import EmailServiceFactory, BaseEmailService, EmailServiceType |
| from ..database import crud |
| from ..database.session import get_db |
| from ..config.constants import ( |
| OPENAI_API_ENDPOINTS, |
| OPENAI_PAGE_TYPES, |
| generate_random_user_info, |
| OTP_CODE_PATTERN, |
| DEFAULT_PASSWORD_LENGTH, |
| PASSWORD_CHARSET, |
| PASSWORD_SPECIAL, |
| PASSWORD_MIN_LENGTH, |
| PASSWORD_MAX_LENGTH, |
| AccountStatus, |
| TaskStatus, |
| ) |
| from ..config.settings import get_settings |
|
|
|
|
| logger = logging.getLogger(__name__) |
|
|
|
|
| @dataclass |
| class RegistrationResult: |
| """注册结果""" |
| success: bool |
| email: str = "" |
| password: str = "" |
| account_id: str = "" |
| workspace_id: str = "" |
| access_token: str = "" |
| refresh_token: str = "" |
| id_token: str = "" |
| session_token: str = "" |
| error_message: str = "" |
| logs: list = None |
| metadata: dict = None |
| source: str = "register" |
|
|
| def to_dict(self) -> Dict[str, Any]: |
| """转换为字典""" |
| return { |
| "success": self.success, |
| "email": self.email, |
| "password": self.password, |
| "account_id": self.account_id, |
| "workspace_id": self.workspace_id, |
| "access_token": self.access_token[:20] + "..." if self.access_token else "", |
| "refresh_token": self.refresh_token[:20] + "..." if self.refresh_token else "", |
| "id_token": self.id_token[:20] + "..." if self.id_token else "", |
| "session_token": self.session_token[:20] + "..." if self.session_token else "", |
| "error_message": self.error_message, |
| "logs": self.logs or [], |
| "metadata": self.metadata or {}, |
| "source": self.source, |
| } |
|
|
|
|
| @dataclass |
| class SignupFormResult: |
| """提交注册表单的结果""" |
| success: bool |
| page_type: str = "" |
| is_existing_account: bool = False |
| response_data: Dict[str, Any] = None |
| error_message: str = "" |
|
|
|
|
| class RegistrationEngine: |
| """ |
| 注册引擎 |
| 负责协调邮箱服务、OAuth 流程和 OpenAI API 调用 |
| """ |
|
|
| def __init__( |
| self, |
| email_service: BaseEmailService, |
| proxy_url: Optional[str] = None, |
| proxy_source: Optional[str] = None, |
| callback_logger: Optional[Callable[[str], None]] = None, |
| task_uuid: Optional[str] = None |
| ): |
| """ |
| 初始化注册引擎 |
| |
| Args: |
| email_service: 邮箱服务实例 |
| proxy_url: 代理 URL |
| proxy_source: 代理来源（'explicit', 'auto', 'direct'） |
| callback_logger: 日志回调函数 |
| task_uuid: 任务 UUID（用于数据库记录） |
| """ |
| self.email_service = email_service |
| self.proxy_url = proxy_url |
| self.proxy_source = proxy_source or "direct" |
| self.callback_logger = callback_logger or (lambda msg: logger.info(msg)) |
| self.task_uuid = task_uuid |
|
|
| |
| self.http_client = OpenAIHTTPClient(proxy_url=proxy_url) |
|
|
| |
| settings = get_settings() |
| self.oauth_manager = OAuthManager( |
| client_id=settings.openai_client_id, |
| auth_url=settings.openai_auth_url, |
| token_url=settings.openai_token_url, |
| redirect_uri=settings.openai_redirect_uri, |
| scope=settings.openai_scope, |
| proxy_url=proxy_url |
| ) |
|
|
| |
| self.email: Optional[str] = None |
| self.password: Optional[str] = None |
| self.email_info: Optional[Dict[str, Any]] = None |
| self.oauth_start: Optional[OAuthStart] = None |
| self.session: Optional[cffi_requests.Session] = None |
| self.session_token: Optional[str] = None |
| self.logs: list = [] |
| self._otp_stage: str = "signup_otp" |
| self._otp_sent_at: Optional[float] = None |
| self._is_existing_account: bool = False |
| self._token_acquisition_requires_login: bool = False |
| self._last_registration_error: Optional[str] = None |
| self._account_created: bool = False |
| self._about_you_resume_attempts: int = 0 |
| self._recovery_account_id: Optional[int] = None |
| self._recovery_mode: bool = False |
| self._workspace_context: Dict[str, Any] = {} |
| self._workspace_resolution_source: Optional[str] = None |
| self._workspace_resolution_error: Optional[str] = None |
| self._oauth_resume_source: Optional[str] = None |
| self._session_bound_reauth_attempted: bool = False |
| self._session_bound_reauth_otp_cycles: int = 0 |
| self._last_create_account_error_code: Optional[str] = None |
| self._last_create_account_error_message: Optional[str] = None |
| self._last_create_account_user_exists: bool = False |
| self._about_you_user_exists_without_resume_attempts: int = 0 |
|
|
| def _log(self, message: str, level: str = "info"): |
| """记录日志""" |
| timestamp = datetime.now().strftime("%H:%M:%S") |
| log_message = f"[{timestamp}] {message}" |
|
|
| |
| self.logs.append(log_message) |
|
|
| |
| if self.callback_logger: |
| self.callback_logger(log_message) |
|
|
| |
| if self.task_uuid: |
| try: |
| with get_db() as db: |
| crud.append_task_log(db, self.task_uuid, log_message) |
| except Exception as e: |
| logger.warning(f"记录任务日志失败: {e}") |
|
|
| |
| if level == "error": |
| logger.error(message) |
| elif level == "warning": |
| logger.warning(message) |
| else: |
| logger.info(message) |
|
|
| def _generate_password(self, length: int = DEFAULT_PASSWORD_LENGTH) -> str: |
| """生成随机密码（随机长度，保证含特殊字符）""" |
| actual_length = random.randint(PASSWORD_MIN_LENGTH, PASSWORD_MAX_LENGTH) |
| |
| password = [ |
| secrets.choice(string.ascii_lowercase), |
| secrets.choice(string.ascii_uppercase), |
| secrets.choice(string.digits), |
| secrets.choice(PASSWORD_SPECIAL), |
| ] |
| password.extend(secrets.choice(PASSWORD_CHARSET) for _ in range(actual_length - 4)) |
| secrets.SystemRandom().shuffle(password) |
| return ''.join(password) |
|
|
| @staticmethod |
| def _human_delay(mean: float = 3.0, std: float = 1.0, minimum: float = 1.0) -> None: |
| """模拟人类操作间隔（正态分布延迟）""" |
| delay = max(random.gauss(mean, std), minimum) |
| time.sleep(delay) |
|
|
| def _check_ip_location(self) -> Tuple[bool, Optional[str]]: |
| """检查 IP 地理位置""" |
| try: |
| return self.http_client.check_ip_location() |
| except Exception as e: |
| self._log(f"检查 IP 地理位置失败: {e}", "error") |
| return False, None |
|
|
| def _create_email(self) -> bool: |
| """创建邮箱""" |
| try: |
| self._log(f"正在创建 {self.email_service.service_type.value} 邮箱，先给新账号整个收件箱...") |
| self.email_info = self.email_service.create_email() |
|
|
| if not self.email_info or "email" not in self.email_info: |
| self._log("创建邮箱失败: 返回信息不完整", "error") |
| return False |
|
|
| self.email = self.email_info["email"] |
| self._log(f"邮箱已就位，地址新鲜出炉: {self.email}") |
| return True |
|
|
| except Exception as e: |
| self._log(f"创建邮箱失败: {e}", "error") |
| return False |
|
|
| def _start_oauth(self) -> bool: |
| """开始 OAuth 流程""" |
| try: |
| self._log("开始 OAuth 授权流程，去门口刷个脸...") |
| self.oauth_start = self.oauth_manager.start_oauth() |
| self._log(f"OAuth URL 已备好，通道已经打开: {self.oauth_start.auth_url[:80]}...") |
| return True |
| except Exception as e: |
| self._log(f"生成 OAuth URL 失败: {e}", "error") |
| return False |
|
|
| def _init_session(self) -> bool: |
| """初始化会话""" |
| try: |
| self.session = self.http_client.session |
| return True |
| except Exception as e: |
| self._log(f"初始化会话失败: {e}", "error") |
| return False |
|
|
| def _warm_entry_flow(self) -> None: |
| """轻量模拟 chatgpt.com 首页访问，建立真实 cookie jar 和引荐链。""" |
| try: |
| self._log("模拟浏览器访问 chatgpt.com 首页...") |
| self.session.get( |
| "https://chatgpt.com/", |
| headers=self.http_client.profile.navigation_headers(), |
| timeout=15, |
| allow_redirects=True, |
| ) |
| self._human_delay(mean=2.0, std=0.8, minimum=1.0) |
| self._log("chatgpt.com 首页访问完成，cookie jar 已预热") |
| except Exception as e: |
| self._log(f"chatgpt.com 预热失败（不影响注册）: {e}", "warning") |
|
|
| def _get_device_id(self) -> Optional[str]: |
| """获取 Device ID""" |
| if not self.oauth_start: |
| return None |
|
|
| max_attempts = 3 |
| for attempt in range(1, max_attempts + 1): |
| try: |
| if not self.session: |
| self.session = self.http_client.session |
|
|
| response = self.session.get( |
| self.oauth_start.auth_url, |
| headers=self.http_client.profile.navigation_headers(), |
| timeout=20 |
| ) |
| did = self.session.cookies.get("oai-did") |
|
|
| if did: |
| self._log(f"Device ID: {did}") |
| return did |
|
|
| self._log( |
| f"获取 Device ID 失败: 未返回 oai-did Cookie (HTTP {response.status_code}, 第 {attempt}/{max_attempts} 次)", |
| "warning" if attempt < max_attempts else "error" |
| ) |
| except Exception as e: |
| self._log( |
| f"获取 Device ID 失败: {e} (第 {attempt}/{max_attempts} 次)", |
| "warning" if attempt < max_attempts else "error" |
| ) |
|
|
| if attempt < max_attempts: |
| time.sleep(attempt) |
| self.http_client.close() |
| self.session = self.http_client.session |
|
|
| return None |
|
|
| def _get_session_user_agent(self) -> Optional[str]: |
| session_headers = getattr(self.session, "headers", None) or {} |
| return session_headers.get("User-Agent") or session_headers.get("user-agent") |
|
|
| def _build_oauth_json_headers(self, referer: str) -> Dict[str, str]: |
| session_cookies = getattr(self.session, "cookies", None) or {} |
| device_id = None |
| if hasattr(session_cookies, "get"): |
| device_id = session_cookies.get("oai-did") |
| elif isinstance(session_cookies, dict): |
| device_id = session_cookies.get("oai-did") |
|
|
| return self.http_client.profile.json_api_headers( |
| referer=referer, |
| oai_did=device_id, |
| ) |
|
|
| def _check_sentinel(self, did: str) -> Optional[str]: |
| """检查 Sentinel 拦截""" |
| try: |
| sen_token = self.http_client.check_sentinel(did) |
| if sen_token: |
| self._log(f"Sentinel token 获取成功") |
| return sen_token |
| self._log("Sentinel 检查失败: 未获取到 token", "warning") |
| return None |
|
|
| except Exception as e: |
| self._log(f"Sentinel 检查异常: {e}", "warning") |
| return None |
|
|
| def _submit_auth_start( |
| self, |
| did: str, |
| sen_token: Optional[str], |
| *, |
| screen_hint: Optional[str], |
| referer: str, |
| log_label: str, |
| record_existing_account: bool = True, |
| ) -> SignupFormResult: |
| """ |
| 提交授权入口表单 |
| |
| Returns: |
| SignupFormResult: 提交结果，包含账号状态判断 |
| """ |
| try: |
| request_payload = { |
| "username": { |
| "value": self.email, |
| "kind": "email", |
| }, |
| } |
| if screen_hint: |
| request_payload["screen_hint"] = screen_hint |
|
|
| request_body = json.dumps(request_payload) |
|
|
| headers = self.http_client.profile.json_api_headers( |
| referer=referer, |
| oai_did=session_cookies.get("oai-did") if hasattr(session_cookies := (getattr(self.session, "cookies", None) or {}), "get") else None, |
| ) |
|
|
| if sen_token: |
| sentinel = json.dumps({ |
| "p": "", |
| "t": "", |
| "c": sen_token, |
| "id": did, |
| "flow": "authorize_continue", |
| }) |
| headers["openai-sentinel-token"] = sentinel |
|
|
| response = self.session.post( |
| OPENAI_API_ENDPOINTS["signup"], |
| headers=headers, |
| data=request_body, |
| ) |
|
|
| self._log(f"{log_label}状态: {response.status_code}") |
|
|
| if response.status_code != 200: |
| return SignupFormResult( |
| success=False, |
| error_message=f"HTTP {response.status_code}: {response.text[:200]}" |
| ) |
|
|
| |
| try: |
| response_data = response.json() |
| self._remember_workspace_payload(f"{screen_hint}_start", response_data) |
| self._remember_navigation_from_response(f"{screen_hint}_start", response) |
| page_type = response_data.get("page", {}).get("type", "") |
| self._log(f"响应页面类型: {page_type}") |
|
|
| is_existing = page_type == OPENAI_PAGE_TYPES["EMAIL_OTP_VERIFICATION"] |
|
|
| if is_existing: |
| self._otp_sent_at = time.time() |
| if record_existing_account: |
| self._log(f"检测到已注册账号，将自动切换到登录流程") |
| self._is_existing_account = True |
| else: |
| self._log("登录流程已触发，等待系统自动发送的验证码") |
|
|
| return SignupFormResult( |
| success=True, |
| page_type=page_type, |
| is_existing_account=is_existing, |
| response_data=response_data |
| ) |
|
|
| except Exception as parse_error: |
| self._log(f"解析响应失败: {parse_error}", "warning") |
| |
| return SignupFormResult(success=True) |
|
|
| except Exception as e: |
| self._log(f"{log_label}失败: {e}", "error") |
| return SignupFormResult(success=False, error_message=str(e)) |
|
|
| def _submit_signup_form( |
| self, |
| did: str, |
| sen_token: Optional[str], |
| *, |
| record_existing_account: bool = True, |
| ) -> SignupFormResult: |
| """提交注册入口表单。""" |
| return self._submit_auth_start( |
| did, |
| sen_token, |
| screen_hint="signup", |
| referer="https://auth.openai.com/create-account", |
| log_label="提交注册表单", |
| record_existing_account=record_existing_account, |
| ) |
|
|
| def _submit_login_start( |
| self, |
| did: str, |
| sen_token: Optional[str], |
| *, |
| screen_hint: Optional[str] = None, |
| ) -> SignupFormResult: |
| """提交登录入口表单。""" |
| return self._submit_auth_start( |
| did, |
| sen_token, |
| screen_hint=screen_hint, |
| referer="https://auth.openai.com/log-in", |
| log_label="提交登录入口", |
| record_existing_account=False, |
| ) |
|
|
| def _submit_login_password(self) -> SignupFormResult: |
| """提交登录密码，进入邮箱验证码页面。""" |
| try: |
| |
| self._human_delay(mean=3.5, std=1.0, minimum=2.0) |
|
|
| response = self.session.post( |
| OPENAI_API_ENDPOINTS["password_verify"], |
| headers=self.http_client.profile.json_api_headers( |
| referer="https://auth.openai.com/log-in/password", |
| ), |
| data=json.dumps({"password": self.password}), |
| ) |
|
|
| self._log(f"提交登录密码状态: {response.status_code}") |
|
|
| if response.status_code != 200: |
| return SignupFormResult( |
| success=False, |
| error_message=f"HTTP {response.status_code}: {response.text[:200]}" |
| ) |
|
|
| response_data = response.json() |
| self._remember_workspace_payload("login_password", response_data) |
| self._remember_navigation_from_response("login_password", response) |
| page_type = response_data.get("page", {}).get("type", "") |
| self._log(f"登录密码响应页面类型: {page_type}") |
|
|
| is_existing = page_type == OPENAI_PAGE_TYPES["EMAIL_OTP_VERIFICATION"] |
| if is_existing: |
| self._otp_sent_at = time.time() |
| self._log("登录密码校验通过，等待系统自动发送的验证码") |
|
|
| return SignupFormResult( |
| success=True, |
| page_type=page_type, |
| is_existing_account=is_existing, |
| response_data=response_data, |
| ) |
|
|
| except Exception as e: |
| self._log(f"提交登录密码失败: {e}", "error") |
| return SignupFormResult(success=False, error_message=str(e)) |
|
|
| def _reset_auth_flow(self) -> None: |
| """重置会话，准备重新发起 OAuth 流程。""" |
| self.http_client.close() |
| self.session = None |
| self.oauth_start = None |
| self.session_token = None |
| self._otp_stage = "signup_otp" |
| self._otp_sent_at = None |
| self._session_bound_reauth_attempted = False |
| self._session_bound_reauth_otp_cycles = 0 |
| self._reset_workspace_context() |
|
|
| def _prepare_authorize_flow(self, label: str) -> Tuple[Optional[str], Optional[str]]: |
| """初始化当前阶段的授权流程，返回 device id 和 sentinel token。""" |
| self._log(f"{label}: 先把会话热热身...") |
| if not self._init_session(): |
| return None, None |
|
|
| |
| self._warm_entry_flow() |
|
|
| self._log(f"{label}: OAuth 流程准备开跑，系好鞋带...") |
| if not self._start_oauth(): |
| return None, None |
|
|
| self._log(f"{label}: 领取 Device ID 通行证...") |
| did = self._get_device_id() |
| if not did: |
| return None, None |
|
|
| |
| self._human_delay(mean=2.0, std=0.7, minimum=1.0) |
|
|
| self._log(f"{label}: 解一道 Sentinel POW 小题，答对才给进...") |
| sen_token = self._check_sentinel(did) |
| if not sen_token: |
| return did, None |
|
|
| |
| self._human_delay(mean=1.5, std=0.5, minimum=0.8) |
|
|
| self._log(f"{label}: Sentinel 点头放行，继续前进") |
| return did, sen_token |
|
|
| def _resolve_oauth_callback_url(self) -> Tuple[Optional[str], Optional[str], Optional[str]]: |
| workspace_id = self._get_workspace_id() |
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
|
|
| if workspace_id: |
| self._workspace_context["resolved_workspace_id"] = workspace_id |
| self._oauth_resume_source = self._oauth_resume_source or "workspace_select_required" |
| callback_url = self._continue_from_workspace_selection(workspace_id) |
| if not callback_url: |
| return None, workspace_id, "选择 Workspace 失败" |
| return callback_url, workspace_id, None |
|
|
| if callback_url: |
| self._mark_workspace_resolution("callback_available_before_workspace") |
| self._oauth_resume_source = self._oauth_resume_source or "callback_found_from_validate_response" |
| return callback_url, None, None |
|
|
| callback_url = self._resume_oauth_callback() |
| if callback_url: |
| return callback_url, None, None |
|
|
| if self._workspace_context.get("reentered_login"): |
| return None, None, "OAuth 恢复链路重新进入登录页" |
| return None, None, "OAuth 续跑失败" |
|
|
| def _complete_token_exchange(self, result: RegistrationResult, skip_otp_validation: bool = False) -> bool: |
| """在登录态已建立后，继续完成 workspace 和 OAuth token 获取。""" |
| callback_url: Optional[str] = None |
| workspace_id: Optional[str] = result.workspace_id or None |
| resolution_error: Optional[str] = None |
|
|
| if self._account_created and not self._token_acquisition_requires_login: |
| self._log("建号后先尝试沿当前会话完成 OAuth，避免过早重新登录") |
| callback_url, workspace_id, resolution_error = self._resolve_oauth_callback_url() |
| if workspace_id: |
| result.workspace_id = workspace_id |
| if callback_url: |
| self._log("建号后当前会话已拿到 callback，跳过重新登录") |
| else: |
| self._log( |
| "建号后当前会话未完成 OAuth，回退到重新登录拿 token: " |
| f"{resolution_error or 'current_session_unresolved'}", |
| "warning", |
| ) |
| login_ready, login_error = self._restart_login_flow() |
| if not login_ready: |
| result.error_message = login_error |
| return False |
|
|
| if not callback_url: |
| if not skip_otp_validation: |
| otp_stage = "relogin_otp" if self._token_acquisition_requires_login else "signup_otp" |
| code = self._get_verification_code( |
| stage=otp_stage, |
| timeout=self._get_verification_timeout(otp_stage), |
| ) |
| if not code: |
| result.error_message = "获取验证码失败" |
| return False |
|
|
| if not self._validate_verification_code(code): |
| result.error_message = "验证码校验失败" |
| return False |
|
|
| about_you_url = self._find_about_you_candidate() |
| if about_you_url and self._about_you_resume_attempts < 3: |
| if getattr(self, "_last_create_account_user_exists", False): |
| self._log("检测到 about-you 且曾经触发过 user_already_exists 死锁，放弃尝试该账号以防封IP", level="error") |
| result.error_message = "账号状态异常(半成品死锁)" |
| return False |
| |
| self._about_you_resume_attempts += 1 |
| self._log( |
| "恢复链路命中 about-you，先补完建号再重启登录: " |
| f"{self._sanitize_url_for_log(about_you_url)} " |
| f"(attempt {self._about_you_resume_attempts}/3)" |
| ) |
| callback_url = None |
| if self._account_created: |
| self._log( |
| f"恢复链路命中 about-you，但账号已建成 (_account_created=True)，" |
| f"跳过 create_account，直接尝试 authorize replay 拿 callback..." |
| ) |
| callback_url = self._attempt_authorize_replay(allow_session_bound_reauth=False, reentry_log_level="warning") |
| if callback_url: |
| self._log("账号已建成 + authorize replay 成功拿到 callback，跳过建号循环") |
| else: |
| callback_url = self._attempt_direct_consent_recovery() |
| if callback_url: |
