@mega-yfue/eufy-sdk 0.2.0-beta.15 → 0.2.0-beta.16

package/dist/core/store.d.ts

@@ -5,6 +5,14 @@ import type { RegionShard } from "../transport/http/mega-client.js";
  */
 export interface PersistedSession {
     userId: string;
+    /**
+     * The eufy account's own `user_id` — the id the `gtoken` header is hashed from, which is not always the
+     * `ap_cloud_user_id` that `userId` prefers.
+     *
+     * Always written, equal to `userId` when the login reply carried only the one id. Absent therefore means a
+     * record from before this was tracked, which {@link isSessionValid} refuses rather than restore.
+     */
+    accountUserId?: string;
     authToken: string;
     geoKey?: string;
     region: RegionShard;
@@ -50,5 +58,14 @@ export declare class FileSessionStore<T = PersistedSession> implements SessionSt
  * (e.g. Solix) whose session shape differs but whose freshness rule is identical.
  */
 export declare function tokenNotExpired(tokenExpiresAt: number | undefined, skewSec?: number): boolean;
-/** A persisted session is usable if it has a token that isn't (near-)expired. */
+/**
+ * A persisted session is usable if it carries a complete credential — token, bound ECDH key, and the account
+ * id the `gtoken` header is hashed from — whose token isn't (near-)expired.
+ *
+ * `accountUserId` is part of the credential, not an optional extra: a record without it was written before
+ * that id was tracked, so it can only be restored as the other id, which is what the gateway rejects the
+ * header on. Nothing in a restored session can recover it either — the id arrives with a login reply. So such
+ * a record is refused and one login re-establishes it, rather than reinstating a session whose every
+ * authenticated call fails identically.
+ */
 export declare function isSessionValid(s: PersistedSession | null, skewSec?: number): boolean;

