avios-cli 0.1.3__tar.gz → 0.1.4__tar.gz

{avios_cli-0.1.3 → avios_cli-0.1.4}/CHANGELOG.md

@@ -6,6 +6,17 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.4] - 2026-07-24
+
+### Fixed
+- **Endless hCaptcha loop during `avios login`.** The login browser opened a fresh,
+  empty context with automation flags on, which hCaptcha/Akamai flag as a bot and
+  answer with infinite challenges. Login now opens a **persistent Chrome profile**
+  (cookies/reputation persist between attempts) with the automation fingerprint
+  disabled (`--disable-blink-features=AutomationControlled`, no `--enable-automation`).
+  If you still hit captchas, use `avios login --from-browser` to import the cookie
+  from your normal Chrome instead.
+
 ## [0.1.3] - 2026-07-24
 
 ### Fixed
@@ -63,7 +74,8 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Reward-flight **availability** search is not yet implemented (needs a British
   Airways capture).
 
-[Unreleased]: https://github.com/alexechoi/avios-cli/compare/v0.1.3...HEAD
+[Unreleased]: https://github.com/alexechoi/avios-cli/compare/v0.1.4...HEAD
+[0.1.4]: https://github.com/alexechoi/avios-cli/compare/v0.1.3...v0.1.4
 [0.1.3]: https://github.com/alexechoi/avios-cli/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/alexechoi/avios-cli/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/alexechoi/avios-cli/compare/v0.1.0...v0.1.1

{avios_cli-0.1.3 → avios_cli-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: avios-cli
-Version: 0.1.3
+Version: 0.1.4
 Summary: A CLI and TUI for avios.com — view your Avios balance and transactions from the terminal.
 Project-URL: Homepage, https://github.com/alexechoi/avios-cli
 Project-URL: Repository, https://github.com/alexechoi/avios-cli
@@ -100,6 +100,11 @@ uvx --from 'avios-cli[login]' avios login --from-browser
 Plain `uvx avios-cli login` won't work — the isolated environment doesn't include
 the `login` extra.
 
+**Stuck in an endless captcha loop?** That's bot detection on the automated
+browser. Use `--from-browser` instead: log into avios.com in your normal Chrome
+(you'll get one normal captcha), then run
+`uvx --from 'avios-cli[login]' avios login --from-browser`.
+
 Your session cookie is stored at `~/.config/avios/state.json` (mode `600`). It
 expires after ~a day; just run `avios login` again. Run `avios logout` to remove it.
 

{avios_cli-0.1.3 → avios_cli-0.1.4}/README.md

@@ -65,6 +65,11 @@ uvx --from 'avios-cli[login]' avios login --from-browser
 Plain `uvx avios-cli login` won't work — the isolated environment doesn't include
 the `login` extra.
 
+**Stuck in an endless captcha loop?** That's bot detection on the automated
+browser. Use `--from-browser` instead: log into avios.com in your normal Chrome
+(you'll get one normal captcha), then run
+`uvx --from 'avios-cli[login]' avios login --from-browser`.
+
 Your session cookie is stored at `~/.config/avios/state.json` (mode `600`). It
 expires after ~a day; just run `avios login` again. Run `avios logout` to remove it.
 

{avios_cli-0.1.3 → avios_cli-0.1.4}/src/avios/__init__.py

@@ -3,4 +3,4 @@
 View your Avios balance, transactions and account details from the terminal.
 """
 
-__version__ = "0.1.3"
+__version__ = "0.1.4"

{avios_cli-0.1.3 → avios_cli-0.1.4}/src/avios/auth.py

@@ -63,15 +63,15 @@ def login_via_browser(
     session = session or Session()
     factory = playwright_factory or _import_sync_playwright()
     base_url = session.settings.base_url
+    profile_dir = str(session.settings.config_dir / "chrome-profile")
 
     with factory() as pw:
-        browser = _launch_browser(pw, headless=headless)
-        ctx = browser.new_context(user_agent=session.settings.user_agent)
+        ctx = _open_login_context(pw, headless=headless, user_data_dir=profile_dir)
         page = ctx.new_page()
         page.goto(f"{base_url}{DASHBOARD_PATH}")
         authed = _wait_for_auth(ctx, page, base_url, timeout_ms)
         cookies = list(ctx.cookies())
-        browser.close()
+        ctx.close()
 
     if not authed:
         raise LoginError("Timed out waiting for login. Run `avios login` again.")
@@ -114,11 +114,27 @@ def _is_authenticated(ctx: Any, base_url: str) -> bool:
         return False
 
