@msout/microsoft-webauth 0.0.5

package/.qwen/settings.json

@@ -0,0 +1,38 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git add *)",
+      "Bash(git commit *)",
+      "Bash(git push)",
+      "Bash(cat)",
+      "Bash(let *)",
+      "Bash(beforeeach)",
+      "Bash(jest.clearallmocks)",
+      "Bash(fs.removesync)",
+      "Bash(config *)",
+      "Bash('../src/config')",
+      "Bash(auth *)",
+      "Bash('../src/auth')",
+      "Bash(})",
+      "Bash(expect)",
+      "Bash(.tobe)",
+      "Bash(eof)",
+      "Bash(npm test)",
+      "Bash(head *)",
+      "Bash(import *)",
+      "Bash(with)",
+      "Bash(as *)",
+      "Bash(content *)",
+      "Bash(old_test *)",
+      "Bash(new_test *)",
+      "Bash(const *)",
+      "Bash('https://mock.test/nonexistent')",
+      "Bash(// *)",
+      "Bash(conservative *)",
+      "Bash(}, *)",
+      "Bash('''\n\ncontent = content.replace(old_test, new_test)\n\nwith open('/users/enola/workspace-msout/microsoft-webauth-playwright-js/test/auth.test.js', 'w)",
+      "Bash(node *)"
+    ]
+  },
+  "$version": 4
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 enola/phptr/msout
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,104 @@
+# microsoft-webauth
+
+A tool to authenticate against microsoft online (live or professionnal tenants)
+e.g: 
+  - https://onenote.cloud.microsoft/notebooks
+  - https://outlook.live.com/mail/
+  - and by extension https://login.microsoft.com
+
+Microsoft web authentication via Playwright — extracted from [MSOneNote Exporter](https://github.com/msout/Microsoft-OneNote-Exporter).
+
+This is a standalone CLI tool for authenticating with Microsoft accounts using Playwright. It handles:
+- Automated login with email/password
+- Manual login in browser
+- MFA/2FA support (OTC codes, number matching)
+- Session persistence
+## Available on npmjs
+
+You can find this package here: https://www.npmjs.com/package/@msout/microsoft-webauth
+
+## Installation
+
+```bash
+npm install -g @msout/microsoft-webauth
+```
+
+Or locally:
+
+```bash
+npm install @msout/microsoft-webauth
+```
+
+## Usage
+
+### Login (Automated)
+
+```bash
+microsoft-webauth login --email your@email.com --password yourpassword
+```
+
+### Login (Manual/Interactive)
+
+```bash
+microsoft-webauth login
+```
+
+This will open a browser window. Log in manually, then press Enter when you see the notebooks list.
+
+### Check Authentication Status
+
+```bash
+microsoft-webauth check
+```
+
+### Logout
+
+```bash
+microsoft-webauth logout
+```
+
+## Options
+
+| Option | Description |
+|--------|-------------|
+| `--email <email>` | Microsoft account email (for automated login) |
+| `--password <password>` | Microsoft account password (for automated login) |
+| `--notheadless` | Run in visible browser mode (disable headless) |
+| `--dodump` | Dump HTML content to files for debugging |
+
+## Output
+
+Authentication state is saved to `auth.json` in the project directory. A metadata file `auth-meta.json` stores:
+- Email used for login
+- Login timestamp
+
+## Testing
+
+```bash
+npm test
+```
+
+Run with coverage:
+
+```bash
+npm run test:coverage
+```
+
+## Project Structure
+
+```
+microsoft-webauth-playwright/
+├── src/
+│   ├── auth.js          # Authentication logic
+│   ├── config.js        # Configuration (paths, URLs)
+│   └── utils/
+│       ├── logger.js    # Logging utilities
+│       └── retry.js     # Retry helpers
+├── test/                # Jest tests
+├── package.json
+└── README.md
+```
+
+## License
+
+ISC — same as MSOneNote Exporter.

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@msout/microsoft-webauth",
+  "version": "0.0.5",
+  "description": "Microsoft web authentication module, using playwright to automate the login process and retrieve cookies for authenticated sessions.",
+  "main": "src/index.js",
+  "bin": {
+    "microsoft-webauth": "src/index.js"
+  },
+  "scripts": {
+    "start": "node src/index.js",
+    "login": "node src/index.js login",
+    "check": "node src/index.js check",
+    "test": "jest",
+    "test:watch": "jest --watch"
+  },
+  "keywords": [
+    "microsoft",
+    "authentication",
+    "playwright",
+    "webauth",
+    "mfa",
+    "javascript"
+  ],
+  "author": "msout@tuta.io",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ms-OneNote-Exporter/microsoft-webauth.git"
+  },
+  "dependencies": {
+    "chalk": "^4.1.2",
+    "commander": "^14.0.3",
+    "fs-extra": "^11.3.3",
+    "playwright": "^1.58.1",
+    "readline": "^1.3.0"
+  },
+  "devDependencies": {
+    "jest": "^29.7.0"
+  }
+}

package/src/auth.js

@@ -0,0 +1,638 @@
+const { chromium } = require('playwright');
+const fs = require('fs-extra');
+const logger = require('./utils/logger');
+const { AUTH_FILE, ONENOTE_URL, OUTLOOK_URL } = require('./config');
+const path = require('path');
+const readline = require('readline');
+
+// Companion metadata file — stores email + login time for display
+const AUTH_META_FILE = AUTH_FILE.replace('auth.json', 'auth-meta.json');
+
+/** Returns { email, loginTime } from auth-meta.json, or null if not found. */
+async function getAuthMeta() {
+    try {
+        if (await fs.pathExists(AUTH_META_FILE)) {
+            return await fs.readJson(AUTH_META_FILE);
+        }
+    } catch (e) { }
+    return null;
+}
+
+/** Deletes auth.json and auth-meta.json (full logout). */
+async function logout() {
+    await fs.remove(AUTH_FILE);
+    await fs.remove(AUTH_META_FILE);
+}
+
+/**
+ * Prompts the user for input in the terminal.