| self._log("账号已建成 + direct consent fallback 成功拿到 callback") |
| else: |
| if self._about_you_resume_attempts >= 2: |
| result.error_message = "账号已建成但无法获取 OAuth callback" |
| return False |
| login_ready, login_error = self._restart_login_flow() |
| if not login_ready: |
| result.error_message = login_error |
| return False |
| return self._complete_token_exchange(result) |
| else: |
| self._oauth_resume_source = self._oauth_resume_source or "continue_url_resume" |
| self._set_recovery_debug_summary( |
| "about_you_requires_account_creation", |
| about_you_url=about_you_url, |
| attempt=self._about_you_resume_attempts, |
| ) |
| if not self._create_user_account(allow_existing_account=True, about_you_url=about_you_url): |
| result.error_message = "创建用户账户失败" |
| return False |
|
|
| unresolved_existing_account_without_resume = False |
| if not callback_url: |
| self._account_created = True |
| callback_after_create = str(self._workspace_context.get("callback_url") or "").strip() |
| workspace_after_create = None |
| auth_cookie = self.session.cookies.get("oai-client-auth-session") if self.session else None |
| if auth_cookie: |
| workspace_after_create = self._get_workspace_id() |
| unresolved_existing_account_without_resume = False |
|
|
| self._log( |
| "about-you 建号后快照: " |
| f"callback_after_create={'yes' if callback_after_create else 'no'}, " |
| f"workspace_after_create={workspace_after_create or '-'}, " |
| f"auth_cookie_present={'yes' if auth_cookie else 'no'}, " |
| f"resume_url_after_create={self._sanitize_url_for_log(self._workspace_context.get('resume_url')) or '-'}, " |
| f"user_exists={self._last_create_account_user_exists}, " |
| f"user_exists_attempt={self._about_you_user_exists_without_resume_attempts}" |
| ) |
|
|
| if callback_after_create or workspace_after_create: |
| self._about_you_user_exists_without_resume_attempts = 0 |
| callback_url, workspace_id, resolution_error = self._resolve_oauth_callback_url() |
| if callback_url: |
| if workspace_id: |
| result.workspace_id = workspace_id |
| self._log("about-you 处理后当前会话已拿到 callback，直接继续换 token") |
| else: |
| self._log("about-you 处理后当前会话未完成 callback，回退到重新登录续跑", "warning") |
| else: |
| callback_url = None |
| workspace_id = None |
| resolution_error = None |
| resume_url_after_create = str(self._workspace_context.get("resume_url") or "").strip() |
| if resume_url_after_create and not self._is_about_you_url(resume_url_after_create): |
| self._log( |
| "about-you 处理后当前会话仍未暴露 callback/workspace，但已缓存恢复 URL，先沿当前会话续跑" |
| ) |
| callback_url = self._resume_oauth_callback() |
| if callback_url: |
| self._about_you_user_exists_without_resume_attempts = 0 |
| self._log("about-you 处理后通过当前会话恢复 URL 拿到 callback，直接继续换 token") |
| else: |
| resolution_error = ( |
| "OAuth 恢复链路重新进入登录页" |
| if self._workspace_context.get("reentered_login") |
| else "OAuth 续跑失败" |
| ) |
| self._set_recovery_debug_summary( |
| "about_you_user_exists_resume_attempt_failed", |
| about_you_url=about_you_url, |
| resume_url=resume_url_after_create, |
| error=resolution_error, |
| ) |
| self._log("about-you 处理后恢复 URL 未拿到 callback，回退到重新登录续跑", "warning") |
| unresolved_existing_account_without_resume = ( |
| self._last_create_account_user_exists |
| and ( |
| not resume_url_after_create |
| or self._is_about_you_url(resume_url_after_create) |
| ) |
| ) |
| if unresolved_existing_account_without_resume: |
| self._log( |
| "about-you 处理后当前会话仍未暴露 callback/workspace，先尝试同会话 authorize replay" |
| ) |
| callback_url = self._attempt_authorize_replay( |
| allow_session_bound_reauth=False, |
| reentry_log_level="warning", |
| ) |
| if callback_url: |
| self._about_you_user_exists_without_resume_attempts = 0 |
| self._set_recovery_debug_summary( |
| "about_you_user_exists_authorize_replay_callback_resolved", |
| about_you_url=about_you_url, |
| callback_url=callback_url, |
| ) |
| self._log( |
| "about-you/user_already_exists 后通过同会话 authorize replay 拿到 callback，直接继续换 token" |
| ) |
| else: |
| login_challenge_url = self._find_cached_resume_candidate("login_challenge_resume") |
| if login_challenge_url: |
| self._log( |
| "about-you/user_already_exists 后 authorize replay 命中过 login_challenge，" |
| "尝试 direct consent fallback", |
| "warning", |
| ) |
| callback_url = self._attempt_direct_consent_recovery() |
| if callback_url: |
| self._about_you_user_exists_without_resume_attempts = 0 |
| self._set_recovery_debug_summary( |
| "about_you_user_exists_direct_consent_callback_resolved", |
| about_you_url=about_you_url, |
| callback_url=callback_url, |
| ) |
| self._log( |
| "about-you/user_already_exists 后通过 direct consent fallback 拿到 callback，" |
| "直接继续换 token" |
| ) |
| else: |
| resolution_error = ( |
| "OAuth 恢复链路重新进入登录页" |
| if self._workspace_context.get("reentered_login") |
| else "OAuth 续跑失败" |
| ) |
| self._about_you_user_exists_without_resume_attempts += 1 |
| self._oauth_resume_source = "about_you_user_exists_without_resume" |
| self._set_recovery_debug_summary( |
| "about_you_user_exists_without_resume", |
| attempt=self._about_you_user_exists_without_resume_attempts, |
| about_you_url=about_you_url, |
| error_code=self._last_create_account_error_code, |
| error=resolution_error, |
| ) |
| self._mark_workspace_resolution( |
| "about_you_user_exists_without_resume", |
| "about-you 返回 user_already_exists，但当前会话未暴露 callback/workspace", |
| ) |
| self._log( |
| "about-you/user_already_exists 后同会话 authorize replay 未拿到 callback，回退到重新登录续跑", |
| "warning", |
| ) |
|
|
| if not callback_url: |
| if ( |
| unresolved_existing_account_without_resume |
| and self._about_you_user_exists_without_resume_attempts >= 2 |
| ): |
| result.error_message = "about-you 返回 user_already_exists，但连续两次未暴露 callback/workspace" |
| self._oauth_resume_source = "about_you_user_exists_without_resume_exhausted" |
| self._set_recovery_debug_summary( |
| "about_you_user_exists_without_resume_exhausted", |
| attempt=self._about_you_user_exists_without_resume_attempts, |
| about_you_url=about_you_url, |
| error_code=self._last_create_account_error_code, |
| ) |
| self._mark_workspace_resolution( |
| "about_you_user_exists_without_resume", |
| result.error_message, |
| ) |
| self._log( |
| "about-you/user_already_exists 连续两次未拿到 callback/workspace，停止重复登录以避免触发 OTP 限制", |
| "error", |
| ) |
| return False |
| login_ready, login_error = self._restart_login_flow() |
| if not login_ready: |
| result.error_message = login_error |
| return False |
| return self._complete_token_exchange(result) |
| else: |
| callback_url, workspace_id, resolution_error = self._resolve_oauth_callback_url() |
|
|
| if workspace_id: |
| result.workspace_id = workspace_id |
| if not callback_url: |
| result.error_message = resolution_error or "OAuth 续跑失败" |
| return False |
|
|
| token_info = self._handle_oauth_callback(callback_url) |
| if not token_info: |
| result.error_message = "处理 OAuth 回调失败" |
| return False |
|
|
| result.account_id = token_info.get("account_id", "") |
| result.access_token = token_info.get("access_token", "") |
| result.refresh_token = token_info.get("refresh_token", "") |
| result.id_token = token_info.get("id_token", "") |
| result.password = self.password or "" |
| result.source = "login" if self._is_existing_account else "register" |
|
|
| if not result.workspace_id: |
| workspace_id = self._get_workspace_id() |
| if not workspace_id: |
| self._mark_workspace_resolution("token_acquired_without_workspace", "获取 Workspace ID 失败") |
| result.error_message = "获取 Workspace ID 失败" |
| return False |
| result.workspace_id = workspace_id |
|
|
| session_cookie = self.session.cookies.get("__Secure-next-auth.session-token") |
| if session_cookie: |
| self.session_token = session_cookie |
| result.session_token = session_cookie |
|
|
| return True |
|
|
| def _restart_login_flow(self) -> Tuple[bool, str]: |
| """新注册账号完成建号后，重新发起一次登录流程拿 token。""" |
| self._token_acquisition_requires_login = True |
| self._log( |
| "重新登录前保留当前恢复快照: " |
| f"callback={self._sanitize_url_for_log(self._workspace_context.get('callback_url')) or '-'}, " |
| f"resume={self._sanitize_url_for_log(self._workspace_context.get('resume_url')) or '-'}, " |
| f"terminal={self._sanitize_url_for_log(self._workspace_context.get('redirect_terminal_url')) or '-'}, " |
| f"resume_source={self._oauth_resume_source or '-'}", |
| "warning", |
| ) |
| self._log("注册这边忙完了，再走一趟登录把 token 请出来，收个尾...") |
| self._reset_auth_flow() |
|
|
| did, sen_token = self._prepare_authorize_flow("重新登录") |
| if not did: |
| return False, "重新登录时获取 Device ID 失败" |
| if not sen_token: |
| return False, "重新登录时 Sentinel POW 验证失败" |
|
|
| import time |
| max_429_retries = 3 |
| backoff_delays = [15, 30, 45] |
| login_start_result = None |
| for i in range(max_429_retries + 1): |
| login_start_result = self._submit_login_start(did, sen_token, screen_hint="login") |
| if login_start_result.success: |
| break |
| if "429" in login_start_result.error_message and i < max_429_retries: |
| delay = backoff_delays[i] |
| self._log(f"重新登录遇到 HTTP 429 速率限制，等待 {delay}s 后重试 (第 {i+1} 次)...", "warning") |
| time.sleep(delay) |
| sen_token = self._check_sentinel(did) or sen_token |
| else: |
| break |
| |
| if not login_start_result.success: |
| return False, f"重新登录提交邮箱失败: {login_start_result.error_message}" |
| if login_start_result.page_type != OPENAI_PAGE_TYPES["LOGIN_PASSWORD"]: |
| return False, f"重新登录未进入密码页面: {login_start_result.page_type or 'unknown'}" |
|
|
| password_result = self._submit_login_password() |
| if not password_result.success: |
| return False, f"重新登录提交密码失败: {password_result.error_message}" |
| if not password_result.is_existing_account: |
| return False, f"重新登录未进入验证码页面: {password_result.page_type or 'unknown'}" |
| self._prepare_relogin_otp_flow("重新登录") |
| return True, "" |
|
|
| |
| |
| |
|
|
| @staticmethod |
| def _extract_session_token_from_cookie_text(cookie_text: str) -> str: |
| """从 Cookie 文本中提取 next-auth session token（兼容分片）。""" |
| text = str(cookie_text or "") |
| if not text: |
| return "" |
|
|
| direct = re.search(r"(?:^|[;,]\s*)(?:__|_)Secure-next-auth\.session-token=([^;,]*)", text) |
| if direct: |
| direct_val = str(direct.group(1) or "").strip().strip('"').strip("'") |
| if direct_val: |
| return direct_val |
|
|
| parts = re.findall(r"(?:__|_)Secure-next-auth\.session-token\.(\d+)=([^;,]*)", text) |
| if not parts: |
| return "" |
|
|
| chunk_map = {} |
| for idx, value in parts: |
| try: |
| clean_value = str(value or "").strip().strip('"').strip("'") |
| if clean_value: |
| chunk_map[int(idx)] = clean_value |
| except Exception: |
| continue |
| if not chunk_map: |
| return "" |
| return "".join(chunk_map[i] for i in sorted(chunk_map.keys())) |
|
|
| @staticmethod |
| def _extract_session_token_from_cookie_jar(cookie_jar) -> str: |
| """从 requests CookieJar 中提取 session token。""" |
| if not cookie_jar: |
| return "" |
| for name in ("__Secure-next-auth.session-token", "_Secure-next-auth.session-token"): |
| val = str(cookie_jar.get(name) or "").strip() |
| if val: |
| return val |
| return "" |
|
|
| @staticmethod |
| def _flatten_set_cookie_headers(response) -> str: |
| """将 response 的所有 Set-Cookie 头拼成一行文本。""" |
| if response is None: |
| return "" |
| headers = getattr(response, "headers", None) |
| if not headers: |
| return "" |
| try: |
| raw = headers.get_all("Set-Cookie") if hasattr(headers, "get_all") else [] |
| except Exception: |
| raw = [] |
| if not raw: |
| val = str(headers.get("Set-Cookie") or "").strip() |
| return val |
| return "; ".join(str(v) for v in raw if v) |
|
|
| @staticmethod |
| def _extract_request_cookie_header(response) -> str: |
| """从 response.request 提取发送时的 Cookie header。""" |
| if response is None: |
| return "" |
| req = getattr(response, "request", None) |
| if not req: |
| return "" |
| headers = getattr(req, "headers", {}) or {} |
| return str(headers.get("Cookie") or "").strip() |
|
|
| def _dump_session_cookies(self) -> str: |
| """将当前 session 的所有 cookie 导出为文本。""" |
| if not self.session: |
| return "" |
| parts = [] |
| try: |
| for cookie in self.session.cookies: |
| parts.append(f"{cookie.name}={cookie.value}") |
| except Exception: |
| pass |
| return "; ".join(parts) |
|
|
| def _warmup_chatgpt_session(self) -> None: |
| """仅预热 chatgpt 首页，避免提前消费一次性 continue_url。""" |
| try: |
| self.session.get( |
| "https://chatgpt.com/", |
| headers={ |
| "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| "referer": "https://auth.openai.com/", |
| "user-agent": ( |
| "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " |
| "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" |
| ), |
| }, |
| timeout=20, |
| ) |
| except Exception as e: |
| self._log(f"chatgpt 首页预热异常: {e}", "warning") |
|
|
| def _capture_auth_session_tokens(self, result, access_hint=None) -> bool: |
| """ |
| 直接通过 /api/auth/session 捕获 session_token + access_token。 |
| """ |
| access_token = str(access_hint or "").strip() |
| set_cookie_text = "" |
| request_cookie_text = "" |
| try: |
| headers = { |
| "accept": "application/json", |
| "referer": "https://chatgpt.com/", |
| "origin": "https://chatgpt.com", |
| "user-agent": ( |
| "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " |
| "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" |
| ), |
| "cache-control": "no-cache", |
| "pragma": "no-cache", |
| } |
| if access_token: |
| headers["authorization"] = f"Bearer {access_token}" |
| response = self.session.get( |
| "https://chatgpt.com/api/auth/session", |
| headers=headers, |
| timeout=20, |
| ) |
| set_cookie_text = self._flatten_set_cookie_headers(response) |
| request_cookie_text = self._extract_request_cookie_header(response) |
| if response.status_code == 200: |
| try: |
| data = response.json() or {} |
| access_from_json = str(data.get("accessToken") or "").strip() |
| if access_from_json: |
| access_token = access_from_json |
| except Exception: |
| pass |
| else: |
| self._log(f"/api/auth/session 返回异常状态: {response.status_code}", "warning") |
| except Exception as e: |
| self._log(f"获取 auth/session 失败: {e}", "warning") |
|
|
| |
| session_token = self._extract_session_token_from_cookie_jar(self.session.cookies) |
|
|
| |
| if not session_token: |
| session_token = self._extract_session_token_from_cookie_text(self._dump_session_cookies()) |
|
|
| |
| if not session_token and set_cookie_text: |
| session_token = self._extract_session_token_from_cookie_text(set_cookie_text) |
|
|
| |
| if not session_token and request_cookie_text: |
| session_token = self._extract_session_token_from_cookie_text(request_cookie_text) |
|
|
| |
| if (not session_token) and access_token: |
| try: |
| retry_response = self.session.get( |
| "https://chatgpt.com/api/auth/session", |
| headers={ |
| "accept": "application/json", |
| "referer": "https://chatgpt.com/", |
| "origin": "https://chatgpt.com", |
| "user-agent": ( |
| "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " |
| "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" |
| ), |
| "authorization": f"Bearer {access_token}", |
| "cache-control": "no-cache", |
| "pragma": "no-cache", |
| }, |
| timeout=20, |
| ) |
| retry_set_cookie = self._flatten_set_cookie_headers(retry_response) |
| retry_request_cookie = self._extract_request_cookie_header(retry_response) |
| if not session_token: |
| session_token = self._extract_session_token_from_cookie_jar(self.session.cookies) |
| if not session_token: |
| session_token = self._extract_session_token_from_cookie_text(self._dump_session_cookies()) |
| if not session_token and retry_set_cookie: |
| session_token = self._extract_session_token_from_cookie_text(retry_set_cookie) |
| if not session_token and retry_request_cookie: |
| session_token = self._extract_session_token_from_cookie_text(retry_request_cookie) |
| except Exception as e: |
| self._log(f"Bearer 兜底换 session_token 失败: {e}", "warning") |
|
|
| if not session_token: |
| cookies_text = self._dump_session_cookies() |
| raw_direct_match = re.search( |
| r"(?:^|[;,]\s*)(?:__|_)Secure-next-auth\.session-token=([^;,]*)", |
| cookies_text, |
| ) |
| raw_direct_len = len(str(raw_direct_match.group(1) or "").strip()) if raw_direct_match else 0 |
| chunk_count = len(re.findall(r"(?:__|_)Secure-next-auth\.session-token\.(\d+)=", cookies_text)) |
| req_cookie_len = len(str(request_cookie_text or "").strip()) |
| self._log( |
| f"auth/session 仍未命中 session_token（raw_direct_len={raw_direct_len}, chunks={chunk_count}, req_cookie_len={req_cookie_len}）", |
| "warning", |
| ) |
|
|
| |
| did = "" |
| try: |
| did = str(self.session.cookies.get("oai-did") or "").strip() |
| except Exception: |
| did = "" |
| if did: |
| self.device_id = did |
|
|
| if session_token: |
| self.session_token = session_token |
| result.session_token = session_token |
| if access_token: |
| result.access_token = access_token |
|
|
| self._log( |
| "Auth Session 捕获结果: session_token=" |
| + ("有" if bool(result.session_token) else "无") |
| + ", access_token=" |
| + ("有" if bool(result.access_token) else "无") |
| ) |
| return bool(result.session_token and result.access_token) |
|
|
| def _follow_chatgpt_auth_redirects(self, start_url: str): |
| """ |
| 手动跟踪 chatgpt.com signin 后的 30x 重定向，识别 /api/auth/callback/openai。 |
| Returns: (callback_url, final_url) |
| """ |
| import urllib.parse |
|
|
| current_url = str(start_url or "").strip() |
| callback_url = "" |
| bridged_header_token = "" |
| if not current_url: |
| return "", "" |
|
|
| max_redirects = 12 |
| ua = ( |
| "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " |
| "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" |
| ) |
| for i in range(max_redirects): |
| self._log(f"会话桥接重定向 {i+1}/{max_redirects}: {current_url[:120]}...") |
| if "/api/auth/callback/openai" in current_url and not callback_url: |
| callback_url = current_url |
|
|
| resp = self.session.get( |
| current_url, |
| headers={ |
| "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| "referer": "https://chatgpt.com/", |
| "user-agent": ua, |
| }, |
| timeout=25, |
| allow_redirects=False, |
| ) |
|
|
| |
| set_cookie_text = self._flatten_set_cookie_headers(resp) |
| token_from_header = self._extract_session_token_from_cookie_text(set_cookie_text) |
| if token_from_header: |
| bridged_header_token = token_from_header |
| for name in ("__Secure-next-auth.session-token", "_Secure-next-auth.session-token"): |
| for domain in (".chatgpt.com", "chatgpt.com"): |
| try: |
| self.session.cookies.set(name, token_from_header, domain=domain, path="/") |
| except Exception: |
| continue |
| self._log( |
| f"会话桥接命中 Set-Cookie session_token（len={len(token_from_header)}）" |
| ) |
|
|
| if resp.status_code not in (301, 302, 303, 307, 308): |
| break |
|
|
| location = str(resp.headers.get("Location") or "").strip() |
| if not location: |
| break |
