comixto 0.3.0__tar.gz → 0.3.1__tar.gz

{comixto-0.3.0 → comixto-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: comixto
-Version: 0.3.0
+Version: 0.3.1
 Summary: Pure-Python comix.to client: request signing, x-enc decrypt, WAF solver
 Author-email: fratboys <fratboys@users.noreply.github.com>
 License: MIT
@@ -36,7 +36,7 @@ Pure-Python toolkit for [comix.to](https://comix.to) by [@fratboys](https://gith
 
 - **Request signing** — `1k4.*` tokens, no browser required  
 - **Response decrypt** — `x-enc: 1|2` chapter lists and protected payloads  
-- **WAF rotation captcha** — NCC-based angle solver  
+- **WAF helpers** — Cloudflare Turnstile + legacy rotation captcha  
 
 **Docs:** [Reverse engineering](docs/REVERSE_ENGINEERING.md) · [Crypto](docs/crypto.md) · [WAF](docs/waf.md)
 
@@ -79,11 +79,19 @@ params = c.sign("/manga/zgk6j/chapters", {
 
 ## WAF
 
+Current site uses **Cloudflare Turnstile** (not the old rotation image).
+Most API calls work without solving it.
+
 ```python
 from comixto import solve_waf
 
-r = solve_waf(source="/")
-assert r["success"]
+# Detect / explain (success=False until you pass a token or captcha API key)
+r = solve_waf(source="/", verbose=True)
+print(r["kind"], r.get("error") or r.get("sitekey"))
+
+# Or verify a token from a browser / 2captcha / Capsolver
+# r = solve_waf(token="...")
+# r = solve_waf(provider="2captcha", api_key="...")
 ```
 
 ## License

{comixto-0.3.0 → comixto-0.3.1}/README.md

@@ -4,7 +4,7 @@ Pure-Python toolkit for [comix.to](https://comix.to) by [@fratboys](https://gith
 
 - **Request signing** — `1k4.*` tokens, no browser required  
 - **Response decrypt** — `x-enc: 1|2` chapter lists and protected payloads  
-- **WAF rotation captcha** — NCC-based angle solver  
+- **WAF helpers** — Cloudflare Turnstile + legacy rotation captcha  
 
 **Docs:** [Reverse engineering](docs/REVERSE_ENGINEERING.md) · [Crypto](docs/crypto.md) · [WAF](docs/waf.md)
 
@@ -47,11 +47,19 @@ params = c.sign("/manga/zgk6j/chapters", {
 
 ## WAF
 
+Current site uses **Cloudflare Turnstile** (not the old rotation image).
+Most API calls work without solving it.
+
 ```python
 from comixto import solve_waf
 
-r = solve_waf(source="/")
-assert r["success"]
+# Detect / explain (success=False until you pass a token or captcha API key)
+r = solve_waf(source="/", verbose=True)
+print(r["kind"], r.get("error") or r.get("sitekey"))
+
+# Or verify a token from a browser / 2captcha / Capsolver
+# r = solve_waf(token="...")
+# r = solve_waf(provider="2captcha", api_key="...")
 ```
 
 ## License

comixto-0.3.1/comixto/__init__.py

@@ -0,0 +1,44 @@
+"""comixto — pure-Python client for comix.to.
+
+Features
+--------
+* Request signing (``1k4.*`` tokens) without a browser
+* ``x-enc`` response decryption for chapter lists and protected payloads
+* WAF helpers for Cloudflare Turnstile and legacy rotation captchas
+
+Example
+-------
+>>> from comixto import Client
+>>> with Client() as c:
+...     data = c.chapters("zgk6j", limit=3)
+...     print(data["items"][0]["number"])
+"""
+
+from .client import Client
+from .crypto import (
+    Crypto,
+    CryptoSession,
+    b64url_decode,
+    b64url_encode,
+    canonical_message,
+)
+from .exceptions import APIError, ComixError, CryptoError, WAFError
+from .waf import ComixSolver, solve as solve_waf
+
+__all__ = [
+    "Client",
+    "Crypto",
+    "CryptoSession",
+    "ComixSolver",
+    "canonical_message",
+    "b64url_encode",
+    "b64url_decode",
+    "solve_waf",
+    "ComixError",
+    "CryptoError",
+    "WAFError",
+    "APIError",
+]
+
+__version__ = "0.3.1"
+__author__ = "fratboys"