+ */
+function promptUser(query) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+    });
+    return new Promise(resolve => rl.question(query, ans => {
+        rl.close();
+        resolve(ans);
+    }));
+}
+
+/**
+ * Waits for successful authentication based on target URL.
+ * @param {import('playwright').Page} page - Playwright page object
+ * @param {string} targetUrl - The target URL (ONENOTE_URL or OUTLOOK_URL)
+ */
+async function waitForAuthSuccess(page, targetUrl) {
+    const isOutlook = targetUrl && targetUrl.includes('outlook.cloud.microsoft');
+
+    if (isOutlook) {
+        logger.info('Waiting for redirection to Outlook mail...');
+        await Promise.any([
+            // Outlook: wait for email message list (table with emails)
+            page.waitForSelector('[aria-label*="message list"], [role="grid"][aria-label*="mail"], .messageList', { state: 'visible', timeout: 60000 }),
+            // Fallback: wait for folder navigation (Inbox, Sent, etc.)
+            page.waitForSelector('text=/Inbox|Sent Mail|Drafts/i', { state: 'visible', timeout: 60000 }),
+            // Fallback: wait for any email-like content
+            page.waitForSelector('div[role="row"]', { state: 'visible', timeout: 60000 }),
+        ]);
+        logger.success('Outlook mail interface detected.');
+    } else {
+        // OneNote default behavior
+        logger.info('Waiting for redirection to notebooks list...');
+        await Promise.any([
+            page.waitForURL(url => url.toString().includes('/notebooks') || url.hostname.includes('onenote.cloud.microsoft') || url.hostname.includes('onenote.com'), { timeout: 60000 }),
+            page.waitForSelector('text="My notebooks"', { state: 'visible', timeout: 60000 }),
+            page.waitForSelector('text="Create new notebook"', { state: 'visible', timeout: 60000 }),
+            page.waitForSelector('text="Welcome, "', { state: 'visible', timeout: 60000 })
+        ]);
+        logger.success('Notebooks list detected.');
+    }
+}
+
+/**
+ * Clicks the page-level "Cancel" button on the FIDO/security-key page and
+ * waits for the browser to navigate away. Works because the addInitScript
+ * override makes navigator.credentials.create() reject immediately, so the
+ * native OS-level WebAuthn dialog never appears and the DOM is fully accessible.
+ *
+ * @param {import('playwright').Page} page
+ * @param {object} logger
+ */
+async function dismissFidoPage(page, logger) {
+    // Try multiple selectors for the page-level Cancel button.
+    // On the FIDO page there are two Cancel-labelled things:
+    //   1. The native OS WebAuthn dialog (blocked by addInitScript — never appears)
+    //   2. The page-level gray "Cancel" button at the bottom of the form
+    const cancelSelectors = [
+        // Exact role button with text "Cancel" (the bottom-of-form button)
+        'button:has-text("Cancel")',
+        '[value="Cancel"]',
+        'input[type="button"][value="Cancel"]',
+    ];
+
+    let clicked = false;
+    for (const sel of cancelSelectors) {
+        try {
+            const btn = page.locator(sel).first();
+            await btn.waitFor({ state: 'visible', timeout: 4000 });
+            logger.info(`FIDO: clicking page-level Cancel via selector "${sel}"...`);
+            await btn.click({ force: true });
+            clicked = true;
+            break;
+        } catch (_) {
+            // try next selector
+        }
+    }
+
+    if (!clicked) {
+        // Last resort: JS click on any visible Cancel button
+        logger.warn('FIDO: DOM selectors failed, trying JS click fallback...');
+        await page.evaluate(() => {
+            const btns = Array.from(document.querySelectorAll('button, input[type="button"], input[type="submit"]'));
+            const cancel = btns.find(b => /^cancel$/i.test((b.textContent || b.value || '').trim()));
+            if (cancel) cancel.click();
+        });
+    }
+
+    // Wait for navigation away from the FIDO page (up to 8 s)
+    try {
+        await page.waitForURL(url => !url.toString().includes('/fido/'), { timeout: 8000 });
+        logger.debug('FIDO: navigated away from FIDO page successfully.');
+    } catch (_) {
+        logger.warn('FIDO: still on FIDO URL after Cancel — continuing anyway.');
+    }
+}
+
+async function login(credentials = {}) {
+    const { email, password, targetUrl } = credentials;
+    const isAutomated = !!(email && password);
+    const headless = !credentials.notheadless && isAutomated;
+    // Use targetUrl if provided, otherwise default to ONENOTE_URL for backward compatibility
+    const finalTargetUrl = targetUrl || ONENOTE_URL;
+
+    // Added to verify version on user's machine
+    logger.debug('Authentication Module: Version 4.4-DEBUG starting...');
+
+    if (isAutomated) {
+        logger.info(`Attempting automated login for ${email}...`);
+    } else {
+        logger.info('Launching browser for manual authentication...');
+        logger.warn('Please log in to your Microsoft account in the browser window.');
+        const serviceName = finalTargetUrl.includes('outlook') ? 'Outlook' : 'OneNote';
+        logger.warn(`The script will wait until you successfully reach the ${serviceName} interface.`);
+    }
+
+    const browser = await chromium.launch({ headless: !!headless });
+    const context = await browser.newContext({
+        // Disable WebAuthn/FIDO hardware key prompts
+        ignoreHTTPSErrors: false,
+    });
+    const page = await context.newPage();
+
+    // Dismiss any native browser dialogs (alert/confirm/prompt) automatically
+    page.on('dialog', async dialog => {
+        logger.debug(`[dialog] Auto-dismissing native dialog: type=${dialog.type()}, message="${dialog.message()}"`);
+        await dialog.dismiss();
+    });
+
+    try {
+        // Inject WebAuthn override BEFORE any navigation.
+        // navigator.credentials.create() triggers a native OS-level dialog that
+        // Playwright cannot dismiss via DOM clicks. Rejecting it programmatically
+        // prevents the dialog from ever appearing, making the page-level Cancel
+        // button accessible instead.
