zevairouter 1.0.90 → 1.0.91

package/src/lib/oauth/services/cloudflareAiBulkImportManager.js

@@ -15,13 +15,15 @@ import {
   KIRO_BULK_IMPORT_MAX_CONCURRENCY,
   KIRO_BULK_IMPORT_MIN_CONCURRENCY,
 } from "./kiroBulkImportManager.js";
-import { runGoogleAccountAutomation } from "./kiroGoogleAutomation.js";
+import { runGoogleAccountAutomation, __test__ as googleTest } from "./kiroGoogleAutomation.js";
 
 const CLOUDFLARE_AI_PROVIDER_ID = "cloudflare-ai";
 const CLOUDFLARE_AI_LABEL = "Cloudflare Workers AI";
 const CF_LOGIN_URL = "https://dash.cloudflare.com/login";
 const CF_HARVEST_TIMEOUT_MS = 4 * 60_000;
 
+const { dismissCookieBanners, clickGoogleLoginRole, waitUntil: waitUntilUi } = googleTest;
+
 function yieldMs(ms = 50) {
   return new Promise((r) => setTimeout(r, ms));
 }
@@ -42,42 +44,43 @@ async function waitUntil(checkFn, { timeout = 8_000, interval = 80 } = {}) {
 function isCloudflareDashboard(url) {
   try {
     const u = new URL(url);
-    return (
-      u.hostname === "dash.cloudflare.com"
-      && !u.pathname.includes("/login")
-      && !u.href.includes("oidcJwt")
-    );
+    if (u.hostname !== "dash.cloudflare.com") return false;
+    // Still on OAuth return /login/google?oidcJwt=… — not ready for token API
+    if (u.pathname.includes("/login")) return false;
+    if (u.href.includes("oidcJwt")) return false;
+    return true;
   } catch {
     return false;
   }
 }
 
 async function dismissCloudflarePostLogin(page) {
+  // Only dismiss known post-login modals — never generic Allow/Continue/Accept
+  // (those match OneTrust "Allow All" and random dashboard actions, which
+  // thrash the page and starve the token harvest evaluate for ~60s).
   const labels = [
-    /i understand/i,
-    /got it/i,
-    /continue/i,
-    /allow/i,
-    /accept/i,
-    /log in/i,
-    /login/i,
+    /^i understand$/i,
+    /^got it$/i,
+    /^dismiss$/i,
+    /^close$/i,
+    /^not now$/i,
+    /^skip$/i,
   ];
   for (const re of labels) {
     try {
       const btn = page.getByRole("button", { name: re }).first();
-      if (await btn.isVisible({ timeout: 200 }).catch(() => false)) {
+      if (await btn.isVisible({ timeout: 120 }).catch(() => false)) {
         const text = ((await btn.innerText().catch(() => "")) || "").toLowerCase();
-        if (/google/.test(text)) continue;
-        await btn.click({ timeout: 3_000 }).catch(() => null);
-        // No fixed sleep — caller re-checks URL / harvest immediately.
+        if (/google|apple|github|sso|sign in|log in|allow all|accept all|reject/i.test(text)) {
+          continue;
+        }
+        await btn.click({ timeout: 2_000, noWaitAfter: true }).catch(() => null);
         return true;
       }
     } catch {
       /* next */
     }
   }
-  // Scroll bottom — CF sometimes parks allow off-screen
-  await page.keyboard.press("End").catch(() => null);
   return false;
 }
 
@@ -85,72 +88,92 @@ async function dismissCloudflarePostLogin(page) {
  * Create Workers AI API token while page holds CF dashboard session cookies.
  */
 export async function harvestCloudflareWorkersAiToken(page) {
-  return page.evaluate(async () => {
-    const getJson = async (path, init) => {
-      const resp = await fetch(path, {
-        credentials: "include",
-        headers: { Accept: "application/json", ...(init?.headers || {}) },
-        ...init,
-      });
-      const data = await resp.json().catch(() => null);
-      return { status: resp.status, ok: resp.ok, data };
-    };
-
-    const accountsRes = await getJson("/api/v4/accounts");
-    if (accountsRes.status !== 200 || !accountsRes.data?.success) {
-      throw new Error(
-        `Account list failed (${accountsRes.status}): ${JSON.stringify(accountsRes.data?.errors || []).slice(0, 200)}`,
-      );
-    }
-    const accounts = accountsRes.data?.result || [];
-    if (!accounts.length) throw new Error("No Cloudflare accounts found for this user");
-    const accountId = accounts[0]?.id;
-    if (!accountId) throw new Error("Empty Cloudflare account ID");
-
-    const permRes = await getJson("/api/v4/user/tokens/permission_groups");
-    if (permRes.status !== 200 || !permRes.data?.success) {
-      throw new Error(
-        `Permission groups failed (${permRes.status}): ${JSON.stringify(permRes.data?.errors || []).slice(0, 200)}`,
-      );
-    }
-    const groups = permRes.data?.result || [];
-    const workersAiGroups = groups
-      .filter((g) => String(g.name || "").toLowerCase().includes("workers ai"))
-      .map((g) => ({ id: g.id, name: g.name || "" }));
-    if (!workersAiGroups.length) {
-      throw new Error("No Workers AI permission groups found (account may lack Workers AI)");
-    }
+  // Use browser context request (same cookies + proxy as the session). Avoids
+  // page.evaluate contention with the automation loop, and avoids Node fetch
+  // which would bypass the residential proxy.
+  const origin = "https://dash.cloudflare.com";
+  const request = page.context().request;
+  const cookies = await page.context().cookies(origin).catch(() => []);
+  if (!cookies || cookies.length < 2) {
+    throw new Error("Cloudflare session cookies not ready yet");
+  }
 
