Improve email code account import flow

services/account_email_login_service.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import threading
 import time
 import uuid
+import secrets
 from dataclasses import dataclass
 from datetime import datetime, timezone
 from typing import Any
@@ -20,7 +21,7 @@ CHATGPT_OPENAI_SCOPE = "openid email profile offline_access model.request model.
 
 
 def _clean(value: object) -> str:
-    return str(value or "").strip()
+    return str(value or "").strip().lstrip("\ufeff")
 
 
 def _now_iso() -> str:
@@ -90,6 +91,7 @@ class PendingEmailLogin:
     signup_name: str = ""
     signup_birthdate: str = ""
     signup_created: bool = False
+    signup_login_started: bool = False
 
     def close(self) -> None:
         try:
@@ -351,6 +353,52 @@ class AccountEmailLoginImportService:
                 + (f": {message}" if message else "")
             )
 
+    def _start_signup_registration(self, email: str) -> tuple[Any, str, str]:
+        session = openai_register.create_session(self._proxy())
+        device_id = str(uuid.uuid4())
+        session.cookies.set("oai-did", device_id, domain=".auth.openai.com")
+        session.cookies.set("oai-did", device_id, domain="auth.openai.com")
+        code_verifier, code_challenge = openai_register._generate_pkce()
+        params = {
+            "issuer": openai_register.auth_base,
+            "client_id": openai_register.platform_oauth_client_id,
+            "audience": openai_register.platform_oauth_audience,
+            "redirect_uri": openai_register.platform_oauth_redirect_uri,
+            "device_id": device_id,
+            "screen_hint": "login_or_signup",
+            "max_age": "0",
+            "login_hint": email,
+            "scope": "openid profile email offline_access",
+            "response_type": "code",
+            "response_mode": "query",
+            "state": secrets.token_urlsafe(32),
+            "nonce": secrets.token_urlsafe(32),
+            "code_challenge": code_challenge,
+            "code_challenge_method": "S256",
+            "auth0Client": openai_register.platform_auth0_client,
+        }
+        headers = dict(openai_register.navigate_headers)
+        headers["referer"] = f"{openai_register.platform_base}/"
+        resp, error = openai_register.request_with_local_retry(
+            session,
+            "get",
+            f"{openai_register.auth_base}/api/accounts/authorize?{urlencode(params)}",
+            headers=headers,
+            allow_redirects=True,
+            verify=False,
+        )
+        if resp is None or resp.status_code != 200:
+            data = _response_json(resp) if resp is not None else {}
+            message = _error_message(data) or _response_excerpt(resp)
+            try:
+                session.close()
+            except Exception:
+                pass
+            if message:
+                raise RuntimeError(f"新账号注册授权失败：{message}")
+            raise RuntimeError(error or f"新账号注册授权失败：HTTP {getattr(resp, 'status_code', 'unknown')}")
+        return session, device_id, code_verifier
+
     def _register_new_chatgpt_user(
         self,
         session: Any,
@@ -400,13 +448,31 @@ class AccountEmailLoginImportService:
                 raise RuntimeError(f"注册验证码发送失败：{message}")
             raise RuntimeError(error or f"注册验证码发送失败：HTTP {getattr(resp, 'status_code', 'unknown')}")
 
