avios-cli 0.1.3__tar.gz → 0.1.5__tar.gz

{avios_cli-0.1.3 → avios_cli-0.1.5}/CHANGELOG.md

@@ -6,6 +6,30 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.5] - 2026-07-24
+
+### Fixed
+- **`--from-browser` only read Chrome's `Default` profile.** If you were logged
+  into avios.com in another profile (Profile 1, a work profile, ...), it grabbed
+  the wrong profile's cookies and every call failed with "Session expired". It now
+  **scans all Chrome profiles, verifies which one actually authenticates**
+  (against `/auth-gateway/user`), and uses that — and reports which profile it used.
+
+### Added
+- `avios login --from-browser --profile "Profile 1"` to target a specific browser
+  profile, and a clear warning when the imported cookies aren't a logged-in session.
+
+## [0.1.4] - 2026-07-24
+
+### Fixed
+- **Endless hCaptcha loop during `avios login`.** The login browser opened a fresh,
+  empty context with automation flags on, which hCaptcha/Akamai flag as a bot and
+  answer with infinite challenges. Login now opens a **persistent Chrome profile**
+  (cookies/reputation persist between attempts) with the automation fingerprint
+  disabled (`--disable-blink-features=AutomationControlled`, no `--enable-automation`).
+  If you still hit captchas, use `avios login --from-browser` to import the cookie
+  from your normal Chrome instead.
+
 ## [0.1.3] - 2026-07-24
 
 ### Fixed
@@ -63,7 +87,9 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - Reward-flight **availability** search is not yet implemented (needs a British
   Airways capture).
 
-[Unreleased]: https://github.com/alexechoi/avios-cli/compare/v0.1.3...HEAD
+[Unreleased]: https://github.com/alexechoi/avios-cli/compare/v0.1.5...HEAD
+[0.1.5]: https://github.com/alexechoi/avios-cli/compare/v0.1.4...v0.1.5
+[0.1.4]: https://github.com/alexechoi/avios-cli/compare/v0.1.3...v0.1.4
 [0.1.3]: https://github.com/alexechoi/avios-cli/compare/v0.1.2...v0.1.3
 [0.1.2]: https://github.com/alexechoi/avios-cli/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/alexechoi/avios-cli/compare/v0.1.0...v0.1.1

{avios_cli-0.1.3 → avios_cli-0.1.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: avios-cli
-Version: 0.1.3
+Version: 0.1.5
 Summary: A CLI and TUI for avios.com — view your Avios balance and transactions from the terminal.
 Project-URL: Homepage, https://github.com/alexechoi/avios-cli
 Project-URL: Repository, https://github.com/alexechoi/avios-cli
@@ -97,9 +97,22 @@ into avios.com with:
 uvx --from 'avios-cli[login]' avios login --from-browser
 ```
 
+This scans **all your Chrome profiles** and uses whichever one is actually logged
+into avios.com (it tells you which). If you have several profiles, you can target
+one directly:
+
+```bash
+uvx --from 'avios-cli[login]' avios login --from-browser --profile "Profile 1"
+```
+
 Plain `uvx avios-cli login` won't work — the isolated environment doesn't include
 the `login` extra.
 
+**Stuck in an endless captcha loop?** That's bot detection on the automated
+browser. Use `--from-browser` instead: log into avios.com in your normal Chrome
+(you'll get one normal captcha), then run
+`uvx --from 'avios-cli[login]' avios login --from-browser`.
+
 Your session cookie is stored at `~/.config/avios/state.json` (mode `600`). It
 expires after ~a day; just run `avios login` again. Run `avios logout` to remove it.
 

{avios_cli-0.1.3 → avios_cli-0.1.5}/README.md

@@ -62,9 +62,22 @@ into avios.com with:
 uvx --from 'avios-cli[login]' avios login --from-browser
 ```
 
+This scans **all your Chrome profiles** and uses whichever one is actually logged
+into avios.com (it tells you which). If you have several profiles, you can target
+one directly:
+
+```bash
+uvx --from 'avios-cli[login]' avios login --from-browser --profile "Profile 1"
+```
+
 Plain `uvx avios-cli login` won't work — the isolated environment doesn't include
 the `login` extra.
 
+**Stuck in an endless captcha loop?** That's bot detection on the automated
+browser. Use `--from-browser` instead: log into avios.com in your normal Chrome
+(you'll get one normal captcha), then run
+`uvx --from 'avios-cli[login]' avios login --from-browser`.
+
 Your session cookie is stored at `~/.config/avios/state.json` (mode `600`). It
 expires after ~a day; just run `avios login` again. Run `avios logout` to remove it.
 