| current_url = urllib.parse.urljoin(current_url, location) |
|
|
| if callback_url and not str(current_url or "").startswith("https://chatgpt.com/"): |
| try: |
| self.session.get( |
| "https://chatgpt.com/", |
| headers={ |
| "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| "referer": current_url, |
| "user-agent": ua, |
| }, |
| timeout=20, |
| ) |
| except Exception: |
| pass |
|
|
| self._log( |
| f"会话桥接重定向结束: callback={'有' if callback_url else '无'}, " |
| f"set_cookie_token={'有' if bool(bridged_header_token) else '无'}, final={current_url[:120]}..." |
| ) |
| return callback_url, current_url |
|
|
| def _bootstrap_chatgpt_signin_for_session(self, result) -> bool: |
| """ |
| chatgpt.com 会话桥接：csrf -> signin/openai -> 跟随跳转 -> auth/session， |
| 目标是在 auth.openai.com 登录态已建立后，通过 chatgpt.com 拿到 session_token。 |
| """ |
| self._log("Session Token 还没就位，尝试 chatgpt.com 会话桥接...") |
| self._warmup_chatgpt_session() |
| csrf_token = "" |
| auth_url = "" |
| try: |
| csrf_resp = self.session.get( |
| "https://chatgpt.com/api/auth/csrf", |
| headers={ |
| "accept": "application/json", |
| "referer": "https://chatgpt.com/auth/login", |
| "origin": "https://chatgpt.com", |
| "user-agent": ( |
| "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " |
| "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" |
| ), |
| }, |
| timeout=20, |
| ) |
| if csrf_resp.status_code == 200: |
| csrf_token = str((csrf_resp.json() or {}).get("csrfToken") or "").strip() |
| else: |
| self._log(f"csrf 获取失败: HTTP {csrf_resp.status_code}", "warning") |
| except Exception as e: |
| self._log(f"csrf 获取异常: {e}", "warning") |
|
|
| if not csrf_token: |
| self._log("csrf token 为空，跳过会话桥接", "warning") |
| return False |
|
|
| try: |
| signin_resp = self.session.post( |
| "https://chatgpt.com/api/auth/signin/openai", |
| headers={ |
| "accept": "application/json", |
| "content-type": "application/x-www-form-urlencoded", |
| "origin": "https://chatgpt.com", |
| "referer": "https://chatgpt.com/auth/login", |
| "user-agent": ( |
| "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " |
| "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" |
| ), |
| }, |
| data={ |
| "csrfToken": csrf_token, |
| "callbackUrl": "https://chatgpt.com/", |
| "json": "true", |
| }, |
| timeout=20, |
| ) |
| if signin_resp.status_code == 200: |
| auth_url = str((signin_resp.json() or {}).get("url") or "").strip() |
| else: |
| self._log(f"signin/openai 失败: HTTP {signin_resp.status_code}", "warning") |
| except Exception as e: |
| self._log(f"signin/openai 异常: {e}", "warning") |
|
|
| if not auth_url: |
| self._log("signin/openai 未返回 auth_url，跳过会话桥接", "warning") |
| return False |
|
|
| callback_url = "" |
| final_url = auth_url |
| try: |
| callback_url, final_url = self._follow_chatgpt_auth_redirects(auth_url) |
| except Exception as e: |
| self._log(f"会话桥接重定向跟踪异常: {e}", "warning") |
| callback_url = "" |
| final_url = auth_url |
|
|
| |
| if callback_url and "error=" not in callback_url: |
| try: |
| self.session.get( |
| callback_url, |
| headers={ |
| "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| "referer": "https://chatgpt.com/auth/login", |
| "user-agent": ( |
| "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " |
| "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" |
| ), |
| }, |
| allow_redirects=True, |
| timeout=25, |
| ) |
| except Exception as e: |
| self._log(f"会话桥接 callback 补跳异常: {e}", "warning") |
| elif callback_url and "error=" in callback_url: |
| self._log(f"会话桥接回调返回错误参数: {callback_url[:140]}...", "warning") |
| else: |
| self._log(f"会话桥接未命中 callback，final_url={final_url[:120]}...", "warning") |
| |
| if "auth.openai.com/log-in" in str(final_url or "").lower(): |
| if not getattr(self, '_bridge_login_active', False): |
| self._log("会话桥接进入登录页，尝试自动登录后继续抓取 session_token...") |
| if self._bridge_login_for_session_token(result): |
| return True |
| else: |
| self._log("会话桥接进入登录页，但已处于桥接登录中，跳过递归", "warning") |
|
|
| self._warmup_chatgpt_session() |
| cookie_text = self._dump_session_cookies() |
| direct_token = self._extract_session_token_from_cookie_text(cookie_text) |
| has_direct = bool(direct_token) |
| chunk_count = len(re.findall(r"(?:__|_)Secure-next-auth\.session-token\.(\d+)=", cookie_text)) |
| if direct_token and not result.session_token: |
| self.session_token = direct_token |
| result.session_token = direct_token |
| self._log(f"会话桥接已缓存 session_token（len={len(direct_token)}）") |
| self._log( |
| f"会话桥接后 cookie 概览: direct={'有' if has_direct else '无'}, chunks={chunk_count}" |
| ) |
| return self._capture_auth_session_tokens(result, access_hint=result.access_token) |
|
|
| def _bridge_login_for_session_token(self, result) -> bool: |
| """ |
| 当 chatgpt signin/openai 跳回 auth.openai 登录页时，自动补一次登录流程： |
| login -> password -> email otp -> workspace -> auth/session。 |
| """ |
| try: |
| if not self.email or not self.password: |
| self._log("会话桥接自动登录缺少邮箱或密码，无法继续", "warning") |
| return False |
|
|
| did = "" |
| try: |
| did = str(self.session.cookies.get("oai-did") or "").strip() |
| except Exception: |
| did = "" |
| if not did: |
| did = str(uuid.uuid4()) |
| try: |
| self.session.cookies.set("oai-did", did, domain=".chatgpt.com", path="/") |
| except Exception: |
| pass |
| self.device_id = did |
|
|
| sen_token = self._check_sentinel(did) |
| login_start_result = self._submit_login_start(did, sen_token) |
| if not login_start_result.success: |
| self._log( |
| f"会话桥接自动登录入口失败: {login_start_result.error_message}", |
| "warning", |
| ) |
| return False |
| page_type = str(login_start_result.page_type or "").strip() |
|
|
| if page_type == OPENAI_PAGE_TYPES["EMAIL_OTP_VERIFICATION"]: |
| self._log("会话桥接自动登录已直达邮箱验证码页，跳过密码提交") |
| elif page_type == OPENAI_PAGE_TYPES["LOGIN_PASSWORD"]: |
| password_result = self._submit_login_password() |
| if not password_result.success: |
| self._log( |
| f"会话桥接自动登录提交密码失败: {password_result.error_message}", |
| "warning", |
| ) |
| return False |
| if not password_result.is_existing_account: |
| self._log( |
| f"会话桥接自动登录未进入邮箱验证码页: {password_result.page_type or 'unknown'}", |
| "warning", |
| ) |
| return False |
| else: |
| self._log( |
| f"会话桥接自动登录入口返回未知页面: {page_type or 'unknown'}", |
| "warning", |
| ) |
| return False |
|
|
| |
| bridge_otp_ok = False |
| code = self._get_verification_code(stage="relogin_otp", timeout=90) |
| if code: |
| bridge_otp_ok = self._validate_verification_code(code) |
| if not bridge_otp_ok: |
| |
| self._log("会话桥接自动登录首轮 OTP 未命中，重发重试...", "warning") |
| self._retrigger_login_otp() |
| code = self._get_verification_code(stage="relogin_otp", timeout=90) |
| if code: |
| bridge_otp_ok = self._validate_verification_code(code) |
| if not bridge_otp_ok: |
| self._log("会话桥接自动登录验证码校验失败", "warning") |
| return False |
|
|
| |
| self._log("会话桥接自动登录 OTP 通过，开始多路径抓取 token...") |
|
|
| |
| |
| |
| |
| cached_callback = str(self._workspace_context.get("callback_url") or "").strip() |
| if cached_callback and "/api/auth/callback/openai" in cached_callback: |
| self._log( |
| f"路径0: validate_otp 已捕获 chatgpt callback URL，直接 GET 换 token: " |
| f"{self._sanitize_url_for_log(cached_callback)}" |
| ) |
| try: |
| cb_resp = self.session.get( |
| cached_callback, |
| allow_redirects=True, |
| timeout=30, |
| headers={ |
| "User-Agent": ( |
| "Mozilla/5.0 (Windows NT 10.0; Win64; x64) " |
| "AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" |
| ), |
| "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| }, |
| ) |
| |
| st = "" |
| for cookie in self.session.cookies: |
| cookie_name = getattr(cookie, "name", "") |
| if "session-token" in cookie_name.lower() or cookie_name == "__Secure-next-auth.session-token": |
| st = getattr(cookie, "value", "") |
| break |
| if not st: |
| |
| set_cookie_headers = cb_resp.headers.get("set-cookie", "") |
| if "session-token=" in str(set_cookie_headers): |
| import re as _re |
| m = _re.search(r"session-token=([^;]+)", str(set_cookie_headers)) |
| if m: |
| st = m.group(1) |
| if st and len(st) > 20: |
| result.session_token = st |
| self.session_token = st |
| self._log(f"路径0: 直接 GET chatgpt callback 成功拿到 session_token ✓ (len={len(st)})") |
| |
| try: |
| self._warmup_chatgpt_session() |
| self._capture_auth_session_tokens(result, access_hint=result.access_token) |
| if result.access_token: |
| self._log(f"路径0: 补取 access_token 成功 ✓ (len={len(result.access_token)})") |
| else: |
| self._log("路径0: 补取 access_token 未命中（仅有 session_token）", "warning") |
| except Exception as e: |
| self._log(f"路径0: 补取 access_token 异常: {e}", "warning") |
| return True |
| else: |
| self._log( |
| f"路径0: GET chatgpt callback 完成但未找到 session_token " |
| f"(status={cb_resp.status_code}, cookies={len(list(self.session.cookies))}), " |
| f"继续尝试其他路径...", |
| "warning", |
| ) |
| except Exception as e: |
| self._log(f"路径0: GET chatgpt callback 异常: {e}，继续尝试其他路径...", "warning") |
| elif cached_callback: |
| self._log( |
| f"路径0: 已有 callback URL 但不是 chatgpt 类型，跳过直接 GET: " |
| f"{self._sanitize_url_for_log(cached_callback)}", |
| "warning", |
| ) |
|
|
| |
| self._warmup_chatgpt_session() |
|
|
| if self._capture_auth_session_tokens(result, access_hint=result.access_token): |
| self._log("会话桥接自动登录在 OTP 后直接命中 session_token ✓") |
| return True |
|
|
| |
| self._log("会话桥接自动登录: 路径1未命中，尝试补提交 about-you...") |
| self._create_user_account(allow_existing_account=True) |
| self._warmup_chatgpt_session() |
| if self._capture_auth_session_tokens(result, access_hint=result.access_token): |
| self._log("会话桥接自动登录在 about-you 后命中 session_token ✓") |
| return True |
|
|
| |
| self._log("会话桥接自动登录: 路径2未命中，尝试 workspace 路径...") |
| workspace_id = self._get_workspace_id() |
| if not workspace_id: |
| workspace_id = str(result.workspace_id or "").strip() |
| if workspace_id: |
| result.workspace_id = workspace_id |
| continue_url = self._select_workspace(workspace_id) |
| if continue_url: |
| callback_url, final_url = self._follow_redirects(continue_url) |
| self._log(f"会话桥接 workspace 路径: callback={'有' if callback_url else '无'}") |
| self._warmup_chatgpt_session() |
| if self._capture_auth_session_tokens(result, access_hint=result.access_token): |
| self._log("会话桥接自动登录 workspace 路径命中 session_token ✓") |
| return True |
|
|
| |
| self._log("会话桥接自动登录: 前3路径均未命中，重走 chatgpt signin...") |
| self._bridge_login_active = True |
| try: |
| if self._bootstrap_chatgpt_signin_for_session(result): |
| self._log("会话桥接自动登录二次 bootstrap 命中 session_token ✓") |
| return True |
| finally: |
| self._bridge_login_active = False |
|
|
| self._log("会话桥接自动登录所有路径均未命中 session_token", "warning") |
| return False |
| except Exception as e: |
| self._log(f"会话桥接自动登录异常: {e}", "warning") |
| return False |
|
|
| def _retrigger_login_otp(self) -> bool: |
| """在当前已登录会话中重新触发 OTP 发送。""" |
| self._log("尝试在当前会话中原地重发登录验证码...") |
| return self._send_verification_code( |
| stage="relogin_otp", |
| referer="https://auth.openai.com/email-verification", |
| allow_failure=True, |
| ) |
|
|
| def _complete_token_exchange_outlook(self, result: RegistrationResult) -> bool: |
| """ |
| Outlook 入口链路专属收尾路径： |
| 走「登录 OTP -> Workspace -> OAuth callback」主干， |
| 含 3 级 OTP 降级重试，避免 Outlook 轮询卡死。 |
| """ |
| self._log("Outlook 专属链路: 等待登录验证码...") |
|
|
| |
| attempted_codes: set = set() |
| code = self._get_verification_code( |
| stage="relogin_otp", |
| timeout=90, |
| ) |
| login_otp_ok = False |
| if code: |
| attempted_codes.add(code) |
| login_otp_ok = self._validate_verification_code(code) |
|
|
| |
| if not login_otp_ok: |
| self._log("登录验证码首轮未命中，尝试原地重发 OTP 后再校验...", "warning") |
| resent = self._retrigger_login_otp() |
| if resent: |
| code = self._get_verification_code( |
| stage="relogin_otp", |
| timeout=90, |
| ) |
| if code and code not in attempted_codes: |
| attempted_codes.add(code) |
| login_otp_ok = self._validate_verification_code(code) |
| elif code and code in attempted_codes: |
| self._log(f"原地重发后取到重复验证码 {code}，跳过", "warning") |
|
|
| |
| if not login_otp_ok: |
| self._log("登录验证码仍未命中，尝试完整重登后再校验...", "warning") |
| login_ready, login_error = self._restart_login_flow() |
| if not login_ready: |
| result.error_message = f"Outlook 重登失败: {login_error}" |
| return False |
|
|
| code = self._get_verification_code( |
| stage="relogin_otp", |
| timeout=120, |
| ) |
| if code and code not in attempted_codes: |
| attempted_codes.add(code) |
| login_otp_ok = self._validate_verification_code(code) |
| elif code and code in attempted_codes: |
| self._log(f"完整重登后取到重复验证码 {code}，跳过", "warning") |
|
|
| if not login_otp_ok: |
| result.error_message = "Outlook 登录验证码 3 级重试全部失败" |
| return False |
|
|
| |
| self._log("Outlook 专属链路: OTP 验证通过，补全 about-you 并启动 OAuth token recovery...") |
|
|
| |
| account_ok = self._create_user_account(allow_existing_account=True) |
| if account_ok: |
| self._account_created = True |
| self._log("Outlook 链路: about-you 建号/确认完成 ✓") |
| else: |
| self._log("Outlook 链路: about-you 建号失败，仍尝试获取 token...", "warning") |
|
|
| |
| fresh_callback_url = self._attempt_oauth_token_recovery() |
|
|
| if fresh_callback_url: |
| |
| token_info = self._handle_oauth_callback(fresh_callback_url) |
| if token_info: |
| result.account_id = token_info.get("account_id", "") |
| result.access_token = token_info.get("access_token", "") |
| result.refresh_token = token_info.get("refresh_token", "") |
| result.id_token = token_info.get("id_token", "") |
| result.password = self.password or "" |
| result.source = "login" if self._is_existing_account else "register" |
| self._log("Outlook 链路: OAuth token recovery 成功获取 access_token ✓") |
|
|
| |
| if not result.workspace_id: |
| result.workspace_id = self._get_workspace_id() or "" |
|
|
| |
| session_cookie = self.session.cookies.get("__Secure-next-auth.session-token") if self.session else None |
| if session_cookie: |
| self.session_token = session_cookie |
| result.session_token = session_cookie |
| else: |
| self._log("Outlook 链路: OAuth callback 处理失败", "warning") |
| else: |
| self._log("Outlook 链路: OAuth token recovery 未拿到 callback，回退到通用流程...", "warning") |
| |
| self._complete_token_exchange(result, skip_otp_validation=True) |
|
|
| |
| if not result.session_token: |
| self._log("Outlook 链路: 尝试 chatgpt 桥接辅助获取 session_token...", "warning") |
| try: |
| result.password = self.password or "" |
| result.source = "login" if self._is_existing_account else "register" |
| if self._bootstrap_chatgpt_signin_for_session(result): |
| self._log("Outlook 链路: chatgpt 会话桥接成功补充 session_token ✓") |
| else: |
| self._warmup_chatgpt_session() |
| self._capture_auth_session_tokens(result) |
| except Exception as e: |
| self._log(f"辅助 chatgpt 桥接异常（忽略）: {e}", "warning") |
|
|
| has_session = bool(result.session_token) |
| has_access = bool(result.access_token) |
| self._log( |
| f"Outlook 链路 token 捕获结果: session_token={'有' if has_session else '无'}, " |
| f"access_token={'有' if has_access else '无'}" |
| ) |
|
|
| if not has_session and not has_access: |
| result.error_message = "Outlook 链路: session_token 和 access_token 均未获取到" |
| return False |
|
|
| self._log("Outlook 专属链路完成: token 获取成功 ✓") |
| return True |
|
|
| def _attempt_oauth_token_recovery(self) -> Optional[str]: |
| """Outlook OTP 通过后的多层降级 OAuth token 恢复。 |
| |
| 策略层级： |
| Step A: strip prompt=login 重放原始 authorize URL（复用已满足的 login challenge） |
| Step B: 全新 OAuth + prompt=none + login_hint（静默 SSO 尝试） |
| |
| 返回 callback URL 或 None。 |
| """ |
| import urllib.parse |
|
|
| |
| callback = self._step_a_replay_authorize_without_prompt() |
| if callback: |
| return callback |
|
|
| |
| callback = self._step_b_fresh_oauth_silent() |
| if callback: |
| return callback |
|
|
| self._log("Outlook token recovery: Step A + Step B 均未获取 callback", "warning") |
| return None |
|
|
| |
| |
| |
| def _step_a_replay_authorize_without_prompt(self) -> Optional[str]: |
| """从原始 self.oauth_start.auth_url 中去掉 prompt=login 并手动跟踪重定向。""" |
| import urllib.parse |
|
|
| if not self.oauth_start: |
| self._log("Step A: 没有可用的原始 authorize URL，跳过", "warning") |
| return None |
|
|
| try: |
| original_url = self.oauth_start.auth_url |
| parsed = urllib.parse.urlsplit(original_url) |
| params = urllib.parse.parse_qs(parsed.query, keep_blank_values=True) |
| params.pop("prompt", None) |
| new_query = urllib.parse.urlencode( |
| {k: v[0] if isinstance(v, list) and len(v) == 1 else v for k, v in params.items()}, |
| doseq=True, |
| ) |
| replay_url = urllib.parse.urlunsplit( |
| (parsed.scheme, parsed.netloc, parsed.path, new_query, "") |
| ) |
| self._log( |
| f"Step A: strip prompt=login 重放: {self._sanitize_url_for_log(replay_url)}" |
| ) |
|
|
| |
| redirect_uri = self.oauth_start.redirect_uri |
| current_url = replay_url |
| max_hops = 12 |
| for hop in range(max_hops): |
| resp = self.session.get( |
| current_url, |
| headers={ |
| "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| "referer": "https://auth.openai.com/", |
| }, |
| allow_redirects=False, |
| timeout=20, |
| ) |
| location = str(resp.headers.get("Location") or "").strip() |
| self._log( |
| f"Step A hop {hop + 1}/{max_hops}: status={resp.status_code}, " |
| f"location={self._sanitize_url_for_log(location) or '-'}" |
| ) |
|
|
| |
| if resp.status_code not in (301, 302, 303, 307, 308): |
| final_url = str(resp.url or current_url) |
| resp_len = len(resp.text or "") if hasattr(resp, 'text') else 0 |
| self._log( |
| f"Step A: 终止于 status={resp.status_code}, " |
| f"url={self._sanitize_url_for_log(final_url)}, body_len={resp_len}" |
| ) |
| |
| if self._is_consent_url(final_url): |
| self._log("Step A: 终止于 consent 页（JS 渲染，HTTP 无法处理）", "warning") |
| break |
|
|
| if not location: |
| self._log("Step A: 重定向无 Location 头，终止", "warning") |
| break |
|
|
| |
| next_url = urllib.parse.urljoin(current_url, location) |
|
|
| |
| if "code=" in next_url and "state=" in next_url: |
| self._log(f"Step A: 在重定向中拿到 callback ✓") |
| return next_url |
|
|
| |
| |
| if next_url.startswith(redirect_uri): |
| self._log(f"Step A: 重定向目标是 redirect_uri (localhost)，直接提取 ✓") |
| return next_url |
|
|
| |
| if self._is_login_page_url(next_url): |
| self._log("Step A: 被重定向到 /log-in，login challenge 不匹配", "warning") |
| return None |
|
|
| current_url = next_url |
|
|
| self._log("Step A: 达到最大重定向次数或无 callback", "warning") |
| return None |
|
|
| except Exception as e: |
| self._log(f"Step A 异常: {e}", "warning") |
| return None |
|
|
| |
| |
| |
| def _step_b_fresh_oauth_silent(self) -> Optional[str]: |
| """生成全新 OAuth URL（prompt=none + login_hint），尝试静默 SSO。""" |
| import urllib.parse |
|
|
| try: |
| fresh_oauth = generate_oauth_url_no_prompt(login_hint=self.email) |
| self.oauth_start = fresh_oauth |
| self._log( |
| f"Step B: 发起静默 OAuth（prompt=none, login_hint={self.email}）: " |
| f"{self._sanitize_url_for_log(fresh_oauth.auth_url)}" |
| ) |
|
|
| redirect_uri = fresh_oauth.redirect_uri |
| current_url = fresh_oauth.auth_url |