 
-def _launch_browser(pw: Any, *, headless: bool) -> Any:
-    """Launch the user's system Chrome if available, else bundled Chromium."""
-    for kwargs in ({"channel": "chrome"}, {}):
+def _open_login_context(pw: Any, *, headless: bool, user_data_dir: str) -> Any:
+    """Open a browser context for login, tuned to avoid the hCaptcha bot loop.
+
+    hCaptcha/Akamai serve endless challenges to obviously-automated browsers, so:
+    - prefer the user's real Chrome (``channel="chrome"``) over bundled Chromium;
+    - disable the automation fingerprint (``navigator.webdriver`` /
+      ``--enable-automation``);
+    - use a **persistent profile** so cookies and captcha reputation carry over
+      between attempts (a brand-new, empty profile looks high-risk).
+    """
+    args = ["--disable-blink-features=AutomationControlled"]
+    ignore_default_args = ["--enable-automation"]
+    for extra in ({"channel": "chrome"}, {}):
         try:
-            return pw.chromium.launch(headless=headless, **kwargs)
+            return pw.chromium.launch_persistent_context(
+                user_data_dir,
+                headless=headless,
+                args=args,
+                ignore_default_args=ignore_default_args,
+                **extra,
+            )
         except Exception:
             continue
     raise LoginError(

{avios_cli-0.1.3 → avios_cli-0.1.4}/tests/test_auth.py

@@ -1,8 +1,8 @@
 """Tests for the login helpers.
 
-The Playwright browser flow can't be automated (Auth0 + hCaptcha + MFA need a
-human), so we test the cookie-conversion/import helpers and the missing-dependency
-paths. ``browser_cookie3`` is faked via ``sys.modules`` so tests don't depend on
+The interactive browser flow can't be automated (Auth0 + hCaptcha + MFA need a
+human), so we inject a fake Playwright to exercise the poll-until-authenticated
+logic, and fake ``browser_cookie3`` via ``sys.modules`` so tests don't depend on
 the optional ``login`` extra or a real browser profile.
 """
 
@@ -17,6 +17,7 @@ from avios.auth import (
     LoginError,
     _default_loader,
     _only_avios,
+    _open_login_context,
     _to_cookie_dicts,
     import_from_browser,
     login_via_browser,
@@ -108,7 +109,7 @@ def test_login_via_browser_without_playwright(
         login_via_browser(_session(settings))
 
 
-# --- fake Playwright, to exercise the poll-until-authenticated flow --------------
+# --- fake Playwright (persistent context) to exercise the login flow ------------
 class _FakeResponse:
     def __init__(self, ok: bool) -> None:
         self.ok = ok
@@ -138,6 +139,7 @@ class _FakeContext:
     def __init__(self, ok_after: int, cookies: list[dict[str, str]]) -> None:
         self.request = _FakeRequest(ok_after)
         self._cookies = cookies
+        self.closed = False
 
     def new_page(self) -> _FakePage:
         return _FakePage()
@@ -145,39 +147,34 @@ class _FakeContext:
     def cookies(self) -> list[dict[str, str]]:
         return self._cookies
 
-
-class _FakeBrowser:
-    def __init__(self, ctx: _FakeContext) -> None:
-        self._ctx = ctx
-        self.closed = False
-
-    def new_context(self, **kwargs: object) -> _FakeContext:
-        return self._ctx
-
     def close(self) -> None:
         self.closed = True
 
