zevairouter 1.0.95 → 1.0.97

package/src/lib/oauth/services/codebuddyCnBulkImportManager.js

@@ -536,6 +536,20 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
   async captureApiKey(job, account, context, page, fiveSimClient, fiveSimOrderId) {
     const PERSONAL_ENTERPRISE_ID = "personal-edition-user-id";
 
+    // Tiny event-driven poller — replaces multi-second blind sleeps.
+    const waitUntil = async (checkFn, { timeout = 12_000, interval = 150 } = {}) => {
+      const deadline = Date.now() + timeout;
+      while (Date.now() < deadline) {
+        try {
+          if (await checkFn()) return true;
+        } catch {
+          /* retry */
+        }
+        await new Promise((r) => setTimeout(r, interval));
+      }
+      return false;
+    };
+
     try {
       // Functional session establishment — do NOT hard-require KEYCLOAK_IDENTITY.
       // Live failures show OTP can succeed with AUTH_SESSION_ID + session + qcloud_uid
@@ -563,43 +577,97 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         names.has("AUTH_SESSION_ID")
         || names.has("session")
         || names.has("qcloud_uid")
-        || names.has("qcmainCSRFToken");
+        || names.has("qcmainCSRFToken")
+        || names.has("x_host_key_access");
 
       const probeConsoleAccounts = async () => page.evaluate(async () => {
         try {
-          const res = await fetch("/console/accounts", {
+          // Absolute URL — relative /console/accounts fails if we are still on login.tencent or keycloak host.
+          const host = window.location.hostname || "www.codebuddy.cn";
+          const base = host.endsWith("codebuddy.cn")
+            ? `${window.location.origin}`
+            : "https://www.codebuddy.cn";
+          const res = await fetch(`${base}/console/accounts`, {
             credentials: "include",
             headers: {
               Accept: "application/json, text/plain, */*",
               "x-requested-with": "XMLHttpRequest",
-              "X-Domain": window.location.hostname || "www.codebuddy.cn",
+              "X-Domain": "www.codebuddy.cn",
+              "X-Product": "SaaS",
             },
           });
-          const data = await res.json().catch(() => null);
-          return { status: res.status, data };
+          const text = await res.text().catch(() => "");
+          let data = null;
+          try {
+            data = text ? JSON.parse(text) : null;
+          } catch {
+            data = { _raw: String(text || "").slice(0, 240), _notJson: true };
+          }
+          return { status: res.status, data, text: String(text || "").slice(0, 240) };
         } catch (error) {
           return { status: 0, error: error?.message || String(error) };
         }
       }).catch(() => null);
 
-      const extractAccountList = (probe) =>
-        probe?.data?.data?.accounts || probe?.data?.accounts || [];
+      const extractAccountList = (probe) => {
+        const d = probe?.data;
+        if (!d || typeof d !== "object") return [];
+        const candidates = [
+          d?.data?.accounts,
+          d?.accounts,
+          d?.data?.list,
+          d?.list,
+          d?.data?.result,
+          d?.result,
+          d?.data?.items,
+          d?.items,
+          Array.isArray(d?.data) ? d.data : null,
+          Array.isArray(d) ? d : null,
+        ];
+        for (const c of candidates) {
+          if (Array.isArray(c) && c.length > 0) return c;
+        }
+        return [];
+      };
+
+      // After goto: wait for accounts XHR or Keycloak cookie — not a fixed sleep.
+      const waitAfterNav = async () => {
+        await Promise.race([
+          page.waitForResponse(
+            (r) => /\/console\/accounts/i.test(r.url()) && r.status() < 500,
+            { timeout: 10_000 },
+          ).catch(() => null),
+          page.waitForResponse(
+            (r) => /\/console\/api\//i.test(r.url()) && r.status() < 500,
+            { timeout: 10_000 },
+          ).catch(() => null),
+          waitUntil(async () => {
+            const snap = await cookieSnapshot();
+            return hasStrongKeycloak(snap.names);
+          }, { timeout: 10_000, interval: 200 }),
+          new Promise((r) => setTimeout(r, 2_500)), // hard cap only
+        ]);
+      };
 
