zevairouter 1.0.90 → 1.0.91

package/src/lib/oauth/services/kiroGoogleAutomation.js

@@ -104,6 +104,9 @@ const GOOGLE_LOGIN_BUTTON_SELECTORS = [
   'button:has-text("Login with Google")',
   'button:has-text("Continue with Google")',
   'button:has-text("Sign in with Google")',
+  // Cloudflare dash: visible label is just "Google", aria is "Continue with Google"
+  'button[aria-label*="Continue with Google" i]',
+  'button[aria-label*="Google" i]',
   'button:has-text("Google")',
   'a:has-text("Google")',
   'div[role="button"]:has-text("Continue with Google")',
@@ -112,7 +115,7 @@ const GOOGLE_LOGIN_BUTTON_SELECTORS = [
   'span:has-text("Continue with Google")',
   'span:has-text("Login with Google")',
   'span:has-text("Google")',
-  '[aria-label*="Google"]',
+  '[aria-label*="Google" i]',
   '[data-provider*="google" i]',
   // xAI / Grok device + account pages
   'button:has-text("Login with Google")',
@@ -120,6 +123,18 @@ const GOOGLE_LOGIN_BUTTON_SELECTORS = [
   '[data-testid*="google" i]',
 ];
 
+/** OneTrust / cookie walls that block the first Google click (Cloudflare login). */
+const COOKIE_DISMISS_SELECTORS = [
+  '#onetrust-accept-btn-handler',
+  '#onetrust-reject-all-handler',
+  '#accept-recommended-btn-handler',
+  'button:has-text("Allow All")',
+  'button:has-text("Reject All")',
+  'button:has-text("Accept All")',
+  'button:has-text("Accept all")',
+  'button:has-text("Confirm My Choices")',
+];
+
 const TERMS_CHECKBOX_SELECTORS = [
   '#agree-policy-account',
   '#agree-policy',
@@ -565,6 +580,61 @@ function isGrokish(serviceLabel) {
   return /grok|cloudflare/i.test(String(serviceLabel || ""));
 }
 
+function isCloudflareLoginUrl(url) {
+  try {
+    const u = new URL(url || "");
+    return u.hostname === "dash.cloudflare.com" && u.pathname.includes("/login");
+  } catch {
+    return false;
+  }
+}
+
+async function dismissCookieBanners(page, reportStep) {
+  // Cookie / OneTrust modals steal the first clicks (CF login shows "Allow All").
+  // Fast path: one scan — must stay cheap because the main automation loop
+  // calls this on every tick (dashboard harvest must not burn 2s here).
+  for (const selector of COOKIE_DISMISS_SELECTORS) {
+    try {
+      const loc = page.locator(selector).first();
+      if (await loc.isVisible({ timeout: 100 }).catch(() => false)) {
+        // noWaitAfter: banner click must not wait on any incidental navigation
+        await loc.click({ timeout: 2_000, noWaitAfter: true }).catch(() => null);
+        reportStep?.("dismissing_cookies", "Dismissed cookie / privacy banner");
+        return true;
+      }
+    } catch {
+      /* next */
+    }
+  }
+  const viaApi = await page.evaluate(() => {
+    try {
+      if (typeof window.OneTrust?.AllowAll === "function") {
+        const banner = document.querySelector(
+          "#onetrust-banner-sdk, #onetrust-consent-sdk, #onetrust-accept-btn-handler",
+        );
+        // Only invoke when a banner is actually present — AllowAll on every
+        // loop tick is wasteful and can re-open consent UI.
+        if (!banner) return false;
+        window.OneTrust.AllowAll();
+        return true;
+      }
+      const btn = document.querySelector("#onetrust-accept-btn-handler");
+      if (btn && btn.offsetParent !== null) {
+        btn.click();
+        return true;
+      }
+    } catch {
+      /* ignore */
+    }
+    return false;
+  }).catch(() => false);
+  if (viaApi) {
+    reportStep?.("dismissing_cookies", "Dismissed cookie / privacy banner");
+    return true;
+  }
+  return false;
+}
+
 // Google bounces flagged (headless) browsers:
 // - myaccount.google.com/not-supported
 // - accounts.google.com/v3/signin/rejected ("This browser or app may not be secure")
@@ -1357,6 +1427,17 @@ async function handleProviderOnboarding(page, reportStep, serviceLabel) {
     return false;
   }
 