comixto-0.3.1/comixto/_rotation.py

@@ -0,0 +1,208 @@
+"""Legacy rotation-captcha geometry helpers for comixto.waf."""
+
+from __future__ import annotations
+
+import base64
+import io
+from typing import Any
+
+import numpy as np
+import orjson
+import requests
+from PIL import Image
+
+
+def decode_image(b64: str) -> Image.Image:
+    """Decode a data-URL or raw base64 string into an RGBA PIL image."""
+    if "," in b64:
+        b64 = b64.split(",", 1)[1]
+    return Image.open(io.BytesIO(base64.b64decode(b64))).convert("RGBA")
+
+
+def score(
+    thumb: Image.Image,
+    gray: np.ndarray,
+    mask0: np.ndarray,
+    angle: float,
+    resample: int,
+    min_pix: int,
+) -> float:
+    """Zero-mean NCC of rotated thumb against the main crop under alpha mask."""
+    rot = thumb.rotate(-angle, resample=resample, expand=False, fillcolor=(0, 0, 0, 0))
+    ra = np.asarray(rot, dtype=np.float32)
+    tg = ra[:, :, 0] * 0.299 + ra[:, :, 1] * 0.587 + ra[:, :, 2] * 0.114
+    ta = ra[:, :, 3]
+    mask = mask0 & (ta > 114.75)
+
+    if int(mask.sum()) < min_pix:
+        return -1.0
+
+    a = gray[mask]
+    a = a - a.mean()
+    b = (tg * (ta / 255.0))[mask]
+    b = b - b.mean()
+    denom = float(np.sqrt((a * a).sum() * (b * b).sum())) + 1e-12
+    return float((a * b).sum() / denom)
+
+
+def find_angle(main: Image.Image, thumb: Image.Image) -> tuple[float, float]:
+    """Recover CSS-clockwise rotation of ``thumb`` vs center of ``main``.
+
+    Returns
+    -------
+    tuple[float, float]
+        ``(angle_degrees, ncc_score)``.
+    """
+    mw, mh = main.size
+    tw, th = thumb.size
+
+    sm = main.resize((max(1, mw // 2), max(1, mh // 2)), Image.BILINEAR)
+    st = thumb.resize((max(1, tw // 2), max(1, th // 2)), Image.BILINEAR)
+
+    sma = np.asarray(sm, dtype=np.float32)
+    sth, stw = st.size[1], st.size[0]
+    sy0 = (sma.shape[0] - sth) // 2
+    sx0 = (sma.shape[1] - stw) // 2
+    sc = sma[sy0 : sy0 + sth, sx0 : sx0 + stw]
+
+    smg = (
+        (sc[:, :, 0] * 0.299 + sc[:, :, 1] * 0.587 + sc[:, :, 2] * 0.114)
+        * (sc[:, :, 3] / 255.0)
+    )
+    smask = sc[:, :, 3] > 114.75
+
+    best = -1.0
+    ba = 0
+
+    for a in range(0, 360, 5):
+        s = score(st, smg, smask, float(a), Image.NEAREST, 40)
+        if s > best:
+            best = s
+            ba = a
+
+    ma = np.asarray(main, dtype=np.float32)
+    y0 = (ma.shape[0] - th) // 2
+    x0 = (ma.shape[1] - tw) // 2
+    center = ma[y0 : y0 + th, x0 : x0 + tw]
+
+    mg = (
+        (center[:, :, 0] * 0.299 + center[:, :, 1] * 0.587 + center[:, :, 2] * 0.114)
+        * (center[:, :, 3] / 255.0)
+    )
+    mask0 = center[:, :, 3] > 114.75
+
+    best2 = -1.0
+    ba2 = float(ba)
+
+    for a in range(ba - 7, ba + 8):
+        for f in (0.0, 0.5):
+            ang = (a + f) % 360.0
+            s = score(thumb, mg, mask0, ang, Image.BILINEAR, 80)
+            if s > best2:
+                best2 = s
+                ba2 = ang
+
+    return ba2, best2
+
+
+def solve_rotation_loop(