 
-class _FakePlaywright:
-    def __init__(self, browser: _FakeBrowser) -> None:
-        self.chromium = _FakeChromium(browser)
-
-
 class _FakeChromium:
-    def __init__(self, browser: _FakeBrowser) -> None:
-        self._browser = browser
-        self.launches: list[str | None] = []
+    def __init__(self, ctx: _FakeContext, fail_channel: str | None = None) -> None:
+        self._ctx = ctx
+        self._fail_channel = fail_channel
+        self.channels: list[str | None] = []
+
+    def launch_persistent_context(self, user_data_dir: str, **kwargs: object) -> _FakeContext:
+        channel = kwargs.get("channel")
+        self.channels.append(channel)  # type: ignore[arg-type]
+        if channel == self._fail_channel:
+            raise RuntimeError("channel unavailable")
+        return self._ctx
 
-    def launch(self, **kwargs: object) -> _FakeBrowser:
-        self.launches.append(kwargs.get("channel"))  # type: ignore[arg-type]
-        return self._browser
+
+class _FakePlaywright:
+    def __init__(self, ctx: _FakeContext, fail_channel: str | None = None) -> None:
+        self.chromium = _FakeChromium(ctx, fail_channel)
 
 
 class _FakeFactory:
-    """Callable that returns a context manager yielding a fake Playwright."""
+    """Callable returning a context manager that yields the fake Playwright."""
 
-    def __init__(self, browser: _FakeBrowser) -> None:
-        self._pw = _FakePlaywright(browser)
+    def __init__(self, ctx: _FakeContext, fail_channel: str | None = None) -> None:
+        self._pw = _FakePlaywright(ctx, fail_channel)
 
     def __call__(self) -> _FakeFactory:
         return self
@@ -195,14 +192,13 @@ def test_login_captures_only_after_authenticated(settings: Settings) -> None:
         {"name": "_ga", "value": "junk", "domain": ".google.com"},
     ]
     ctx = _FakeContext(ok_after=3, cookies=cookies)
-    browser = _FakeBrowser(ctx)
     session = _session(settings)
 
-    count = login_via_browser(session, timeout_ms=100_000, playwright_factory=_FakeFactory(browser))
+    count = login_via_browser(session, timeout_ms=100_000, playwright_factory=_FakeFactory(ctx))
 
     assert count == 1  # only the avios cookie
     assert session.load_cookies() == cookies
-    assert browser.closed
+    assert ctx.closed
     assert ctx.request.calls >= 3  # polled until authenticated, not immediately
 
 
@@ -210,34 +206,18 @@ def test_login_times_out_without_saving(settings: Settings) -> None:
     ctx = _FakeContext(
         ok_after=999, cookies=[{"name": "appSession", "value": "x", "domain": "www.avios.com"}]
     )
-    browser = _FakeBrowser(ctx)
     session = _session(settings)
 
     with pytest.raises(LoginError, match="Timed out"):
-        login_via_browser(session, timeout_ms=6_000, playwright_factory=_FakeFactory(browser))
+        login_via_browser(session, timeout_ms=6_000, playwright_factory=_FakeFactory(ctx))
 
     assert session.is_authenticated() is False  # nothing saved on timeout
-    assert browser.closed
-
-
-def test_launch_browser_prefers_chrome_then_falls_back() -> None:
-    from avios.auth import _launch_browser
-
-    class Chromium:
-        def __init__(self) -> None:
-            self.channels: list[str | None] = []
-
-        def launch(self, **kwargs: object) -> str:
-            channel = kwargs.get("channel")
-            self.channels.append(channel)  # type: ignore[arg-type]
-            if channel == "chrome":
-                raise RuntimeError("no system chrome")
-            return "browser"
+    assert ctx.closed
 
-    class PW:
-        def __init__(self) -> None:
-            self.chromium = Chromium()
 
-    pw = PW()
-    assert _launch_browser(pw, headless=True) == "browser"
-    assert pw.chromium.channels == ["chrome", None]
+def test_open_login_context_prefers_chrome_then_falls_back(tmp_path: object) -> None:
+    ctx = _FakeContext(ok_after=1, cookies=[])
+    pw = _FakePlaywright(ctx, fail_channel="chrome")
+    result = _open_login_context(pw, headless=True, user_data_dir=str(tmp_path))
+    assert result is ctx
+    assert pw.chromium.channels == ["chrome", None]  # tried Chrome, fell back to Chromium