+  // Cloudflare dashboard / login: "Allow All" cookie + "Sign in" must not be
+  // treated as provider onboarding Continues.
+  try {
+    const host = new URL(page.url()).hostname || "";
+    if (host === "dash.cloudflare.com" || host.endsWith(".cloudflare.com")) {
+      return false;
+    }
+  } catch {
+    /* ignore */
+  }
+
   // If Google SSO is still offered, do not mash generic Continue.
   if (await providerHasGoogleLogin(page)) {
     return false;
@@ -1430,13 +1511,33 @@ async function handleXaiDeviceCodeConfirm(page, reportStep, { alreadyAuthed = fa
   return true;
 }
 
+/**
+ * Click a Google SSO control without waiting for the cross-origin navigation.
+ *
+ * Playwright's default click() waits for navigations started by the action.
+ * CF → accounts.google.com through a residential proxy often exceeds 5s, so the
+ * click "fails" even though OAuth already started — then we re-click for 30–40s.
+ */
+async function clickSsoControl(page, locator) {
+  const enabled = await locator.isEnabled().catch(() => true);
+  if (!enabled) return false;
+  await locator.scrollIntoViewIfNeeded().catch(() => null);
+  const clicked = await locator
+    .click({ timeout: 2_500, force: true, noWaitAfter: true })
+    .then(() => true)
+    .catch(() => false);
+  if (clicked) return true;
+  // Trusted mouse path (also does not wait on navigation).
+  return clickLocatorCenter(page, locator).catch(() => false);
+}
+
 async function clickGoogleLoginRole(page) {
-  // Role-based matches are more reliable on SPA auth shells (xAI, etc.)
-  // than CSS :has-text alone — especially when the label is nested.
+  // Role-based matches are more reliable on SPA auth shells (xAI, CF, etc.)
+  // than CSS :has-text alone — especially when the label is nested / aria-only.
   const roleNames = [
+    /continue with google/i,
     /login with google/i,
     /log in with google/i,
-    /continue with google/i,
     /sign up with google/i,
     /sign in with google/i,
     /^google$/i,
@@ -1445,10 +1546,7 @@ async function clickGoogleLoginRole(page) {
     try {
       const btn = page.getByRole("button", { name }).first();
       if (await btn.isVisible({ timeout: 250 }).catch(() => false)) {
-        const enabled = await btn.isEnabled().catch(() => true);
-        if (!enabled) continue;
-        await btn.click({ timeout: 5_000 });
-        return true;
+        if (await clickSsoControl(page, btn)) return true;
       }
     } catch {
       /* next */
@@ -1456,13 +1554,30 @@ async function clickGoogleLoginRole(page) {
     try {
       const link = page.getByRole("link", { name }).first();
       if (await link.isVisible({ timeout: 200 }).catch(() => false)) {
-        await link.click({ timeout: 5_000 });
-        return true;
+        if (await clickSsoControl(page, link)) return true;
       }
     } catch {
       /* next */
     }
   }
+  // Cloudflare: button text "Google", aria-label "Continue with Google"
+  try {
+    const ariaBtn = page.locator('button[aria-label*="Google" i]').first();
+    if (await ariaBtn.isVisible({ timeout: 200 }).catch(() => false)) {
+      if (await clickSsoControl(page, ariaBtn)) return true;
+    }
+  } catch {
+    /* ignore */
+  }
+  // Last resort: CSS text match with noWaitAfter
+  try {
+    const textBtn = page.locator('button:has-text("Google")').first();
+    if (await textBtn.isVisible({ timeout: 150 }).catch(() => false)) {
+      if (await clickSsoControl(page, textBtn)) return true;
+    }
+  } catch {
+    /* ignore */
+  }
   return false;
 }
 
@@ -1508,6 +1623,8 @@ async function ensureProviderTermsChecked(page, reportStep) {
 async function handleProviderLoginGate(page, reportStep, { allowGoogleClick = true } = {}) {
   if (isGoogleAuthPage(page)) return false;
 
+  await dismissCookieBanners(page, reportStep);
+
   const confirmedExistingDialog = await clickFirstActionable(page, PRIVACY_CONFIRM_BUTTON_SELECTORS);
   if (confirmedExistingDialog) {
     reportStep("accepting_provider_privacy_dialog", "Confirmed provider privacy agreement dialog");
@@ -1525,8 +1642,25 @@ async function handleProviderLoginGate(page, reportStep, { allowGoogleClick = tr
 