{avios_cli-0.1.3 → avios_cli-0.1.5}/src/avios/__init__.py

@@ -3,4 +3,4 @@
 View your Avios balance, transactions and account details from the terminal.
 """
 
-__version__ = "0.1.3"
+__version__ = "0.1.5"

avios_cli-0.1.5/src/avios/auth.py

@@ -0,0 +1,308 @@
+"""Browser-assisted login for avios.
+
+avios.com has no plain credential API: login is Auth0 "Universal Login" guarded by
+hCaptcha, Akamai Bot Manager and SMS/passkey MFA, so there is no way to POST a
+username/password over HTTP and obtain a session. Instead we let a real browser
+handle the login once and capture the resulting session cookie.
+
+Two strategies, both requiring the optional ``login`` extra
+(``pip install "avios-cli[login]"``):
+
+- :func:`login_via_browser` — open a Playwright browser, the user logs in
+  (password + captcha + MFA), and we grab the cookies. Also needs
+  ``playwright install chromium``.
+- :func:`import_from_browser` — read the avios.com cookie straight out of a
+  running browser via ``browser_cookie3`` (no popup) if already logged in there.
+"""
+
+from __future__ import annotations
+
+import contextlib
+from collections.abc import Callable, Iterable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Protocol
+
+import httpx
+
+from avios import endpoints
+from avios.config import Settings
+from avios.session import Session, cookie_header_from
+
+DASHBOARD_PATH = "/manage-avios/dashboard"
+LOGIN_TIMEOUT_MS = 300_000  # 5 minutes to complete password + captcha + MFA
+LOGIN_POLL_MS = 2_000  # how often to check whether the session is authenticated
+SUPPORTED_BROWSERS = ("chrome", "firefox", "edge", "brave", "safari", "chromium")
+
+# Chromium-family user-data roots per browser (relative to home), used to discover
+# per-profile cookie databases (Default, "Profile 1", ...).
+_CHROMIUM_ROOTS = {
+    "chrome": [
+        "Library/Application Support/Google/Chrome",
+        ".config/google-chrome",
+        "AppData/Local/Google/Chrome/User Data",
+    ],
+    "brave": [
+        "Library/Application Support/BraveSoftware/Brave-Browser",
+        ".config/BraveSoftware/Brave-Browser",
+        "AppData/Local/BraveSoftware/Brave-Browser/User Data",
+    ],
+    "edge": [
+        "Library/Application Support/Microsoft Edge",
+        ".config/microsoft-edge",
+        "AppData/Local/Microsoft/Edge/User Data",
+    ],
+    "chromium": [
+        "Library/Application Support/Chromium",
+        ".config/chromium",
+        "AppData/Local/Chromium/User Data",
+    ],
+}
+
+
+class LoginError(RuntimeError):
+    """Login could not be completed."""
+
+
+@dataclass
+class ImportResult:
+    """Outcome of importing cookies from a browser."""
+
+    count: int
+    profile: str | None
+    authenticated: bool
+
+
+class _RawCookie(Protocol):
+    name: str
+    value: str
+    domain: str
+
+
+def _to_cookie_dicts(raw: Iterable[_RawCookie]) -> list[dict[str, Any]]:
+    """Convert browser_cookie3 / cookiejar entries to our stored cookie format."""
+    return [{"name": c.name, "value": c.value, "domain": c.domain} for c in raw]
+
+
+def _only_avios(cookies: list[dict[str, Any]]) -> list[dict[str, Any]]:
+    return [c for c in cookies if "avios.com" in c.get("domain", "")]
+
+
+def login_via_browser(
+    session: Session | None = None,
+    *,
+    headless: bool = False,
+    timeout_ms: int = LOGIN_TIMEOUT_MS,
+    playwright_factory: Any = None,
+) -> int:
+    """Open a browser, wait until the user is actually logged in, save the cookie.
+
+    Returns the number of avios.com cookies captured. ``playwright_factory`` is an
+    injection point for tests; production uses the real ``sync_playwright``.
+    """
+    session = session or Session()
+    factory = playwright_factory or _import_sync_playwright()
+    base_url = session.settings.base_url
+    profile_dir = str(session.settings.config_dir / "chrome-profile")
+
+    with factory() as pw:
+        ctx = _open_login_context(pw, headless=headless, user_data_dir=profile_dir)
+        page = ctx.new_page()
+        page.goto(f"{base_url}{DASHBOARD_PATH}")
+        authed = _wait_for_auth(ctx, page, base_url, timeout_ms)
+        cookies = list(ctx.cookies())
+        ctx.close()
+
+    if not authed:
+        raise LoginError("Timed out waiting for login. Run `avios login` again.")
+    session.save_cookies(cookies)
+    return len(_only_avios(cookies))
+
+
+def _import_sync_playwright() -> Any:
+    try:
+        from playwright.sync_api import sync_playwright
+    except ImportError as exc:
+        raise LoginError(
+            "Playwright isn't installed. Log in using the 'login' extra:\n"
+            "  uvx --from 'avios-cli[login]' avios login\n"
+            "  (first time only: uvx --from playwright playwright install chromium)\n"
+            "Or import the cookie from Chrome instead (no browser download):\n"
+            "  uvx --from 'avios-cli[login]' avios login --from-browser"
+        ) from exc
+    return sync_playwright
+
+
+def _wait_for_auth(ctx: Any, page: Any, base_url: str, timeout_ms: int) -> bool:
+    """Poll the auth endpoint until the session is authenticated (or time out).
+
+    The dashboard is a client-side SPA, so its URL is NOT a reliable signal — it
+    matches the moment we navigate, before login. ``/auth-gateway/user`` returns
+    401 until logged in, then 200.
+    """
+    for _ in range(max(1, timeout_ms // LOGIN_POLL_MS)):
+        if _is_authenticated(ctx, base_url):
+            return True
+        page.wait_for_timeout(LOGIN_POLL_MS)
+    return False
+
+
+def _is_authenticated(ctx: Any, base_url: str) -> bool:
+    try:
+        return bool(ctx.request.get(f"{base_url}{endpoints.AUTH_USER}").ok)
+    except Exception:
+        return False
+
+