-    const payload = {
-      name: `zevai-cf-ai-${Math.floor(Date.now() / 1000)}`,
-      policies: [
-        {
-          effect: "allow",
-          permission_groups: workersAiGroups.map((p) => ({ id: p.id })),
-          resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
-        },
-      ],
+  const getJson = async (path, init = {}) => {
+    const method = String(init.method || "GET").toUpperCase();
+    // Token create is slower through residential proxy than GET accounts.
+    const timeout = method === "POST" ? 15_000 : 8_000;
+    const opts = {
+      headers: {
+        Accept: "application/json",
+        ...(init.headers || {}),
+      },
+      timeout,
     };
+    if (init.body != null) opts.data = typeof init.body === "string" ? JSON.parse(init.body) : init.body;
+    const resp = method === "POST"
+      ? await request.post(`${origin}${path}`, opts)
+      : await request.get(`${origin}${path}`, opts);
+    const data = await resp.json().catch(() => null);
+    return { status: resp.status(), ok: resp.ok(), data };
+  };
+
+  const accountsRes = await getJson("/api/v4/accounts");
+  if (accountsRes.status === 401 || accountsRes.status === 403) {
+    throw new Error(`Not authenticated yet (${accountsRes.status})`);
+  }
+  if (accountsRes.status !== 200 || !accountsRes.data?.success) {
+    throw new Error(
+      `Account list failed (${accountsRes.status}): ${JSON.stringify(accountsRes.data?.errors || []).slice(0, 200)}`,
+    );
+  }
+  const accounts = accountsRes.data?.result || [];
+  if (!accounts.length) throw new Error("No Cloudflare accounts found for this user");
+  const accountId = accounts[0]?.id;
+  if (!accountId) throw new Error("Empty Cloudflare account ID");
 
-    const tokenRes = await getJson("/api/v4/user/tokens", {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json" },
-      body: JSON.stringify(payload),
-    });
-    if (tokenRes.status !== 200 || !tokenRes.data?.success) {
-      throw new Error(
-        `Token create failed (${tokenRes.status}): ${JSON.stringify(tokenRes.data?.errors || []).slice(0, 240)}`,
-      );
-    }
-    const apiKey = tokenRes.data?.result?.value;
-    if (!apiKey) throw new Error("Empty API token value from Cloudflare");
+  const permRes = await getJson("/api/v4/user/tokens/permission_groups");
+  if (permRes.status !== 200 || !permRes.data?.success) {
+    throw new Error(
+      `Permission groups failed (${permRes.status}): ${JSON.stringify(permRes.data?.errors || []).slice(0, 200)}`,
+    );
+  }
+  const groups = permRes.data?.result || [];
+  const workersAiGroups = groups
+    .filter((g) => String(g.name || "").toLowerCase().includes("workers ai"))
+    .map((g) => ({ id: g.id, name: g.name || "" }));
+  if (!workersAiGroups.length) {
+    throw new Error("No Workers AI permission groups found (account may lack Workers AI)");
+  }
 
-    return {
-      accountId,
-      apiKey,
-      accountName: accounts[0]?.name || "",
-    };
+  const payload = {
+    name: `zevai-cf-ai-${Math.floor(Date.now() / 1000)}`,
+    policies: [
+      {
+        effect: "allow",
+        permission_groups: workersAiGroups.map((p) => ({ id: p.id })),
+        resources: { [`com.cloudflare.api.account.${accountId}`]: "*" },
+      },
+    ],
+  };
+
+  const tokenRes = await getJson("/api/v4/user/tokens", {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify(payload),
   });
+  if (tokenRes.status !== 200 || !tokenRes.data?.success) {
+    throw new Error(
+      `Token create failed (${tokenRes.status}): ${JSON.stringify(tokenRes.data?.errors || []).slice(0, 240)}`,
+    );
+  }
+  const apiKey = tokenRes.data?.result?.value;
+  if (!apiKey) throw new Error("Empty API token value from Cloudflare");
+
+  return {
+    accountId,
+    apiKey,
+    accountName: accounts[0]?.name || "",
+  };
 }
 
 function createCloudflareHarvestPromise(page, { timeoutMs = CF_HARVEST_TIMEOUT_MS, onStep, cancelCheck } = {}) {
@@ -163,11 +186,18 @@ function createCloudflareHarvestPromise(page, { timeoutMs = CF_HARVEST_TIMEOUT_M
       const url = page.url?.() || "";
 