+    def _send_login_otp(self, session: Any) -> None:
+        headers = dict(openai_register.navigate_headers)
+        headers["referer"] = f"{openai_register.auth_base}/log-in/password"
+        resp, error = openai_register.request_with_local_retry(
+            session,
+            "get",
+            f"{openai_register.auth_base}/api/accounts/email-otp/send",
+            headers=headers,
+            allow_redirects=True,
+            verify=False,
+        )
+        if resp is None or resp.status_code not in (200, 302):
+            data = _response_json(resp) if resp is not None else {}
+            message = _error_message(data) or _response_excerpt(resp)
+            if message:
+                raise RuntimeError(f"登录验证码发送失败：{message}")
+            raise RuntimeError(error or f"登录验证码发送失败：HTTP {getattr(resp, 'status_code', 'unknown')}")
+
     def _create_signup_profile(
         self,
         session: Any,
         device_id: str,
         name: str,
         birthdate: str,
-    ) -> None:
+    ) -> str:
         headers = dict(openai_register.common_headers)
         headers["referer"] = f"{openai_register.auth_base}/about-you"
         headers["oai-device-id"] = device_id
@@ -430,6 +496,173 @@ class AccountEmailLoginImportService:
             if message:
                 raise RuntimeError(f"创建账号资料失败：{message}")
             raise RuntimeError(error or f"创建账号资料失败：HTTP {getattr(resp, 'status_code', 'unknown')}")
+        data = _response_json(resp)
+        return _continue_url(data) or _clean(getattr(resp, "headers", {}).get("Location") if resp is not None else "")
+
+    def _import_platform_token_account(
+        self,
+        tokens: dict[str, Any],
+        email: str,
+        owner: dict[str, object] | None = None,
+    ) -> dict[str, Any]:
+        access_token = _clean(tokens.get("access_token"))
+        if not access_token:
+            raise RuntimeError("新账号注册完成，但没有换取到 access_token")
+        item = {
+            "email": _clean(tokens.get("email")) or email,
+            "access_token": access_token,
+            "refresh_token": _clean(tokens.get("refresh_token")),
+            "id_token": _clean(tokens.get("id_token")),
+            "created_at": _now_iso(),
+        }
+        add_result = account_service.add_account_items([item], owner=owner)
+        refresh_result = account_service.refresh_accounts([access_token])
+        visible_items = account_service.list_accounts_for_identity(owner) if owner else refresh_result.get("items", add_result.get("items", []))
+        return {
+            **add_result,
+            "refreshed": refresh_result.get("refreshed", 0),
+            "errors": refresh_result.get("errors", []),
+            "items": visible_items,
+        }
+
+    def _exchange_signup_tokens(self, pending: PendingEmailLogin) -> dict[str, Any]:
+        continue_url = pending.continue_url or f"{openai_register.auth_base}/sign-in-with-chatgpt/codex/consent"
+        tokens = openai_register.exchange_platform_tokens(
+            pending.session,
+            pending.device_id,
+            pending.code_verifier,
+            continue_url,
+        )
+        if not tokens:
+            raise RuntimeError("新账号注册完成，但 token 换取失败，请稍后重试或使用 Session JSON 导入")
+        return tokens
+
+    def _start_signup_password_login(
+        self,
+        email: str,
+        password: str,
+    ) -> tuple[Any, str, str, str, bool]:
+        session = openai_register.create_session(self._proxy())
+        device_id = str(uuid.uuid4())
+        session.cookies.set("oai-did", device_id, domain=".auth.openai.com")
+        session.cookies.set("oai-did", device_id, domain="auth.openai.com")
+        code_verifier, code_challenge = openai_register._generate_pkce()
+        params = {
+            "issuer": openai_register.auth_base,
+            "client_id": openai_register.platform_oauth_client_id,
+            "audience": openai_register.platform_oauth_audience,
+            "redirect_uri": openai_register.platform_oauth_redirect_uri,
+            "device_id": device_id,
+            "screen_hint": "login_or_signup",
+            "max_age": "0",
+            "login_hint": email,
+            "scope": "openid profile email offline_access",
+            "response_type": "code",
+            "response_mode": "query",
+            "state": secrets.token_urlsafe(32),