+        await page.addInitScript(() => {
+            if (typeof navigator !== 'undefined' && navigator.credentials) {
+                navigator.credentials.create = () =>
+                    Promise.reject(new DOMException('Cancelled by automation', 'NotAllowedError'));
+                navigator.credentials.get = (options) => {
+                    if (options && options.publicKey) {
+                        return Promise.reject(new DOMException('Cancelled by automation', 'NotAllowedError'));
+                    }
+                    // Allow password-manager / federated credential requests through
+                    return Promise.reject(new DOMException('Cancelled by automation', 'NotAllowedError'));
+                };
+            }
+        });
+
+        await page.goto(finalTargetUrl);
+
+        if (isAutomated) {
+            logger.step('Automating login steps...');
+
+            // 0. Handle landing page if it appears (redirection to onenote.cloud.microsoft)
+            try {
+                // Look for "Sign in" button.
+                const signInButton = page.getByRole('button', { name: 'Sign in' }).first();
+
+                await signInButton.waitFor({ state: 'visible', timeout: 10000 });
+
+                logger.info('Landing page detected. Clicking "Sign in"...');
+
+                await signInButton.click({ noWaitAfter: true });
+
+                logger.debug('Clicked "Sign in", waiting for login form...');
+            } catch (e) {
+                logger.debug('Landing page not detected or "Sign in" button not found within timeout.');
+            }
+
+            // 1. Enter Email
+            try {
+                await page.waitForSelector('input[name="loginfmt"]', { state: 'visible', timeout: 30000 });
+                await page.fill('input[name="loginfmt"]', email);
+
+                logger.info('Email entered. Clicking "Next"...');
+                await page.click('input[type="submit"]');
+
+                logger.debug('Waiting for email field to disappear...');
+                await page.waitForSelector('input[name="loginfmt"]', { state: 'hidden', timeout: 15000 }).catch(() => {
+                    logger.debug('Email field still present, proceeding with caution.');
+                });
+
+                logger.info('Will wait 1 seconds to give the UI a moment to settle into the next screen (MFA/Password)');
+                await page.waitForTimeout(1000);
+
+                const usernameError = page.locator('#usernameError');
+                if (await usernameError.isVisible({ timeout: 2000 })) {
+                    const errorMsg = await usernameError.textContent();
+                    throw new Error(`Login Error (Username): ${errorMsg?.trim()}`);
+                }
+            } catch (e) {
+                logger.error(`Failed to enter email: ${e.message}`);
+                if (credentials.dodump) {
+                    const dumpDir = await logger.getDumpDir();
+                    const displayPath = logger.getDumpDisplayPath();
+                    const debugFile = path.join(dumpDir, 'debug_login_error_email.html');
+                    await fs.writeFile(debugFile, await page.content().catch(e => `<!-- Error: ${e.message} -->`));
+                    logger.error(`Email submission failed. HTML dumped to ${displayPath}/debug_login_error_email.html`);
+                }
+                throw e;
+            }
+
+            // Proactive dump after email step (before MFA detection)
+            if (credentials.dodump) {
+                const dumpDir = await logger.getDumpDir();
+                const displayPath = logger.getDumpDisplayPath();
+                const debugFile = path.join(dumpDir, 'debug_after_email.html');
+                await fs.writeFile(debugFile, await page.content().catch(e => `<!-- Error: ${e.message} -->`));
+                logger.debug(`[dodump] Post-email state dumped to ${displayPath}/debug_after_email.html`);
+            }
+
+            // 1.5. Handle intermediate screens (MFA selection, "Other ways to sign in")
+            try {
+                const pageTitle = (await page.title()).trim();
+                const pageHeading = (await page.locator('h1, [role="heading"]').first().textContent().catch(() => '')).trim();
+
+                logger.debug(`Settled State: Title="${pageTitle}" | Heading="${pageHeading}"`);
+                logger.debug('Checking for intermediate MFA/Sign-in option screens...');
+
+                const result = await Promise.race([
+                    page.waitForSelector('text=/Other ways to sign in/i', { state: 'visible', timeout: 15000 }).then(() => 'other_ways'),
+                    page.waitForSelector('text=/Get a code to sign in/i', { state: 'visible', timeout: 15000 }).then(() => 'other_ways'),
+                    page.waitForSelector('text=/Verify your identity/i', { state: 'visible', timeout: 15000 }).then(() => 'other_ways'),
+                    page.waitForSelector('text=/Use your password/i', { state: 'visible', timeout: 15000 }).then(() => 'use_password'),
+                    page.waitForSelector('text=/Approve a request on my Microsoft Authenticator app/i', { state: 'visible', timeout: 5000 }).then(() => 'approve_app'),
+                    page.waitForSelector('input[name="passwd"]', { state: 'visible', timeout: 15000 }).then(() => 'password'),
+                    page.waitForFunction(() => {
+                        const h = document.querySelector('h1, [role="heading"]')?.textContent || '';
+                        return h.includes('Get a code') || h.includes('Verify your identity');
+                    }, { timeout: 15000 }).then(() => 'other_ways'),
+                ]).catch((err) => {
+                    logger.debug(`Detection race timed out or failed: ${err.message}`);
+                    return 'timeout';
+                });
+
+                logger.debug(`Intermediate screen detection result: ${result}`);
+
+                if (credentials.dodump) {
+                    const dumpDir = await logger.getDumpDir();
+                    const displayPath = logger.getDumpDisplayPath();
+                    const debugFile = path.join(dumpDir, 'debug_intermediate_screen.html');
+                    await fs.writeFile(debugFile, await page.content().catch(e => `<!-- Error: ${e.message} -->`));
+                    logger.debug(`[dodump] Intermediate screen state dumped to ${displayPath}/debug_intermediate_screen.html`);
+                }
+
+                if (result === 'other_ways' || pageHeading.includes('Get a code') || pageHeading.includes('Verify your identity')) {
+                    logger.info('Detected MFA/Verification screen. Attempting to locate "Other ways to sign in"...');
+
+                    const otherWays = page.getByRole('button', { name: /Other ways to sign in|Sign in another way/i })
+                        .or(page.getByText(/Other ways to sign in|Sign in another way/i))
+                        .first();
+
+                    try {
+                        logger.debug('Waiting for "Other ways" link to appear in DOM...');
+                        await otherWays.waitFor({ state: 'attached', timeout: 15000 });