   // Prefer explicit Google SSO over generic Continue (device code pages
   // often have both — clicking Continue without a session yields invalid_code).
+  // Cloudflare: click Google SSO only — never the CF email "Sign in" form.
   const clickedGoogleRole = await clickGoogleLoginRole(page);
-  const clickedGoogle = clickedGoogleRole || await clickFirstActionable(page, GOOGLE_LOGIN_BUTTON_SELECTORS);
+  let clickedGoogle = clickedGoogleRole;
+  if (!clickedGoogle) {
+    // Selector fallback with noWaitAfter (clickFirstActionable waits on nav — bad for SSO).
+    for (const selector of GOOGLE_LOGIN_BUTTON_SELECTORS.slice(0, 16)) {
+      try {
+        const loc = page.locator(selector).first();
+        if (await loc.isVisible({ timeout: 100 }).catch(() => false)) {
+          if (await clickSsoControl(page, loc)) {
+            clickedGoogle = true;
+            break;
+          }
+        }
+      } catch {
+        /* next */
+      }
+    }
+  }
   if (clickedGoogle) {
     reportStep("selecting_google_login", "Selecting Google login");
 
@@ -1536,10 +1670,12 @@ async function handleProviderLoginGate(page, reportStep, { allowGoogleClick = tr
     }
 
     // Wait for OAuth redirect to Google (or email field) — event-driven.
+    // CF→Google through proxy can take a few seconds; click already returned (noWaitAfter).
+    const onCf = isCloudflareLoginUrl(page.url?.() || "");
     const reached = await waitForPageAdvance(page, {
       urlMatch: (u) => isGoogleHostname(u),
       selector: EMAIL_INPUT_SELECTOR,
-      timeout: 12_000,
+      timeout: onCf ? 10_000 : 12_000,
     });
     if (reached || isGoogleAuthPage(page)) {
       reportStep("google_login_page", "Reached Google sign-in after provider SSO");
@@ -1879,6 +2015,10 @@ export async function runGoogleAccountAutomation({
   successStep = "oauth_success_received",
   successMessage = "OAuth success received",
   onStep,
+  /** When true, skip page.goto(authUrl) — caller already navigated (e.g. CF pre-click Google). */
+  skipGoto = false,
+  /** Caller already clicked Google SSO; wait for accounts.google.com before re-clicking. */
+  expectGoogleSoon = false,
 }) {
   const startTime = Date.now();
   const reportStep = (step, message) => {
@@ -1897,7 +2037,9 @@ export async function runGoogleAccountAutomation({
   let deviceInvalidReopenCount = 0;
   // Cooldowns prevent double-submit only — not artificial pacing.
   const PASSWORD_RESUBMIT_COOLDOWN_MS = isGrokish(serviceLabel) ? 6_000 : 18_000;
-  const EMAIL_RESUBMIT_COOLDOWN_MS = isGrokish(serviceLabel) ? 3_000 : 8_000;
+  // Longer email cooldown for fast bulk — Google identifier page can sit 5–10s
+  // after Next; re-typing the whole email wastes another 10–15s.
+  const EMAIL_RESUBMIT_COOLDOWN_MS = isGrokish(serviceLabel) ? 12_000 : 8_000;
   const GOOGLE_SSO_COOLDOWN_MS = isGrokish(serviceLabel) ? 3_000 : 8_000;
   // Don't hammer Allow — xAI rate_limits rapid device posts.
   const DEVICE_APPROVE_COOLDOWN_MS = 3_000;
@@ -1909,46 +2051,90 @@ export async function runGoogleAccountAutomation({
   // Loop poll: race successPromise — keep tiny so fast networks aren't stalled.
   const loopTickMs = isGrokFlow ? 120 : 500;
 