+            "nonce": secrets.token_urlsafe(32),
+            "code_challenge": code_challenge,
+            "code_challenge_method": "S256",
+            "auth0Client": openai_register.platform_auth0_client,
+        }
+
+        def _nav_headers(referer: str = "") -> dict[str, str]:
+            headers = dict(openai_register.navigate_headers)
+            if referer:
+                headers["referer"] = referer
+            return headers
+
+        def _json_headers(referer: str) -> dict[str, str]:
+            headers = dict(openai_register.common_headers)
+            headers["referer"] = referer
+            headers["oai-device-id"] = device_id
+            headers.update(openai_register._make_trace_headers())
+            return headers
+
+        def _authorize() -> tuple[Any, str]:
+            return openai_register.request_with_local_retry(
+                session,
+                "get",
+                f"{openai_register.auth_base}/api/accounts/authorize?{urlencode(params)}",
+                headers=_nav_headers(f"{openai_register.platform_base}/"),
+                allow_redirects=True,
+                verify=False,
+            )
+
+        def _authorize_continue() -> tuple[Any, str]:
+            headers = _json_headers(f"{openai_register.auth_base}/log-in?usernameKind=email")
+            headers["openai-sentinel-token"] = openai_register.build_sentinel_token(
+                session,
+                device_id,
+                "authorize_continue",
+            )
+            return openai_register.request_with_local_retry(
+                session,
+                "post",
+                f"{openai_register.auth_base}/api/accounts/authorize/continue",
+                json={"username": {"kind": "email", "value": email}},
+                headers=headers,
+                allow_redirects=False,
+                verify=False,
+            )
+
+        def _fail(prefix: str, resp: Any, error: str = "") -> None:
+            data = _response_json(resp) if resp is not None else {}
+            message = _error_message(data) or _response_excerpt(resp)
+            try:
+                session.close()
+            except Exception:
+                pass
+            raise RuntimeError(
+                f"{prefix}{': ' + message if message else ''}"
+                if message
+                else error or f"{prefix}: HTTP {getattr(resp, 'status_code', 'unknown')}"
+            )
+
+        resp, error = _authorize()
+        if resp is None:
+            _fail("新账号登录授权失败", resp, error)
+
+        resp, error = _authorize_continue()
+        if resp is not None and resp.status_code == 409:
+            for cookie in list(session.cookies):
+                if "auth.openai.com" in str(cookie.domain or ""):
+                    session.cookies.clear(domain=cookie.domain, path=cookie.path, name=cookie.name)
+            session.cookies.set("oai-did", device_id, domain=".auth.openai.com")
+            session.cookies.set("oai-did", device_id, domain="auth.openai.com")
+            resp, error = _authorize()
+            if resp is None:
+                _fail("新账号登录授权重试失败", resp, error)
+            resp, error = _authorize_continue()
+
+        if resp is None or resp.status_code != 200:
+            _fail("新账号邮箱提交失败", resp, error)
+
+        headers = _json_headers(f"{openai_register.auth_base}/log-in/password")
+        headers["openai-sentinel-token"] = openai_register.build_sentinel_token(
+            session,
+            device_id,
+            "password_verify",
+        )
+        resp, error = openai_register.request_with_local_retry(
+            session,
+            "post",
+            f"{openai_register.auth_base}/api/accounts/password/verify",
+            json={"password": password},
+            headers=headers,
+            allow_redirects=False,
+            verify=False,
+        )
+        if resp is None or resp.status_code != 200:
+            _fail("新账号密码校验失败", resp, error)
+
+        payload = _response_json(resp)
+        continue_url = _continue_url(payload)
+        page_type = _page_type(payload)
+        needs_email_code = _looks_like_email_otp(page_type, continue_url)
+        if needs_email_code:
+            self._send_login_otp(session)
+        return session, device_id, code_verifier, continue_url, needs_email_code
 