+    session: requests.Session,
+    base: str,
+    source: str,
+    timeout: float,
+    max_attempts: int,
+    log,
+) -> dict[str, Any]:
+    """Run the legacy ``/@waf/generate`` + angle verify loop."""
+    import time
+
+    out: dict[str, Any] = {
+        "success": False,
+        "kind": "rotation",
+        "angle": None,
+        "captcha_id": None,
+        "score": None,
+        "attempts": 0,
+        "verify": None,
+        "response": None,
+        "cookies": {},
+        "session": session,
+        "source": source,
+        "error": None,
+    }
+
+    try:
+        session.get(
+            f"{base}/@waf/challenge",
+            params={"return": source},
+            timeout=timeout,
+        )
+    except Exception as exc:
+        out["error"] = f"challenge warm failed: {exc}"
+        return out
+
+    last_err = None
+
+    for attempt in range(1, max_attempts + 1):
+        out["attempts"] = attempt
+        gr = session.get(
+            f"{base}/@waf/generate",
+            headers={"Accept": "application/json", "X-Requested-With": "XMLHttpRequest"},
+            timeout=timeout,
+        )
+
+        if gr.status_code != 200:
+            last_err = f"generate status={gr.status_code} body={gr.text[:120]!r}"
+            log(last_err)
+            time.sleep(0.25)
+            continue
+
+        try:
+            data = orjson.loads(gr.content)
+        except Exception:
+            last_err = f"generate non-json status={gr.status_code}"
+            log(last_err)
+            time.sleep(0.25)
+            continue
+
+        cid = data.get("captcha_id")
+        if not cid or "image_base64" not in data or "thumb_base64" not in data:
+            last_err = f"generate missing fields: {list(data)[:8]}"
+            log(last_err)
+            time.sleep(0.25)
+            continue
+
+        main = decode_image(data["image_base64"])
+        thumb = decode_image(data["thumb_base64"])
+        angle, sc = find_angle(main, thumb)
+        out["angle"] = angle
+        out["score"] = sc
+        out["captcha_id"] = cid
+        log(f"angle={angle:.2f} score={sc:.4f}")
+
+        vr = session.post(
+            f"{base}/@waf/verify",
+            data=orjson.dumps({"captcha_id": cid, "angle": int(round(angle))}),
+            headers={"Content-Type": "application/json"},
+            timeout=timeout,
+        )
+        try:
+            body = orjson.loads(vr.content)
+        except Exception:
+            body = {"success": False, "raw": vr.text[:200]}
+        out["verify"] = body
+
+        if body.get("success"):
+            out["success"] = True
+            out["cookies"] = dict(session.cookies)
+            try:
+                out["response"] = session.get(f"{base}{source}", timeout=timeout)
+            except Exception:
+                pass
+            return out
+
+        time.sleep(0.2)
+
+    out["cookies"] = dict(session.cookies)
+    out["error"] = last_err or "rotation captcha exhausted attempts"
+    return out

