fix: harden CPA auth flow with API callback/state checks

Move CPA oauth url/callback handling to management API first, persist state/origin runtime keys, and fail fast on invalid callback or missing management auth to reduce flaky panel-driven auth failures.
2026-04-27 19:13:22 +08:00
parent c98cfd7053
commit f9f8df19d3
12 changed files with 911 additions and 2294 deletions
@@ -40,9 +40,6 @@
      getPendingAutoRunTimerPlan,
      getSourceLabel,
      getState,
-      getStepDefinitionForState,
-      getStepIdsForState,
-      getLastStepIdForState,
      getTabId,
      getStopRequested,
      handleAutoRunLoopUnhandledError,
@@ -130,122 +127,7 @@
      }
    }

-    function getStepKeyForState(step, state = {}) {
-      if (typeof getStepDefinitionForState === 'function') {
-        return String(getStepDefinitionForState(step, state)?.key || '').trim();
-      }
-      return '';
-    }
-
-    function isStepProtectedFromAutoSkip(status) {
-      return status === 'running'
-        || status === 'completed'
-        || status === 'manual_completed'
-        || status === 'skipped';
-    }
-
-    function findStepByKeyAfter(currentStep, targetKey, state = {}) {
-      const activeStepIds = typeof getStepIdsForState === 'function'
-        ? getStepIdsForState(state)
-        : [];
-      const candidates = activeStepIds.length ? activeStepIds : [Number(currentStep) + 1, 8];
-      return candidates.find((stepId) => {
-        const numericStep = Number(stepId);
-        if (!Number.isFinite(numericStep) || numericStep <= Number(currentStep)) {
-          return false;
-        }
-        const stepKey = getStepKeyForState(numericStep, state);
-        if (stepKey) {
-          return stepKey === targetKey;
-        }
-        return targetKey === 'fetch-login-code' && Number(currentStep) === 7 && numericStep === 8;
-      }) || null;
-    }
-
-    async function handlePlatformVerifyStepData(payload) {
-      if (payload.localhostUrl) {
-        await closeLocalhostCallbackTabs(payload.localhostUrl);
-      }
-      const latestState = await getState();
-      if (latestState.currentHotmailAccountId && isHotmailProvider(latestState)) {
-        await patchHotmailAccount(latestState.currentHotmailAccountId, {
-          used: true,
-          lastUsedAt: Date.now(),
-        });
-        await addLog('当前 Hotmail 账号已自动标记为已用。', 'ok');
-      }
-      if (String(latestState.mailProvider || '').trim().toLowerCase() === '2925' && latestState.currentMail2925AccountId) {
-        await patchMail2925Account(latestState.currentMail2925AccountId, {
-          lastUsedAt: Date.now(),
-          lastError: '',
-        });
-        await addLog('当前 2925 账号已记录最近使用时间。', 'ok');
-      }
-      if (isLuckmailProvider(latestState)) {
-        const currentPurchase = getCurrentLuckmailPurchase(latestState);
-        if (currentPurchase?.id) {
-          await setLuckmailPurchaseUsedState(currentPurchase.id, true);
-          await addLog(`当前 LuckMail 邮箱 ${currentPurchase.email_address} 已在本地标记为已用。`, 'ok');
-        }
-        await clearLuckmailRuntimeState({ clearEmail: true });
-        await addLog('当前 LuckMail 邮箱运行态已清空，下轮将优先复用未用邮箱或重新购买邮箱。', 'ok');
-      }
-      const localhostPrefix = buildLocalhostCleanupPrefix(payload.localhostUrl);
-      if (localhostPrefix) {
-        await closeTabsByUrlPrefix(localhostPrefix, {
-          excludeUrls: [payload.localhostUrl],
-          excludeLocalhostCallbacks: true,
-        });
-      }
-      await finalizeIcloudAliasAfterSuccessfulFlow(latestState);
-    }
-
    async function handleStepData(step, payload) {
-      const stateForStep = await getState();
-      const stepKey = getStepKeyForState(step, stateForStep);
-
-      if (stepKey === 'oauth-login') {
-        if (payload.skipLoginVerificationStep) {
-          await setState({ loginVerificationRequestedAt: null });
-          const latestState = await getState();
-          const loginCodeStep = findStepByKeyAfter(step, 'fetch-login-code', latestState);
-          if (loginCodeStep) {
-            const currentStatus = latestState.stepStatuses?.[loginCodeStep];