     def _fetch_chatgpt_session(self, session: Any) -> dict[str, Any]:
         headers = {
@@ -613,20 +846,27 @@ class AccountEmailLoginImportService:
                 first_name, last_name = openai_register._random_name()
                 birthdate = openai_register._random_birthdate()
                 display_name = f"{first_name} {last_name}"
+                signup_session = None
                 try:
-                    self._register_new_chatgpt_user(login_session, login_device_id, normalized_email, password)
-                    self._send_signup_otp(login_session)
+                    signup_session, signup_device_id, signup_code_verifier = self._start_signup_registration(normalized_email)
+                    self._register_new_chatgpt_user(signup_session, signup_device_id, normalized_email, password)
+                    self._send_signup_otp(signup_session)
                 except RuntimeError as exc:
+                    if signup_session is not None:
+                        try:
+                            signup_session.close()
+                        except Exception:
+                            pass
                     raise RuntimeError(
                         f"当前邮箱没有进入临时登录代码流程，且自动注册新账号失败：{exc}"
                     ) from exc
                 session_id = uuid.uuid4().hex[:12]
                 pending = PendingEmailLogin(
                     session_id=session_id,
-                    session=login_session,
+                    session=signup_session,
                     email=normalized_email,
-                    device_id=login_device_id,
-                    code_verifier="",
+                    device_id=signup_device_id,
+                    code_verifier=signup_code_verifier,
                     continue_url=continue_url,
                     created_at=time.time(),
                     updated_at=time.time(),
@@ -638,7 +878,6 @@ class AccountEmailLoginImportService:
                 with self._lock:
                     self._prune_locked()
                     self._pending[session_id] = pending
-                should_keep_session = True
                 return {
                     "status": "pending_code",
                     "session_id": session_id,
@@ -674,32 +913,66 @@ class AccountEmailLoginImportService:
             resp, reason = openai_register.validate_otp(pending.session, pending.device_id, normalized_code)
             if resp is None or resp.status_code != 200:
                 data = _response_json(resp) if resp is not None else {}
-                message = _error_message(data)
-                raise ValueError(reason or message or "验证码校验失败")
+                message = _error_message(data) or _response_excerpt(resp)
+                raise ValueError(reason or message or "验证码校验失败，请确认验证码是否最新")
             otp_payload = _response_json(resp)
             pending.continue_url = _continue_url(otp_payload) or pending.continue_url
             pending.otp_verified = True
             pending.updated_at = time.time()
 