comixto-0.3.1/comixto/exceptions.py

@@ -0,0 +1,35 @@
+"""Package-level exceptions for comixto."""
+
+
+class ComixError(Exception):
+    """Base exception for all comixto errors."""
+
+
+class CryptoError(ComixError):
+    """Raised when request signing or x-enc decryption fails."""
+
+
+class WAFError(ComixError):
+    """Raised when a WAF / captcha solve cannot complete.
+
+    Soft failures (e.g. Turnstile without a token) return a result dict with
+    ``success=False`` instead of raising. Hard configuration errors (unknown
+    captcha provider, solver API rejection) raise this class.
+    """
+
+
+class APIError(ComixError):
+    """Raised for non-success HTTP responses from the comix.to API.
+
+    Attributes
+    ----------
+    status_code:
+        HTTP status code from the response.
+    body:
+        Parsed JSON body when available, otherwise raw text.
+    """
+
+    def __init__(self, status_code: int, body: object) -> None:
+        self.status_code = status_code
+        self.body = body
+        super().__init__(f"{status_code}: {body}")

comixto-0.3.1/comixto/waf.py

@@ -0,0 +1,416 @@
+"""WAF challenge solver for comix.to.
+
+The site has used two challenge styles:
+
+1. **Legacy rotation captcha** (``/@waf/generate`` + angle POST) — may return
+   HTTP 500 ``captcha generation failed`` on current builds.
+2. **Cloudflare Turnstile** (current default) — challenge page at
+   ``/@waf/challenge`` with sitekey, verify via
+   ``POST /@waf/verify`` body ``{"cf_turnstile_token": "..."}``.
+
+Pure Python cannot complete Turnstile by itself (Cloudflare scores the browser).
+This module detects the active challenge, solves rotation when available,
+accepts external Turnstile tokens, and integrates 2captcha / Capsolver.
+
+Most ``/api/v1`` routes work **without** solving WAF.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import time
+from typing import Any, Optional
+
+import orjson
+import requests
+from PIL import Image
+
+from . import _rotation
+from .exceptions import WAFError
+
+DEFAULT_TURNSTILE_SITEKEY = "0x4AAAAAAB_OAw9NJC7858li"
+
+_SITEKEY_RE = re.compile(
+    r"""sitekey["']?\s*[:=]\s*["']([0-9A-Za-z_-]+)["']""",
+    re.IGNORECASE,
+)
+
+
+class ComixSolver:
+    """High-level WAF solver for rotation and Turnstile challenges.
+
+    Parameters
+    ----------
+    base:
+        Origin of the site, e.g. ``https://comix.to``.
+    verbose:
+        Print progress lines to stdout when true.
+    timeout:
+        Per-request HTTP timeout in seconds.
+    sitekey:
+        Override Turnstile sitekey. When ``None``, scraped from the challenge
+        page or :data:`DEFAULT_TURNSTILE_SITEKEY`.
+    """
+
+    __slots__ = ("base", "verbose", "timeout", "session", "sitekey")
+
+    def __init__(
+        self,
+        base: str = "https://comix.to",
+        *,
+        verbose: bool = True,
+        timeout: float = 15.0,
+        sitekey: Optional[str] = None,
+    ) -> None:
+        self.base = base.rstrip("/")
+        self.verbose = verbose
+        self.timeout = timeout
+        self.sitekey = sitekey
+        self.session = requests.Session()
+        self.session.headers.update(
+            {
+                "User-Agent": (
+                    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
+                    "AppleWebKit/537.36 (KHTML, like Gecko) "
+                    "Chrome/120.0.0.0 Safari/537.36"
+                ),
+                "Accept": "application/json, text/html, */*",
+                "Accept-Language": "en-US,en;q=0.9",
+                "Origin": self.base,
+                "Referer": f"{self.base}/",
+            }
+        )
+
+    def _log(self, msg: str) -> None:
+        """Emit a debug line when verbose mode is enabled."""
+        if self.verbose:
+            print(msg)
+
+    def fetch_challenge_page(self, source: str = "/") -> str:
+        """GET ``/@waf/challenge`` and return HTML text."""