-            if (!isStepProtectedFromAutoSkip(currentStatus)) {
-              await setStepStatus(loginCodeStep, 'skipped');
-              await addLog(`步骤 ${step}：认证页已直接进入 OAuth 授权页，已自动跳过步骤 ${loginCodeStep} 的登录验证码。`, 'warn');
-            }
-          }
-        } else if (payload.loginVerificationRequestedAt) {
-          await setState({ loginVerificationRequestedAt: payload.loginVerificationRequestedAt });
-        }
-        return;
-      }
-
-      if (stepKey === 'fetch-login-code') {
-        await setState({
-          lastEmailTimestamp: payload.emailTimestamp || null,
-          loginVerificationRequestedAt: null,
-        });
-        return;
-      }
-
-      if (stepKey === 'confirm-oauth') {
-        if (payload.localhostUrl) {
-          if (!isLocalhostOAuthCallbackUrl(payload.localhostUrl)) {
-            throw new Error(`步骤 ${step} 返回了无效的 localhost OAuth 回调地址。`);
-          }
-          await setState({ localhostUrl: payload.localhostUrl });
-          broadcastDataUpdate({ localhostUrl: payload.localhostUrl });
-        }
-        return;
-      }
-
-      if (stepKey === 'platform-verify') {
-        await handlePlatformVerifyStepData(payload);
-        return;
-      }
-
      switch (step) {
        case 1: {
          const updates = {};
@@ -258,6 +140,8 @@
          if (payload.sub2apiGroupId !== undefined) updates.sub2apiGroupId = payload.sub2apiGroupId || null;
          if (payload.sub2apiDraftName !== undefined) updates.sub2apiDraftName = payload.sub2apiDraftName || null;
          if (payload.sub2apiProxyId !== undefined) updates.sub2apiProxyId = payload.sub2apiProxyId || null;
+          if (payload.cpaOAuthState !== undefined) updates.cpaOAuthState = payload.cpaOAuthState || null;
+          if (payload.cpaManagementOrigin !== undefined) updates.cpaManagementOrigin = payload.cpaManagementOrigin || null;
          if (payload.codex2apiSessionId !== undefined) updates.codex2apiSessionId = payload.codex2apiSessionId || null;
          if (payload.codex2apiOAuthState !== undefined) updates.codex2apiOAuthState = payload.codex2apiOAuthState || null;
          if (Object.keys(updates).length) {
@@ -299,6 +183,11 @@
            await setState({ loginVerificationRequestedAt: payload.loginVerificationRequestedAt });
          }
          break;
+        case 7:
+          if (payload.loginVerificationRequestedAt) {
+            await setState({ loginVerificationRequestedAt: payload.loginVerificationRequestedAt });
+          }
+          break;
        case 4:
          await setState({
            lastEmailTimestamp: payload.emailTimestamp || null,
@@ -313,6 +202,59 @@
            }
          }
          break;
+        case 8:
+          await setState({
+            lastEmailTimestamp: payload.emailTimestamp || null,
+            loginVerificationRequestedAt: null,
+          });
+          break;
+        case 9:
+          if (payload.localhostUrl) {
+            if (!isLocalhostOAuthCallbackUrl(payload.localhostUrl)) {
+              throw new Error('步骤 9 返回了无效的 localhost OAuth 回调地址。');
+            }
+            await setState({ localhostUrl: payload.localhostUrl });
+            broadcastDataUpdate({ localhostUrl: payload.localhostUrl });
+          }
+          break;
+        case 10: {
+          if (payload.localhostUrl) {
+            await closeLocalhostCallbackTabs(payload.localhostUrl);
+          }
+          const latestState = await getState();
+          if (latestState.currentHotmailAccountId && isHotmailProvider(latestState)) {
+            await patchHotmailAccount(latestState.currentHotmailAccountId, {
+              used: true,
+              lastUsedAt: Date.now(),
+            });
+            await addLog('当前 Hotmail 账号已自动标记为已用。', 'ok');
+          }
+          if (String(latestState.mailProvider || '').trim().toLowerCase() === '2925' && latestState.currentMail2925AccountId) {
+            await patchMail2925Account(latestState.currentMail2925AccountId, {
+              lastUsedAt: Date.now(),
+              lastError: '',