         if pending.signup_password and not pending.signup_created:
-            self._create_signup_profile(
+            profile_continue_url = self._create_signup_profile(
                 pending.session,
                 pending.device_id,
                 pending.signup_name or "ChatGPT User",
                 pending.signup_birthdate or openai_register._random_birthdate(),
             )
+            pending.continue_url = profile_continue_url or pending.continue_url
             pending.signup_created = True
             pending.updated_at = time.time()
 
+        if pending.signup_password and pending.signup_created and not pending.signup_login_started:
+            old_session = pending.session
+            (
+                login_session,
+                login_device_id,
+                login_code_verifier,
+                login_continue_url,
+                needs_email_code,
+            ) = self._start_signup_password_login(pending.email, pending.signup_password)
+            pending.session = login_session
+            pending.device_id = login_device_id
+            pending.code_verifier = login_code_verifier
+            pending.continue_url = login_continue_url or f"{openai_register.auth_base}/sign-in-with-chatgpt/codex/consent"
+            pending.signup_login_started = True
+            pending.otp_verified = not needs_email_code
+            pending.updated_at = time.time()
+            try:
+                old_session.close()
+            except Exception:
+                pass
+            if needs_email_code:
+                return {
+                    "status": "pending_code",
+                    "session_id": pending.session_id,
+                    "email": pending.email,
+                    "created_account": True,
+                    "message": "新账号已创建，OpenAI 还需要再验证一次登录验证码。请输入邮箱新收到的验证码完成导入。",
+                }
+
         continue_url = pending.continue_url or f"{openai_register.auth_base}/sign-in-with-chatgpt/codex/consent"
         try:
-            self._complete_chatgpt_login_session(pending.session, continue_url)
-            session_data = self._fetch_chatgpt_session(pending.session)
-            result = self._import_chatgpt_session_account(
-                session_data,
-                cookie_names=self._chatgpt_cookie_names(pending.session),
-                owner=pending.owner or owner,
-            )
+            if pending.signup_password:
+                tokens = self._exchange_signup_tokens(pending)
+                result = self._import_platform_token_account(tokens, pending.email, owner=pending.owner or owner)
+            else:
+                self._complete_chatgpt_login_session(pending.session, continue_url)
+                session_data = self._fetch_chatgpt_session(pending.session)
+                result = self._import_chatgpt_session_account(
+                    session_data,
+                    cookie_names=self._chatgpt_cookie_names(pending.session),
+                    owner=pending.owner or owner,
+                )
             with self._lock:
                 self._close_pending_locked(normalized_session_id)
             return {