-  reportStep(openingStep, openingMessage);
-  await page.goto(authUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
-  // Wait for interactive UI (Continue / Google / email), not a fixed sleep.
-  await waitUntil(
-    async () =>
-      isGoogleAuthPage(page)
-      || (await getFirstVisibleLocator(page, 'button:has-text("Continue"), button:has-text("Login with Google"), button:has-text("Google")'))
-      || (await getFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR)),
-    { timeout: isGrokFlow ? 6_000 : 12_000, interval: 80 },
-  );
-  if (!isGrokFlow) {
-    await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
-  }
-
-  // Provider shells (xAI device, CodeBuddy, …) must pick Google SSO first.
-  // Never type credentials into provider user_code / email fields.
-  // xAI: confirm device user_code first, then Google SSO — event-driven retries.
-  for (let attempt = 0; attempt < (isGrokFlow ? 6 : 2); attempt += 1) {
-    if (isGoogleAuthPage(page)) break;
-    if (await handleXaiDeviceCodeConfirm(page, reportStep)) {
-      continue;
-    }
-    if (await handleProviderLoginGate(page, reportStep)) {
+  let alreadyOnGoogle = skipGoto && isGoogleAuthPage(page);
+  if (!skipGoto) {
+    reportStep(openingStep, openingMessage);
+    await page.goto(authUrl, { waitUntil: "domcontentloaded", timeout: 60_000 });
+    await dismissCookieBanners(page, reportStep);
+  } else if (alreadyOnGoogle) {
+    reportStep("google_login_page", "Already on Google sign-in — filling credentials");
+  } else if (expectGoogleSoon) {
+    // CF (etc.) already clicked Google — wait for redirect, do NOT re-goto / re-click yet.
+    reportStep("waiting_google_redirect", "Waiting for Google after provider SSO click");
+    const reached = await waitUntil(() => isGoogleAuthPage(page), {
+      timeout: 25_000,
+      interval: 100,
+    });
+    if (reached) {
+      alreadyOnGoogle = true;
       googleLoginSelectedAt = Date.now();
-      if (isGoogleAuthPage(page)) break;
-      // Gate already waited for Google URL; only brief yield if still on provider.
-      await yieldMs(50);
-      continue;
+      reportStep("google_login_page", "Reached Google sign-in after provider SSO");
+    } else {
+      reportStep("google_redirect_slow", "Google redirect slow — will retry SSO click");
     }
-    // SPA not ready — poll for buttons, don't sleep 600ms blindly.
-    const ready = await waitUntil(
-      async () =>
-        (await providerHasGoogleLogin(page))
-        || /enter the code|login with google|continue/i.test(await readPageText(page).catch(() => "")),
-      { timeout: 800, interval: 80 },
+  } else {
+    reportStep(openingStep, openingMessage);
+    await dismissCookieBanners(page, reportStep);
+  }
+
+  // Cloudflare login always shows email/password fields — do NOT treat those as
+  // "ready for Google email fill". Wait for Google SSO button / Google page only.
+  const onCfLogin = isCloudflareLoginUrl(page.url?.() || "") || /cloudflare/i.test(String(serviceLabel || ""));
+
+  if (!alreadyOnGoogle) {
+    await waitUntil(
+      async () => {
+        if (isGoogleAuthPage(page)) return true;
+        if (await getFirstVisibleLocator(
+          page,
+          'button[aria-label*="Google" i], button:has-text("Continue with Google"), button:has-text("Login with Google"), button:has-text("Google")',
+        )) {
+          return true;
+        }
+        if (!onCfLogin && (await getFirstVisibleLocator(page, EMAIL_INPUT_SELECTOR))) {
+          return true;
+        }
+        if (!onCfLogin && (await getFirstVisibleLocator(page, 'button:has-text("Continue")'))) {
+          return true;
+        }
+        return false;
+      },
+      { timeout: isGrokFlow ? 8_000 : 12_000, interval: 80 },
     );
-    if (!ready) await yieldMs(100);
-  }
-  if (!isGrokFlow) {
-    await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(6_000));
+    if (!isGrokFlow) {
+      await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(8_000));
+    }
+
+    // Provider shells (xAI device, CodeBuddy, Cloudflare, …) must pick Google SSO first.
+    // Never type credentials into provider email fields (CF has its own email/password).
+    for (let attempt = 0; attempt < (isGrokFlow || onCfLogin ? 8 : 2); attempt += 1) {
+      if (isGoogleAuthPage(page)) break;
+      await dismissCookieBanners(page, reportStep);
+      if (await handleXaiDeviceCodeConfirm(page, reportStep)) {
+        continue;
+      }
+      if (await handleProviderLoginGate(page, reportStep)) {
+        googleLoginSelectedAt = Date.now();
+        if (isGoogleAuthPage(page)) break;
+        // Gate already waited for Google URL; only brief yield if still on provider.
+        await yieldMs(50);
+        continue;
+      }
+      // SPA not ready — poll for Google SSO (not CF email form).
+      const ready = await waitUntil(
+        async () =>
+          isGoogleAuthPage(page)
+          || (await providerHasGoogleLogin(page))
+          || /enter the code|login with google|continue with google/i.test(
+            await readPageText(page).catch(() => ""),
+          ),
+        { timeout: 600, interval: 80 },
+      );
+      if (!ready) await yieldMs(80);
+    }
+    if (!isGrokFlow) {
+      await waitThroughGoogleInterstitials(page, reportStep, interstitialOpts(6_000));
+    }
   }
 