       // Navigate sequence to finish OIDC handoff when only AUTH_SESSION_ID is present.
+      // Order matters: home → console → keys (login/ last — re-triggering login can wipe soft session).
       const oIDCNudgePaths = [
         "https://www.codebuddy.cn/",
-        "https://www.codebuddy.cn/login/",
         "https://www.codebuddy.cn/console",
+        "https://www.codebuddy.cn/console/",
         "https://www.codebuddy.cn/profile",
         "https://www.codebuddy.cn/profile/keys",
+        // only if still empty after console probes
+        "https://www.codebuddy.cn/login/",
       ];
 
       let accountList = [];
       let accountsProbe = null;
       let sessionReady = false;
+      let lastPayloadSnippet = "";
 
-      // Cap OIDC nudge loop — 18 × multi-second waits was too long on 2GB VPS.
-      const OIDC_MAX_ATTEMPTS = 8;
+      // Event-driven OIDC settle: more attempts but each wait is response-driven, not blind multi-sec sleep.
+      const OIDC_MAX_ATTEMPTS = 10;
       for (let attempt = 0; attempt < OIDC_MAX_ATTEMPTS; attempt += 1) {
         if (job.cancelRequested) {
           throw new Error("Job cancelled while establishing session");
@@ -609,35 +677,38 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
         const strong = hasStrongKeycloak(snap.names);
         const soft = hasSoftSession(snap.names);
 
-        // Progressive navigation to complete half-finished Keycloak login
         const path = oIDCNudgePaths[Math.min(attempt, oIDCNudgePaths.length - 1)];
-        if (attempt === 0 || attempt === 2 || attempt === 4 || attempt === 6) {
+        // Always nudge on first 3 + even attempts; skip re-nav when soft session already present
+        // and we only need to re-probe accounts.
+        const shouldNav = attempt < 3 || attempt % 2 === 0 || !soft;
+        if (shouldNav) {
           this.setAccountStep(
             account,
             "waiting_session",
-            `OIDC handoff attempt ${attempt + 1}/${OIDC_MAX_ATTEMPTS} → ${path} (cookies: ${strong ? "KEYCLOAK" : soft ? "soft-session" : "weak"})`,
+            `OIDC handoff ${attempt + 1}/${OIDC_MAX_ATTEMPTS} → ${path.replace("https://www.codebuddy.cn", "")} (${strong ? "KEYCLOAK" : soft ? "soft-session" : "weak"})`,
           );
           await this.persistJobSnapshot(job, { forcePreview: false });
           await page.goto(path, { waitUntil: "domcontentloaded", timeout: 25_000 }).catch(() => null);
-          await page.waitForTimeout(1_500);
-
-          // If Keycloak login iframe reappears, user session is not complete —
-          // don't treat blank SPA as success; keep probing.
+          await waitAfterNav();
         } else {
-          await page.waitForTimeout(1_000);
+          // Soft session present — short yield then re-probe (no blind multi-second sleep).
+          await new Promise((r) => setTimeout(r, 300));
         }
 
-        // Prefer landing on console for the API probe
-        if (attempt >= 2 && !String(page.url() || "").includes("/console")) {
+        // Prefer landing on console for the API probe (absolute host)
+        const onCodebuddy = /codebuddy\.cn/i.test(page.url?.() || "");
+        if (!onCodebuddy || (!String(page.url() || "").includes("/console") && attempt >= 1)) {
           await page.goto("https://www.codebuddy.cn/console", {
             waitUntil: "domcontentloaded",
             timeout: 25_000,
           }).catch(() => null);
-          await page.waitForTimeout(1_000);
+          await waitAfterNav();
         }
 
         accountsProbe = await probeConsoleAccounts();
         accountList = extractAccountList(accountsProbe);
+        lastPayloadSnippet = JSON.stringify(accountsProbe?.data ?? accountsProbe?.text ?? null).slice(0, 180);
+
         if (accountsProbe?.status === 200 && Array.isArray(accountList) && accountList.length > 0) {
           sessionReady = true;
           this.setAccountStep(
@@ -649,40 +720,67 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
           break;
         }
 