+def _open_login_context(pw: Any, *, headless: bool, user_data_dir: str) -> Any:
+    """Open a browser context for login, tuned to avoid the hCaptcha bot loop.
+
+    hCaptcha/Akamai serve endless challenges to obviously-automated browsers, so:
+    - prefer the user's real Chrome (``channel="chrome"``) over bundled Chromium;
+    - disable the automation fingerprint (``navigator.webdriver`` /
+      ``--enable-automation``);
+    - use a **persistent profile** so cookies and captcha reputation carry over
+      between attempts (a brand-new, empty profile looks high-risk).
+    """
+    args = ["--disable-blink-features=AutomationControlled"]
+    ignore_default_args = ["--enable-automation"]
+    for extra in ({"channel": "chrome"}, {}):
+        try:
+            return pw.chromium.launch_persistent_context(
+                user_data_dir,
+                headless=headless,
+                args=args,
+                ignore_default_args=ignore_default_args,
+                **extra,
+            )
+        except Exception:
+            continue
+    raise LoginError(
+        "Couldn't launch a browser. Install Chromium once with:\n"
+        "  uvx --from playwright playwright install chromium"
+    )
+
+
+def _bc3() -> Any:
+    try:
+        import browser_cookie3 as bc3
+    except ImportError as exc:
+        raise LoginError(
+            "browser-cookie3 isn't installed. Run with the 'login' extra:\n"
+            "  uvx --from 'avios-cli[login]' avios login --from-browser"
+        ) from exc
+    return bc3
+
+
+def _browser_fn(bc3: Any, browser: str) -> Any:
+    fn = getattr(bc3, browser, None)
+    if fn is None:
+        raise LoginError(
+            f"Unknown browser '{browser}'. Choose from: {', '.join(SUPPORTED_BROWSERS)}"
+        )
+    return fn
+
+
+def _profile_cookie_files(browser: str, profile: str | None) -> list[tuple[str, Path]]:
+    """Discover (profile_name, Cookies-db) pairs for a chromium-family browser."""
+    found: list[tuple[str, Path]] = []
+    for rel in _CHROMIUM_ROOTS.get(browser, []):
+        root = Path.home() / rel
+        if not root.exists():
+            continue
+        for prof in sorted(p for p in root.iterdir() if p.is_dir()):
+            if profile and prof.name != profile:
+                continue
+            for db in (prof / "Cookies", prof / "Network" / "Cookies"):
+                if db.exists():
+                    found.append((prof.name, db))
+                    break
+    return found
+
+
+def _candidate_cookie_sets(
+    browser: str, profile: str | None
+) -> list[tuple[str, list[dict[str, Any]]]]:
+    """Return [(profile_name, avios_cookies)] to try, most specific first."""
+    bc3 = _bc3()
+    fn = _browser_fn(bc3, browser)
+    candidates: list[tuple[str, list[dict[str, Any]]]] = []
+    for name, db in _profile_cookie_files(browser, profile):
+        try:
+            raw = fn(domain_name="avios.com", cookie_file=str(db))
+        except Exception:
+            continue
+        candidates.append((name, _only_avios(_to_cookie_dicts(raw))))
+    if not profile:
+        # Fallback to browser_cookie3's own default lookup.
+        with contextlib.suppress(Exception):
+            raw = fn(domain_name="avios.com")
+            candidates.append(("default", _only_avios(_to_cookie_dicts(raw))))
+    return candidates
+
+
+def _cookies_authenticate(settings: Settings, cookies: list[dict[str, Any]]) -> bool:
+    """True if these cookies yield a 200 from the auth endpoint."""
+    header = cookie_header_from(cookies)
+    if not header:
+        return False
+    try:
+        with httpx.Client(
+            base_url=settings.base_url,
+            timeout=15.0,
+            follow_redirects=False,
+            headers={
+                "accept": "application/json",
+                "user-agent": settings.user_agent,
+                "cookie": header,
+            },
+        ) as client:
+            return client.get(endpoints.AUTH_USER).status_code == 200
+    except httpx.HTTPError:
+        return False
+
+
+def import_from_browser(
+    session: Session | None = None,
+    browser: str = "chrome",
+    *,
+    profile: str | None = None,
+    loader: Callable[[], Iterable[_RawCookie]] | None = None,
+    authenticator: Callable[[list[dict[str, Any]]], bool] | None = None,
+) -> ImportResult:
+    """Import the avios.com session cookie from a browser profile.
+
+    Scans the browser's profiles, prefers the one whose cookies actually
+    authenticate, and saves them. ``loader``/``authenticator`` are test seams.
+    """
+    session = session or Session()
+    authenticate = authenticator or (lambda c: _cookies_authenticate(session.settings, c))
+
+    if loader is not None:
+        candidates: list[tuple[str, list[dict[str, Any]]]] = [
+            ("browser", _only_avios(_to_cookie_dicts(loader())))
+        ]
+    else:
+        candidates = _candidate_cookie_sets(browser, profile)
+
+    working: tuple[str, list[dict[str, Any]]] | None = None
+    fallback: tuple[str, list[dict[str, Any]]] | None = None
+    for name, cookies in candidates:
+        if not cookies:
+            continue
+        if fallback is None:
+            fallback = (name, cookies)
+        if authenticate(cookies):
+            working = (name, cookies)
+            break
+
+    chosen = working or fallback
+    if chosen is None:
+        where = f"profile '{profile}'" if profile else browser
+        raise LoginError(
+            f"No avios.com cookies found in {where}. Log into avios.com in that "
+            "browser first (and check the profile with --profile)."
+        )
+    name, cookies = chosen
+    session.save_cookies(cookies)
+    return ImportResult(count=len(cookies), profile=name, authenticated=working is not None)