| max_hops = 12 |
| for hop in range(max_hops): |
| resp = self.session.get( |
| current_url, |
| headers={ |
| "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| "referer": "https://auth.openai.com/", |
| }, |
| allow_redirects=False, |
| timeout=20, |
| ) |
| location = str(resp.headers.get("Location") or "").strip() |
| self._log( |
| f"Step B hop {hop + 1}/{max_hops}: status={resp.status_code}, " |
| f"location={self._sanitize_url_for_log(location) or '-'}" |
| ) |
|
|
| if resp.status_code not in (301, 302, 303, 307, 308): |
| final_url = str(resp.url or current_url) |
| resp_len = len(resp.text or "") if hasattr(resp, 'text') else 0 |
| self._log( |
| f"Step B: 终止于 status={resp.status_code}, " |
| f"url={self._sanitize_url_for_log(final_url)}, body_len={resp_len}" |
| ) |
| if self._is_consent_url(final_url): |
| self._log("Step B: 终止于 consent 页（JS 渲染，HTTP 无法处理）", "warning") |
| break |
|
|
| if not location: |
| break |
|
|
| next_url = urllib.parse.urljoin(current_url, location) |
|
|
| |
| if "code=" in next_url and "state=" in next_url: |
| self._log("Step B: 在重定向中拿到 callback ✓") |
| return next_url |
| if next_url.startswith(redirect_uri): |
| self._log("Step B: 重定向目标是 redirect_uri，直接提取 ✓") |
| return next_url |
|
|
| |
| if "error=login_required" in next_url or "error=consent_required" in next_url: |
| self._log(f"Step B: 静默授权返回错误: {self._sanitize_url_for_log(next_url)}", "warning") |
| return None |
|
|
| |
| if self._is_login_page_url(next_url): |
| self._log("Step B: 被重定向到 /log-in，静默授权失败", "warning") |
| return None |
|
|
| current_url = next_url |
|
|
| self._log("Step B: 达到最大重定向次数或无 callback", "warning") |
| return None |
|
|
| except Exception as e: |
| self._log(f"Step B 异常: {e}", "warning") |
| return None |
|
|
| |
| |
| |
| @staticmethod |
| def _is_login_page_url(url: str) -> bool: |
| """判断 URL 是否指向 OpenAI 的登录页面。""" |
| if not url: |
| return False |
| return ( |
| "/log-in" in url |
| or "/login" in url |
| or "/sign-in" in url |
| ) and "auth.openai.com" in url |
|
|
| @staticmethod |
| def _is_consent_url(url: str) -> bool: |
| """判断 URL 是否指向 consent 授权页面。""" |
| if not url: |
| return False |
| return "consent" in url.lower() and "auth.openai.com" in url |
|
|
| def _register_password(self, did: str, sen_token: Optional[str]) -> Tuple[bool, Optional[str]]: |
| """注册密码""" |
| try: |
| self._last_registration_error = None |
| |
| password = self._generate_password() |
| self.password = password |
| self._log(f"生成密码: {password}") |
|
|
| |
| register_body = json.dumps({ |
| "password": password, |
| "username": self.email |
| }) |
|
|
| headers = { |
| "referer": "https://auth.openai.com/create-account/password", |
| "accept": "application/json", |
| "content-type": "application/json", |
| } |
|
|
| if sen_token: |
| sentinel = json.dumps({ |
| "p": "", |
| "t": "", |
| "c": sen_token, |
| "id": did, |
| "flow": "authorize_continue", |
| }) |
| headers["openai-sentinel-token"] = sentinel |
|
|
| response = self.session.post( |
| OPENAI_API_ENDPOINTS["register"], |
| headers=headers, |
| data=register_body, |
| ) |
|
|
| self._log(f"提交密码状态: {response.status_code}") |
|
|
| if response.status_code != 200: |
| error_text = response.text[:500] |
| self._log(f"密码注册失败: {error_text}", "warning") |
|
|
| |
| try: |
| error_json = response.json() |
| error_msg = error_json.get("error", {}).get("message", "") |
| error_code = error_json.get("error", {}).get("code", "") |
| error_msg_lower = error_msg.lower() |
|
|
| if ( |
| "already" in error_msg_lower |
| or "exists" in error_msg_lower |
| or error_code == "user_exists" |
| or "failed to register username" in error_msg_lower |
| ): |
| self._last_registration_error = "邮箱已被占用或疑似已注册，请更换新的 Outlook 邮箱" |
| self._mark_email_as_registered("username_rejected_or_existing_account") |
| elif error_msg: |
| self._last_registration_error = f"注册密码失败: {error_msg}" |
| except Exception: |
| pass |
|
|
| if not self._last_registration_error: |
| self._last_registration_error = "注册密码失败" |
| return False, None |
|
|
| return True, password |
|
|
| except Exception as e: |
| self._log(f"密码注册失败: {e}", "error") |
| self._last_registration_error = "注册密码失败" |
| return False, None |
|
|
| def _mark_email_as_registered( |
| self, |
| register_failed_reason: str = "email_already_registered_on_openai", |
| ): |
| """标记邮箱为已注册状态（用于防止重复尝试）""" |
| try: |
| with get_db() as db: |
| |
| existing = crud.get_account_by_email(db, self.email) |
| if not existing: |
| |
| crud.create_account( |
| db, |
| email=self.email, |
| password="", |
| email_service=self.email_service.service_type.value, |
| email_service_id=self.email_info.get("service_id") if self.email_info else None, |
| status="failed", |
| extra_data={"register_failed_reason": register_failed_reason} |
| ) |
| self._log(f"已在数据库中标记邮箱 {self.email} 为已注册状态") |
| except Exception as e: |
| logger.warning(f"标记邮箱状态失败: {e}") |
|
|
| def _set_verification_stage(self, stage: str) -> None: |
| self._otp_stage = stage |
| if ( |
| self.email |
| and hasattr(self.email_service, "set_verification_stage") |
| ): |
| try: |
| self.email_service.set_verification_stage(self.email, stage) |
| except Exception as e: |
| logger.warning(f"同步 OTP 阶段失败: {e}") |
|
|
| def _get_verification_timeout(self, stage: Optional[str] = None) -> int: |
| actual_stage = stage or self._otp_stage |
| if ( |
| self.email_service.service_type == EmailServiceType.OUTLOOK |
| and actual_stage == "relogin_otp" |
| ): |
| return 180 |
| return 120 |
|
|
| def _send_verification_code( |
| self, |
| *, |
| stage: str = "signup_otp", |
| referer: str = "https://auth.openai.com/create-account/password", |
| allow_failure: bool = False, |
| ) -> bool: |
| """发送验证码""" |
| try: |
| self._set_verification_stage(stage) |
| self._otp_sent_at = time.time() |
|
|
| response = self.session.get( |
| OPENAI_API_ENDPOINTS["send_otp"], |
| headers={ |
| "referer": referer, |
| "accept": "application/json", |
| }, |
| ) |
|
|
| level = "warning" if allow_failure and response.status_code != 200 else "info" |
| self._log(f"{stage} verification send status: {response.status_code}", level) |
| return response.status_code == 200 |
|
|
| except Exception as e: |
| self._log( |
| f"{stage} verification send failed: {e}", |
| "warning" if allow_failure else "error", |
| ) |
| return False |
|
|
| def _get_verification_code( |
| self, |
| *, |
| stage: Optional[str] = None, |
| timeout: Optional[int] = None, |
| ) -> Optional[str]: |
| """获取验证码""" |
| try: |
| actual_stage = stage or self._otp_stage |
| actual_timeout = timeout or self._get_verification_timeout(actual_stage) |
| self._set_verification_stage(actual_stage) |
| self._log(f"Waiting for {actual_stage} verification code for {self.email}...") |
|
|
| email_id = self.email_info.get("service_id") if self.email_info else None |
| code = self.email_service.get_verification_code( |
| email=self.email, |
| email_id=email_id, |
| timeout=actual_timeout, |
| pattern=OTP_CODE_PATTERN, |
| otp_sent_at=self._otp_sent_at, |
| ) |
|
|
| if code: |
| self._log(f"Got {actual_stage} verification code: {code}") |
| self._log_email_service_verification_debug("OTP retrieval debug") |
| return code |
| self._log(f"Timed out waiting for {actual_stage} verification code", "error") |
| self._log_email_service_verification_debug("OTP retrieval debug") |
| return None |
|
|
| except Exception as e: |
| self._log(f"获取验证码失败: {e}", "error") |
| self._log_email_service_verification_debug("OTP retrieval debug") |
| return None |
|
|
| def _log_email_service_verification_debug(self, label: str) -> None: |
| if not self.email or not hasattr(self.email_service, "get_last_verification_debug"): |
| return |
|
|
| try: |
| debug = self.email_service.get_last_verification_debug(self.email) |
| except Exception as e: |
| logger.warning(f"读取邮箱验证码调试信息失败: {e}") |
| return |
|
|
| if not isinstance(debug, dict) or not debug: |
| return |
|
|
| parts = [ |
| f"stage={debug.get('stage') or '-'}", |
| f"polls={debug.get('poll_count') or 0}", |
| f"status={debug.get('last_status') or '-'}", |
| f"otp_sent_at={debug.get('otp_sent_at') or 0}", |
| f"min_ts={debug.get('min_timestamp') or 0}", |
| f"fresh_verifications={debug.get('fresh_verification_count') or 0}", |
| f"fresh_preferred={debug.get('fresh_preferred_sender_count') or 0}", |
| f"stale_preferred={debug.get('stale_preferred_sender_count') or 0}", |
| f"available_fresh_verifications={debug.get('available_fresh_verification_count') or 0}", |
| f"available_fresh_preferred={debug.get('available_fresh_preferred_sender_count') or 0}", |
| f"used_fresh_preferred={debug.get('used_fresh_preferred_sender_count') or 0}", |
| f"selected_sender={debug.get('selected_sender') or '-'}", |
| f"selected_code={debug.get('selected_code') or '-'}", |
| f"selected_ts={debug.get('selected_received_timestamp') or '-'}", |
| f"deferred_generic_only_polls={debug.get('deferred_generic_only_polls') or 0}", |
| ] |
|
|
| candidates = debug.get("candidate_summaries") or [] |
| if candidates: |
| formatted_candidates = [] |
| for item in candidates[:5]: |
| formatted_candidates.append( |
| "sender={sender},ts={ts},delta={delta},code={code},preferred={preferred}".format( |
| sender=item.get("sender") or "-", |
| ts=item.get("received_timestamp") or "-", |
| delta=item.get("delta_from_otp_sent") if item.get("delta_from_otp_sent") is not None else "-", |
| code=item.get("code") or "-", |
| preferred=item.get("is_preferred_sender") is True, |
| ) |
| ) |
| parts.append("candidates=" + " | ".join(formatted_candidates)) |
|
|
| self._log(f"{label}: " + "; ".join(parts)) |
|
|
| def _log_response_debug( |
| self, |
| label: str, |
| response: Any, |
| payload: Optional[Dict[str, Any]] = None, |
| *, |
| level: str = "info", |
| ) -> None: |
| if response is None: |
| return |
|
|
| headers = getattr(response, "headers", {}) or {} |
| request_id = "" |
| if isinstance(headers, dict): |
| request_id = ( |
| str(headers.get("x-request-id") or headers.get("request-id") or "").strip() |
| ) |
|
|
| parts = [ |
| f"status={getattr(response, 'status_code', '-')}", |
| f"url={self._sanitize_url_for_log(getattr(response, 'url', '') or '-')}", |
| ] |
| if request_id: |
| parts.append(f"request_id={request_id}") |
|
|
| if isinstance(payload, dict): |
| page_type = str((payload.get("page") or {}).get("type") or "").strip() |
| continue_url = str(payload.get("continue_url") or "").strip() |
| callback_url = str(payload.get("callback_url") or "").strip() |
| error_info = payload.get("error") or {} |
| error_code = str(error_info.get("code") or "").strip() |
| error_message = str(error_info.get("message") or "").strip() |
|
|
| if page_type: |
| parts.append(f"page_type={page_type}") |
| if continue_url: |
| parts.append(f"continue_url={self._sanitize_url_for_log(continue_url)}") |
| if callback_url: |
| parts.append(f"callback_url={self._sanitize_url_for_log(callback_url)}") |
| if error_code: |
| parts.append(f"error_code={error_code}") |
| if error_message: |
| parts.append(f"error_message={error_message[:240]}") |
|
|
| text_excerpt = str(getattr(response, "text", "") or "").strip() |
| if text_excerpt: |
| parts.append(f"text={text_excerpt[:240]}") |
|
|
| self._log(f"{label}: " + "; ".join(parts), level) |
|
|
| def _log_session_cookie_debug(self, label: str) -> None: |
| if not self.session: |
| return |
|
|
| parts = [] |
|
|
| auth_cookie = self.session.cookies.get("oai-client-auth-session") |
| if auth_cookie: |
| decoded_segments, failed_segments = self._decode_auth_cookie_json_segments(auth_cookie) |
| auth_parts = [ |
| f"decoded={len(decoded_segments)}", |
| f"failed={failed_segments}", |
| ] |
| if decoded_segments: |
| primary = decoded_segments[0] |
| for key in [ |
| "email", |
| "email_verified", |
| "email_verification_mode", |
| "original_screen_hint", |
| "session_id", |
| ]: |
| value = primary.get(key) |
| if value in (None, "", []): |
| continue |
| value_text = str(value) |
| if key == "session_id" and len(value_text) > 12: |
| value_text = value_text[:12] + "..." |
| auth_parts.append(f"{key}={value_text}") |
| parts.append("auth_cookie(" + ", ".join(auth_parts) + ")") |
| else: |
| parts.append("auth_cookie=missing") |
|
|
| next_auth_cookie = self.session.cookies.get("__Secure-next-auth.session-token") |
| if next_auth_cookie: |
| claims = _jwt_claims_no_verify(next_auth_cookie) |
| workspace_id = self._extract_workspace_id_from_data(claims) |
| claim_keys = ",".join(sorted(claims.keys())[:6]) if isinstance(claims, dict) else "-" |
| parts.append(f"next_auth(workspace={workspace_id or '-'}, keys={claim_keys or '-'})") |
| else: |
| parts.append("next_auth=missing") |
|
|
| for name in ["login_session", "auth_provider"]: |
| if self.session.cookies.get(name): |
| parts.append(f"{name}=present") |
|
|
| for name in ["auth-session-minimized", "unified_session_manifest"]: |
| cookie_value = self.session.cookies.get(name) |
| if not cookie_value: |
| continue |
| payloads = self._decode_cookie_json_payloads(cookie_value) |
| workspace_id = None |
| sample_keys = "-" |
| for payload in payloads: |
| workspace_id = self._extract_workspace_id_from_data(payload) |
| if workspace_id: |
| break |
| if payloads: |
| sample_keys = ",".join(sorted(payloads[0].keys())[:6]) or "-" |
| parts.append( |
| f"{name}(decoded={len(payloads)}, workspace={workspace_id or '-'}, keys={sample_keys})" |
| ) |
|
|
| self._log(f"{label}: " + "; ".join(parts)) |
|
|
| def _validate_verification_code(self, code: str) -> bool: |
| """验证验证码""" |
| try: |
| code_body = f'{{"code":"{code}"}}' |
|
|
| response = self.session.post( |
| OPENAI_API_ENDPOINTS["validate_otp"], |
| headers=self.http_client.profile.json_api_headers( |
| referer="https://auth.openai.com/email-verification", |
| ), |
| data=code_body, |
| ) |
|
|
| self._log(f"验证码校验状态: {response.status_code}") |
| try: |
| response_data = response.json() |
| except Exception: |
| response_data = None |
|
|
| self._log_response_debug( |
| "validate_otp response", |
| response, |
| response_data, |
| level="warning" if response.status_code != 200 else "info", |
| ) |
| self._log_session_cookie_debug("validate_otp cookies") |
| if response.status_code == 200: |
| self._remember_workspace_payload("validate_otp", response_data) |
| self._remember_navigation_from_response("validate_otp", response) |
| self._log_navigation_snapshot("验证码校验后导航快照") |
| return response.status_code == 200 |
|
|
| except Exception as e: |
| self._log(f"验证验证码失败: {e}", "error") |
| return False |
|
|
| def _prime_about_you_page(self, about_you_url: str) -> bool: |
| """预取 about-you 页面，尽量复用浏览器的会话建立顺序。""" |
| try: |
| candidate = str(about_you_url or "").strip() |
| if not candidate: |
| return True |
|
|
| self._log( |
| "预取 about-you 页面，补齐建号前会话状态: " |
| f"{self._sanitize_url_for_log(candidate)}" |
| ) |
| response = self.session.get( |
| candidate, |
| headers={ |
| "referer": "https://auth.openai.com/email-verification", |
| "accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| }, |
| timeout=20, |
| ) |
| self._log(f"about-you 页面状态: {response.status_code}") |
| self._log_response_debug("about_you_page response", response, level="info") |
| self._log_session_cookie_debug("about_you_page cookies") |
| self._remember_navigation_from_response("about_you_page", response) |
| self._log_navigation_snapshot("about-you 页面预取后导航快照") |
|
|
| if response.status_code >= 400: |
| self._log( |
| f"about-you 页面预取失败: HTTP {response.status_code}", |
| "warning", |
| ) |
| return False |
|
|
| return True |
|
|
| except Exception as e: |
| self._log(f"预取 about-you 页面失败: {e}", "error") |
| return False |
|
|
| def _create_user_account( |
| self, |
| allow_existing_account: bool = False, |
| about_you_url: Optional[str] = None, |
| ) -> bool: |
| """创建用户账户""" |
| try: |
| self._last_create_account_error_code = None |
| self._last_create_account_error_message = None |
| self._last_create_account_user_exists = False |
| if about_you_url and not self._prime_about_you_page(about_you_url): |
| return False |
|
|
| user_info = generate_random_user_info() |
| self._log(f"生成用户信息: {user_info['name']}, 生日: {user_info['birthdate']}") |
| create_account_body = json.dumps(user_info) |
|
|
| |
| self._human_delay(mean=3.0, std=0.8, minimum=2.0) |
|
|
| response = self.session.post( |
| OPENAI_API_ENDPOINTS["create_account"], |
| headers=self.http_client.profile.json_api_headers( |
| referer="https://auth.openai.com/about-you", |
| ), |
| data=create_account_body, |
| ) |
|
|
| self._log(f"账户创建状态: {response.status_code}") |
| try: |
| response_data = response.json() |
| except Exception: |
| response_data = None |
| self._log_response_debug( |
| "create_account response", |
| response, |
| response_data, |
| level="warning" if response.status_code != 200 else "info", |
| ) |
| self._log_session_cookie_debug("create_account cookies") |
| self._remember_workspace_payload("create_account", response_data) |
| self._remember_navigation_from_response("create_account", response) |
| self._log_navigation_snapshot("建号后导航快照") |
| page_type = "" |
| continue_url = "" |
| callback_hint = "" |
| if isinstance(response_data, dict): |
| page_type = str((response_data.get("page") or {}).get("type") or "").strip() |
| continue_url = str(response_data.get("continue_url") or "").strip() |
| callback_hint = str(response_data.get("callback_url") or "").strip() |
| response_keys = ",".join(sorted(response_data.keys())) if isinstance(response_data, dict) else "-" |
| self._log( |
| "create_account 快照: " |
| f"status={response.status_code}, " |
| f"page_type={page_type or '-'}, " |
| f"continue_url={self._sanitize_url_for_log(continue_url) or '-'}, " |
| f"callback_url={self._sanitize_url_for_log(callback_hint) or '-'}, " |
| f"response_keys={response_keys}" |
| ) |
|
|
| if response.status_code != 200: |
| error_payload = response_data if isinstance(response_data, dict) else None |
| error_info = error_payload.get("error", {}) if isinstance(error_payload, dict) else {} |
| error_code = str(error_info.get("code") or "").strip().lower() |
| error_message = str(error_info.get("message") or "").strip() |
| self._last_create_account_error_code = error_code or None |
| self._last_create_account_error_message = error_message or None |
|
|
| if error_code == "registration_disallowed" and self.email and "@" in self.email: |
| domain = self.email.rsplit("@", 1)[-1] |
| if domain: |
| self._blacklist_email_domain(domain) |
|
|
| error_message_lower = error_message.lower() |
| if allow_existing_account and ( |
| error_code == "user_already_exists" |
| or "already exists for this email address" in error_message_lower |
| ): |
| self._last_create_account_user_exists = True |
| self._log("about-you 建号返回 user_already_exists，按已建号继续恢复登录") |