+
+                        const isVisible = await otherWays.isVisible();
+                        logger.debug(`"Other ways" link visibility: ${isVisible}`);
+
+                        logger.info('Clicking "Other ways to sign in"...');
+                        try {
+                            await otherWays.click({ timeout: 5000 });
+                        } catch (e) {
+                            logger.debug(`Standard click failed, trying forced: ${e.message}`);
+                            await otherWays.click({ force: true, timeout: 5000 });
+                        }
+                    } catch (e) {
+                        logger.warn(`MFA link interaction failed: ${e.message}`);
+
+                        logger.debug('Attempting final fallback: JavaScript-based click...');
+                        const clicked = await page.evaluate(() => {
+                            const elements = Array.from(document.querySelectorAll('span, a, button'));
+                            const target = elements.find(el =>
+                                el.textContent.toLowerCase().includes('other ways to sign in') ||
+                                el.textContent.toLowerCase().includes('sign in another way')
+                            );
+                            if (target) {
+                                target.click();
+                                return true;
+                            }
+                            return false;
+                        });
+
+                        if (clicked) {
+                            logger.info('Successfully triggered click via JavaScript fallback.');
+                        } else if (pageHeading.includes('Get a code')) {
+                            throw new Error('STUCK: "Other ways to sign in" link not found even via JS scan.');
+                        }
+                    }
+
+                    logger.debug('Waiting for method selection screen ("Use your password")...');
+                    const subResult = await Promise.race([
+                        page.waitForSelector('text=/Use your password/i', { state: 'visible', timeout: 15000 }).then(() => 'use_password'),
+                        page.waitForSelector('#idA_PWD_SwitchToPassword', { state: 'visible', timeout: 15000 }).then(() => 'use_password'),
+                        page.waitForSelector('text=/Select a verification method/i', { state: 'visible', timeout: 15000 }).then(() => 'other_ways_list'),
+                    ]).catch(() => 'timeout');
+
+                    logger.debug(`Sub-screen detection result: ${subResult}`);
+
+                    if (subResult === 'use_password') {
+                        logger.info('Selecting "Use your password" option...');
+                        await page.click('text=/Use your password/i');
+                    } else if (subResult === 'other_ways_list') {
+                        logger.info('Selection list detected. Looking for "Password"...');
+                        await page.click('text=/Password|Use your password/i');
+                    }
+                } else if (result === 'use_password') {
+                    logger.info('Detected "Use your password" option. Clicking...');
+                    await page.click('text="Use your password"');
+                } else if (result === 'approve_app') {
+                    logger.warn('MFA notification already sent. Attempting to switch to password...');
+                    const otherLink = page.locator('text="Other ways to sign in", #signInAnotherWay').first();
+                    if (await otherLink.isVisible()) {
+                        await otherLink.click();
+                        await page.waitForSelector('text="Use your password"', { state: 'visible', timeout: 10000 });
+                        await page.click('text="Use your password"');
+                    }
+                } else if (result === 'password') {
+                    logger.debug('Direct password field detected.');
+                } else if (result === 'timeout') {
+                    logger.debug('No intermediate screen detected within timeout. Proceeding to password entry.');
+                }
+            } catch (e) {
+                logger.debug(`Intermediate screen handler encountered a fatal issue: ${e.message}`);
+            }
+
+            // 2. Enter Password
+            try {
+                await page.waitForSelector('input[name="passwd"]', { state: 'visible', timeout: 30000 });
+                await page.fill('input[name="passwd"]', password);
+
+                const submitButton = page.locator('input[type="submit"], button[type="submit"]').filter({ hasText: /Sign in|Next|Finish/i }).first();
+
+                logger.debug('Waiting for submit button to be enabled...');
+                await submitButton.waitFor({ state: 'visible', timeout: 10000 });
+                if (await submitButton.isDisabled()) {
+                    logger.debug('Submit button is disabled. It might be the wrong one or the password field is not considered filled.');
+                    logger.info('Will wait 1 seconds to let the submit button load properly');
+                    await page.waitForTimeout(1000);
+                }
+
+                await submitButton.click();
+
+                const passwordError = page.locator('#passwordError');
+                if (await passwordError.isVisible({ timeout: 2000 })) {
+                    const errorMsg = await passwordError.textContent();
+                    throw new Error(`Login Error (Password): ${errorMsg?.trim()}`);
+                }
+            } catch (e) {
+                if (credentials.dodump) {
+                    const dumpDir = await logger.getDumpDir();
+                    const displayPath = logger.getDumpDisplayPath();
+                    const debugFile = path.join(dumpDir, 'debug_login_error_password.html');
+                    await fs.writeFile(debugFile, await page.content().catch(e => `<!-- Error: ${e.message} -->`));
+                    logger.error(`Password entry failed. HTML dumped to ${displayPath}/debug_login_error_password.html`);
+                }
+                throw e;
+            }
+
+            // Proactive dump after password submission (before post-password MFA check)
+            if (credentials.dodump) {
+                const dumpDir = await logger.getDumpDir();
+                const displayPath = logger.getDumpDisplayPath();
+                const debugFile = path.join(dumpDir, 'debug_after_password.html');
+                await fs.writeFile(debugFile, await page.content().catch(e => `<!-- Error: ${e.message} -->`));
+                logger.debug(`[dodump] Post-password state dumped to ${displayPath}/debug_after_password.html`);
+            }
+
+            // 2.5b. Handle FIDO/security key page (login.microsoft.com/consumers/fido/create)
+            // The addInitScript above makes navigator.credentials.create() reject immediately,
+            // so the native OS WebAuthn dialog never appears. We only need to click the
+            // page-level "Cancel" button and wait for navigation away from the FIDO URL.