{avios_cli-0.1.3 → avios_cli-0.1.5}/src/avios/cli.py

@@ -98,6 +98,9 @@ def login(
         False, "--from-browser", help="Import the cookie from a running browser (no popup)."
     ),
     browser: str = typer.Option("chrome", help="Browser to import from (with --from-browser)."),
+    profile: str | None = typer.Option(
+        None, help="Browser profile name for --from-browser (e.g. 'Default', 'Profile 1')."
+    ),
     headless: bool = typer.Option(
         False, help="Run the login browser headless (only works without captcha/MFA)."
     ),
@@ -106,7 +109,19 @@ def login(
     session = Session()
     try:
         if from_browser:
-            count = import_from_browser(session, browser)
+            result = import_from_browser(session, browser, profile=profile)
+            where = f" from {browser} profile '{result.profile}'" if result.profile else ""
+            if not result.authenticated:
+                console.print(
+                    f"[yellow]Imported {result.count} cookie(s){where}, but they're not a "
+                    "logged-in avios session.[/]"
+                )
+                console.print(
+                    "Log into avios.com in that profile, pick another with "
+                    "[bold]--profile[/], or use [bold]avios login[/] (browser)."
+                )
+                raise typer.Exit(2)
+            console.print(f"[green]Logged in{where}.[/] Saved {result.count} cookie(s).")
         else:
             console.print(
                 "Opening a browser — log in normally (password, captcha, SMS code). "
@@ -114,11 +129,11 @@ def login(
                 "captures your session automatically."
             )
             count = login_via_browser(session, headless=headless)
+            console.print(f"[green]Logged in.[/] Saved {count} avios cookie(s).")
     except LoginError as exc:
         console.print(f"[red]{escape(str(exc))}[/]")
         raise typer.Exit(1) from exc
 
-    console.print(f"[green]Logged in.[/] Saved {count} avios cookie(s).")
     try:
         balance = AviosClient(session).get_balance()
         console.print(

{avios_cli-0.1.3 → avios_cli-0.1.5}/tests/test_auth.py

@@ -1,8 +1,8 @@
 """Tests for the login helpers.
 