+        // Soft session + HTTP 200 empty accounts: console often still accepts api-keys.
+        // Don't fail early — break out and try key create with personal enterprise id.
+        if (
+          soft
+          && accountsProbe?.status === 200
+          && Array.isArray(accountList)
+          && accountList.length === 0
+          && attempt >= 4
+        ) {
+          this.setAccountStep(
+            account,
+            "session_soft",
+            `Console HTTP 200 but 0 accounts — trying personal API key with soft session (cookies ok)`,
+          );
+          await this.persistJobSnapshot(job, { forcePreview: true });
+          sessionReady = true; // allow create-key path
+          break;
+        }
+
         this.setAccountStep(
           account,
           "resolving_enterprise",
-          `Console not ready (HTTP ${accountsProbe?.status || 0}) — retry ${attempt + 1}/${OIDC_MAX_ATTEMPTS}`,
+          `Console not ready (HTTP ${accountsProbe?.status || 0}, accounts=${accountList.length}) — ${attempt + 1}/${OIDC_MAX_ATTEMPTS} body=${lastPayloadSnippet.slice(0, 80)}`,
         );
         await this.persistJobSnapshot(job, { forcePreview: false });
       }
 
-      if (!sessionReady || !Array.isArray(accountList) || accountList.length === 0) {
+      if (!sessionReady) {
         const snap = await cookieSnapshot();
         throw new Error(
-          `Console accounts unavailable after login (HTTP ${accountsProbe?.status || 0}; cookies: ${snap.list.slice(0, 18).join(",") || "(none)"}) — session not accepted for API key`,
+          `Console accounts unavailable after login (HTTP ${accountsProbe?.status || 0}; cookies: ${snap.list.slice(0, 18).join(",") || "(none)"}; body=${lastPayloadSnippet.slice(0, 120)}) — session not accepted for API key`,
         );
       }
 
       let userEnterpriseId = PERSONAL_ENTERPRISE_ID;
-      const preferred = accountList.find((entry) => entry?.lastLogin) || accountList[0];
-      if (preferred?.type && preferred.type !== "personal" && preferred.enterpriseId) {
-        userEnterpriseId = preferred.enterpriseId;
+      if (Array.isArray(accountList) && accountList.length > 0) {
+        const preferred = accountList.find((entry) => entry?.lastLogin) || accountList[0];
+        if (preferred?.type && preferred.type !== "personal" && preferred.enterpriseId) {
+          userEnterpriseId = preferred.enterpriseId;
+        } else if (preferred?.enterpriseId && preferred?.type !== "personal") {
+          userEnterpriseId = preferred.enterpriseId;
+        }
       }
 
       // Create API key — CN requires user_enterprise_id (400 code 12505 without it).
-      this.setAccountStep(account, "creating_api_key", `Creating API key (enterprise=${userEnterpriseId})`);
+      this.setAccountStep(account, "creating_api_key", `Creating API key (enterprise=${userEnterpriseId}, accounts=${accountList.length})`);
       await this.persistJobSnapshot(job, { forcePreview: true });
 
       const createKeyOnPage = async (enterpriseId) => page.evaluate(async ({ enterpriseId: entId }) => {
-        const res = await fetch("/console/api/client/v1/api-keys", {
+        const host = window.location.hostname || "www.codebuddy.cn";
+        const base = host.endsWith("codebuddy.cn")
+          ? window.location.origin
+          : "https://www.codebuddy.cn";
+        const res = await fetch(`${base}/console/api/client/v1/api-keys`, {
           method: "POST",
           credentials: "include",
           headers: {
             "Content-Type": "application/json",
             Accept: "application/json, text/plain, */*",
             "x-requested-with": "XMLHttpRequest",
-            "X-Domain": window.location.hostname || "www.codebuddy.cn",
+            "X-Domain": "www.codebuddy.cn",
             "X-Product": "SaaS",
           },
           body: JSON.stringify({
@@ -691,26 +789,49 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
             user_enterprise_id: entId,
           }),
         });
-        const data = await res.json().catch(() => null);
+        const text = await res.text().catch(() => "");
+        let data = null;
+        try {
+          data = text ? JSON.parse(text) : null;
+        } catch {
+          data = { _raw: String(text || "").slice(0, 200) };
+        }
         return { ok: res.ok, status: res.status, data };
       }, { enterpriseId });
 