+            });
+            await addLog('当前 2925 账号已记录最近使用时间。', 'ok');
+          }
+          if (isLuckmailProvider(latestState)) {
+            const currentPurchase = getCurrentLuckmailPurchase(latestState);
+            if (currentPurchase?.id) {
+              await setLuckmailPurchaseUsedState(currentPurchase.id, true);
+              await addLog(`当前 LuckMail 邮箱 ${currentPurchase.email_address} 已在本地标记为已用。`, 'ok');
+            }
+            await clearLuckmailRuntimeState({ clearEmail: true });
+            await addLog('当前 LuckMail 邮箱运行态已清空，下轮将优先复用未用邮箱或重新购买邮箱。', 'ok');
+          }
+          const localhostPrefix = buildLocalhostCleanupPrefix(payload.localhostUrl);
+          if (localhostPrefix) {
+            await closeTabsByUrlPrefix(localhostPrefix, {
+              excludeUrls: [payload.localhostUrl],
+              excludeLocalhostCallbacks: true,
+            });
+          }
+          await finalizeIcloudAliasAfterSuccessfulFlow(latestState);
+          break;
+        }
        default:
          break;
      }
@@ -363,15 +305,11 @@
            return { ok: true, error: errorMessage };
          }

-          const completionStateCandidate = await getState();
-          const lastStepId = typeof getLastStepIdForState === 'function'
-            ? getLastStepIdForState(completionStateCandidate)
-            : 10;
-          const completionState = message.step === lastStepId ? completionStateCandidate : null;
+          const completionState = message.step === 10 ? await getState() : null;
          await setStepStatus(message.step, 'completed');
          await addLog(`步骤 ${message.step} 已完成`, 'ok');
          await handleStepData(message.step, message.payload);
-          if (message.step === lastStepId && typeof appendAccountRunRecord === 'function') {
+          if (message.step === 10 && typeof appendAccountRunRecord === 'function') {
            await appendAccountRunRecord('success', completionState);
          }
          notifyStepComplete(message.step, message.payload);
@@ -520,8 +458,7 @@
            await setPersistentSettings({ emailPrefix: message.payload.emailPrefix });
            await setState({ emailPrefix: message.payload.emailPrefix });
          }
-          const executionState = await getState();
-          if (doesStepUseCompletionSignal(step, executionState)) {
+          if (doesStepUseCompletionSignal(step)) {
            await executeStepViaCompletionSignal(step);
          } else {
            await executeStep(step);
@@ -626,35 +563,13 @@
        }

        case 'SAVE_SETTING': {
-          const currentState = await getState();
          const updates = buildPersistentSettingsPayload(message.payload || {});
          const sessionUpdates = buildLuckmailSessionSettingsPayload(message.payload || {});
-          const modeChanged = Object.prototype.hasOwnProperty.call(updates, 'plusModeEnabled')
-            && Boolean(currentState?.plusModeEnabled) !== Boolean(updates.plusModeEnabled);
          await setPersistentSettings(updates);
-          const stateUpdates = {
+          await setState({
            ...updates,
            ...sessionUpdates,
-          };
-          if (modeChanged && typeof getStepIdsForState === 'function') {
-            const nextStateForSteps = { ...currentState, ...stateUpdates };
-            stateUpdates.stepStatuses = Object.fromEntries(
-              getStepIdsForState(nextStateForSteps).map((stepId) => [stepId, 'pending'])
-            );
-            stateUpdates.currentStep = 0;
-          }
-          await setState(stateUpdates);
-          if (Boolean(currentState?.contributionMode) && typeof setContributionMode === 'function') {
-            await setContributionMode(true);
-          }
-          if (modeChanged) {
-            await addLog(
-              Boolean(updates.plusModeEnabled)
-                ? 'Plus 模式已开启，已切换为 Plus Checkout + PayPal 步骤。'
-                : 'Plus 模式已关闭，已恢复普通注册授权步骤。',
-              'info'
-            );
-          }
+          });
          return { ok: true, state: await getState() };
        }