-The Playwright browser flow can't be automated (Auth0 + hCaptcha + MFA need a
-human), so we test the cookie-conversion/import helpers and the missing-dependency
-paths. ``browser_cookie3`` is faked via ``sys.modules`` so tests don't depend on
+The interactive browser flow can't be automated (Auth0 + hCaptcha + MFA need a
+human), so we inject a fake Playwright to exercise the poll-until-authenticated
+logic, and fake ``browser_cookie3`` via ``sys.modules`` so tests don't depend on
 the optional ``login`` extra or a real browser profile.
 """
 
@@ -14,9 +14,11 @@ import types
 import pytest
 
 from avios.auth import (
+    ImportResult,
     LoginError,
-    _default_loader,
+    _browser_fn,
     _only_avios,
+    _open_login_context,
     _to_cookie_dicts,
     import_from_browser,
     login_via_browser,
@@ -51,52 +53,49 @@ def test_only_avios_filters_foreign_domains() -> None:
     assert _only_avios(cookies) == [cookies[0]]
 
 
-def test_import_from_browser_saves_only_avios(settings: Settings) -> None:
+def test_import_from_browser_uses_authenticated_cookies(settings: Settings) -> None:
     session = _session(settings)
-    count = import_from_browser(
+    result = import_from_browser(
         session,
         loader=lambda: [
             FakeCookie("appSession", "abc", "www.avios.com"),
             FakeCookie("_ga", "junk", ".google.com"),
         ],
+        authenticator=lambda cookies: True,
     )
-    assert count == 1
-    assert session.is_authenticated()
+    assert isinstance(result, ImportResult)
+    assert result.count == 1  # only the avios cookie
+    assert result.authenticated is True
     assert session.load_cookies() == [
         {"name": "appSession", "value": "abc", "domain": "www.avios.com"}
     ]
 
 
-def test_import_from_browser_no_cookies_raises(settings: Settings) -> None:
-    with pytest.raises(LoginError, match="No avios.com cookies"):
-        import_from_browser(_session(settings), loader=lambda: [FakeCookie("_ga", "j", ".x.com")])
-
-
-def _fake_bc3(monkeypatch: pytest.MonkeyPatch, **funcs: object) -> None:
-    module = types.ModuleType("browser_cookie3")
-    for name, fn in funcs.items():
-        setattr(module, name, fn)
-    monkeypatch.setitem(sys.modules, "browser_cookie3", module)
-
-
-def test_default_loader_passes_domain(monkeypatch: pytest.MonkeyPatch) -> None:
-    seen: dict[str, str] = {}
+def test_import_from_browser_reports_unauthenticated(settings: Settings) -> None:
+    session = _session(settings)
+    result = import_from_browser(
+        session,
+        loader=lambda: [FakeCookie("appSession", "stale", "www.avios.com")],
+        authenticator=lambda cookies: False,  # cookies exist but don't authenticate
+    )
+    assert result.count == 1
+    assert result.authenticated is False  # saved as best-effort, flagged as not working
 
-    def chrome(**kwargs: str) -> list[FakeCookie]:
-        seen.update(kwargs)
-        return [FakeCookie("appSession", "x", "www.avios.com")]
 
-    _fake_bc3(monkeypatch, chrome=chrome)
-    loader = _default_loader("chrome")
-    cookies = list(loader())
-    assert seen["domain_name"] == "avios.com"
-    assert cookies[0].name == "appSession"
+def test_import_from_browser_no_cookies_raises(settings: Settings) -> None:
+    with pytest.raises(LoginError, match="No avios.com cookies"):
+        import_from_browser(
+            _session(settings),
+            loader=lambda: [FakeCookie("_ga", "j", ".x.com")],
+            authenticator=lambda cookies: True,
+        )
 
 
-def test_default_loader_unknown_browser(monkeypatch: pytest.MonkeyPatch) -> None:
-    _fake_bc3(monkeypatch, chrome=lambda **k: [])
+def test_browser_fn_unknown_browser() -> None:
+    bc3 = types.ModuleType("browser_cookie3")
+    bc3.chrome = lambda **k: []  # type: ignore[attr-defined]
     with pytest.raises(LoginError, match="Unknown browser"):
-        _default_loader("nope")
+        _browser_fn(bc3, "nope")
 
 
 def test_login_via_browser_without_playwright(
@@ -108,7 +107,7 @@ def test_login_via_browser_without_playwright(
         login_via_browser(_session(settings))
 