+        response = self.session.get(
+            f"{self.base}/@waf/challenge",
+            params={"return": source},
+            timeout=self.timeout,
+        )
+        response.raise_for_status()
+        return response.text
+
+    def detect_kind(self, html: Optional[str] = None, source: str = "/") -> str:
+        """Classify the active WAF challenge.
+
+        Returns ``"turnstile"``, ``"rotation"``, or ``"unknown"``.
+        """
+        if html is None:
+            html = self.fetch_challenge_page(source)
+
+        lower = html.lower()
+        if "turnstile" in lower or "cf_turnstile" in lower or "challenges.cloudflare.com" in lower:
+            return "turnstile"
+
+        try:
+            probe = self.session.get(
+                f"{self.base}/@waf/generate",
+                headers={"Accept": "application/json", "X-Requested-With": "XMLHttpRequest"},
+                timeout=self.timeout,
+            )
+            if probe.status_code == 200:
+                data = orjson.loads(probe.content)
+                if isinstance(data, dict) and (
+                    "image_base64" in data or "thumb_base64" in data
+                ):
+                    return "rotation"
+        except Exception:
+            pass
+
+        return "unknown"
+
+    def extract_sitekey(self, html: Optional[str] = None, source: str = "/") -> str:
+        """Parse the Turnstile sitekey from challenge HTML."""
+        if self.sitekey:
+            return self.sitekey
+        if html is None:
+            html = self.fetch_challenge_page(source)
+        match = _SITEKEY_RE.search(html)
+        if match:
+            return match.group(1)
+        return DEFAULT_TURNSTILE_SITEKEY
+
+    def verify_turnstile(self, token: str) -> dict[str, Any]:
+        """POST a Turnstile token to ``/@waf/verify``."""
+        response = self.session.post(
+            f"{self.base}/@waf/verify",
+            data=orjson.dumps({"cf_turnstile_token": token}),
+            headers={"Content-Type": "application/json", "Accept": "application/json"},
+            timeout=self.timeout,
+        )
+        try:
+            return orjson.loads(response.content)
+        except Exception:
+            return {
+                "success": False,
+                "status_code": response.status_code,
+                "body": response.text[:500],
+            }
+
+    def solve_with_token(self, token: str, source: str = "/") -> dict[str, Any]:
+        """Verify an externally obtained Turnstile token."""
+        try:
+            self.fetch_challenge_page(source)
+        except Exception as exc:
+            self._log(f"challenge page warm failed: {exc}")
+
+        body = self.verify_turnstile(token)
+        success = bool(body.get("success"))
+        return {
+            "success": success,
+            "kind": "turnstile",
+            "token": token[:32] + "…" if len(token) > 32 else token,
+            "angle": None,
+            "captcha_id": None,
+            "score": None,
+            "attempts": 1,
+            "verify": body,
+            "response": None,
+            "cookies": dict(self.session.cookies),
+            "session": self.session,
+            "source": source,
+            "sitekey": self.extract_sitekey(source=source),
+        }
+
+    def solve_with_provider(
+        self,
+        *,
+        provider: str,
+        api_key: str,
+        source: str = "/",
+        poll_interval: float = 3.0,
+        max_wait: float = 120.0,
+    ) -> dict[str, Any]:
+        """Solve Turnstile via 2captcha or Capsolver."""
+        sitekey = self.extract_sitekey(source=source)
+        page_url = f"{self.base}/@waf/challenge?return={source}"
+        name = provider.strip().lower()
+
+        if name in ("2captcha", "twocaptcha"):
+            token = self._solve_2captcha(api_key, sitekey, page_url, poll_interval, max_wait)
+        elif name == "capsolver":