+      // Always open keys page first (SPA hydrates CSRF / host-key there).
+      await page.goto("https://www.codebuddy.cn/profile/keys", {
+        waitUntil: "domcontentloaded",
+        timeout: 45_000,
+      }).catch(() => null);
+      await waitAfterNav();
+
       let apiKeyResult = await createKeyOnPage(userEnterpriseId).catch(() => null);
 
-      // Retry from keys page if console path was not enough.
+      // Retry personal id if enterprise id failed or accounts were empty.
+      if (
+        (!apiKeyResult || !apiKeyResult.ok)
+        && userEnterpriseId !== PERSONAL_ENTERPRISE_ID
+      ) {
+        this.setAccountStep(account, "retrying_api_key", "Retrying with personal-edition enterprise id");
+        await this.persistJobSnapshot(job, { forcePreview: false });
+        apiKeyResult = await createKeyOnPage(PERSONAL_ENTERPRISE_ID).catch(() => null);
+      }
+
+      // Retry from console root if keys page POST failed.
       if (!apiKeyResult || !apiKeyResult.ok) {
-        this.setAccountStep(account, "retrying_api_key", "Retrying API key creation from profile/keys");
+        this.setAccountStep(account, "retrying_api_key", "Retrying API key from /console");
         await this.persistJobSnapshot(job, { forcePreview: true });
+        await page.goto("https://www.codebuddy.cn/console", {
+          waitUntil: "domcontentloaded",
+          timeout: 45_000,
+        }).catch(() => null);
+        await waitAfterNav();
         await page.goto("https://www.codebuddy.cn/profile/keys", {
           waitUntil: "domcontentloaded",
           timeout: 45_000,
         }).catch(() => null);
-        await page.waitForTimeout(2_500);
-        apiKeyResult = await createKeyOnPage(userEnterpriseId).catch(() => null);
-      }
-
-      // Last resort: personal edition id explicitly.
-      if ((!apiKeyResult || !apiKeyResult.ok) && userEnterpriseId !== PERSONAL_ENTERPRISE_ID) {
+        await waitAfterNav();
         apiKeyResult = await createKeyOnPage(PERSONAL_ENTERPRISE_ID).catch(() => null);
       }
 
@@ -719,9 +840,13 @@ export class CodeBuddyCnBulkImportManager extends KiroBulkImportManager {
       if (!apiKeyResult?.ok && (status === 401 || status === 403 || status === 0 || !apiKeyResult)) {
         this.setAccountStep(account, "retrying_api_key", "API key 401/403 — re-running OIDC handoff then retry");
         await this.persistJobSnapshot(job, { forcePreview: true });
-        for (const path of ["https://www.codebuddy.cn/login/", "https://www.codebuddy.cn/", "https://www.codebuddy.cn/console", "https://www.codebuddy.cn/profile/keys"]) {
+        for (const path of [
+          "https://www.codebuddy.cn/",
+          "https://www.codebuddy.cn/console",
+          "https://www.codebuddy.cn/profile/keys",
+        ]) {
           await page.goto(path, { waitUntil: "domcontentloaded", timeout: 45_000 }).catch(() => null);
-          await page.waitForTimeout(2_000);
+          await waitAfterNav();
         }
         apiKeyResult = await createKeyOnPage(PERSONAL_ENTERPRISE_ID).catch(() => null);
       }