+            try {
+                const currentUrl = page.url();
+                const onFidoPage = currentUrl.includes('/fido/');
+
+                if (onFidoPage) {
+                    logger.info(`Already on FIDO page (${currentUrl}). Clicking page-level Cancel...`);
+                    await dismissFidoPage(page, logger);
+                } else {
+                    // Race: either we navigate to fido, or 8 s passes (no fido page)
+                    const fidoHandled = await Promise.race([
+                        page.waitForURL(url => url.toString().includes('/fido/'), { timeout: 8000 })
+                            .then(async () => {
+                                logger.info(`Navigated to FIDO page: ${page.url()}. Dismissing...`);
+                                await dismissFidoPage(page, logger);
+                                return 'fido_cancelled';
+                            }),
+                        page.waitForTimeout(8000).then(() => 'no_fido'),
+                    ]);
+                    logger.debug(`FIDO check result: ${fidoHandled}`);
+                }
+            } catch (e) {
+                logger.debug(`FIDO popup handler skipped: ${e.message}`);
+            }
+
+            // 2.5. Handle post-password MFA/Verification if needed
+            try {
+                const verificationScreen = await Promise.race([
+                    page.waitForSelector('text="Verify your identity"', { timeout: 10000 }).then(() => 'verify'),
+                    page.waitForSelector('text="Enter code"', { timeout: 10000 }).then(() => 'enter_code'),
+                    page.waitForSelector('input[name="otc"]', { timeout: 10000 }).then(() => 'otc_input'),
+                    page.waitForSelector('text=/Approve sign in request/i', { timeout: 10000 }).then(() => 'number_match'),
+                    page.waitForSelector('.displaySign', { timeout: 10000 }).then(() => 'number_match'),
+                ]).catch(() => null);
+
+                if (credentials.dodump) {
+                    const dumpDir = await logger.getDumpDir();
+                    const displayPath = logger.getDumpDisplayPath();
+                    const debugFile = path.join(dumpDir, 'debug_post_password_mfa.html');
+                    await fs.writeFile(debugFile, await page.content().catch(e => `<!-- Error: ${e.message} -->`));
+                    logger.debug(`[dodump] Post-password MFA screen state dumped to ${displayPath}/debug_post_password_mfa.html`);
+                }
+
+                if (verificationScreen === 'number_match') {
+                    logger.warn('Number Matching MFA detected ("Approve sign in request" screen).');
+
+                    let matchNumber = '??';
+                    try {
+                        matchNumber = await page.$eval('.displaySign', el => el.textContent.trim());
+                    } catch (_) {
+                        logger.debug('Could not extract number from .displaySign — user may still see it if --notheadless is used.');
+                    }
+
+                    logger.step('══════════════════════════════════════════════════════');
+                    logger.step(`  ACTION REQUIRED: Open Microsoft Authenticator on your phone.`);
+                    logger.step(`  Enter the number:  ${matchNumber}`);
+                    logger.step(`  Then tap "Yes" / "Approve" in the app.`);
+                    logger.step('══════════════════════════════════════════════════════');
+                    logger.info('Waiting for phone approval (up to 120 seconds)...');
+
+                    await Promise.race([
+                        page.waitForSelector('.displaySign', { state: 'hidden', timeout: 120000 }),
+                        page.waitForURL(url => !url.toString().includes('login.microsoftonline.com'), { timeout: 120000 }),
+                        page.waitForSelector('text=/Stay signed in/i', { timeout: 120000 }),
+                    ]);
+
+                    logger.success('Phone approval received. Continuing login flow...');
+
+                } else if (verificationScreen) {
+                    logger.warn('MFA/Verification screen detected.');
+                    logger.step('A verification code is required. Please check your email or authenticator app.');
+
+                    const code = await promptUser('Enter the verification code: ');
+
+                    if (await page.locator('input[name="otc"]').isVisible()) {
+                        await page.fill('input[name="otc"]', code);
+                    } else if (await page.locator('input[type="tel"]').isVisible()) {
+                        await page.fill('input[type="tel"]', code);
+                    } else {
+                        await page.locator('input[type="text"]:visible, input[type="tel"]:visible').first().fill(code);
+                    }
+
+                    await page.click('input[type="submit"]');
+                }
+            } catch (e) {
+                logger.debug(`Post-password verification handling skipped or failed: ${e.message}`);
+            }
+            
+            // 2.7. Handle "Help protect your account" interrupt screen
+            try {
+                const interruptPrompt = page.getByText(/Help protect your account/i).first();
+                if (await interruptPrompt.isVisible({ timeout: 5000 }) || page.url().includes('account.live.com/interrupt/')) {
+                    logger.info('Detected "Help protect your account" interrupt screen.');
+                    const skipButton = page.getByRole('button', { name: /Skip for now/i })
+                        .or(page.getByText(/Skip for now/i))
+                        .first();
+                    if (await skipButton.isVisible()) {
+                        logger.info('Clicking "Skip for now"...');
+                        await skipButton.click();
+                    }
+                }
+            } catch (e) {
+                logger.debug(`Help protect your account interrupt screen did not appear: ${e.message}`);
+            }
+
+            // 3. Handle "Stay signed in?" prompt if it appears
+            try {
+                logger.debug('Checking for "Stay signed in?" prompt...');
+
+                const staySignedIn = page.getByText(/Stay signed in?/i)
+                    .or(page.locator('#KmsiDescription'))
+                    .first();
+
+                await staySignedIn.waitFor({ state: 'visible', timeout: 7000 });
+
+                logger.info('Detected "Stay signed in?" prompt.');
+
+                const dontShowAgain = page.locator('input[name="DontShowAgain"], #KmsiCheckboxField').first();
+                if (await dontShowAgain.isVisible()) {
+                    logger.debug('Checking "Don\'t show this again" checkbox...');
+                    await dontShowAgain.check().catch(() => { });
+                }
+
+                const yesButton = page.getByRole('button', { name: /^Yes$/i })
+                    .or(page.locator('button[data-testid="primaryButton"]'))
+                    .or(page.locator('#idSIButton9'))
+                    .first();
+
+                logger.info('Clicking "Yes" to stay signed in...');
+                await yesButton.click();
+            } catch (e) {
+                logger.debug(`Stay signed in prompt did not appear or was not recognized: ${e.message}`);
+            }
+
+            // 4. Wait for redirection to target interface (notebooks or mail)
+            try {
+                await waitForAuthSuccess(page, finalTargetUrl);
+            } catch (e) {
+                if (credentials.dodump) {