+            token = self._solve_capsolver(api_key, sitekey, page_url, poll_interval, max_wait)
+        else:
+            raise WAFError(f"unsupported captcha provider: {provider!r}")
+
+        return self.solve_with_token(token, source=source)
+
+    def _solve_2captcha(
+        self,
+        api_key: str,
+        sitekey: str,
+        page_url: str,
+        poll_interval: float,
+        max_wait: float,
+    ) -> str:
+        """Create and poll a 2captcha Turnstile task."""
+        create = self.session.post(
+            "https://2captcha.com/in.php",
+            data={
+                "key": api_key,
+                "method": "turnstile",
+                "sitekey": sitekey,
+                "pageurl": page_url,
+                "json": 1,
+            },
+            timeout=self.timeout,
+        )
+        payload = orjson.loads(create.content)
+        if payload.get("status") != 1:
+            raise WAFError(f"2captcha create failed: {payload}")
+
+        task_id = payload["request"]
+        self._log(f"2captcha task {task_id}")
+        deadline = time.time() + max_wait
+
+        while time.time() < deadline:
+            time.sleep(poll_interval)
+            poll = self.session.get(
+                "https://2captcha.com/res.php",
+                params={"key": api_key, "action": "get", "id": task_id, "json": 1},
+                timeout=self.timeout,
+            )
+            body = orjson.loads(poll.content)
+            if body.get("status") == 1:
+                return str(body["request"])
+            if body.get("request") != "CAPCHA_NOT_READY":
+                raise WAFError(f"2captcha poll failed: {body}")
+
+        raise WAFError("2captcha timed out waiting for Turnstile token")
+
+    def _solve_capsolver(
+        self,
+        api_key: str,
+        sitekey: str,
+        page_url: str,
+        poll_interval: float,
+        max_wait: float,
+    ) -> str:
+        """Create and poll a Capsolver Turnstile task."""
+        create = self.session.post(
+            "https://api.capsolver.com/createTask",
+            data=orjson.dumps(
+                {
+                    "clientKey": api_key,
+                    "task": {
+                        "type": "AntiTurnstileTaskProxyLess",
+                        "websiteURL": page_url,
+                        "websiteKey": sitekey,
+                    },
+                }
+            ),
+            headers={"Content-Type": "application/json"},
+            timeout=self.timeout,
+        )
+        payload = orjson.loads(create.content)
+        if payload.get("errorId"):
+            raise WAFError(f"capsolver create failed: {payload}")
+
+        task_id = payload.get("taskId")
+        self._log(f"capsolver task {task_id}")
+        deadline = time.time() + max_wait
+
+        while time.time() < deadline:
+            time.sleep(poll_interval)
+            poll = self.session.post(
+                "https://api.capsolver.com/getTaskResult",
+                data=orjson.dumps({"clientKey": api_key, "taskId": task_id}),
+                headers={"Content-Type": "application/json"},
+                timeout=self.timeout,
+            )
+            body = orjson.loads(poll.content)
+            if body.get("status") == "ready":
+                solution = body.get("solution") or {}
+                token = solution.get("token") or solution.get("gRecaptchaResponse")
+                if not token:
+                    raise WAFError(f"capsolver ready without token: {body}")
+                return str(token)
+            if body.get("errorId"):
+                raise WAFError(f"capsolver poll failed: {body}")
+
+        raise WAFError("capsolver timed out waiting for Turnstile token")
+
+    def find_angle(self, main: Image.Image, thumb: Image.Image) -> tuple[float, float]:
+        """Recover CSS-clockwise rotation of ``thumb`` vs center of ``main``."""
+        return _rotation.find_angle(main, thumb)
+