 
-# --- fake Playwright, to exercise the poll-until-authenticated flow --------------
+# --- fake Playwright (persistent context) to exercise the login flow ------------
 class _FakeResponse:
     def __init__(self, ok: bool) -> None:
         self.ok = ok
@@ -138,6 +137,7 @@ class _FakeContext:
     def __init__(self, ok_after: int, cookies: list[dict[str, str]]) -> None:
         self.request = _FakeRequest(ok_after)
         self._cookies = cookies
+        self.closed = False
 
     def new_page(self) -> _FakePage:
         return _FakePage()
@@ -145,39 +145,34 @@ class _FakeContext:
     def cookies(self) -> list[dict[str, str]]:
         return self._cookies
 
-
-class _FakeBrowser:
-    def __init__(self, ctx: _FakeContext) -> None:
-        self._ctx = ctx
-        self.closed = False
-
-    def new_context(self, **kwargs: object) -> _FakeContext:
-        return self._ctx
-
     def close(self) -> None:
         self.closed = True
 
 
-class _FakePlaywright:
-    def __init__(self, browser: _FakeBrowser) -> None:
-        self.chromium = _FakeChromium(browser)
-
-
 class _FakeChromium:
-    def __init__(self, browser: _FakeBrowser) -> None:
-        self._browser = browser
-        self.launches: list[str | None] = []
+    def __init__(self, ctx: _FakeContext, fail_channel: str | None = None) -> None:
+        self._ctx = ctx
+        self._fail_channel = fail_channel
+        self.channels: list[str | None] = []
+
+    def launch_persistent_context(self, user_data_dir: str, **kwargs: object) -> _FakeContext:
+        channel = kwargs.get("channel")
+        self.channels.append(channel)  # type: ignore[arg-type]
+        if channel == self._fail_channel:
+            raise RuntimeError("channel unavailable")
+        return self._ctx
+
 
-    def launch(self, **kwargs: object) -> _FakeBrowser:
-        self.launches.append(kwargs.get("channel"))  # type: ignore[arg-type]
-        return self._browser
+class _FakePlaywright:
+    def __init__(self, ctx: _FakeContext, fail_channel: str | None = None) -> None:
+        self.chromium = _FakeChromium(ctx, fail_channel)
 
 
 class _FakeFactory:
-    """Callable that returns a context manager yielding a fake Playwright."""
+    """Callable returning a context manager that yields the fake Playwright."""
 
-    def __init__(self, browser: _FakeBrowser) -> None:
-        self._pw = _FakePlaywright(browser)
+    def __init__(self, ctx: _FakeContext, fail_channel: str | None = None) -> None:
+        self._pw = _FakePlaywright(ctx, fail_channel)
 
     def __call__(self) -> _FakeFactory:
         return self
@@ -195,14 +190,13 @@ def test_login_captures_only_after_authenticated(settings: Settings) -> None:
         {"name": "_ga", "value": "junk", "domain": ".google.com"},
     ]
     ctx = _FakeContext(ok_after=3, cookies=cookies)
-    browser = _FakeBrowser(ctx)
     session = _session(settings)
 
-    count = login_via_browser(session, timeout_ms=100_000, playwright_factory=_FakeFactory(browser))
+    count = login_via_browser(session, timeout_ms=100_000, playwright_factory=_FakeFactory(ctx))
 
     assert count == 1  # only the avios cookie
     assert session.load_cookies() == cookies
-    assert browser.closed
+    assert ctx.closed
     assert ctx.request.calls >= 3  # polled until authenticated, not immediately
 
 
@@ -210,34 +204,18 @@ def test_login_times_out_without_saving(settings: Settings) -> None:
     ctx = _FakeContext(
         ok_after=999, cookies=[{"name": "appSession", "value": "x", "domain": "www.avios.com"}]
     )
-    browser = _FakeBrowser(ctx)
     session = _session(settings)
 
     with pytest.raises(LoginError, match="Timed out"):
-        login_via_browser(session, timeout_ms=6_000, playwright_factory=_FakeFactory(browser))
+        login_via_browser(session, timeout_ms=6_000, playwright_factory=_FakeFactory(ctx))
 
     assert session.is_authenticated() is False  # nothing saved on timeout
-    assert browser.closed
-
-
-def test_launch_browser_prefers_chrome_then_falls_back() -> None:
-    from avios.auth import _launch_browser
-
-    class Chromium:
-        def __init__(self) -> None:
-            self.channels: list[str | None] = []
-
-        def launch(self, **kwargs: object) -> str:
-            channel = kwargs.get("channel")
-            self.channels.append(channel)  # type: ignore[arg-type]
-            if channel == "chrome":
-                raise RuntimeError("no system chrome")
-            return "browser"
+    assert ctx.closed
 