test/test_account_image_capabilities.py

@@ -905,7 +905,9 @@ class AuthServiceTests(unittest.TestCase):
 
     def test_email_login_import_can_register_new_email_with_manual_otp(self) -> None:
         service = AccountEmailLoginImportService()
-        fake_session = _FakeSession()
+        fake_login_session = _FakeSession()
+        fake_signup_session = _FakeSession()
+        fake_password_login_session = _FakeSession()
 
         def fake_request_with_local_retry(_session, _method: str, url: str, **_kwargs):
             if "/api/accounts/authorize?" in url:
@@ -915,13 +917,18 @@ class AuthServiceTests(unittest.TestCase):
             raise AssertionError(f"unexpected request url: {url}")
 
         with (
-            patch.object(email_login_module.openai_register, "create_session", return_value=fake_session),
+            patch.object(email_login_module.openai_register, "create_session", return_value=fake_login_session),
             patch.object(service, "_start_chatgpt_nextauth_login", return_value="https://auth.openai.com/api/accounts/authorize?test=1"),
             patch.object(email_login_module.openai_register, "request_with_local_retry", side_effect=fake_request_with_local_retry),
             patch.object(email_login_module.openai_register, "build_sentinel_token", return_value="sentinel"),
             patch.object(email_login_module.openai_register, "_random_password", return_value="GeneratedPassword123."),
             patch.object(email_login_module.openai_register, "_random_name", return_value=("New", "User")),
             patch.object(email_login_module.openai_register, "_random_birthdate", return_value="1990-01-01"),
+            patch.object(
+                service,
+                "_start_signup_registration",
+                return_value=(fake_signup_session, "signup-device", "signup-verifier"),
+            ) as start_signup,
             patch.object(service, "_register_new_chatgpt_user") as register_user,
             patch.object(service, "_send_signup_otp") as send_signup_otp,
             patch.object(
@@ -929,13 +936,28 @@ class AuthServiceTests(unittest.TestCase):
                 "validate_otp",
                 return_value=(_FakeResponse(200, {"continue_url": "https://auth.openai.com/consent"}), ""),
             ),
-            patch.object(service, "_create_signup_profile") as create_profile,
-            patch.object(service, "_complete_chatgpt_login_session", return_value=None),
+            patch.object(service, "_create_signup_profile", return_value="https://auth.openai.com/profile-consent") as create_profile,
             patch.object(
                 service,
-                "_fetch_chatgpt_session",
-                return_value={"user": {"email": "new@example.com"}, "accessToken": "access-token"},
-            ),
+                "_start_signup_password_login",
+                return_value=(
+                    fake_password_login_session,
+                    "login-device",
+                    "login-verifier",
+                    "https://auth.openai.com/login-consent",
+                    False,
+                ),
+            ) as start_password_login,
+            patch.object(
+                service,
+                "_exchange_signup_tokens",
+                return_value={
+                    "email": "new@example.com",
+                    "access_token": "access-token",
+                    "refresh_token": "refresh-token",
+                    "id_token": "id-token",
+                },
+            ) as exchange_signup_tokens,
             patch.object(
                 email_login_module.account_service,
                 "add_account_items",
@@ -956,8 +978,9 @@ class AuthServiceTests(unittest.TestCase):
             self.assertEqual(started["status"], "pending_code")
             self.assertTrue(started["created_account"])
             pending = service._pending[started["session_id"]]
-            register_user.assert_called_once_with(fake_session, pending.device_id, "new@example.com", "GeneratedPassword123.")
-            send_signup_otp.assert_called_once_with(fake_session)
+            start_signup.assert_called_once_with("new@example.com")
+            register_user.assert_called_once_with(fake_signup_session, "signup-device", "new@example.com", "GeneratedPassword123.")
+            send_signup_otp.assert_called_once_with(fake_signup_session)
 
             completed = service.verify(str(started["session_id"]), "123456")
 