| return True |
|
|
| error_text = response.text[:200] |
| if not error_text and error_payload is not None: |
| error_text = json.dumps(error_payload, ensure_ascii=False)[:200] |
| self._log(f"账户创建失败: {error_text}", "warning") |
| return False |
|
|
| return True |
|
|
| except Exception as e: |
| self._log(f"创建账户失败: {e}", "error") |
| return False |
|
|
| def _blacklist_email_domain(self, domain: str) -> None: |
| """将被 OpenAI 拒绝的邮箱域名加入黑名单""" |
| try: |
| with get_db() as db: |
| setting = crud.get_setting(db, "email.domain_blacklist") |
| if setting and setting.value: |
| try: |
| blacklist = json.loads(setting.value) |
| except (json.JSONDecodeError, TypeError): |
| blacklist = [] |
| else: |
| blacklist = [] |
|
|
| domain_lower = domain.lower().strip() |
| if domain_lower not in blacklist: |
| blacklist.append(domain_lower) |
| crud.set_setting( |
| db, |
| key="email.domain_blacklist", |
| value=json.dumps(blacklist), |
| description="被 OpenAI 拒绝注册的邮箱域名黑名单", |
| category="email", |
| ) |
| self._log(f"已将域名 {domain_lower} 加入黑名单 (共 {len(blacklist)} 个)") |
| else: |
| self._log(f"域名 {domain_lower} 已在黑名单中，跳过") |
| except Exception as e: |
| logger.warning(f"写入邮箱域名黑名单失败: {e}") |
|
|
| def _decode_auth_cookie_json_segments(self, auth_cookie: str) -> Tuple[list, int]: |
| import base64 |
| from urllib.parse import unquote |
|
|
| decoded_segments = [] |
| failed_segments = 0 |
| seen_payloads = set() |
| candidates = [str(auth_cookie or "").strip()] |
| decoded_cookie = unquote(candidates[0]) if candidates and candidates[0] else "" |
| if decoded_cookie and decoded_cookie != candidates[0]: |
| candidates.append(decoded_cookie) |
|
|
| for candidate in candidates: |
| if not candidate: |
| continue |
|
|
| normalized = candidate |
| if ( |
| (normalized.startswith('"') and normalized.endswith('"')) |
| or (normalized.startswith("'") and normalized.endswith("'")) |
| ): |
| normalized = normalized[1:-1] |
|
|
| segments = [segment for segment in normalized.split(".") if segment] |
| if normalized and "." in normalized: |
| first_segment = normalized.split(".", 1)[0] |
| if first_segment: |
| segments.insert(0, first_segment) |
|
|
| for segment in segments: |
| try: |
| pad = "=" * ((4 - (len(segment) % 4)) % 4) |
| decoded = base64.urlsafe_b64decode((segment + pad).encode("ascii")) |
| decoded_json = json.loads(decoded.decode("utf-8")) |
| if isinstance(decoded_json, dict): |
| payload_key = json.dumps(decoded_json, sort_keys=True, ensure_ascii=True) |
| if payload_key not in seen_payloads: |
| seen_payloads.add(payload_key) |
| decoded_segments.append(decoded_json) |
| except Exception: |
| failed_segments += 1 |
| return decoded_segments, failed_segments |
|
|
| def _decode_cookie_json_payloads(self, cookie_value: Any) -> List[Dict[str, Any]]: |
| import base64 |
| from urllib.parse import unquote |
|
|
| queue = [str(cookie_value or "").strip()] |
| seen_candidates = set() |
| seen_payloads = set() |
| payloads: List[Dict[str, Any]] = [] |
|
|
| def remember_payload(payload: Any) -> None: |
| if isinstance(payload, dict): |
| payload_key = json.dumps(payload, sort_keys=True, ensure_ascii=True) |
| if payload_key in seen_payloads: |
| return |
| seen_payloads.add(payload_key) |
| payloads.append(payload) |
| return |
| if isinstance(payload, list): |
| for item in payload: |
| if isinstance(item, (dict, list)): |
| remember_payload(item) |
| elif isinstance(item, str) and item.strip(): |
| queue.append(item.strip()) |
|
|
| while queue: |
| candidate = str(queue.pop(0) or "").strip() |
| if not candidate or candidate in seen_candidates: |
| continue |
| seen_candidates.add(candidate) |
|
|
| if ( |
| (candidate.startswith('"') and candidate.endswith('"')) |
| or (candidate.startswith("'") and candidate.endswith("'")) |
| ): |
| queue.append(candidate[1:-1].strip()) |
|
|
| decoded_candidate = unquote(candidate) |
| if decoded_candidate and decoded_candidate != candidate: |
| queue.append(decoded_candidate) |
|
|
| try: |
| decoded_json = json.loads(candidate) |
| except Exception: |
| decoded_json = None |
| if decoded_json is not None: |
| if isinstance(decoded_json, str): |
| queue.append(decoded_json.strip()) |
| else: |
| remember_payload(decoded_json) |
|
|
| base64_candidates = [candidate] |
| if "." in candidate: |
| first_segment = candidate.split(".", 1)[0].strip() |
| if first_segment: |
| base64_candidates.append(first_segment) |
| base64_candidates.extend( |
| segment.strip() for segment in candidate.split(".") if segment.strip() |
| ) |
|
|
| for segment in base64_candidates: |
| try: |
| pad = "=" * ((4 - (len(segment) % 4)) % 4) |
| decoded_text = base64.urlsafe_b64decode((segment + pad).encode("ascii")).decode("utf-8") |
| except Exception: |
| continue |
| decoded_text = decoded_text.strip() |
| if decoded_text: |
| queue.append(decoded_text) |
|
|
| return payloads |
|
|
| def _collect_interesting_text_fragments_from_data( |
| self, |
| data: Any, |
| fragments: List[str], |
| seen: set, |
| ) -> None: |
| if isinstance(data, str): |
| fragment = self._normalize_response_text(data) |
| if not fragment: |
| return |
| fragment_lower = fragment.lower() |
| interesting_tokens = ( |
| "http://", |
| "https://", |
| "localhost", |
| "callback", |
| "continue_url", |
| "workspace", |
| "workspaces", |
| "organization", |
| "orgs", |
| "consent", |
| "/api/", |
| ) |
| if any(token in fragment_lower for token in interesting_tokens): |
| if fragment not in seen: |
| seen.add(fragment) |
| fragments.append(fragment) |
| return |
|
|
| if isinstance(data, dict): |
| for value in data.values(): |
| self._collect_interesting_text_fragments_from_data(value, fragments, seen) |
| return |
|
|
| if isinstance(data, list): |
| for item in data: |
| self._collect_interesting_text_fragments_from_data(item, fragments, seen) |
|
|
| def _extract_app_router_push_payloads_from_text(self, text: Any) -> List[str]: |
| normalized = self._normalize_response_text(text) |
| if not normalized: |
| return [] |
|
|
| import re |
|
|
| payloads: List[str] = [] |
| seen = set() |
| for match in re.finditer(r'push\(\s*', normalized): |
| prefix = normalized[max(0, match.start() - 96):match.start()].lower() |
| if "__next_f" not in prefix: |
| continue |
| payload_text = self._extract_json_block_from_text(normalized, match.end()) |
| if payload_text and payload_text not in seen: |
| seen.add(payload_text) |
| payloads.append(payload_text) |
|
|
| return payloads |
|
|
| def _extract_app_router_text_fragments_from_text(self, text: Any) -> List[str]: |
| fragments: List[str] = [] |
| seen = set() |
| for payload_text in self._extract_app_router_push_payloads_from_text(text): |
| try: |
| decoded = json.loads(payload_text) |
| except Exception: |
| continue |
| self._collect_interesting_text_fragments_from_data(decoded, fragments, seen) |
|
|
| return fragments |
|
|
| def _extract_json_payload_candidates_from_fragment(self, fragment: str) -> List[str]: |
| candidate = self._normalize_response_text(fragment) |
| if not candidate: |
| return [] |
|
|
| import re |
|
|
| payloads: List[str] = [] |
| seen = set() |
| hints = [ |
| "workspaces", |
| "workspace", |
| "callback_url", |
| "continue_url", |
| "redirect_url", |
| "location", |
| "orgs", |
| "organization", |
| ] |
|
|
| for hint in hints: |
| for match in re.finditer(re.escape(hint), candidate, re.IGNORECASE): |
| lower_bound = max(0, match.start() - 4096) |
| start_index = candidate.rfind("{", lower_bound, match.start() + 1) |
| while start_index != -1: |
| payload_text = self._extract_json_block_from_text(candidate, start_index) |
| if payload_text and match.start() < start_index + len(payload_text): |
| if payload_text not in seen: |
| seen.add(payload_text) |
| payloads.append(payload_text) |
| break |
| start_index = candidate.rfind("{", lower_bound, start_index) |
|
|
| return payloads |
|
|
| def _reset_workspace_context(self) -> None: |
| self._workspace_context = { |
| "payloads": {}, |
| "continue_url": None, |
| "callback_url": None, |
| "resume_url": None, |
| "resume_source": None, |
| "redirect_locations": [], |
| "token_info": None, |
| "navigation_urls": [], |
| "redirect_terminal_url": None, |
| "redirect_terminal_status": None, |
| "reentered_login": False, |
| "last_login_challenge_url": None, |
| "last_recovery_debug_summary": None, |
| "resolved_workspace_id": None, |
| } |
| self._workspace_resolution_source = None |
| self._workspace_resolution_error = None |
| self._oauth_resume_source = None |
|
|
| def _sanitize_url_for_log(self, url: Optional[str]) -> str: |
| candidate = str(url or "").strip() |
| if not candidate: |
| return "" |
| try: |
| import urllib.parse |
|
|
| parsed = urllib.parse.urlsplit(candidate) |
| query_pairs = urllib.parse.parse_qsl(parsed.query, keep_blank_values=True) |
| sanitized_query = [] |
| for key, value in query_pairs: |
| if key.lower() in { |
| "code", |
| "state", |
| "id_token", |
| "access_token", |
| "refresh_token", |
| "login_challenge", |
| "consent_challenge", |
| }: |
| value = "<redacted>" |
| elif len(value) > 24: |
| value = f"{value[:8]}...{value[-4:]}" |
| sanitized_query.append((key, value)) |
| return urllib.parse.urlunsplit( |
| ( |
| parsed.scheme, |
| parsed.netloc, |
| parsed.path, |
| urllib.parse.urlencode(sanitized_query), |
| parsed.fragment, |
| ) |
| ) |
| except Exception: |
| return candidate |
|
|
| def _set_recovery_debug_summary(self, reason: str, **details: Any) -> None: |
| parts = [reason] |
| for key, value in details.items(): |
| text = str(value or "").strip() |
| if not text: |
| continue |
| if "url" in key.lower(): |
| text = self._sanitize_url_for_log(text) |
| parts.append(f"{key}={text}") |
| self._workspace_context["last_recovery_debug_summary"] = "; ".join(parts) |
|
|
| def _find_cached_resume_candidate(self, resume_source: str) -> Optional[str]: |
| navigation_urls = self._workspace_context.get("navigation_urls", []) or [] |
| for item in reversed(navigation_urls): |
| candidate = str(item.get("url") or "").strip() |
| source = str(item.get("source") or "").strip() |
| if candidate and self._classify_resume_source(source, candidate) == resume_source: |
| return candidate |
| return None |
|
|
| def _is_about_you_url(self, url: Optional[str]) -> bool: |
| candidate = str(url or "").strip().lower() |
| if not candidate: |
| return False |
| return "/about-you" in candidate or candidate.endswith("about_you") |
|
|
| def _extract_about_you_candidate_from_data(self, data: Any) -> Optional[str]: |
| if isinstance(data, dict): |
| for key, value in data.items(): |
| if isinstance(value, str): |
| value_text = value.strip() |
| if self._is_about_you_url(value_text): |
| return value_text |
| if str(key).strip().lower() == "type" and value_text.lower() in {"about_you", "about-you"}: |
| return "https://auth.openai.com/about-you" |
| candidate = self._extract_about_you_candidate_from_data(value) |
| if candidate: |
| return candidate |
| elif isinstance(data, list): |
| for item in data: |
| candidate = self._extract_about_you_candidate_from_data(item) |
| if candidate: |
| return candidate |
| return None |
|
|
| def _find_about_you_candidate(self) -> Optional[str]: |
| resume_url = str(self._workspace_context.get("resume_url") or "").strip() |
| if self._is_about_you_url(resume_url): |
| return resume_url |
|
|
| payloads = self._workspace_context.get("payloads", {}) or {} |
| for payload in reversed(list(payloads.values())): |
| candidate = self._extract_about_you_candidate_from_data(payload) |
| if candidate: |
| return candidate |
|
|
| navigation_urls = self._workspace_context.get("navigation_urls", []) or [] |
| for item in reversed(navigation_urls): |
| candidate = str(item.get("url") or "").strip() |
| if self._is_about_you_url(candidate): |
| return candidate |
|
|
| return None |
|
|
| def _resume_candidate_priority(self, source_name: str, candidate: str) -> int: |
| candidate_lower = str(candidate or "").strip().lower() |
| source_lower = str(source_name or "").strip().lower() |
| if not candidate_lower: |
| return -1 |
|
|
| priority = 0 |
| if self._is_login_page_url(candidate): |
| priority = max(priority, 10) |
| if "/email-verification" in candidate_lower: |
| priority = max(priority, 20) |
| if "login_challenge=" in candidate_lower: |
| priority = max(priority, 30) |
| if "consent_challenge=" in candidate_lower: |
| priority = max(priority, 35) |
| if "/add-phone" in candidate_lower: |
| priority = max(priority, 36) |
| if "/sign-in-with-chatgpt/" in candidate_lower or "/consent" in candidate_lower: |
| priority = max(priority, 38) |
| if "/workspace/select" in candidate_lower: |
| priority = max(priority, 42) |
| if "/organization/select" in candidate_lower: |
| priority = max(priority, 45) |
| if self._is_about_you_url(candidate): |
| priority = max(priority, 40) |
| if "/api/oauth/oauth2/auth" in candidate_lower: |
| priority = max(priority, 50) |
|
|
| if "validate_otp" in source_lower: |
| priority += 3 |
| elif "login_password" in source_lower: |
| priority += 2 |
| elif "login_start" in source_lower: |
| priority += 1 |
|
|
| return priority |
|
|
| def _remember_resume_candidate(self, source_name: str, candidate: Optional[str]) -> None: |
| candidate_text = str(candidate or "").strip() |
| if not candidate_text: |
| return |
|
|
| resume_source = self._classify_resume_source(source_name, candidate_text) |
| if not resume_source: |
| return |
|
|
| current_resume = str(self._workspace_context.get("resume_url") or "").strip() |
| if not current_resume: |
| self._workspace_context["resume_url"] = candidate_text |
| self._workspace_context["resume_source"] = resume_source |
| return |
|
|
| if current_resume == candidate_text: |
| return |
|
|
| current_priority = self._resume_candidate_priority( |
| str(self._workspace_context.get("resume_source") or ""), |
| current_resume, |
| ) |
| candidate_priority = self._resume_candidate_priority(source_name, candidate_text) |
|
|
| if candidate_priority > current_priority: |
| self._log( |
| f"Resume candidate upgraded: " |
| f"current={self._sanitize_url_for_log(current_resume) or '-'}; " |
| f"new={self._sanitize_url_for_log(candidate_text)}" |
| ) |
| self._workspace_context["resume_url"] = candidate_text |
| self._workspace_context["resume_source"] = resume_source |
| return |
|
|
| self._log( |
| f"Resume candidate ignored: " |
| f"current={self._sanitize_url_for_log(current_resume) or '-'}; " |
| f"new={self._sanitize_url_for_log(candidate_text)}" |
| ) |
|
|
| def _log_navigation_snapshot(self, label: str) -> None: |
| self._log( |
| f"{label}: callback={self._sanitize_url_for_log(self._workspace_context.get('callback_url')) or '-'}, " |
| f"resume={self._sanitize_url_for_log(self._workspace_context.get('resume_url')) or '-'}, " |
| f"terminal={self._sanitize_url_for_log(self._workspace_context.get('redirect_terminal_url')) or '-'}, " |
| f"candidates={len(self._workspace_context.get('navigation_urls', []) or [])}" |
| ) |
|
|
| def _log_navigation_candidates(self, label: str, limit: int = 8) -> None: |
| items = self._workspace_context.get("navigation_urls", []) or [] |
| if not items: |
| self._log(f"{label}: no navigation candidates recorded") |
| return |
| tail = items[-limit:] |
| formatted = " | ".join( |
| f"{item.get('source')}={self._sanitize_url_for_log(item.get('url'))}" |
| for item in tail |
| ) |
| self._log(f"{label}: {formatted}") |
|
|
| def _remember_workspace_payload(self, name: str, payload: Optional[Dict[str, Any]]) -> None: |
| if not isinstance(payload, dict): |
| return |
|
|
| self._workspace_context.setdefault("payloads", {})[name] = payload |
| self._log( |
| f"Payload[{name}] keys: {','.join(sorted(payload.keys())) or '-'}" |
| ) |
|
|
| callback_url = self._extract_callback_url_from_data(payload) |
| if callback_url and not self._workspace_context.get("callback_url"): |
| self._workspace_context["callback_url"] = callback_url |
| self._oauth_resume_source = self._oauth_resume_source or f"callback_found_from_{name}_payload" |
|
|
| resume_url = self._extract_resume_url_from_data(payload) |
| if resume_url: |
| self._remember_resume_candidate(f"{name}_continue_url", resume_url) |
|
|
| def _remember_navigation_candidate( |
| self, |
| source_name: str, |
| url: Optional[str], |
| base_url: Optional[str] = None, |
| ) -> None: |
| candidate = str(url or "").strip() |
| if not candidate: |
| return |
|
|
| if base_url: |
| import urllib.parse |
|
|
| candidate = urllib.parse.urljoin(base_url, candidate) |
|
|
| self._workspace_context.setdefault("navigation_urls", []).append( |
| {"source": source_name, "url": candidate} |
| ) |
|
|
| if "code=" in candidate and "state=" in candidate and not self._workspace_context.get("callback_url"): |
| self._workspace_context["callback_url"] = candidate |
| if ( |
| not self._oauth_resume_source |
| or ( |
| "about_you" in source_name.lower() |
| and self._oauth_resume_source in { |
| "continue_url_resume", |
| "resume_url_found_after_validate_otp", |
| "resume_url_found_from_navigation", |
| } |
| ) |
| ): |
| self._oauth_resume_source = f"callback_found_from_{source_name}" |
| return |
|
|
| resume_source = self._classify_resume_source(source_name, candidate) |
| if resume_source: |
| self._remember_resume_candidate(source_name, candidate) |
| if resume_source == "login_challenge_resume": |
| self._workspace_context["last_login_challenge_url"] = candidate |
|
|
| def _extract_consent_script_asset_urls(self, base_url: str, text: Any) -> List[str]: |
| normalized = self._normalize_response_text(text) |
| if not normalized: |
| return [] |
|
|
| import urllib.parse |
|
|
| urls: List[str] = [] |
| seen = set() |
| for match in re.finditer(r'<script[^>]+src=["\']([^"\']+)["\']', normalized, re.IGNORECASE): |
| src = str(match.group(1) or "").strip() |
| if not src: |
| continue |
| candidate = urllib.parse.urljoin(base_url or "https://auth.openai.com", src) |
| parsed = urllib.parse.urlsplit(candidate) |
| if parsed.scheme not in {"http", "https"}: |
| continue |
| if parsed.netloc and parsed.netloc != "auth.openai.com": |
| continue |
| if candidate in seen: |
| continue |
| seen.add(candidate) |
| urls.append(candidate) |
| return urls |
|
|
| def _inspect_consent_script_assets(self, source_name: str, final_url: str, response_text: Any) -> None: |
| script_urls = self._extract_consent_script_asset_urls(final_url, response_text) |
| if not script_urls: |
| self._log(f"Navigation source={source_name}: consent_script_assets=0") |
| return |
|
|
| self._log( |
| "Navigation source=" |
| f"{source_name}: consent_script_assets={len(script_urls)} " |
| + " | ".join(self._sanitize_url_for_log(url) for url in script_urls[:6]) |
| ) |
|
|
| import os |
| import urllib.parse |