+    def solve_rotation(self, source: str = "/", max_attempts: int = 12) -> dict[str, Any]:
+        """Attempt the legacy image-rotation challenge."""
+        return _rotation.solve_rotation_loop(
+            self.session,
+            self.base,
+            source,
+            self.timeout,
+            max_attempts,
+            self._log,
+        )
+
+    def solve(
+        self,
+        source: str = "/",
+        *,
+        max_attempts: int = 12,
+        token: Optional[str] = None,
+        provider: Optional[str] = None,
+        api_key: Optional[str] = None,
+    ) -> dict[str, Any]:
+        """Solve the active WAF challenge.
+
+        Resolution order: explicit ``token`` → captcha ``provider`` → detect
+        kind → rotation or Turnstile guidance.
+        """
+        if token:
+            return self.solve_with_token(token, source=source)
+
+        key = api_key or os.environ.get("COMIXTO_CAPTCHA_KEY") or os.environ.get("CAPTCHA_API_KEY")
+        prov = provider or os.environ.get("COMIXTO_CAPTCHA_PROVIDER") or "2captcha"
+
+        if key:
+            try:
+                return self.solve_with_provider(provider=prov, api_key=key, source=source)
+            except WAFError as exc:
+                self._log(f"provider solve failed: {exc}")
+
+        try:
+            html = self.fetch_challenge_page(source)
+        except Exception as exc:
+            return {
+                "success": False,
+                "kind": "unknown",
+                "error": f"cannot load challenge page: {exc}",
+                "angle": None,
+                "captcha_id": None,
+                "score": None,
+                "attempts": 0,
+                "verify": None,
+                "response": None,
+                "cookies": dict(self.session.cookies),
+                "session": self.session,
+                "source": source,
+            }
+
+        kind = self.detect_kind(html=html, source=source)
+        self._log(f"detected WAF kind={kind}")
+
+        if kind == "rotation":
+            return self.solve_rotation(source=source, max_attempts=max_attempts)
+
+        if kind == "turnstile":
+            sitekey = self.extract_sitekey(html=html, source=source)
+            return {
+                "success": False,
+                "kind": "turnstile",
+                "sitekey": sitekey,
+                "error": (
+                    "Site uses Cloudflare Turnstile. Pass token= from a browser/solver, "
+                    "or set COMIXTO_CAPTCHA_KEY + provider (2captcha/capsolver). "
+                    "Most /api/v1 routes work without solving WAF."
+                ),
+                "angle": None,
+                "captcha_id": None,
+                "score": None,
+                "attempts": 0,
+                "verify": None,
+                "response": None,
+                "cookies": dict(self.session.cookies),
+                "session": self.session,
+                "source": source,
+                "challenge_url": f"{self.base}/@waf/challenge?return={source}",
+            }
+
+        rot = self.solve_rotation(source=source, max_attempts=max_attempts)
+        if rot["success"]:
+            return rot
+        rot["kind"] = "unknown"
+        rot["error"] = (
+            rot.get("error")
+            or "Unknown WAF challenge; rotation generate failed and no Turnstile token supplied"
+        )
+        return rot
+
+
+def solve(
+    source: str = "/",
+    *,
+    base: str = "https://comix.to",
+    verbose: bool = True,
+    max_attempts: int = 12,
+    token: Optional[str] = None,
+    provider: Optional[str] = None,
+    api_key: Optional[str] = None,
+) -> dict[str, Any]:
+    """Convenience wrapper around :meth:`ComixSolver.solve`."""
+    return ComixSolver(base=base, verbose=verbose).solve(
+        source=source,
+        max_attempts=max_attempts,
+        token=token,
+        provider=provider,
+        api_key=api_key,
+    )