@@ -965,7 +988,140 @@ class AuthServiceTests(unittest.TestCase):
             self.assertTrue(completed["created_account"])
             self.assertEqual(completed["generated_password"], "GeneratedPassword123.")
             create_profile.assert_called_once()
+            start_password_login.assert_called_once_with("new@example.com", "GeneratedPassword123.")
+            exchange_signup_tokens.assert_called_once()
+            self.assertEqual(len(service._pending), 0)
+            self.assertTrue(fake_login_session.closed)
+            self.assertTrue(fake_signup_session.closed)
+            self.assertTrue(fake_password_login_session.closed)
+
+    def test_email_login_import_new_email_can_continue_second_login_otp(self) -> None:
+        service = AccountEmailLoginImportService()
+        fake_login_session = _FakeSession()
+        fake_signup_session = _FakeSession()
+        fake_password_login_session = _FakeSession()
+
+        def fake_request_with_local_retry(_session, _method: str, url: str, **_kwargs):
+            if "/api/accounts/authorize?" in url:
+                return _FakeResponse(200, {}), ""
+            if url.endswith("/api/accounts/authorize/continue"):
+                return _FakeResponse(200, {"page": {"type": "login_password"}}), ""
+            raise AssertionError(f"unexpected request url: {url}")
+
+        with (
+            patch.object(email_login_module.openai_register, "create_session", return_value=fake_login_session),
+            patch.object(service, "_start_chatgpt_nextauth_login", return_value="https://auth.openai.com/api/accounts/authorize?test=1"),
+            patch.object(email_login_module.openai_register, "request_with_local_retry", side_effect=fake_request_with_local_retry),
+            patch.object(email_login_module.openai_register, "build_sentinel_token", return_value="sentinel"),
+            patch.object(email_login_module.openai_register, "_random_password", return_value="GeneratedPassword123."),
+            patch.object(email_login_module.openai_register, "_random_name", return_value=("New", "User")),
+            patch.object(email_login_module.openai_register, "_random_birthdate", return_value="1990-01-01"),
+            patch.object(
+                service,
+                "_start_signup_registration",
+                return_value=(fake_signup_session, "signup-device", "signup-verifier"),
+            ),
+            patch.object(service, "_register_new_chatgpt_user"),
+            patch.object(service, "_send_signup_otp"),
+            patch.object(
+                email_login_module.openai_register,
+                "validate_otp",
+                side_effect=[
+                    (_FakeResponse(200, {"continue_url": "https://auth.openai.com/signup-consent"}), ""),
+                    (_FakeResponse(200, {"continue_url": "https://auth.openai.com/login-consent"}), ""),
+                ],
+            ) as validate_otp,
+            patch.object(service, "_create_signup_profile", return_value="https://auth.openai.com/profile-consent"),
+            patch.object(
+                service,
+                "_start_signup_password_login",
+                return_value=(
+                    fake_password_login_session,
+                    "login-device",
+                    "login-verifier",
+                    "https://auth.openai.com/login-email-otp",
+                    True,
+                ),
+            ),
+            patch.object(
+                service,
+                "_exchange_signup_tokens",
+                return_value={
+                    "email": "new@example.com",
+                    "access_token": "access-token",
+                    "refresh_token": "refresh-token",
+                    "id_token": "id-token",
+                },
+            ) as exchange_signup_tokens,
+            patch.object(
+                email_login_module.account_service,
+                "add_account_items",
+                return_value={"added": 1, "skipped": 0, "items": [{"access_token": "access-token"}]},
+            ),
+            patch.object(
+                email_login_module.account_service,
+                "refresh_accounts",
+                return_value={
+                    "refreshed": 1,
+                    "errors": [],
+                    "items": [{"access_token": "access-token", "email": "new@example.com"}],
+                },
+            ),
+        ):
+            started = service.start("new@example.com")
+            second_code = service.verify(str(started["session_id"]), "111111")
+
+            self.assertEqual(second_code["status"], "pending_code")
+            self.assertEqual(second_code["session_id"], started["session_id"])
+            self.assertTrue(second_code["created_account"])
+            exchange_signup_tokens.assert_not_called()
+
+            completed = service.verify(str(started["session_id"]), "222222")
+
+            self.assertEqual(completed["status"], "completed")
+            self.assertEqual(validate_otp.call_count, 2)
+            self.assertEqual(exchange_signup_tokens.call_count, 1)
             self.assertEqual(len(service._pending), 0)
+            self.assertTrue(fake_signup_session.closed)
+            self.assertTrue(fake_password_login_session.closed)
+
+    def test_email_login_import_sends_second_login_otp_when_required(self) -> None:
+        service = AccountEmailLoginImportService()
+        fake_session = _FakeSession()
+
+        def fake_request_with_local_retry(_session, _method: str, url: str, **_kwargs):
+            if "/api/accounts/authorize?" in url:
+                return _FakeResponse(200, {}), ""
+            if url.endswith("/api/accounts/authorize/continue"):
+                return _FakeResponse(200, {}), ""
+            if url.endswith("/api/accounts/password/verify"):
+                return _FakeResponse(
+                    200,
+                    {
+                        "continue_url": "https://auth.openai.com/email-verification",
+                        "page": {"type": "email_otp_verification"},
+                    },
+                ), ""
+            raise AssertionError(f"unexpected request url: {url}")
+
+        with (
+            patch.object(email_login_module.openai_register, "create_session", return_value=fake_session),
+            patch.object(email_login_module.openai_register, "_generate_pkce", return_value=("verifier", "challenge")),
+            patch.object(email_login_module.openai_register, "build_sentinel_token", return_value="sentinel"),
+            patch.object(email_login_module.openai_register, "request_with_local_retry", side_effect=fake_request_with_local_retry),
+            patch.object(service, "_send_login_otp") as send_login_otp,
+        ):
+            session, device_id, code_verifier, continue_url, needs_email_code = service._start_signup_password_login(
+                "new@example.com",
+                "GeneratedPassword123.",
+            )
+
+            self.assertIs(session, fake_session)
+            self.assertTrue(device_id)
+            self.assertEqual(code_verifier, "verifier")
+            self.assertEqual(continue_url, "https://auth.openai.com/email-verification")
+            self.assertTrue(needs_email_code)
+            send_login_otp.assert_called_once_with(fake_session)
 
     def test_email_login_import_returns_only_visible_accounts_for_owner(self) -> None:
         service = AccountEmailLoginImportService()

web/src/app/accounts/components/account-import-dialog.tsx

@@ -334,9 +334,16 @@ export function AccountImportDialog({ disabled, isAdmin = false, onImported }: A
     }
 
     setIsSubmitting(true);
-    setEmailLoginMessage("正在校验验证码，并自动读取 ChatGPT session...");
+    setEmailLoginMessage("正在校验验证码，并继续完成登录导入...");
     try {
       const data = await verifyAccountEmailLoginImport(emailLoginSessionId, emailLoginCode);
+      if (data.status === "pending_code" && data.session_id) {
+        setEmailLoginSessionId(data.session_id);
+        setEmailLoginCode("");
+        setEmailLoginMessage(data.message);
+        toast.success(data.message);
+        return;
+      }
       completeEmailLoginImport(data, data.message);
     } catch (error) {
       const message = error instanceof Error ? error.message : "验证码校验失败";