+                    const dumpDir = await logger.getDumpDir();
+                    const displayPath = logger.getDumpDisplayPath();
+                    const debugFile = path.join(dumpDir, 'debug_login_error_success.html');
+                    await fs.writeFile(debugFile, await page.content().catch(e => `<!-- Error: ${e.message} -->`));
+                    logger.error(`Success detection failed. HTML dumped to ${displayPath}/debug_login_error_success.html`);
+                }
+                throw e;
+            }
+        } else {
+            logger.warn('Login flow requires manual interaction.');
+            const serviceName = finalTargetUrl.includes('outlook') ? 'Outlook' : 'OneNote';
+            logger.step(`>>> Once you see your ${serviceName} interface in the browser, return here and press ENTER to continue. <<<`);
+
+            const rl = readline.createInterface({
+                input: process.stdin,
+                output: process.stdout
+            });
+
+            await new Promise(resolve => {
+                rl.question('', () => {
+                    rl.close();
+                    resolve();
+                });
+            });
+        }
+
+        logger.info('Saving authentication state...');
+        await context.storageState({ path: AUTH_FILE });
+
+        await fs.writeJson(AUTH_META_FILE, {
+            email: email || 'manual login',
+            loginTime: new Date().toISOString()
+        });
+
+        logger.success(`Authentication successful! State saved to ${AUTH_FILE}`);
+    } catch (error) {
+        logger.error('Authentication failed or cancelled:', error);
+        if (isAutomated) {
+            logger.debug('Possible cause: incorrect credentials, MFA requirement, or selector change.');
+        }
+    } finally {
+        await browser.close();
+    }
+}
+
+async function getAuthenticatedContext(browser) {
+    if (await fs.pathExists(AUTH_FILE)) {
+        return browser.newContext({ storageState: AUTH_FILE });
+    } else {
+        throw new Error('No authentication state found. Please run "login" command first.');
+    }
+}
+
+async function checkAuth(targetUrl = ONENOTE_URL) {
+    if (!(await fs.pathExists(AUTH_FILE))) {
+        return false;
+    }
+
+    let browser;
+    try {
+        logger.debug('Verifying authentication session...');
+        browser = await chromium.launch({ headless: true });
+        const context = await browser.newContext({ storageState: AUTH_FILE });
+        const page = await context.newPage();
+
+        await page.goto(targetUrl, { waitUntil: 'domcontentloaded', timeout: 15000 });
+
+        logger.info('Will wait 2 sec to allow client-side redirects to Microsoft login pages if session is dead/');
+        await page.waitForTimeout(2000);
+
+        const url = page.url();
+        const isLoginUrl = url.includes('login.live.com') || url.includes('login.microsoftonline.com');
+
+        if (isLoginUrl) {
+            logger.warn('Authentication session has expired. Deleting stale auth state.');
+            await logout();
+            return false;
+        }
+
+        return true;
+    } catch (e) {
+        logger.debug(`Session verification encountered an error (timeout/network): ${e.message}`);
+        return true;
+    } finally {
+        logger.debug(`Looks like user is logged in.`);
+        if (browser) {
+            await browser.close();
+        }
+    }
+}
+
+module.exports = {
+    login,
+    getAuthenticatedContext,
+    checkAuth,
+    getAuthMeta,
+    logout
+};

package/src/config.js

@@ -0,0 +1,22 @@
+const path = require('path');
+
+/**
+ * Returns the directory where auth files (auth.json, auth-meta.json) are stored.
+ * For this standalone CLI tool, we use the project root.
+ */
+function getUserDataDir() {
+    return path.resolve(__dirname, '..');
+}
+
+const USER_DATA_DIR = getUserDataDir();
+
+const AUTH_FILE = path.join(USER_DATA_DIR, 'auth.json');
+const ONENOTE_URL = 'https://onenote.cloud.microsoft/en-us';
+const OUTLOOK_URL = 'https://outlook.cloud.microsoft/mail/';
+
+module.exports = {
+    AUTH_FILE,
+    ONENOTE_URL,
+    OUTLOOK_URL,
+    USER_DATA_DIR,
+};

package/src/index.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+const { program } = require('commander');
+const logger = require('./utils/logger');
+const { login, checkAuth, getAuthMeta, logout } = require('./auth');
+const { ONENOTE_URL, OUTLOOK_URL } = require('./config');
+
+program
+    .name('webauth')
+    .description('Microsoft web authentication via Playwright — extracted from MSOneNote Exporter')
+    .version('1.0.0');
+
+program
+    .command('login')
+    .description('Authenticate with Microsoft Account')
+    .option('--email <email>', 'Microsoft account email')
+    .option('--password <password>', 'Microsoft account password')
+    .option('--notheadless', 'Run in visible browser mode for debugging')
+    .option('--dodump', 'Dump HTML content to files for debugging')
+    .option('--against <target>', 'Target service: onenote (default) or outlook', 'onenote')
+    .action(async (options) => {
+        const targetUrl = options.against === 'outlook' ? OUTLOOK_URL : ONENOTE_URL;
+        await login({ ...options, targetUrl });
+    });
+
+program
+    .command('check')
+    .description('Check if authenticated')
+    .option('--against <target>', 'Target service: onenote (default) or outlook', 'onenote')
+    .action(async (options) => {
+        const targetUrl = options.against === 'outlook' ? OUTLOOK_URL : ONENOTE_URL;
+        const isAuth = await checkAuth(targetUrl);
+        if (isAuth) {
+            logger.success('Authentication file found. You are authenticated.');
+            const meta = await getAuthMeta();
+            if (meta && meta.email) {
+                const loginTime = new Date(meta.loginTime).toLocaleString();
+                logger.info(`Logged in as: ${meta.email}`);
+                logger.debug(`Session started at: ${loginTime}`);
+            }
+        } else {
+            logger.error('Authentication file NOT found or invalid. Run "login" first.');
+        }
+    });
+
+program
+    .command('logout')
+    .description('Clear authentication state')
+    .action(async () => {
+        await logout();
+        logger.success('Logged out successfully. Authentication state cleared.');
+    });
+
+program.parse();

package/src/utils/logger.js

@@ -0,0 +1,148 @@
+const chalk = require('chalk');
+const fs = require('fs-extra');
+const path = require('path');
+
+class Logger {
+    constructor() {
+        this.months = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+        this.logFilePath = path.resolve(__dirname, '../logs/app.log');
+
+         // Initialize dump directory name once per execution
+        const now = new Date();
+        const yyyy = now.getFullYear();
+        const mm = String(now.getMonth() + 1).padStart(2, '0');
+        const dd = String(now.getDate()).padStart(2, '0');
+        const hh = String(now.getHours()).padStart(2, '0');
+        const min = String(now.getMinutes()).padStart(2, '0');
+
+         // Format: YYYY-MM-DD_HHhMM
+        this.dumpSubDir = `${yyyy}-${mm}-${dd}_${hh}h${min}`;
+
+         // Ensure logs directory exists
+        fs.ensureDirSync(path.dirname(this.logFilePath));
+    }
+
+    _getTimestamp() {
+        const now = new Date();
+        const month = this.months[now.getMonth()];
+        const day = String(now.getDate()).padStart(2, '0');
+        const time = now.toTimeString().split(' ')[0];
+        return `[${month} ${day} ${time}]`;
+    }
+
+    /**
+     * Returns the absolute path to the current session's dump directory.