-    class PW:
-        def __init__(self) -> None:
-            self.chromium = Chromium()
 
-    pw = PW()
-    assert _launch_browser(pw, headless=True) == "browser"
-    assert pw.chromium.channels == ["chrome", None]
+def test_open_login_context_prefers_chrome_then_falls_back(tmp_path: object) -> None:
+    ctx = _FakeContext(ok_after=1, cookies=[])
+    pw = _FakePlaywright(ctx, fail_channel="chrome")
+    result = _open_login_context(pw, headless=True, user_data_dir=str(tmp_path))
+    assert result is ctx
+    assert pw.chromium.channels == ["chrome", None]  # tried Chrome, fell back to Chromium

{avios_cli-0.1.3 → avios_cli-0.1.5}/tests/test_cli.py

@@ -13,7 +13,7 @@ import pytest
 from typer.testing import CliRunner
 
 from avios import __version__
-from avios.auth import LoginError
+from avios.auth import ImportResult, LoginError
 from avios.cli import app
 from avios.models import Account, Balance, Overview, Profile, Transaction
 from avios.session import NotAuthenticated, SessionExpired
@@ -134,16 +134,31 @@ def test_session_expired(monkeypatch: pytest.MonkeyPatch) -> None:
 
 # -- login / logout ----------------------------------------------------------
 def test_login_from_browser(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr("avios.cli.import_from_browser", lambda session, browser: 2)
+    monkeypatch.setattr(
+        "avios.cli.import_from_browser",
+        lambda session, browser, profile=None: ImportResult(2, "Default", True),
+    )
     monkeypatch.setattr("avios.cli.AviosClient", FakeClient)
     result = runner.invoke(app, ["login", "--from-browser"])
     assert result.exit_code == 0
     assert "Logged in" in result.stdout
+    assert "Default" in result.stdout
     assert "Balance" in result.stdout
 
 
+def test_login_from_browser_unauthenticated(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(
+        "avios.cli.import_from_browser",
+        lambda session, browser, profile=None: ImportResult(20, "Default", False),
+    )
+    result = runner.invoke(app, ["login", "--from-browser"])
+    assert result.exit_code == 2
+    normalized = " ".join(result.stdout.split())  # Rich wraps lines
+    assert "not a logged-in avios session" in normalized
+
+
 def test_login_error(monkeypatch: pytest.MonkeyPatch) -> None:
-    def boom(session: Any, browser: str) -> int:
+    def boom(session: Any, browser: str, profile: str | None = None) -> ImportResult:
         raise LoginError("nope")
 
     monkeypatch.setattr("avios.cli.import_from_browser", boom)