   // Only fill Google email once we are actually on accounts.google.com.
@@ -2003,6 +2189,50 @@ export async function runGoogleAccountAutomation({
       };
     }
 
+    // Cloudflare: after Google password, land on dash — park on harvest promise.
+    // Do NOT thrash cookie dismiss / generic Approve (starves token API work).
+    if (
+      isGrokFlow
+      && seenGoogleAuth
+      && passwordSubmittedAt
+      && /cloudflare/i.test(String(serviceLabel || ""))
+    ) {
+      try {
+        const u = new URL(page.url?.() || "");
+        const onDash =
+          u.hostname === "dash.cloudflare.com"
+          && !u.pathname.includes("/login")
+          && !u.href.includes("oidcJwt");
+        if (onDash) {
+          reportStep(
+            "waiting_cf_harvest",
+            "On Cloudflare dashboard — waiting for Workers AI token harvest",
+          );
+          // Yield the page: only race success (longer tick while harvesting).
+          const parked = await Promise.race([
+            successPromise
+              .then((result) => ({ kind: "success", result }))
+              .catch((error) => ({ kind: "success_error", error })),
+            yieldMs(2_000).then(() => null),
+          ]);
+          if (parked?.kind === "success") {
+            reportStep(successStep, successMessage);
+            return { status: "success", ...parked.result };
+          }
+          if (parked?.kind === "success_error") {
+            reportStep("oauth_timeout", `Timed out waiting for ${serviceLabel} authorization`);
+            return {
+              status: "failed_timeout",
+              error: parked.error?.message || `Timed out waiting for ${serviceLabel} authorization`,
+            };
+          }
+          continue;
+        }
+      } catch {
+        /* fall through */
+      }
+    }
+
     // Unblock SetSID / empty Google interstitials before other handlers
     const waited = await waitThroughGoogleInterstitials(
       page,
@@ -2236,10 +2466,26 @@ export async function runGoogleAccountAutomation({
 
     // On xAI before Google login, APPROVE selectors match "Continue with Google"
     // via :has-text("Continue") and wreck the device code → Invalid action loop.
+    // On Cloudflare login, "Allow All" cookies + "Sign in" must not be mashed.
+    await dismissCookieBanners(page, reportStep);
+    const onCfHost = (() => {
+      try {
+        const h = new URL(page.url()).hostname || "";
+        return h === "dash.cloudflare.com" || h.endsWith(".cloudflare.com");
+      } catch {
+        return false;
+      }
+    })();
     const mayGenericApprove =
       isGoogleAuthPage(page)
-      || (seenGoogleAuth && passwordSubmittedAt && !(await providerHasGoogleLogin(page)));
-    if (mayGenericApprove) {
+      || (
+        seenGoogleAuth
+        && passwordSubmittedAt
+        && !(await providerHasGoogleLogin(page))
+        && !isCloudflareLoginUrl(page.url?.() || "")
+      );
+    if (mayGenericApprove && !isCloudflareLoginUrl(page.url?.() || "")) {
+      // Avoid OneTrust "Allow All" as if it were OAuth approve when still mid-flow
       const clickedApprove = await clickFirstVisible(page, APPROVE_BUTTON_SELECTORS);
       if (clickedApprove) {
         reportStep("approving_consent", `Approving Google or ${serviceLabel} consent`);
@@ -2248,6 +2494,11 @@ export async function runGoogleAccountAutomation({
         continue;
       }
     }
+    // Cloudflare login stuck: keep hammering Google SSO only
+    if (onCfHost && !seenGoogleAuth && (await handleProviderLoginGate(page, reportStep))) {
+      googleLoginSelectedAt = Date.now();
+      continue;
+    }
 
     // Periodic diagnostics so jobs aren't opaque "waiting" spam
     if (Math.floor((Date.now() - startTime) / 5000) !== Math.floor((Date.now() - startTime - loopTickMs) / 5000)) {
@@ -2331,4 +2582,7 @@ export const __test__ = {
   handleXaiDeviceCodeConfirm,
   GOOGLE_LOGIN_BUTTON_SELECTORS,
   isGrokish,
+  dismissCookieBanners,
+  clickGoogleLoginRole,
+  isCloudflareLoginUrl,
 };