|
|
| hint_values: List[str] = [] |
| hint_seen = set() |
| for script_index, script_url in enumerate(script_urls[:6], start=1): |
| try: |
| headers = {"accept": "*/*"} |
| user_agent = self._get_session_user_agent() |
| if user_agent: |
| headers["user-agent"] = user_agent |
| if final_url: |
| headers["referer"] = final_url |
|
|
| asset_response = self.session.get( |
| script_url, |
| headers=headers, |
| timeout=15, |
| ) |
| asset_text = self._normalize_response_text(getattr(asset_response, "text", "") or "") |
| if not asset_text: |
| continue |
|
|
| asset_name = os.path.basename(urllib.parse.urlsplit(script_url).path) or f"asset-{script_index}" |
| asset_lower = asset_text.lower() |
| for token in ("clientaction", "workspace/select", "organization/select"): |
| if token not in asset_lower: |
| continue |
| hint = f"{asset_name}:{token}" |
| if hint in hint_seen: |
| continue |
| hint_seen.add(hint) |
| hint_values.append(hint) |
|
|
| asset_candidates = self._extract_navigation_candidates_from_text(asset_text) |
| for candidate_index, candidate in enumerate(asset_candidates, start=1): |
| self._remember_navigation_candidate( |
| f"{source_name}_script_{script_index}_candidate_{candidate_index}", |
| candidate, |
| base_url=script_url, |
| ) |
|
|
| asset_payloads = self._extract_embedded_payloads_from_text(asset_text) |
| for payload_index, payload in enumerate(asset_payloads, start=1): |
| self._remember_workspace_payload( |
| f"{source_name}_script_{script_index}_payload_{payload_index}", |
| payload, |
| ) |
| except Exception as e: |
| self._log( |
| "Navigation source=" |
| f"{source_name}: consent_script_fetch_failed=" |
| f"{self._sanitize_url_for_log(script_url)} error={e}", |
| "warning", |
| ) |
|
|
| if hint_values: |
| self._log( |
| f"Navigation source={source_name}: consent_bundle_hints=" |
| + " | ".join(hint_values[:12]) |
| ) |
|
|
| def _remember_navigation_from_response(self, source_name: str, response: Any) -> None: |
| if response is None: |
| return |
|
|
| self._log( |
| f"Navigation source={source_name}: status={getattr(response, 'status_code', '-')}, " |
| f"url={self._sanitize_url_for_log(getattr(response, 'url', '') or '-')}" |
| ) |
| final_url = str(getattr(response, "url", "") or "").strip() |
| self._remember_navigation_candidate(f"{source_name}_response_url", final_url) |
|
|
| headers = getattr(response, "headers", {}) or {} |
| location = headers.get("Location") if isinstance(headers, dict) else None |
| self._remember_navigation_candidate(f"{source_name}_location", location, base_url=final_url) |
|
|
| history = getattr(response, "history", []) or [] |
| for idx, history_item in enumerate(history, start=1): |
| history_url = str(getattr(history_item, "url", "") or "").strip() |
| self._remember_navigation_candidate(f"{source_name}_history_{idx}_url", history_url) |
| history_headers = getattr(history_item, "headers", {}) or {} |
| history_location = history_headers.get("Location") if isinstance(history_headers, dict) else None |
| self._remember_navigation_candidate( |
| f"{source_name}_history_{idx}_location", |
| history_location, |
| base_url=history_url, |
| ) |
|
|
| response_text = getattr(response, "text", "") or "" |
| text_candidates = self._extract_navigation_candidates_from_text(response_text) |
| if text_candidates: |
| self._log( |
| f"Navigation source={source_name}: text_candidates=" |
| f"{' | '.join(self._sanitize_url_for_log(candidate) for candidate in text_candidates[:6])}" |
| ) |
| for idx, candidate in enumerate(text_candidates, start=1): |
| self._remember_navigation_candidate(f"{source_name}_text_{idx}", candidate, base_url=final_url) |
|
|
| app_router_fragments = self._extract_app_router_text_fragments_from_text(response_text) |
| if app_router_fragments: |
| self._log( |
| f"Navigation source={source_name}: app_router_fragments={len(app_router_fragments)}" |
| ) |
|
|
| embedded_payloads = self._extract_embedded_payloads_from_text(response_text) |
| if embedded_payloads: |
| self._log( |
| f"Navigation source={source_name}: embedded_payloads={len(embedded_payloads)}" |
| ) |
| for idx, payload in enumerate(embedded_payloads, start=1): |
| self._remember_workspace_payload(f"{source_name}_text_payload_{idx}", payload) |
|
|
| if self._is_consent_url(final_url): |
| normalized_text = self._normalize_response_text(response_text) |
| self._log( |
| f"Navigation source={source_name}: consent_diag text_len={len(normalized_text)}, " |
| f"text_candidates={len(text_candidates)}, " |
| f"embedded_payloads={len(embedded_payloads)}, " |
| f"app_router_fragments={len(app_router_fragments)}" |
| ) |
| self._inspect_consent_script_assets(source_name, final_url, response_text) |
| if normalized_text and not text_candidates and not embedded_payloads and not app_router_fragments: |
| excerpt = re.sub(r"\s+", " ", normalized_text)[:240] |
| self._log(f"Navigation source={source_name}: consent_excerpt={excerpt}") |
|
|
| def _normalize_response_text(self, text: Any) -> str: |
| raw_text = str(text or "").strip() |
| if not raw_text: |
| return "" |
|
|
| import html |
| import re |
|
|
| normalized = html.unescape(raw_text) |
| normalized = re.sub( |
| r"\\+u([0-9a-fA-F]{4})", |
| lambda match: chr(int(match.group(1), 16)), |
| normalized, |
| ) |
| normalized = normalized.replace("\\/", "/") |
| return normalized |
|
|
| def _extract_json_block_from_text(self, text: str, start_index: int) -> Optional[str]: |
| candidate = str(text or "") |
| if start_index < 0 or start_index >= len(candidate): |
| return None |
|
|
| index = start_index |
| while index < len(candidate) and candidate[index].isspace(): |
| index += 1 |
| if index >= len(candidate) or candidate[index] not in "{[": |
| return None |
|
|
| opening = candidate[index] |
| closing = "}" if opening == "{" else "]" |
| depth = 0 |
| in_string = False |
| escaped = False |
|
|
| for cursor in range(index, len(candidate)): |
| char = candidate[cursor] |
| if in_string: |
| if escaped: |
| escaped = False |
| continue |
| if char == "\\": |
| escaped = True |
| continue |
| if char == '"': |
| in_string = False |
| continue |
|
|
| if char == '"': |
| in_string = True |
| continue |
| if char == opening: |
| depth += 1 |
| continue |
| if char == closing: |
| depth -= 1 |
| if depth == 0: |
| return candidate[index:cursor + 1] |
|
|
| return None |
|
|
| def _parse_embedded_payload_candidate(self, payload_text: str) -> List[Dict[str, Any]]: |
| candidate = str(payload_text or "").strip() |
| if not candidate: |
| return [] |
|
|
| try: |
| decoded = json.loads(candidate) |
| except Exception: |
| return [] |
|
|
| if isinstance(decoded, dict): |
| return [decoded] |
| if isinstance(decoded, list): |
| return [item for item in decoded if isinstance(item, dict)] |
| return [] |
|
|
| def _extract_embedded_payloads_from_text(self, text: Any) -> List[Dict[str, Any]]: |
| normalized = self._normalize_response_text(text) |
| if not normalized: |
| return [] |
|
|
| import re |
|
|
| payloads: List[Dict[str, Any]] = [] |
| seen = set() |
|
|
| def remember(payload_text: str) -> None: |
| for payload in self._parse_embedded_payload_candidate(payload_text): |
| payload_key = json.dumps(payload, sort_keys=True, ensure_ascii=True) |
| if payload_key in seen: |
| continue |
| seen.add(payload_key) |
| payloads.append(payload) |
|
|
| for match in re.finditer( |
| r'<script[^>]+id=["\']__NEXT_DATA__["\'][^>]*>(.*?)</script>', |
| normalized, |
| re.IGNORECASE | re.DOTALL, |
| ): |
| remember(match.group(1)) |
|
|
| assignment_patterns = [ |
| r'window\.__STATE__\s*=\s*', |
| r'window\.__NEXT_DATA__\s*=\s*', |
| r'__NEXT_DATA__\s*=\s*', |
| r'__STATE__\s*=\s*', |
| ] |
| for pattern in assignment_patterns: |
| for match in re.finditer(pattern, normalized): |
| payload_text = self._extract_json_block_from_text(normalized, match.end()) |
| if payload_text: |
| remember(payload_text) |
|
|
| for payload_text in self._extract_app_router_push_payloads_from_text(normalized): |
| remember(payload_text) |
|
|
| for fragment in self._extract_app_router_text_fragments_from_text(normalized): |
| remember(fragment) |
| for payload_text in self._extract_json_payload_candidates_from_fragment(fragment): |
| remember(payload_text) |
|
|
| return payloads |
|
|
| def _extract_navigation_candidates_from_text(self, text: Any) -> List[str]: |
| normalized = self._normalize_response_text(text) |
| if not normalized: |
| return [] |
|
|
| import re |
| patterns = [ |
| r'["\']((?:https?://|/)[^"\']+)["\']', |
| r'((?:https?://|/)[^\s<>"\']+)', |
| ] |
|
|
| candidates: List[str] = [] |
| seen = set() |
|
|
| def remember_from_text_blob(candidate_text: str) -> None: |
| for pattern in patterns: |
| for match in re.finditer(pattern, candidate_text): |
| candidate = next((group for group in match.groups() if group), "").strip() |
| if not candidate: |
| continue |
| candidate = candidate.rstrip(".,;)}]\\") |
| if candidate in seen: |
| continue |
| if "code=" in candidate and "state=" in candidate: |
| seen.add(candidate) |
| candidates.append(candidate) |
| continue |
| if self._classify_resume_source("response_text", candidate): |
| seen.add(candidate) |
| candidates.append(candidate) |
|
|
| remember_from_text_blob(normalized) |
| for fragment in self._extract_app_router_text_fragments_from_text(normalized): |
| remember_from_text_blob(fragment) |
|
|
| return candidates |
|
|
| def _extract_workspace_id_from_data(self, data: Any) -> Optional[str]: |
| if isinstance(data, dict): |
| workspaces = data.get("workspaces") |
| if isinstance(workspaces, list): |
| for workspace in workspaces: |
| if isinstance(workspace, dict): |
| workspace_id = str(workspace.get("id") or "").strip() |
| if workspace_id: |
| return workspace_id |
| workspace = data.get("workspace") |
| if isinstance(workspace, dict): |
| workspace_id = str(workspace.get("id") or "").strip() |
| if workspace_id: |
| return workspace_id |
| if isinstance(workspace, str) and workspace.strip(): |
| return workspace.strip() |
| for value in data.values(): |
| workspace_id = self._extract_workspace_id_from_data(value) |
| if workspace_id: |
| return workspace_id |
| elif isinstance(data, list): |
| for item in data: |
| workspace_id = self._extract_workspace_id_from_data(item) |
| if workspace_id: |
| return workspace_id |
| return None |
|
|
| def _extract_callback_url_from_data(self, data: Any) -> Optional[str]: |
| if isinstance(data, dict): |
| for key, value in data.items(): |
| if isinstance(value, str) and "code=" in value and "state=" in value: |
| if key in {"callback_url", "url", "redirect_url", "location", "continue_url"}: |
| return value.strip() |
| callback_url = self._extract_callback_url_from_data(value) |
| if callback_url: |
| return callback_url |
| elif isinstance(data, list): |
| for item in data: |
| callback_url = self._extract_callback_url_from_data(item) |
| if callback_url: |
| return callback_url |
| return None |
|
|
| def _extract_resume_url_from_data(self, data: Any) -> Optional[str]: |
| if isinstance(data, dict): |
| for key, value in data.items(): |
| if isinstance(value, str) and self._classify_resume_source(str(key), value): |
| return value.strip() |
| resume_url = self._extract_resume_url_from_data(value) |
| if resume_url: |
| return resume_url |
| elif isinstance(data, list): |
| for item in data: |
| resume_url = self._extract_resume_url_from_data(item) |
| if resume_url: |
| return resume_url |
| return None |
|
|
| def _classify_resume_source(self, source_name: str, candidate: str) -> Optional[str]: |
| candidate_lower = str(candidate or "").strip().lower() |
| source_lower = str(source_name or "").strip().lower() |
| if not candidate_lower: |
| return None |
| if "login_challenge=" in candidate_lower: |
| return "login_challenge_resume" |
| if "consent_challenge=" in candidate_lower: |
| return "consent_challenge_resume" |
| if "/sign-in-with-chatgpt/" in candidate_lower or "/consent" in candidate_lower: |
| return "consent_resume" |
| if "/workspace/select" in candidate_lower: |
| return "workspace_select_resume" |
| if "/organization/select" in candidate_lower: |
| return "organization_select_resume" |
| if "continue_url" in source_lower: |
| return "continue_url_resume" |
| if "/api/oauth/oauth2/auth" in candidate_lower: |
| if "validate_otp" in source_lower: |
| return "resume_url_found_after_validate_otp" |
| if "login_password" in source_lower: |
| return "resume_url_reused_from_login_password" |
| return "resume_url_found_from_navigation" |
| return None |
|
|
| def _is_login_page_url(self, url: Optional[str]) -> bool: |
| candidate = str(url or "").strip().lower() |
| if not candidate: |
| return False |
| return candidate.endswith("/log-in") or "/log-in?" in candidate or "auth.openai.com/log-in" in candidate |
|
|
| def _is_consent_url(self, url: Optional[str]) -> bool: |
| candidate = str(url or "").strip().lower() |
| if not candidate: |
| return False |
| return "/sign-in-with-chatgpt/" in candidate or "/consent" in candidate |
|
|
| def _mark_workspace_resolution(self, source: str, error: Optional[str] = None) -> None: |
| self._workspace_resolution_source = source |
| self._workspace_resolution_error = error |
|
|
| def _get_workspace_id(self) -> Optional[str]: |
| """获取 Workspace ID""" |
| try: |
| auth_cookie = self.session.cookies.get("oai-client-auth-session") |
| if auth_cookie: |
| decoded_segments, failed_segments = self._decode_auth_cookie_json_segments(auth_cookie) |
| self._log( |
| f"Workspace 解析: auth_cookie decoded_segments={len(decoded_segments)}, " |
| f"failed_segments={failed_segments}" |
| ) |
| for payload in decoded_segments: |
| workspace_id = self._extract_workspace_id_from_data(payload) |
| if workspace_id: |
| self._mark_workspace_resolution("auth_cookie") |
| self._log(f"Workspace ID: {workspace_id}") |
| return workspace_id |
|
|
| if decoded_segments: |
| self._mark_workspace_resolution( |
| "auth_cookie_decoded_without_workspace", |
| "获取 Workspace ID 失败", |
| ) |
| if failed_segments: |
| self._log("授权 Cookie 仅部分可解码，且没有 workspace 信息", "warning") |
| else: |
| self._log("授权 Cookie 里没有 workspace 信息", "warning") |
| else: |
| self._mark_workspace_resolution("auth_cookie_unreadable", "获取 Workspace ID 失败") |
| self._log("授权 Cookie 无法解码成 JSON", "warning") |
| else: |
| self._mark_workspace_resolution("auth_cookie_missing", "获取 Workspace ID 失败") |
| self._log("未能获取到授权 Cookie", "warning") |
|
|
| next_auth_cookie = self.session.cookies.get("__Secure-next-auth.session-token") |
| if next_auth_cookie: |
| self._log("Workspace 解析: 检查 next-auth session token") |
| for segment in next_auth_cookie.split("."): |
| payload = _decode_jwt_segment(segment) |
| workspace_id = self._extract_workspace_id_from_data(payload) |
| if workspace_id: |
| self._mark_workspace_resolution("next_auth_session_token") |
| self._log(f"Workspace ID: {workspace_id}") |
| return workspace_id |
|
|
| for cookie_name in ["auth-session-minimized", "unified_session_manifest"]: |
| cookie_value = self.session.cookies.get(cookie_name) |
| if not cookie_value: |
| continue |
|
|
| payloads = self._decode_cookie_json_payloads(cookie_value) |
| self._log( |
| f"Workspace 解析: 检查 {cookie_name}, decoded_payloads={len(payloads)}" |
| ) |
| for payload in payloads: |
| workspace_id = self._extract_workspace_id_from_data(payload) |
| if workspace_id: |
| self._mark_workspace_resolution(cookie_name) |
| self._log(f"Workspace ID: {workspace_id}") |
| return workspace_id |
| if payloads: |
| key_preview = " | ".join( |
| ",".join(sorted(payload.keys())[:6]) or "-" |
| for payload in payloads[:2] |
| if isinstance(payload, dict) |
| ) |
| if key_preview: |
| self._log( |
| f"Workspace 解析: {cookie_name} payload keys={key_preview}" |
| ) |
|
|
| for source_name, payload in self._workspace_context.get("payloads", {}).items(): |
| workspace_id = self._extract_workspace_id_from_data(payload) |
| if workspace_id: |
| self._mark_workspace_resolution(f"{source_name}_payload") |
| self._log(f"Workspace ID: {workspace_id}") |
| return workspace_id |
| if self._workspace_context.get("payloads"): |
| self._log( |
| "Workspace 解析: payload 来源未命中 " |
| + ",".join(sorted(self._workspace_context.get("payloads", {}).keys())) |
| ) |
|
|
| resolved_workspace_id = str(self._workspace_context.get("resolved_workspace_id") or "").strip() |
| if resolved_workspace_id: |
| self._mark_workspace_resolution("resolved_workspace_cache") |
| self._log(f"Workspace ID: {resolved_workspace_id}") |
| return resolved_workspace_id |
|
|
| token_info = self._workspace_context.get("token_info") or {} |
| id_token = token_info.get("id_token") or "" |
| if id_token: |
| self._log("Workspace 解析: 检查 id_token claims") |
| claims = _jwt_claims_no_verify(id_token) |
| workspace_id = self._extract_workspace_id_from_data(claims) |
| if workspace_id: |
| self._mark_workspace_resolution("id_token_claims") |
| self._log(f"Workspace ID: {workspace_id}") |
| return workspace_id |
|
|
| if self._workspace_context.get("callback_url"): |
| self._mark_workspace_resolution("callback_available_before_workspace", "获取 Workspace ID 失败") |
| self._log("已经拿到 callback URL，但还没有 workspace 信息", "warning") |
| self._set_recovery_debug_summary( |
| "callback_without_workspace", |
| callback_url=self._workspace_context.get("callback_url"), |
| ) |
| return None |
|
|
| if not self._workspace_resolution_source: |
| self._mark_workspace_resolution("workspace_not_found", "获取 Workspace ID 失败") |
| self._log("当前所有已知来源都没有 workspace 信息", "error") |
| self._set_recovery_debug_summary( |
| "workspace_not_found", |
| resolution_source=self._workspace_resolution_source, |
| terminal_url=self._workspace_context.get("redirect_terminal_url"), |
| ) |
| return None |
|
|
| except Exception as e: |
| self._mark_workspace_resolution("workspace_lookup_exception", str(e)) |
| self._log(f"获取 Workspace ID 失败: {e}", "error") |
| return None |
|
|
| def _select_workspace(self, workspace_id: str) -> Optional[str]: |
| """选择 Workspace""" |
| try: |
| import urllib.parse |
|
|
| select_body = f'{{"workspace_id":"{workspace_id}"}}' |
|
|
| response = self.session.post( |
| OPENAI_API_ENDPOINTS["select_workspace"], |
| headers=self._build_oauth_json_headers( |
| "https://auth.openai.com/sign-in-with-chatgpt/codex/consent" |
| ), |
| data=select_body, |
| ) |
|
|
| try: |
| response_data = response.json() |
| except Exception: |
| response_data = None |
|
|
| self._remember_workspace_payload("select_workspace", response_data) |
| self._remember_navigation_from_response("select_workspace", response) |
|
|
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
| if callback_url: |
| return callback_url |
|
|
| if response.status_code in [301, 302, 303, 307, 308]: |