avios_cli-0.1.3/src/avios/auth.py

@@ -1,165 +0,0 @@
-"""Browser-assisted login for avios.
-
-avios.com has no plain credential API: login is Auth0 "Universal Login" guarded by
-hCaptcha, Akamai Bot Manager and SMS/passkey MFA, so there is no way to POST a
-username/password over HTTP and obtain a session. Instead we let a real browser
-handle the login once and capture the resulting session cookie.
-
-Two strategies, both requiring the optional ``login`` extra
-(``pip install "avios-cli[login]"``):
-
-- :func:`login_via_browser` — open a Playwright browser, the user logs in
-  (password + captcha + MFA), and we grab the cookies. Also needs
-  ``playwright install chromium``.
-- :func:`import_from_browser` — read the avios.com cookie straight out of a
-  running browser via ``browser_cookie3`` (no popup) if already logged in there.
-"""
-
-from __future__ import annotations
-
-from collections.abc import Callable, Iterable
-from typing import Any, Protocol
-
-from avios import endpoints
-from avios.session import Session
-
-DASHBOARD_PATH = "/manage-avios/dashboard"
-LOGIN_TIMEOUT_MS = 300_000  # 5 minutes to complete password + captcha + MFA
-LOGIN_POLL_MS = 2_000  # how often to check whether the session is authenticated
-SUPPORTED_BROWSERS = ("chrome", "firefox", "edge", "brave", "safari", "chromium")
-
-
-class LoginError(RuntimeError):
-    """Login could not be completed."""
-
-
-class _RawCookie(Protocol):
-    name: str
-    value: str
-    domain: str
-
-
-def _to_cookie_dicts(raw: Iterable[_RawCookie]) -> list[dict[str, Any]]:
-    """Convert browser_cookie3 / cookiejar entries to our stored cookie format."""
-    return [{"name": c.name, "value": c.value, "domain": c.domain} for c in raw]
-
-
-def _only_avios(cookies: list[dict[str, Any]]) -> list[dict[str, Any]]:
-    return [c for c in cookies if "avios.com" in c.get("domain", "")]
-
-
-def login_via_browser(
-    session: Session | None = None,
-    *,
-    headless: bool = False,
-    timeout_ms: int = LOGIN_TIMEOUT_MS,
-    playwright_factory: Any = None,
-) -> int:
-    """Open a browser, wait until the user is actually logged in, save the cookie.
-
-    Returns the number of avios.com cookies captured. ``playwright_factory`` is an
-    injection point for tests; production uses the real ``sync_playwright``.
-    """
-    session = session or Session()
-    factory = playwright_factory or _import_sync_playwright()
-    base_url = session.settings.base_url
-
-    with factory() as pw:
-        browser = _launch_browser(pw, headless=headless)
-        ctx = browser.new_context(user_agent=session.settings.user_agent)
-        page = ctx.new_page()
-        page.goto(f"{base_url}{DASHBOARD_PATH}")
-        authed = _wait_for_auth(ctx, page, base_url, timeout_ms)
-        cookies = list(ctx.cookies())
-        browser.close()
-
-    if not authed:
-        raise LoginError("Timed out waiting for login. Run `avios login` again.")
-    session.save_cookies(cookies)
-    return len(_only_avios(cookies))
-
-
-def _import_sync_playwright() -> Any:
-    try:
-        from playwright.sync_api import sync_playwright
-    except ImportError as exc:
-        raise LoginError(
-            "Playwright isn't installed. Log in using the 'login' extra:\n"
-            "  uvx --from 'avios-cli[login]' avios login\n"
-            "  (first time only: uvx --from playwright playwright install chromium)\n"
-            "Or import the cookie from Chrome instead (no browser download):\n"
-            "  uvx --from 'avios-cli[login]' avios login --from-browser"
-        ) from exc
-    return sync_playwright
-
-
-def _wait_for_auth(ctx: Any, page: Any, base_url: str, timeout_ms: int) -> bool:
-    """Poll the auth endpoint until the session is authenticated (or time out).
-
-    The dashboard is a client-side SPA, so its URL is NOT a reliable signal — it
-    matches the moment we navigate, before login. ``/auth-gateway/user`` returns
-    401 until logged in, then 200.
-    """
-    for _ in range(max(1, timeout_ms // LOGIN_POLL_MS)):
-        if _is_authenticated(ctx, base_url):
-            return True
-        page.wait_for_timeout(LOGIN_POLL_MS)
-    return False
-
-
-def _is_authenticated(ctx: Any, base_url: str) -> bool:
-    try:
-        return bool(ctx.request.get(f"{base_url}{endpoints.AUTH_USER}").ok)
-    except Exception:
-        return False
-
-
-def _launch_browser(pw: Any, *, headless: bool) -> Any:
-    """Launch the user's system Chrome if available, else bundled Chromium."""
-    for kwargs in ({"channel": "chrome"}, {}):
-        try:
-            return pw.chromium.launch(headless=headless, **kwargs)
-        except Exception:
-            continue
-    raise LoginError(
-        "Couldn't launch a browser. Install Chromium once with:\n"
-        "  uvx --from playwright playwright install chromium"
-    )
-
-
-def _default_loader(browser: str) -> Callable[[], Iterable[_RawCookie]]:
-    """Return a callable that reads avios.com cookies from ``browser``."""
-    try:
-        import browser_cookie3 as bc3
-    except ImportError as exc:
-        raise LoginError(
-            "browser-cookie3 isn't installed. Run with the 'login' extra:\n"
-            "  uvx --from 'avios-cli[login]' avios login --from-browser"
-        ) from exc
-    fn = getattr(bc3, browser, None)
-    if fn is None:
-        raise LoginError(
-            f"Unknown browser '{browser}'. Choose from: {', '.join(SUPPORTED_BROWSERS)}"
-        )
-    return lambda: fn(domain_name="avios.com")
-
-
-def import_from_browser(
-    session: Session | None = None,
-    browser: str = "chrome",
-    *,
-    loader: Callable[[], Iterable[_RawCookie]] | None = None,
-) -> int:
-    """Import the avios.com session cookie from a running browser.
-
-    Returns the number of avios.com cookies imported.
-    """
-    session = session or Session()
-    load = loader or _default_loader(browser)
-    cookies = _only_avios(_to_cookie_dicts(load()))
-    if not cookies:
-        raise LoginError(
-            f"No avios.com cookies found in {browser}. Log into avios.com there first."
-        )
-    session.save_cookies(cookies)
-    return len(cookies)