+     * Ensures the directory exists.
+     * @returns {Promise<string>}
+     */
+    async getDumpDir() {
+        const dumpDir = path.resolve(__dirname, '../logs/dumps', this.dumpSubDir);
+        await fs.ensureDir(dumpDir);
+        return dumpDir;
+    }
+
+    /**
+     * Returns a user-friendly relative path for logging.
+     * @returns {string}
+     */
+    getDumpDisplayPath() {
+        return `logs/dumps/${this.dumpSubDir}`;
+    }
+
+    _stripColors(str) {
+         // eslint-disable-next-line no-control-regex
+        return str.replace(/\u001b\[[0-9;]*m/g, '');
+    }
+
+    _formatMessage(level, message, colorFunc = (m) => m) {
+        const timestamp = this._getTimestamp();
+        const coloredTimestamp = chalk.gray(timestamp);
+        const levelTag = `[${level}]`;
+        const coloredLevelTag = colorFunc(levelTag);
+
+         // Handle multi-line messages
+        let formattedMessage = '';
+        if (typeof message === 'string' && message.includes('\n')) {
+            formattedMessage = message.split('\n').map(line => `${coloredTimestamp} ${coloredLevelTag} ${line}`).join('\n');
+        } else if (typeof message !== 'string') {
+             // Handle objects/errors
+            try {
+                const stringified = JSON.stringify(message, null, 2);
+                formattedMessage = `${coloredTimestamp} ${coloredLevelTag} ${stringified}`;
+            } catch (e) {
+                formattedMessage = `${coloredTimestamp} ${coloredLevelTag} [Complex Object]`;
+            }
+        } else {
+            formattedMessage = `${coloredTimestamp} ${coloredLevelTag} ${message}`;
+        }
+
+         // Write to log file (no colors)
+        const plainTimestamp = timestamp;
+        const plainLevelTag = levelTag;
+        let plainMessage = '';
+
+        if (typeof message === 'string' && message.includes('\n')) {
+            plainMessage = message.split('\n').map(line => `${plainTimestamp} ${plainLevelTag} ${line}`).join('\n');
+        } else if (typeof message !== 'string') {
+            try {
+                const stringified = JSON.stringify(message, null, 2);
+                plainMessage = `${plainTimestamp} ${plainLevelTag} ${stringified}`;
+            } catch (e) {
+                plainMessage = `${plainTimestamp} ${plainLevelTag} [Complex Object]`;
+            }
+        } else {
+            plainMessage = `${plainTimestamp} ${plainLevelTag} ${message}`;
+        }
+
+         // Append to log file
+        fs.appendFileSync(this.logFilePath, plainMessage + '\n');
+
+        return formattedMessage;
+    }
+
+    /** Generic log method for programmatic use */
+    log(level, message) {
+        const lv = (level || 'info').toLowerCase();
+        if (this[lv] && typeof this[lv] === 'function') {
+            this[lv](message);
+        } else {
+            this.info(message);
+        }
+    }
+
+    info(message) {
+        process.stdout.write(this._formatMessage('INFO', message, chalk.blue) + '\n');
+    }
+
+    warn(message) {
+        process.stdout.write(this._formatMessage('WARN', message, chalk.yellow) + '\n');
+    }
+
+    error(message, error = null) {
+        process.stderr.write(this._formatMessage('ERROR', message, chalk.red) + '\n');
+        if (error) {
+            if (error.stack) {
+                const stack = chalk.red(error.stack);
+                process.stderr.write(stack + '\n');
+                 // Also write stack to file
+                fs.appendFileSync(this.logFilePath, this._stripColors(stack) + '\n');
+            } else {
+                process.stderr.write(this._formatMessage('ERROR', error, chalk.red) + '\n');
+            }
+        }
+    }
+
+    success(message) {
+        process.stdout.write(this._formatMessage('SUCCESS', message, chalk.green) + '\n');
+    }
+
+    debug(message) {
+        process.stdout.write(this._formatMessage('DEBUG', message, chalk.gray) + '\n');
+    }
+
+    step(message) {
+        process.stdout.write(this._formatMessage('STEP', message, chalk.magenta) + '\n');
+    }
+}
+
+module.exports = new Logger();

package/src/utils/retry.js

@@ -0,0 +1,59 @@
+const logger = require('./logger');
+
+/**
+ * Retry a function with exponential backoff
+ * @param {Function} fn - Async function to retry
+ * @param {Object} options - Retry options
+ * @param {number} options.maxAttempts - Maximum number of attempts (default: 3)
+ * @param {number} options.initialDelayMs - Initial delay in milliseconds (default: 500)
+ * @param {number} options.maxDelayMs - Maximum delay in milliseconds (default: 5000)
+ * @param {number} options.backoffMultiplier - Backoff multiplier (default: 2)
+ * @param {string} options.operationName - Name of operation for logging (default: 'Operation')
+ * @param {boolean} options.silent - Suppress retry logging (default: false)
+ * @returns {Promise<any>} Result of the function
+ * @throws {Error} If all attempts fail
+ */
+async function withRetry(fn, options = {}) {
+    const {
+        maxAttempts = 3,
+        initialDelayMs = 500,
+        maxDelayMs = 5000,
+        backoffMultiplier = 2,
+        operationName = 'Operation',
+        silent = false
+    } = options;
+
+    let lastError;
+    let delayMs = initialDelayMs;
+
+    for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+        try {
+            return await fn();
+        } catch (error) {
+            lastError = error;
+
