zevairouter 1.0.82 → 1.0.84

package/src/lib/oauth/services/tempmailClient.js

@@ -1,6 +1,11 @@
 /**
  * Client for self-hosted tempmail (tempmail.zevai.web.id).
  * Inbox-only: create address, poll OTP. No passwords stored server-side.
+ *
+ * Always hits tempmail **direct** (never HTTP(S)_PROXY). Browser automation may
+ * set proxy env for CloakBrowser/xAI, but OTP must be read from our mail API
+ * on the host — residential proxies often slow/block the inbox endpoint and
+ * leave the job stuck on "polling_otp".
  */
 
 const DEFAULT_BASE_URL = process.env.TEMPMAIL_BASE_URL || "https://tempmail.zevai.web.id";
@@ -20,9 +25,45 @@ export function getTempmailConfig(overrides = {}) {
   };
 }
 
+/**
+ * Node undici/fetch may honor process.env HTTP(S)_PROXY. Tempmail must not.
+ */
+async function directFetch(url, init = {}) {
+  // Prefer undici Agent without proxy env (Node 18+).
+  try {
+    const undici = await import("undici");
+    const dispatcher = new undici.Agent({ connect: { timeout: 20_000 } });
+    return undici.fetch(url, { ...init, dispatcher });
+  } catch {
+    // fall through to global fetch with proxy env stripped
+  }
+  const saved = {
+    HTTP_PROXY: process.env.HTTP_PROXY,
+    HTTPS_PROXY: process.env.HTTPS_PROXY,
+    http_proxy: process.env.http_proxy,
+    https_proxy: process.env.https_proxy,
+    ALL_PROXY: process.env.ALL_PROXY,
+    all_proxy: process.env.all_proxy,
+  };
+  try {
+    delete process.env.HTTP_PROXY;
+    delete process.env.HTTPS_PROXY;
+    delete process.env.http_proxy;
+    delete process.env.https_proxy;
+    delete process.env.ALL_PROXY;
+    delete process.env.all_proxy;
+    return await fetch(url, init);
+  } finally {
+    for (const [k, v] of Object.entries(saved)) {
+      if (v === undefined) delete process.env[k];
+      else process.env[k] = v;
+    }
+  }
+}
+
 async function tempmailFetch(config, path, { method = "GET", body } = {}) {
   const url = `${config.baseUrl}${path.startsWith("/") ? path : `/${path}`}`;
-  const res = await fetch(url, {
+  const res = await directFetch(url, {
     method,
     headers: {
       Accept: "application/json",
@@ -118,39 +159,126 @@ export async function listTempmailInbox(address, cfg = {}) {
 }
 
 /**
- * Poll inbox for xAI OTP. Subject format: "ABC-123 xAI confirmation code"
+ * Extract xAI-style OTP from subject/body. Formats vary:
+ *   "ABC-123 xAI confirmation code"
+ *   "Your xAI confirmation code is ABC-123"
+ *   "xAI verification code: AB12-CD34"
+ */
+export function extractXaiOtpFromMail(mail) {
+  if (!mail || typeof mail !== "object") return null;
+  const blobs = [
+    mail.subject,
+    mail.body,
+    mail.text,
+    mail.snippet,
+    mail.preview,
+    mail.html,
+    typeof mail.raw === "string" ? mail.raw : null,
+  ]
+    .filter(Boolean)
+    .map((s) => String(s));
+
+  const text = blobs.join("\n");
+  if (!text.trim()) return null;
+
+  const patterns = [
+    // Live 2026-07-19: "SpaceXAI confirmation code: 2BP-IVP"
+    /SpaceXAI confirmation code[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
+    /([A-Z0-9]{2,5}-[A-Z0-9]{2,5})\s+xAI confirmation code/i,
+    /xAI confirmation code[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
+    /confirmation code[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
+    /verification code[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
+    /security code[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
+    /one[-\s]?time(?:\s+code)?[:\s#-]*([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
+    // last resort: dashed code near xAI / SpaceXAI branding
+    /(?:xAI|SpaceXAI)[\s\S]{0,80}?([A-Z0-9]{2,5}-[A-Z0-9]{2,5})/i,
+    /([A-Z0-9]{2,5}-[A-Z0-9]{2,5})[\s\S]{0,40}(?:xAI|SpaceXAI)/i,
+  ];
+
+  for (const re of patterns) {
+    const m = text.match(re);
+    if (m?.[1]) {
+      return m[1].toUpperCase();
+    }
+  }
+  return null;
+}
+
+/**
+ * Poll inbox for xAI OTP.
+ * @param {string} address
+ * @param {object} [opts]
+ * @param {number} [opts.timeoutMs=180000]
+ * @param {number} [opts.intervalMs=3000]
+ * @param {Set} [opts.seenIds]
+ * @param {(info: object) => void} [opts.onProgress]  inbox status for UI
  */
 export async function pollTempmailXaiOtp(
   address,
   {
-    timeoutMs = 120_000,
+    timeoutMs = 180_000,
     intervalMs = 3_000,
     seenIds = null,
+    onProgress = null,
     ...cfg
   } = {}
 ) {
   const seen = seenIds || new Set();
   const start = Date.now();
+  let lastError = null;
+  let attempt = 0;
+
   while (Date.now() - start < timeoutMs) {
-    const mails = await listTempmailInbox(address, cfg);
-    const sorted = [...mails].sort((a, b) => (b.received_at || 0) - (a.received_at || 0));
-    for (const mail of sorted) {
-      const id = mail.id || `${mail.subject}-${mail.received_at}`;
-      if (seen.has(id)) continue;
-      const subject = mail.subject || "";
-      const match = subject.match(/([A-Z0-9]{2,5}-[A-Z0-9]{2,5})\s+xAI confirmation code/i);
-      if (match) {
-        seen.add(id);
-        return {
-          code: match[1],
-          subject,
-          id: mail.id || null,
-          mail,
-        };
+    attempt += 1;
+    const elapsedSec = Math.round((Date.now() - start) / 1000);
+    try {
+      const mails = await listTempmailInbox(address, cfg);
+      const sorted = [...mails].sort((a, b) => (b.received_at || 0) - (a.received_at || 0));
+      const subjects = sorted.slice(0, 3).map((m) => (m.subject || "(no subject)").slice(0, 60));
+
+      onProgress?.({
+        attempt,
+        elapsedSec,
+        inboxCount: sorted.length,
+        subjects,
+        address,
+      });
+
+      for (const mail of sorted) {
+        const id = mail.id || `${mail.subject}-${mail.received_at}`;
+        if (seen.has(id)) continue;
+        const code = extractXaiOtpFromMail(mail);
+        if (code) {
+          seen.add(id);
+          return {
+            code,
+            subject: mail.subject || "",
+            id: mail.id || null,
+            mail,
+          };
+        }
       }
+      lastError = null;
+    } catch (error) {
+      lastError = error;
+      onProgress?.({
+        attempt,
+        elapsedSec,
+        inboxCount: -1,
+        error: error.message || String(error),
+        address,
+      });
     }
     await wait(intervalMs);
   }
+
+  if (lastError) {
+    const err = new Error(
+      `No xAI OTP on tempmail after ${Math.round(timeoutMs / 1000)}s (last inbox error: ${lastError.message})`
+    );
+    err.cause = lastError;
+    throw err;
+  }
   return null;
 }