package/dist/index.js

@@ -153,7 +153,7 @@ function tokenNotExpired(tokenExpiresAt, skewSec = 300) {
   return true;
 }
 function isSessionValid(s, skewSec = 300) {
-  if (!s?.authToken || !s.shareKey || !s.keyIdent)
+  if (!s?.authToken || !s.shareKey || !s.keyIdent || !s.accountUserId)
     return false;
   return tokenNotExpired(s.tokenExpiresAt, skewSec);
 }
@@ -1135,7 +1135,7 @@ var REAUTH_HOLD_OFF_CAP_MS = 30 * 6e4;
 var REAUTH_STABLE_MS = 10 * 6e4;
 var CONTENDED_SESSION_HINT = "another client may be signed in with the same account and device identity, and each login displaces the other's session; give each client its own openudid";
 function tokenRejected(code, msg) {
-  return code === EufyCloudErrorCode.SESSION_KICKED || /user_id is empty|invalid.*token|token.*(expired|error|not exist)|kicked|(?:token|session).*does not exist|unauthor/i.test(msg ?? "");
+  return code === EufyCloudErrorCode.SESSION_KICKED || /user_id is empty|invalid[^,]*\btoken\b|\btoken\b[^,]*(expired|error|not exist)|kicked|(?:\btoken\b|\bsession\b)[^,]*does not exist|unauthor/i.test(msg ?? "");
 }
 function withoutTokenEcho(text2) {
   return text2.replace(/token\s*[=:]\s*"?[A-Za-z0-9._-]{8,}"?/gi, "token = <redacted>");
@@ -1147,6 +1147,13 @@ var MegaHttpClient = class {
   sessionKey;
   /** Per-host ECDH session keys for non-mega gateways (e.g. eufylife) keyed by host. */
   sessionKeys = /* @__PURE__ */ new Map();
+  /**
+   * The held credential. `userId` is the login reply's `ap_cloud_user_id` where it has one — the Anker
+   * Passport cloud's id — while `accountUserId` is the eufy account's own `user_id`.
+   *
+   * The `gtoken` header is hashed from `accountUserId`: that is the id the gateway recomputes the header
+   * from, rejecting a disagreement with `"gtoken not equal userid error"`.
+   */
   auth_;
   /** captcha_id of an in-flight challenge, held between login() and solveCaptcha(). */
   pendingCaptchaId;
@@ -1212,7 +1219,12 @@ var MegaHttpClient = class {
     if (!isSessionValid(saved) || !saved)
       return void 0;
     this.region = saved.region;
-    this.auth_ = { userId: saved.userId, authToken: saved.authToken, geoKey: saved.geoKey };
+    this.auth_ = {
+      userId: saved.userId,
+      accountUserId: saved.accountUserId,
+      authToken: saved.authToken,
+      geoKey: saved.geoKey
+    };
     this.tokenExpiresAt = saved.tokenExpiresAt;
     this.sessionKey = {
       keyIdent: saved.keyIdent,
@@ -1275,7 +1287,16 @@ var MegaHttpClient = class {
     };
   }
   /**
-   * The account-credential headers every authed call carries — `x-auth-token` + `gtoken` (`md5(userId)`).
+   * The id `gtoken` is hashed from — the account's own `user_id`, which is what the gateway recomputes the
+   * header from. One place so the two header paths cannot drift on which of the session's ids that is.
+   *
+   * Call only where `auth_` is already established; every header path guards it.
+   */
+  gtokenUserId() {
+    return this.auth_.accountUserId ?? this.auth_.userId;
+  }
+  /**
+   * The account-credential headers every authed call carries — `x-auth-token` + `gtoken`.
    * One place so the signed path, the key-exchange and the bearer path can't drift on what "authed" means.
    */
   authTokenHeaders() {
@@ -1284,7 +1305,7 @@ var MegaHttpClient = class {
     return {
       "x-auth-token": this.auth_.authToken,
       authorization: this.auth_.authToken,
-      gtoken: gtoken(this.auth_.userId)
+      gtoken: gtoken(this.gtokenUserId())
     };
   }
   /**
@@ -1588,7 +1609,7 @@ var MegaHttpClient = class {
     try {
       return await downloadMediaResource(url, {
         "x-auth-token": this.auth_.authToken,
-        gtoken: gtoken(this.auth_.userId),
+        gtoken: gtoken(this.gtokenUserId()),
         "app-name": "eufy_mega",
         "model-type": "PHONE",
         "user-agent": this.mediaUserAgent
@@ -1890,17 +1911,19 @@ var MegaHttpClient = class {
     {
       const cap = Object.keys(res).filter((k) => /captcha|answer|picture|image|fa_/i.test(k));
       this.logger.debug("[mega] login resp keys:", Object.keys(res).join(","));
+      this.logger.debug("[mega] ids agree:", res.ap_cloud_user_id === res.user_id);
       if (cap.length)
         this.logger.debug("[mega] captcha/fa:", JSON.stringify(Object.fromEntries(cap.map((k) => [k, res[k]]))));
     }
     const userId = res.ap_cloud_user_id ?? res.user_id ?? res.userId;
+    const accountUserId = res.user_id ?? res.userId;
     const authToken = res.auth_token ?? res.token;
     if (!userId || !authToken)
       throw new Error(`login returned no session: ${JSON.stringify(res).slice(0, 200)}`);
     const faInfo = res.fa_info ?? {};
     const needs2fa = !isVerify && !!faInfo.info;
     if (needs2fa) {
-      this.auth_ = { userId, authToken, geoKey: res.geo_key };
+      this.auth_ = { userId, accountUserId, authToken, geoKey: res.geo_key };
       this.pendingCaptchaId = void 0;
       this.pending2fa = true;
       await this.sendVerifyCode(messageType);
@@ -1908,7 +1931,7 @@ var MegaHttpClient = class {
     }
     this.pendingCaptchaId = void 0;
     this.pending2fa = false;
-    this.auth_ = { userId, authToken, geoKey: res.geo_key };
+    this.auth_ = { userId, accountUserId, authToken, geoKey: res.geo_key };
     this.tokenExpiresAt = Number(res.token_expires_at ?? 0) || 0;
     this.sessionKey = void 0;
     await this.ensureSessionKey();
@@ -1921,6 +1944,7 @@ var MegaHttpClient = class {
       return;
     this.store.save({
       userId: this.auth_.userId,
+      accountUserId: this.auth_.accountUserId ?? this.auth_.userId,
       authToken: this.auth_.authToken,
       geoKey: this.auth_.geoKey,
       region: this.region,
@@ -26406,6 +26430,11 @@ var SolixClient = class {
    * Turn a decrypted `/passport/login` payload into an `ok`/`2fa` result, establishing the session on
    * `ok`. The passport marks a pending 2FA with a non-empty `fa_info.info`, and empties it once the code
    * has been satisfied.
+   *
+   * `gtoken` is hashed from `ap_cloud_user_id` where the reply carries one, `user_id` otherwise. Whether
+   * this gateway recomputes the header from `user_id` specifically — as the mega gateway does, rejecting a
+   * disagreement with `"gtoken not equal userid error"` — is unverified here: no Solix response has been
+   * observed refusing the header, which is consistent with the two ids agreeing on the accounts seen.
    */
   classifyLogin(data, isVerify) {
     const userId = data.ap_cloud_user_id ?? data.user_id;