| location = str((response.headers or {}).get("Location") or "").strip() |
| if location: |
| return urllib.parse.urljoin(OPENAI_API_ENDPOINTS["select_workspace"], location) |
|
|
| if response.status_code != 200: |
| self._log(f"选择 workspace 失败: {response.status_code}", "error") |
| self._log(f"响应: {response.text[:200]}", "warning") |
| return None |
|
|
| continue_url = str((response_data or {}).get("continue_url") or "").strip() |
| if not continue_url: |
| self._log("workspace/select 响应里缺少 continue_url", "error") |
| return None |
|
|
| self._workspace_context["continue_url"] = continue_url |
| self._log(f"Continue URL: {continue_url[:100]}...") |
| return continue_url |
|
|
| except Exception as e: |
| self._log(f"选择 Workspace 失败: {e}", "error") |
| return None |
|
|
| def _extract_org_selection_from_data(self, data: Any) -> Tuple[Optional[str], Optional[str]]: |
| if isinstance(data, dict): |
| orgs = data.get("orgs") |
| if isinstance(orgs, list): |
| for org in orgs: |
| if not isinstance(org, dict): |
| continue |
| org_id = str(org.get("id") or "").strip() |
| project_id = None |
| projects = org.get("projects") |
| if isinstance(projects, list): |
| for project in projects: |
| if not isinstance(project, dict): |
| continue |
| project_id = str(project.get("id") or "").strip() or None |
| if project_id: |
| break |
| if org_id: |
| return org_id, project_id |
| for value in data.values(): |
| org_id, project_id = self._extract_org_selection_from_data(value) |
| if org_id: |
| return org_id, project_id |
| elif isinstance(data, list): |
| for item in data: |
| org_id, project_id = self._extract_org_selection_from_data(item) |
| if org_id: |
| return org_id, project_id |
| return None, None |
|
|
| def _select_organization( |
| self, |
| org_id: str, |
| project_id: Optional[str] = None, |
| *, |
| referer: Optional[str] = None, |
| ) -> Optional[str]: |
| try: |
| import urllib.parse |
|
|
| body: Dict[str, Any] = {"org_id": org_id} |
| if project_id: |
| body["project_id"] = project_id |
|
|
| response = self.session.post( |
| "https://auth.openai.com/api/accounts/organization/select", |
| headers=self._build_oauth_json_headers( |
| referer or "https://auth.openai.com/sign-in-with-chatgpt/codex/consent" |
| ), |
| data=json.dumps(body), |
| ) |
|
|
| try: |
| response_data = response.json() |
| except Exception: |
| response_data = None |
|
|
| self._remember_workspace_payload("select_organization", response_data) |
| self._remember_navigation_from_response("select_organization", response) |
|
|
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
| if callback_url: |
| return callback_url |
|
|
| if response.status_code in [301, 302, 303, 307, 308]: |
| location = str((response.headers or {}).get("Location") or "").strip() |
| if location: |
| return urllib.parse.urljoin( |
| "https://auth.openai.com/api/accounts/organization/select", |
| location, |
| ) |
|
|
| if response.status_code != 200: |
| self._log(f"选择 organization 失败: {response.status_code}", "error") |
| self._log(f"响应: {response.text[:200]}", "warning") |
| return None |
|
|
| continue_url = str((response_data or {}).get("continue_url") or "").strip() |
| if continue_url: |
| self._workspace_context["continue_url"] = continue_url |
| self._log(f"Organization Continue URL: {continue_url[:100]}...") |
| return continue_url |
|
|
| self._log("organization/select 响应里缺少 continue_url", "error") |
| return None |
|
|
| except Exception as e: |
| self._log(f"选择 Organization 失败: {e}", "error") |
| return None |
|
|
| def _probe_callback_via_allow_redirects( |
| self, |
| url: str, |
| *, |
| referer: Optional[str] = None, |
| ) -> Optional[str]: |
| try: |
| import re |
|
|
| headers = { |
| "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| "Upgrade-Insecure-Requests": "1", |
| } |
| session_headers = getattr(self.session, "headers", None) or {} |
| user_agent = session_headers.get("User-Agent") or session_headers.get("user-agent") |
| if user_agent: |
| headers["User-Agent"] = user_agent |
| if referer: |
| headers["Referer"] = referer |
|
|
| response = self.session.get( |
| url, |
| headers=headers, |
| allow_redirects=True, |
| timeout=15, |
| ) |
| self._remember_navigation_from_response("allow_redirect_probe", response) |
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
| if callback_url: |
| self._log( |
| "allow_redirect probe 命中 callback: " |
| f"{self._sanitize_url_for_log(callback_url)}" |
| ) |
| return callback_url |
| except Exception as e: |
| import re |
|
|
| maybe_localhost = re.search(r'(https?://localhost[^\s\'"]+)', str(e)) |
| if maybe_localhost: |
| callback_url = maybe_localhost.group(1) |
| self._remember_navigation_candidate("allow_redirect_probe_exception", callback_url) |
| self._log( |
| "allow_redirect probe 从异常中命中 callback: " |
| f"{self._sanitize_url_for_log(callback_url)}" |
| ) |
| return callback_url |
| self._log(f"allow_redirect probe 失败: {e}", "warning") |
|
|
| return str(self._workspace_context.get("callback_url") or "").strip() or None |
|
|
| def _continue_from_workspace_selection(self, workspace_id: str) -> Optional[str]: |
| continue_url = self._select_workspace(workspace_id) |
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
| if callback_url: |
| return callback_url |
| if not continue_url: |
| return None |
|
|
| select_payload = self._workspace_context.get("payloads", {}).get("select_workspace") or {} |
| org_id, project_id = self._extract_org_selection_from_data(select_payload) |
| page_type = "" |
| if isinstance(select_payload, dict): |
| page_type = str((select_payload.get("page") or {}).get("type") or "").strip().lower() |
| payload_text = "" |
| if select_payload: |
| try: |
| payload_text = json.dumps(select_payload, ensure_ascii=True).lower() |
| except Exception: |
| payload_text = str(select_payload).lower() |
|
|
| requires_org_selection = bool(org_id) and ( |
| "organization" in str(continue_url).lower() |
| or "organization" in page_type |
| or "organization" in payload_text |
| ) |
| if requires_org_selection: |
| self._log("workspace/select 响应提示还需要 organization 选择，继续补齐") |
| continue_url = self._select_organization(org_id, project_id, referer=continue_url) |
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
| if callback_url: |
| return callback_url |
| if not continue_url: |
| return None |
|
|
| callback_url = self._follow_redirects(continue_url) |
| if callback_url: |
| return callback_url |
| callback_url = self._probe_callback_via_allow_redirects(continue_url, referer=continue_url) |
| if callback_url: |
| return callback_url |
| return str(self._workspace_context.get("callback_url") or "").strip() or None |
|
|
| def _attempt_direct_consent_recovery(self, consent_url: Optional[str] = None) -> Optional[str]: |
| import urllib.parse |
|
|
| consent_url = str(consent_url or "https://auth.openai.com/sign-in-with-chatgpt/codex/consent").strip() |
| if consent_url.startswith("/"): |
| consent_url = urllib.parse.urljoin("https://auth.openai.com", consent_url) |
| self._oauth_resume_source = "direct_consent_fallback" |
| self._log( |
| "当前会话命中 consent 链路，尝试 direct consent fallback: " |
| f"{self._sanitize_url_for_log(consent_url)}", |
| "warning", |
| ) |
|
|
| callback_url = self._follow_redirects(consent_url) |
| if callback_url: |
| self._set_recovery_debug_summary( |
| "direct_consent_callback_resolved", |
| consent_url=consent_url, |
| callback_url=callback_url, |
| ) |
| return callback_url |
|
|
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
| if callback_url: |
| self._set_recovery_debug_summary( |
| "direct_consent_cached_callback_resolved", |
| consent_url=consent_url, |
| callback_url=callback_url, |
| ) |
| return callback_url |
|
|
| callback_url = self._probe_callback_via_allow_redirects(consent_url, referer=consent_url) |
| if callback_url: |
| self._set_recovery_debug_summary( |
| "direct_consent_allow_redirect_callback_resolved", |
| consent_url=consent_url, |
| callback_url=callback_url, |
| ) |
| return callback_url |
|
|
| workspace_id = self._get_workspace_id() |
| if workspace_id: |
| self._workspace_context["resolved_workspace_id"] = workspace_id |
| callback_url = self._continue_from_workspace_selection(workspace_id) |
| if callback_url: |
| self._set_recovery_debug_summary( |
| "direct_consent_workspace_resolved", |
| consent_url=consent_url, |
| workspace_id=workspace_id, |
| callback_url=callback_url, |
| ) |
| return callback_url |
|
|
| self._set_recovery_debug_summary( |
| "direct_consent_fallback_failed", |
| consent_url=consent_url, |
| resolution_source=self._workspace_resolution_source, |
| terminal_url=self._workspace_context.get("redirect_terminal_url"), |
| ) |
| self._log("direct consent fallback 未拿到 callback/workspace", "warning") |
| return None |
|
|
| def _continue_same_session_after_resume(self, label: str) -> Optional[str]: |
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
| if callback_url: |
| self._set_recovery_debug_summary( |
| f"{label}_cached_callback_resolved", |
| callback_url=callback_url, |
| ) |
| return callback_url |
|
|
| workspace_id = self._get_workspace_id() |
| if workspace_id: |
| self._workspace_context["resolved_workspace_id"] = workspace_id |
| self._log( |
| f"{label}: 当前会话已拿到 workspace={workspace_id}，继续走 workspace/select" |
| ) |
| callback_url = self._continue_from_workspace_selection(workspace_id) |
| if callback_url: |
| self._set_recovery_debug_summary( |
| f"{label}_workspace_resolved", |
| workspace_id=workspace_id, |
| callback_url=callback_url, |
| ) |
| return callback_url |
|
|
| consent_url = self._find_cached_resume_candidate("consent_resume") |
| if consent_url: |
| self._log( |
| f"{label}: 当前会话命中 consent 候选，继续同会话恢复: " |
| f"{self._sanitize_url_for_log(consent_url)}", |
| "warning", |
| ) |
| callback_url = self._attempt_direct_consent_recovery(consent_url) |
| if callback_url: |
| return callback_url |
|
|
| return None |
|
|
| def _follow_redirects(self, start_url: str) -> Optional[str]: |
| """跟随重定向链，寻找回调 URL""" |
| try: |
| import urllib.parse |
|
|
| current_url = start_url |
| referer_url: Optional[str] = None |
| max_redirects = 6 |
| self._workspace_context["redirect_terminal_url"] = None |
| self._workspace_context["redirect_terminal_status"] = None |
| self._workspace_context["reentered_login"] = False |
|
|
| for i in range(max_redirects): |
| self._remember_navigation_candidate(f"redirect_{i+1}_request_url", current_url) |
| self._log( |
| f"重定向 {i+1}/{max_redirects}: {self._sanitize_url_for_log(current_url)[:160]}" |
| ) |
|
|
| headers = { |
| "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", |
| "Upgrade-Insecure-Requests": "1", |
| } |
| session_headers = getattr(self.session, "headers", None) or {} |
| user_agent = session_headers.get("User-Agent") or session_headers.get("user-agent") |
| if user_agent: |
| headers["User-Agent"] = user_agent |
| if referer_url: |
| headers["Referer"] = referer_url |
|
|
| response = self.session.get( |
| current_url, |
| headers=headers, |
| allow_redirects=False, |
| timeout=15 |
| ) |
| self._remember_navigation_from_response(f"redirect_{i+1}", response) |
|
|
| final_url = str(getattr(response, "url", "") or current_url).strip() or current_url |
| referer_url = final_url |
| self._workspace_context["redirect_terminal_url"] = final_url |
| self._workspace_context["redirect_terminal_status"] = response.status_code |
| self._log( |
| f"重定向响应: status={response.status_code}, final={self._sanitize_url_for_log(final_url) or '-'}" |
| ) |
|
|
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
| if callback_url: |
| self._set_recovery_debug_summary( |
| "callback_found_in_redirect_chain", |
| start_url=start_url, |
| callback_url=callback_url, |
| ) |
| return callback_url |
|
|
| location = response.headers.get("Location") or "" |
|
|
| |
| if response.status_code not in [301, 302, 303, 307, 308]: |
| login_challenge_url = self._find_cached_resume_candidate("login_challenge_resume") |
| started_from_login_challenge = ( |
| self._classify_resume_source("start_url", start_url) == "login_challenge_resume" |
| ) |
| if self._is_login_page_url(final_url) and (not login_challenge_url or started_from_login_challenge): |
| self._workspace_context["reentered_login"] = True |
| self._set_recovery_debug_summary( |
| "bare_login_reentry", |
| start_url=start_url, |
| terminal_url=final_url, |
| ) |
| elif self._is_login_page_url(final_url): |
| self._set_recovery_debug_summary( |
| "login_reentry_with_cached_login_challenge", |
| start_url=start_url, |
| terminal_url=final_url, |
| login_challenge_url=login_challenge_url, |
| ) |
| return None |
|
|
| if not location: |
| login_challenge_url = self._find_cached_resume_candidate("login_challenge_resume") |
| started_from_login_challenge = ( |
| self._classify_resume_source("start_url", start_url) == "login_challenge_resume" |
| ) |
| if self._is_login_page_url(final_url) and (not login_challenge_url or started_from_login_challenge): |
| self._workspace_context["reentered_login"] = True |
| self._set_recovery_debug_summary( |
| "bare_login_reentry_without_location", |
| start_url=start_url, |
| terminal_url=final_url, |
| ) |
| elif self._is_login_page_url(final_url): |
| self._set_recovery_debug_summary( |
| "login_reentry_with_cached_login_challenge", |
| start_url=start_url, |
| terminal_url=final_url, |
| login_challenge_url=login_challenge_url, |
| ) |
| return None |
|
|
| |
| next_url = urllib.parse.urljoin(current_url, location) |
| self._workspace_context.setdefault("redirect_locations", []).append(next_url) |
| self._remember_navigation_candidate(f"redirect_{i+1}_next_url", next_url) |
| self._log(f"重定向目标: {self._sanitize_url_for_log(next_url)}") |
|
|
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
| if callback_url: |
| self._set_recovery_debug_summary( |
| "callback_found_from_redirect_location", |
| start_url=start_url, |
| callback_url=callback_url, |
| ) |
| return callback_url |
|
|
| current_url = next_url |
|
|
| self._log("未能在重定向链中找到回调 URL", "error") |
| self._set_recovery_debug_summary( |
| "redirect_chain_exhausted", |
| start_url=start_url, |
| terminal_url=self._workspace_context.get("redirect_terminal_url"), |
| ) |
| return None |
|
|
| except Exception as e: |
| self._log(f"跟随重定向失败: {e}", "error") |
| return None |
|
|
| def _handle_oauth_callback(self, callback_url: str) -> Optional[Dict[str, Any]]: |
| """处理 OAuth 回调""" |
| try: |
| if not self.oauth_start: |
| self._log("OAuth 流程未初始化", "error") |
| return None |
|
|
| self._log("处理 OAuth 回调，最后一哆嗦，稳住别抖...") |
| token_info = self.oauth_manager.handle_callback( |
| callback_url=callback_url, |
| expected_state=self.oauth_start.state, |
| code_verifier=self.oauth_start.code_verifier |
| ) |
|
|
| self._workspace_context["token_info"] = token_info |
| self._log("OAuth 授权成功，通关文牒到手") |
| return token_info |
|
|
| except Exception as e: |
| self._log(f"处理 OAuth 回调失败: {e}", "error") |
| return None |
|
|
| def _is_recoverable_outlook_account(self, account) -> bool: |
| if not account: |
| return False |
| if account.email_service != EmailServiceType.OUTLOOK.value: |
| return False |
| if account.status != "failed": |
| return False |
| extra_data = account.extra_data or {} |
| return ( |
| extra_data.get("register_failed_reason") == "token_recovery_pending" |
| and extra_data.get("recovery_ready") is True |
| and bool(account.password) |
| ) |
|
|
| def _load_recoverable_outlook_account(self) -> Optional[Dict[str, Any]]: |
| if self.email_service.service_type != EmailServiceType.OUTLOOK or not self.email: |
| return None |
|
|
| try: |
| with get_db() as db: |
| account = crud.get_account_by_email(db, self.email) |
| if not self._is_recoverable_outlook_account(account): |
| return None |
| extra_data = dict(account.extra_data or {}) |
| return { |
| "id": account.id, |
| "email": account.email, |
| "password": account.password, |
| "account_created": bool(extra_data.get("account_created")), |
| } |
| except Exception as e: |
| self._log(f"检查 Outlook 可恢复账号失败: {e}", "warning") |
| return None |
|
|
| def _persist_recoverable_outlook_account(self, error_message: str) -> bool: |
| if self.email_service.service_type != EmailServiceType.OUTLOOK: |
| return False |
| if not self.email or not self.password: |
| return False |
| if not self._account_created and not self._recovery_mode: |
| return False |
|
|
| try: |
| with get_db() as db: |
| existing = crud.get_account_by_email(db, self.email) |
| base_extra = dict(existing.extra_data or {}) if existing else {} |
| workspace_resolution_source = ( |
| self._workspace_resolution_source |
| or base_extra.get("last_workspace_resolution_source") |
| ) |
| workspace_resolution_error = ( |
| self._workspace_resolution_error |
| or base_extra.get("last_workspace_resolution_error") |
| ) |
| base_extra.update( |
| { |
| "recovery_ready": True, |
| "account_created": True, |
| "token_acquired": False, |
| "workspace_acquired": False, |
| "register_failed_reason": "token_recovery_pending", |
| "last_recovery_error": error_message, |
| "last_otp_stage": self._otp_stage, |
| "last_oauth_resume_source": self._oauth_resume_source |
| or base_extra.get("last_oauth_resume_source"), |
| "last_workspace_resolution_source": workspace_resolution_source, |
| "last_workspace_resolution_error": workspace_resolution_error, |
| "last_recovery_debug_summary": self._workspace_context.get("last_recovery_debug_summary") |
| or base_extra.get("last_recovery_debug_summary"), |
| } |
| ) |
|
|
| if existing: |
| crud.update_account( |
| db, |
| existing.id, |
| password=self.password, |
| client_id=get_settings().openai_client_id, |
| email_service=self.email_service.service_type.value, |
| email_service_id=self.email_info.get("service_id") |
| if self.email_info |
| else existing.email_service_id, |
| proxy_used=self.proxy_url, |
| status="failed", |
| extra_data=base_extra, |
| source=existing.source or "register", |
| ) |
| self._recovery_account_id = existing.id |
| return True |
|
|
| account = crud.create_account( |
| db, |
| email=self.email, |
| password=self.password, |
| client_id=get_settings().openai_client_id, |
| email_service=self.email_service.service_type.value, |
| email_service_id=self.email_info.get("service_id") if self.email_info else None, |
| proxy_used=self.proxy_url, |
| extra_data=base_extra, |
| status="failed", |
| source="register", |
| ) |
| self._recovery_account_id = account.id |
| return True |
| except Exception as e: |
| self._log(f"保存可恢复 Outlook 账号失败: {e}", "warning") |
| return False |
|
|
| def _fail_with_recovery(self, result: RegistrationResult, error_message: str) -> RegistrationResult: |
| result.error_message = error_message |
| self._persist_recoverable_outlook_account(error_message) |