       if (!isCloudflareDashboard(url)) {
+        // OAuth return /login/google?oidcJwt=… — wait for CF to finish routing.
+        if (url.includes("oidcJwt") || /\/login\//i.test(url)) {
+          onStep?.(
+            "waiting_cf_dashboard",
+            "Waiting for Cloudflare dashboard after Google OAuth",
+          );
+        }
         await dismissCloudflarePostLogin(page);
         // Event-driven: wait for dash (not a blind 1.2s sleep).
         const landed = await waitUntil(
           () => isCloudflareDashboard(page.url?.() || ""),
-          { timeout: 900, interval: 80 },
+          { timeout: 1_500, interval: 80 },
         );
         if (!landed) await yieldMs(80);
         continue;
@@ -176,14 +206,22 @@ function createCloudflareHarvestPromise(page, { timeoutMs = CF_HARVEST_TIMEOUT_M
       await dismissCloudflarePostLogin(page);
       try {
         onStep?.("harvesting_cf_token", "Creating Cloudflare Workers AI API token");
-        const result = await harvestCloudflareWorkersAiToken(page);
+        // Cap evaluate network work so a hung CF API cannot stall the job for minutes.
+        // Through residential proxy account/token APIs usually finish in a few seconds;
+        // 12s is enough — fail fast and retry with fresh session settle.
+        const result = await Promise.race([
+          harvestCloudflareWorkersAiToken(page),
+          yieldMs(12_000).then(() => {
+            throw new Error("Cloudflare token harvest timed out (12s)");
+          }),
+        ]);
         if (result?.apiKey && result?.accountId) return result;
       } catch (e) {
         lastErr = String(e?.message || e);
         onStep?.("harvest_retry", lastErr.slice(0, 140));
         // Session may still be settling — short backoff only on error.
         await yieldMs(failBackoffMs);
-        failBackoffMs = Math.min(failBackoffMs + 100, 600);
+        failBackoffMs = Math.min(failBackoffMs + 150, 800);
         continue;
       }
       await yieldMs(80);
@@ -270,6 +308,48 @@ class CloudflareAiBulkImportManager extends KiroBulkImportManager {
       );
       await this.persistJobSnapshot(job, { forcePreview: true });
 
+      // Fast open: CF login has its own email/password form + cookie wall.
+      // Dismiss cookies and click Google SSO BEFORE shared automation so we
+      // don't sit 30–40s matching the wrong email field / Allow All button.
+      // Critical: SSO click must use noWaitAfter (proxy makes Google nav >5s).
+      this.setAccountStep(account, "opening_cloudflare_login", "Opening Cloudflare login");
+      await page.goto(CF_LOGIN_URL, { waitUntil: "domcontentloaded", timeout: 60_000 });
+      await dismissCookieBanners(page, (step, message) => {
+        this.setAccountStep(account, step, message);
+        void this.persistJobSnapshot(job, { forcePreview: false });
+      });
+      // Wait for CF React shell to paint the Google SSO control (after domcontentloaded).
+      this.setAccountStep(account, "waiting_google_sso", "Waiting for Continue with Google on Cloudflare");
+      await this.persistJobSnapshot(job, { forcePreview: false });
+      const googleBtnReady = await waitUntilUi(
+        async () => {
+          try {
+            const btn = page.locator('button[aria-label*="Google" i]').first();
+            return (await btn.isVisible().catch(() => false))
+              && (await btn.isEnabled().catch(() => true));
+          } catch {
+            return false;
+          }
+        },
+        { timeout: 12_000, interval: 80 },
+      );
+      this.setAccountStep(
+        account,
+        "selecting_google_login",
+        googleBtnReady
+          ? "Clicking Continue with Google on Cloudflare"
+          : "Google SSO not ready yet — retrying via automation",
+      );
+      await this.persistJobSnapshot(job, { forcePreview: true });
+      let clickedGoogle = googleBtnReady ? await clickGoogleLoginRole(page) : false;
+      if (!clickedGoogle && googleBtnReady) {
+        // One more pass after a short paint settle (OT / SPA re-render).
+        await dismissCookieBanners(page, (step, message) => {
+          this.setAccountStep(account, step, message);
+          void this.persistJobSnapshot(job, { forcePreview: false });
+        });
+        clickedGoogle = await clickGoogleLoginRole(page);
+      }
       const automationResult = await runGoogleAccountAutomation({
         page,
         authUrl: CF_LOGIN_URL,
@@ -282,6 +362,9 @@ class CloudflareAiBulkImportManager extends KiroBulkImportManager {
         openingMessage: "Opening Cloudflare dashboard (Google login)",
         successStep: "cloudflare_token_created",
         successMessage: "Cloudflare Workers AI API token created",
+        // Already on CF login (and often already clicked Google) — don't re-goto.
+        skipGoto: true,
+        expectGoogleSoon: clickedGoogle,
         onStep: (step, message) => {
           this.setAccountStep(account, step, message);
           void this.persistJobSnapshot(job, { forcePreview: false });