+            if (attempt === maxAttempts) {
+                if (!silent) {
+                    logger.error(`${operationName} failed after ${maxAttempts} attempts:`, error);
+                }
+                throw error;
+            }
+
+            if (!silent) {
+                logger.warn(`${operationName} failed (attempt ${attempt}/${maxAttempts}): ${error.message}`);
+                logger.info(`Will wait ${delayMs / 1000} seconds to retry`);
+                logger.debug(`  Retrying in ${delayMs}ms...`);
+            }
+
+             // Wait before retrying
+            await new Promise(resolve => setTimeout(resolve, delayMs));
+
+             // Exponential backoff with max cap
+            delayMs = Math.min(delayMs * backoffMultiplier, maxDelayMs);
+        }
+    }
+
+    throw lastError;
+}
+
+module.exports = { withRetry };

package/test/auth.test.js

@@ -0,0 +1,134 @@
+const path = require('path');
+const fs = require('fs-extra');
+
+// Mock the modules before requiring auth
+jest.mock('../src/config', () => ({
+    AUTH_FILE: '/tmp/test-auth.json',
+    ONENOTE_URL: 'https://www.onenote.com/notebooks',
+    OUTLOOK_URL: 'https://outlook.cloud.microsoft/mail/',
+    USER_DATA_DIR: '/tmp'
+}));
+
+jest.mock('../src/utils/logger', () => ({
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    success: jest.fn(),
+    debug: jest.fn(),
+    step: jest.fn(),
+    getDumpDir: async () => '/tmp/dumps',
+    getDumpDisplayPath: () => 'logs/dumps/test'
+}));
+
+describe('Auth Module', () => {
+    let auth;
+    let config;
+
+    beforeEach(() => {
+        jest.clearAllMocks();
+        // Clean up test files before each test
+        fs.removeSync('/tmp/test-auth.json');
+        fs.removeSync('/tmp/test-auth-meta.json');
+        
+        // Re-import after mocks are set up
+        config = require('../src/config');
+        auth = require('../src/auth');
+    });
+
+    afterAll(async () => {
+        // Clean up after all tests
+        fs.removeSync('/tmp/test-auth.json');
+        fs.removeSync('/tmp/test-auth-meta.json');
+    });
+
+    describe('getAuthMeta', () => {
+        it('should return null when no auth meta file exists', async () => {
+            const { getAuthMeta } = require('../src/auth');
+            const meta = await getAuthMeta();
+            expect(meta).toBeNull();
+        });
+
+        it('should return metadata when auth meta file exists', async () => {
+            // Create a test meta file
+            await fs.writeJson('/tmp/test-auth-meta.json', {
+                email: 'test@example.com',
+                loginTime: new Date().toISOString()
+            });
+            
+            const { getAuthMeta } = require('../src/auth');
+            const meta = await getAuthMeta();
+            
+            expect(meta).toBeDefined();
+            expect(meta.email).toBe('test@example.com');
+            expect(meta.loginTime).toBeDefined();
+        });
+    });
+
+    describe('logout', () => {
+        it('should remove auth files', async () => {
+            // Create test files
+            await fs.writeJson('/tmp/test-auth.json', { test: true });
+            await fs.writeJson('/tmp/test-auth-meta.json', { email: 'test@example.com' });
+            
+            const { logout } = require('../src/auth');
+            await logout();
+            
+            expect(await fs.pathExists('/tmp/test-auth.json')).toBe(false);
+            expect(await fs.pathExists('/tmp/test-auth-meta.json')).toBe(false);
+        });
+    });
+
+    describe('checkAuth', () => {
+        it('should return false when no auth file exists', async () => {
+            const { checkAuth } = require('../src/auth');
+            const isAuth = await checkAuth();
+            expect(isAuth).toBe(false);
+        });
+
+        it('should handle network errors gracefully', async () => {
+            // Create a dummy auth file
+            await fs.writeJson('/tmp/test-auth.json', { test: true });
+            
+            const { checkAuth } = require('../src/auth');
+            // Use mock URL that won't actually connect
+            const isAuth = await checkAuth('https://mock.test/nonexistent');
+            
+            // Should return true on error (conservative approach)
+            expect(isAuth).toBe(true);
+        }, 10000);
+    });
+
+    describe('getAuthenticatedContext', () => {
+        it('should throw error when no auth file exists', async () => {
+            const { getAuthenticatedContext } = require('../src/auth');
+            
+            await expect(getAuthenticatedContext(null)).rejects.toThrow(
+                'No authentication state found. Please run "login" command first.'
+            );
+        });
+    });
+});
+
+describe('config', () => {
+    let config;
+    
+    beforeEach(() => {
+        jest.clearAllMocks();
+        fs.removeSync('/tmp/test-auth.json');
+        fs.removeSync('/tmp/test-auth-meta.json');
+        config = require('../src/config');
+        auth = require('../src/auth');
+    });
+
+    it('should export AUTH_FILE', () => {
+        expect(config.AUTH_FILE).toBe('/tmp/test-auth.json');
+    });
+
+    it('should export ONENOTE_URL', () => {
+        expect(config.ONENOTE_URL).toBe('https://www.onenote.com/notebooks');
+    });
+
+    it('should export OUTLOOK_URL', () => {
+        expect(config.OUTLOOK_URL).toBe('https://outlook.cloud.microsoft/mail/');
+    });
+});