| return result |
|
|
| def _prepare_relogin_otp_flow(self, label: str) -> None: |
| self._token_acquisition_requires_login = True |
| self._set_verification_stage("relogin_otp") |
| if self.email_service.service_type == EmailServiceType.OUTLOOK: |
| resend_ok = self._send_verification_code( |
| stage="relogin_otp", |
| referer="https://auth.openai.com/log-in/password", |
| allow_failure=True, |
| ) |
| if not resend_ok: |
| self._log(f"{label}: relogin_otp resend failed, falling back to polling", "warning") |
|
|
| def _start_saved_password_recovery(self) -> Tuple[bool, str]: |
| self._recovery_mode = True |
| self._is_existing_account = True |
| self._reset_auth_flow() |
|
|
| did, sen_token = self._prepare_authorize_flow("恢复登录") |
| if not did: |
| return False, "恢复登录时获取 Device ID 失败" |
| if not sen_token: |
| return False, "恢复登录时 Sentinel POW 验证失败" |
|
|
| login_start_result = self._submit_login_start(did, sen_token, screen_hint="login") |
| if not login_start_result.success: |
| return False, f"恢复登录提交邮箱失败: {login_start_result.error_message}" |
| if login_start_result.page_type != OPENAI_PAGE_TYPES["LOGIN_PASSWORD"]: |
| return False, f"恢复登录未进入密码页面: {login_start_result.page_type or 'unknown'}" |
|
|
| password_result = self._submit_login_password() |
| if not password_result.success: |
| return False, f"恢复登录提交密码失败: {password_result.error_message}" |
| if not password_result.is_existing_account: |
| return False, f"恢复登录未进入验证码页面: {password_result.page_type or 'unknown'}" |
|
|
| self._prepare_relogin_otp_flow("恢复登录") |
| return True, "" |
|
|
| def _attempt_session_bound_reauth(self) -> Optional[str]: |
| if self._session_bound_reauth_attempted: |
| self._oauth_resume_source = "session_bound_reauth_exhausted" |
| self._set_recovery_debug_summary( |
| "session_bound_reauth_exhausted", |
| terminal_url=self._workspace_context.get("redirect_terminal_url"), |
| ) |
| self._log("会话内重登已尝试过一次，停止继续恢复", "warning") |
| return None |
|
|
| self._session_bound_reauth_attempted = True |
| self._oauth_resume_source = "session_bound_reauth" |
| self._reset_workspace_context() |
| self._log("恢复链路回到裸登录页，尝试在当前会话内重做登录", "warning") |
|
|
| if not self.session and not self._init_session(): |
| self._set_recovery_debug_summary("session_bound_reauth_session_init_failed") |
| return None |
|
|
| did = self.session.cookies.get("oai-did") if self.session else None |
| reused_did = bool(did) |
| if reused_did: |
| self._log(f"会话内重登: 复用当前 Device ID {did}") |
| else: |
| if not self.oauth_start: |
| self._oauth_resume_source = "session_bound_reauth_missing_oauth_start" |
| self._set_recovery_debug_summary("session_bound_reauth_missing_oauth_start") |
| self._log("会话内重登缺少 OAuth 上下文，无法补取 Device ID", "warning") |
| return None |
| self._log("会话内重登: 当前会话没有 Device ID，补取一次") |
| did = self._get_device_id() |
| if not did: |
| self._oauth_resume_source = "session_bound_reauth_device_id_failed" |
| self._set_recovery_debug_summary("session_bound_reauth_device_id_failed") |
| return None |
|
|
| sen_token = self._check_sentinel(did) |
| if not sen_token: |
| self._oauth_resume_source = "session_bound_reauth_sentinel_failed" |
| self._set_recovery_debug_summary( |
| "session_bound_reauth_sentinel_failed", |
| reused_did=reused_did, |
| ) |
| return None |
|
|
| login_start_result = self._submit_login_start(did, sen_token) |
| if not login_start_result.success: |
| self._oauth_resume_source = "session_bound_reauth_login_start_failed" |
| self._set_recovery_debug_summary( |
| "session_bound_reauth_login_start_failed", |
| reused_did=reused_did, |
| error=login_start_result.error_message, |
| ) |
| return None |
|
|
| if login_start_result.page_type == OPENAI_PAGE_TYPES["LOGIN_PASSWORD"]: |
| password_result = self._submit_login_password() |
| if not password_result.success: |
| self._oauth_resume_source = "session_bound_reauth_password_failed" |
| self._set_recovery_debug_summary( |
| "session_bound_reauth_password_failed", |
| reused_did=reused_did, |
| error=password_result.error_message, |
| ) |
| return None |
| if not password_result.is_existing_account: |
| self._oauth_resume_source = "session_bound_reauth_failed_to_reach_otp" |
| self._set_recovery_debug_summary( |
| "session_bound_reauth_failed_to_reach_otp", |
| page_type=password_result.page_type, |
| ) |
| return None |
| elif login_start_result.page_type != OPENAI_PAGE_TYPES["EMAIL_OTP_VERIFICATION"]: |
| self._oauth_resume_source = "session_bound_reauth_failed_to_reach_otp" |
| self._set_recovery_debug_summary( |
| "session_bound_reauth_failed_to_reach_otp", |
| page_type=login_start_result.page_type, |
| ) |
| return None |
|
|
| self._session_bound_reauth_otp_cycles += 1 |
| if self._session_bound_reauth_otp_cycles > 1: |
| self._oauth_resume_source = "session_bound_reauth_exhausted" |
| self._set_recovery_debug_summary("session_bound_reauth_exhausted", reason="otp_cycle_limit") |
| self._log("会话内重登 OTP 已达到上限，停止继续恢复", "warning") |
| return None |
|
|
| self._prepare_relogin_otp_flow("会话内重登") |
| code = self._get_verification_code( |
| stage="relogin_otp", |
| timeout=self._get_verification_timeout("relogin_otp"), |
| ) |
| if not code: |
| self._oauth_resume_source = "session_bound_reauth_otp_timeout" |
| self._set_recovery_debug_summary("session_bound_reauth_otp_timeout") |
| return None |
|
|
| if not self._validate_verification_code(code): |
| self._oauth_resume_source = "session_bound_reauth_validate_failed" |
| self._set_recovery_debug_summary("session_bound_reauth_validate_failed") |
| return None |
|
|
| self._oauth_resume_source = "session_bound_reauth" |
| callback_url, _workspace_id, resolution_error = self._resolve_oauth_callback_url() |
| if callback_url: |
| self._oauth_resume_source = "session_bound_reauth" |
| self._set_recovery_debug_summary( |
| "session_bound_reauth_callback_resolved", |
| callback_url=callback_url, |
| reused_did=reused_did, |
| ) |
| return callback_url |
|
|
| if self._workspace_context.get("reentered_login"): |
| self._oauth_resume_source = "session_bound_reauth_reentered_login" |
| self._set_recovery_debug_summary( |
| "session_bound_reauth_reentered_login", |
| terminal_url=self._workspace_context.get("redirect_terminal_url"), |
| reused_did=reused_did, |
| ) |
| return None |
|
|
| self._oauth_resume_source = "session_bound_reauth_failed" |
| self._set_recovery_debug_summary( |
| "session_bound_reauth_failed", |
| error=resolution_error, |
| reused_did=reused_did, |
| ) |
| return None |
|
|
| def _attempt_authorize_replay( |
| self, |
| *, |
| allow_session_bound_reauth: bool = True, |
| reentry_log_level: str = "error", |
| ) -> Optional[str]: |
| if not self.oauth_start: |
| self._oauth_resume_source = "authorize_replay_failed" |
| self._log("OAuth 续跑失败：当前没有可重放的 authorize URL", "error") |
| return None |
|
|
| callback_url = self._follow_redirects(self.oauth_start.auth_url) |
| if callback_url: |
| if self._oauth_resume_source != "session_bound_reauth": |
| self._oauth_resume_source = "callback_found_from_authorize_replay" |
| return callback_url |
|
|
| login_challenge_url = self._find_cached_resume_candidate("login_challenge_resume") |
| if login_challenge_url: |
| if self._oauth_resume_source != "session_bound_reauth": |
| self._oauth_resume_source = "login_challenge_resume" |
| self._log( |
| "authorize replay 后拿到 login_challenge，尝试二次恢复: " |
| f"{self._sanitize_url_for_log(login_challenge_url)}" |
| ) |
| callback_url = self._follow_redirects(login_challenge_url) |
| if callback_url: |
| return callback_url |
|
|
| if self._workspace_context.get("reentered_login"): |
| if allow_session_bound_reauth: |
| callback_url = self._attempt_session_bound_reauth() |
| if callback_url: |
| return callback_url |
| if self._oauth_resume_source != "session_bound_reauth_reentered_login": |
| self._oauth_resume_source = "fresh_authorize_replay_reentered_login" |
| self._log("OAuth 恢复链路重新进入登录页，无法继续当前流程", reentry_log_level) |
| return None |
|
|
| self._oauth_resume_source = "authorize_replay_failed" |
| self._log("OAuth 续跑失败：重放 authorize 链路后仍未拿到 callback", "error") |
| return None |
|
|
| def _resume_oauth_callback(self) -> Optional[str]: |
| callback_url = str(self._workspace_context.get("callback_url") or "").strip() |
| if callback_url: |
| self._oauth_resume_source = self._oauth_resume_source or "callback_found_from_cached_navigation" |
| self._set_recovery_debug_summary("cached_callback_available", callback_url=callback_url) |
| return callback_url |
|
|
| resume_url = str(self._workspace_context.get("resume_url") or "").strip() |
| if resume_url: |
| resume_source = str(self._workspace_context.get("resume_source") or "").strip() |
| if not resume_source: |
| resume_source = ( |
| self._classify_resume_source("cached_resume_url", resume_url) |
| or "resume_url_found_after_validate_otp" |
| ) |
| self._oauth_resume_source = resume_source |
| self._log( |
| f"尝试沿缓存的 OAuth 恢复链路继续: {resume_source} -> " |
| f"{self._sanitize_url_for_log(resume_url)}" |
| ) |
| callback_url = self._follow_redirects(resume_url) |
| if callback_url: |
| return callback_url |
| callback_url = self._continue_same_session_after_resume("resume_url_follow_up") |
| if callback_url: |
| return callback_url |
| upgraded_resume_url = str(self._workspace_context.get("resume_url") or "").strip() |
| if ( |
| upgraded_resume_url |
| and upgraded_resume_url != resume_url |
| and not self._is_about_you_url(upgraded_resume_url) |
| ): |
| upgraded_resume_source = ( |
| str(self._workspace_context.get("resume_source") or "").strip() |
| or self._classify_resume_source("upgraded_resume_url", upgraded_resume_url) |
| or "resume_url_found_from_navigation" |
| ) |
| if self._oauth_resume_source != "session_bound_reauth": |
| self._oauth_resume_source = upgraded_resume_source |
| self._log( |
| "恢复链路在页面提取后升级续跑 URL，继续尝试: " |
| f"{upgraded_resume_source} -> {self._sanitize_url_for_log(upgraded_resume_url)}" |
| ) |
| callback_url = self._follow_redirects(upgraded_resume_url) |
| if callback_url: |
| return callback_url |
| callback_url = self._continue_same_session_after_resume("upgraded_resume_follow_up") |
| if callback_url: |
| return callback_url |
| login_challenge_url = self._find_cached_resume_candidate("login_challenge_resume") |
| if login_challenge_url and login_challenge_url != resume_url: |
| if self._oauth_resume_source != "session_bound_reauth": |
| self._oauth_resume_source = "login_challenge_resume" |
| self._log( |
| "恢复链路命中过 login_challenge，中转页再次续跑: " |
| f"{self._sanitize_url_for_log(login_challenge_url)}" |
| ) |
| callback_url = self._follow_redirects(login_challenge_url) |
| if callback_url: |
| return callback_url |
| callback_url = self._continue_same_session_after_resume("login_challenge_follow_up") |
| if callback_url: |
| return callback_url |
| if self._workspace_context.get("reentered_login"): |
| callback_url = self._attempt_session_bound_reauth() |
| if callback_url: |
| return callback_url |
| self._log("OAuth 恢复链路重新进入登录页，停止继续恢复", "warning") |
| return None |
|
|
| return self._attempt_authorize_replay() |
|
|
| def _activate_recovered_account(self, result: RegistrationResult) -> bool: |
| if not self._recovery_mode: |
| return False |
|
|
| try: |
| with get_db() as db: |
| account = crud.get_account_by_email(db, result.email) |
| if not account: |
| return False |
|
|
| merged_extra = dict(account.extra_data or {}) |
| merged_extra.update( |
| { |
| "email_service": self.email_service.service_type.value, |
| "proxy_used": self.proxy_url, |
| "registered_at": datetime.now().isoformat(), |
| "is_existing_account": True, |
| "token_acquired_via_relogin": self._token_acquisition_requires_login, |
| "recovery_ready": False, |
| "account_created": True, |
| "token_acquired": True, |
| "workspace_acquired": bool(result.workspace_id), |
| "last_oauth_resume_source": self._oauth_resume_source |
| or merged_extra.get("last_oauth_resume_source"), |
| "last_workspace_resolution_source": self._workspace_resolution_source |
| or merged_extra.get("last_workspace_resolution_source"), |
| "last_workspace_resolution_error": self._workspace_resolution_error |
| or merged_extra.get("last_workspace_resolution_error"), |
| "last_recovery_debug_summary": self._workspace_context.get("last_recovery_debug_summary") |
| or merged_extra.get("last_recovery_debug_summary"), |
| } |
| ) |
|
|
| account.password = result.password |
| account.client_id = get_settings().openai_client_id |
| account.session_token = result.session_token |
| account.email_service = self.email_service.service_type.value |
| account.email_service_id = ( |
| self.email_info.get("service_id") if self.email_info else account.email_service_id |
| ) |
| account.account_id = result.account_id |
| account.workspace_id = result.workspace_id |
| account.access_token = result.access_token |
| account.refresh_token = result.refresh_token |
| account.id_token = result.id_token |
| account.proxy_used = self.proxy_url |
| account.status = "active" |
| account.extra_data = merged_extra |
| account.source = account.source or result.source |
| db.commit() |
| db.refresh(account) |
| result.metadata = merged_extra |
| result.metadata["database_saved"] = True |
| return True |
| except Exception as e: |
| self._log(f"更新恢复账号失败: {e}", "warning") |
| return False |
|
|
| def run(self) -> RegistrationResult: |
| result = RegistrationResult(success=False, logs=self.logs) |
|
|
| try: |
| self._is_existing_account = False |
| self._token_acquisition_requires_login = False |
| self._otp_stage = "signup_otp" |
| self._otp_sent_at = None |
| self._last_registration_error = None |
| self._account_created = False |
| self._about_you_resume_attempts = 0 |
| self._about_you_user_exists_without_resume_attempts = 0 |
| self._recovery_mode = False |
| self._recovery_account_id = None |
| self._session_bound_reauth_attempted = False |
| self._session_bound_reauth_otp_cycles = 0 |
| self._reset_workspace_context() |
|
|
| ip_ok, location = self._check_ip_location() |
| if not ip_ok: |
| result.error_message = f"IP 地理位置不支持: {location}" |
| return result |
|
|
| if not self._create_email(): |
| result.error_message = "创建邮箱失败" |
| return result |
|
|
| result.email = self.email |
|
|
| recoverable_account = self._load_recoverable_outlook_account() |
| if recoverable_account: |
| self._recovery_account_id = recoverable_account["id"] |
| self.password = recoverable_account["password"] |
| self._account_created = bool(recoverable_account.get("account_created")) |
| login_ready, login_error = self._start_saved_password_recovery() |
| if not login_ready: |
| return self._fail_with_recovery(result, login_error) |
| else: |
| did, sen_token = self._prepare_authorize_flow("首次授权") |
| if not did: |
| result.error_message = "获取 Device ID 失败" |
| return result |
| if not sen_token: |
| result.error_message = "Sentinel POW 验证失败" |
| return result |
|
|
| signup_result = self._submit_signup_form(did, sen_token) |
| if not signup_result.success: |
| result.error_message = f"提交注册表单失败: {signup_result.error_message}" |
| return result |
|
|
| if self._is_existing_account: |
| self._log("检测到已注册账号，直接走登录拿 token") |
| else: |
| password_ok, _ = self._register_password(did, sen_token) |
| if not password_ok: |
| result.error_message = self._last_registration_error or "注册密码失败" |
| return result |
|
|
| if not self._send_verification_code(): |
| result.error_message = "发送验证码失败" |
| return result |
|
|
| code = self._get_verification_code() |
| if not code: |
| result.error_message = "获取验证码失败" |
| return result |
|
|
| if not self._validate_verification_code(code): |
| result.error_message = "验证码校验失败" |
| return result |
|
|
| if not self._create_user_account(): |
| result.error_message = "创建用户账户失败" |
| return result |
|
|
| self._account_created = True |
| self._log("新账号建号完成，先保留当前会话，交给统一 token 阶段决定是否需要重新登录") |
|
|
| |
| service_type_raw = getattr(self.email_service, "service_type", "") |
| service_type_value = str( |
| getattr(service_type_raw, "value", service_type_raw) or "" |
| ).strip().lower() |
|
|
| if service_type_value == "outlook": |
| |
| if self._is_existing_account: |
| self._log("检测到已注册 Outlook 邮箱，使用专属 token 获取路径（已注册账号重登 + 3 级 OTP 重试）") |
| else: |
| self._log("检测到 Outlook 邮箱，使用专属 token 获取路径（注册后重登 + 3 级 OTP 重试）") |
| |
| |
| if not self._recovery_mode: |
| login_ready, login_error = self._restart_login_flow() |
| if not login_ready: |
| return self._fail_with_recovery(result, login_error) |
| if not self._complete_token_exchange_outlook(result): |
| return self._fail_with_recovery(result, result.error_message) |
| else: |
| |
| if not self._complete_token_exchange(result): |
| return self._fail_with_recovery(result, result.error_message) |
|
|
| result.success = True |
| result.metadata = { |
| "email_service": self.email_service.service_type.value, |
| "proxy_used": self.proxy_url, |
| "registered_at": datetime.now().isoformat(), |
| "is_existing_account": self._is_existing_account, |
| "token_acquired_via_relogin": self._token_acquisition_requires_login, |
| "recovery_ready": False, |
| "account_created": True, |
| "token_acquired": True, |
| "workspace_acquired": bool(result.workspace_id), |
| "last_oauth_resume_source": self._oauth_resume_source, |
| "last_workspace_resolution_source": self._workspace_resolution_source, |
| "last_workspace_resolution_error": self._workspace_resolution_error, |
| "last_recovery_debug_summary": self._workspace_context.get("last_recovery_debug_summary"), |
| } |
|
|
| if self._recovery_mode: |
| self._activate_recovered_account(result) |
|
|
| return result |
|
|
| except Exception as e: |
| self._log(f"注册过程中发生未预期错误: {e}", "error") |
| result.error_message = str(e) |
| return self._fail_with_recovery(result, result.error_message) |
|
|
|
|
| def save_to_database(self, result: RegistrationResult) -> bool: |
| """ |
| 保存注册结果到数据库 |
| |
| Args: |
| result: 注册结果 |
| |
| Returns: |
| 是否保存成功 |
| """ |
| if not result.success: |
| return False |
|
|
| try: |
| |
| settings = get_settings() |
|
|
| with get_db() as db: |
| |
| account = crud.create_account( |
| db, |
| email=result.email, |
| password=result.password, |
| client_id=settings.openai_client_id, |
| session_token=result.session_token, |
| email_service=self.email_service.service_type.value, |
| email_service_id=self.email_info.get("service_id") if self.email_info else None, |
| account_id=result.account_id, |
| workspace_id=result.workspace_id, |
| access_token=result.access_token, |
| refresh_token=result.refresh_token, |
| id_token=result.id_token, |
| proxy_used=self.proxy_url, |
| extra_data=result.metadata, |
| source=result.source |
| ) |
|
|
| self._log(f"账户已存进数据库，落袋为安，ID: {account.id}") |
| return True |
|
|
| except Exception as e: |
| self._log(f"保存到数据库失败: {e}", "error") |
| return False |
|
|