{comixto-0.3.0 → comixto-0.3.1}/comixto.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: comixto
-Version: 0.3.0
+Version: 0.3.1
 Summary: Pure-Python comix.to client: request signing, x-enc decrypt, WAF solver
 Author-email: fratboys <fratboys@users.noreply.github.com>
 License: MIT
@@ -36,7 +36,7 @@ Pure-Python toolkit for [comix.to](https://comix.to) by [@fratboys](https://gith
 
 - **Request signing** — `1k4.*` tokens, no browser required  
 - **Response decrypt** — `x-enc: 1|2` chapter lists and protected payloads  
-- **WAF rotation captcha** — NCC-based angle solver  
+- **WAF helpers** — Cloudflare Turnstile + legacy rotation captcha  
 
 **Docs:** [Reverse engineering](docs/REVERSE_ENGINEERING.md) · [Crypto](docs/crypto.md) · [WAF](docs/waf.md)
 
@@ -79,11 +79,19 @@ params = c.sign("/manga/zgk6j/chapters", {
 
 ## WAF
 
+Current site uses **Cloudflare Turnstile** (not the old rotation image).
+Most API calls work without solving it.
+
 ```python
 from comixto import solve_waf
 
-r = solve_waf(source="/")
-assert r["success"]
+# Detect / explain (success=False until you pass a token or captcha API key)
+r = solve_waf(source="/", verbose=True)
+print(r["kind"], r.get("error") or r.get("sitekey"))
+
+# Or verify a token from a browser / 2captcha / Capsolver
+# r = solve_waf(token="...")
+# r = solve_waf(provider="2captcha", api_key="...")
 ```
 
 ## License

{comixto-0.3.0 → comixto-0.3.1}/comixto.egg-info/SOURCES.txt

@@ -2,6 +2,7 @@ LICENSE
 README.md
 pyproject.toml
 comixto/__init__.py
+comixto/_rotation.py
 comixto/client.py
 comixto/crypto.py
 comixto/exceptions.py

{comixto-0.3.0 → comixto-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "comixto"
-version = "0.3.0"
+version = "0.3.1"
 description = "Pure-Python comix.to client: request signing, x-enc decrypt, WAF solver"
 readme = "README.md"
 requires-python = ">=3.10"

{comixto-0.3.0 → comixto-0.3.1}/tests/test_smoke.py

@@ -1,4 +1,4 @@
-"""Unit + integration tests."""
+"""Unit + integration tests for comixto."""
 
 from __future__ import annotations
 
@@ -8,27 +8,30 @@ import pytest
 from PIL import Image
 
 from comixto import (
+    APIError,
     Client,
-    Crypto,
     ComixSolver,
-    canonical_message,
-    b64url_encode,
+    Crypto,
     b64url_decode,
-    CryptoError,
-    APIError,
+    b64url_encode,
+    canonical_message,
+    solve_waf,
 )
 
 
 def test_imports() -> None:
+    """Package exports the public surface area."""
     import comixto
 
     assert hasattr(comixto, "Client")
     assert hasattr(comixto, "Crypto")
+    assert hasattr(comixto, "solve_waf")
     assert comixto.__version__
     assert comixto.__author__ == "fratboys"
 
 
 def test_canonical_message() -> None:
+    """Query keys are sorted; brackets stay literal."""
     assert canonical_message("/manga/x") == "/manga/x"
     assert (
         canonical_message("/manga/x", {"page": 1, "limit": 2})
@@ -37,11 +40,13 @@ def test_canonical_message() -> None:
 
 
 def test_b64url_roundtrip() -> None:
+    """URL-safe base64 encode/decode is reversible."""
     raw = b"hello\x00world"
     assert b64url_decode(b64url_encode(raw)) == raw
 
 
 def test_crypto_sign_known() -> None:
+    """Pure-Python MAC matches a known live token."""
     c = Crypto()
     token = c.encrypt_message(
         "/manga/zgk6j/chapters?limit=20&order[number]=desc&page=1&v=0&w=0"
@@ -50,6 +55,7 @@ def test_crypto_sign_known() -> None:
 
 
 def test_crypto_sign_params() -> None:
+    """``Crypto.sign`` injects ``_`` from canonical params."""
     c = Crypto()
     params = c.sign(
         "/manga/zgk6j/chapters",
@@ -59,20 +65,23 @@ def test_crypto_sign_params() -> None:
 
 
 def test_client_unsigned_warning() -> None:
+    """Public routes still work when crypto is enabled."""
     with Client(crypto=True) as client:
-        with warnings.catch_warnings(record=True) as w:
+        with warnings.catch_warnings(record=True):
             warnings.simplefilter("always")
             data = client.comments(limit=1)
             assert data is not None
 
 
 def test_client_context() -> None:
+    """Context manager closes the session."""
     with Client(crypto=False) as client:
         assert client.session is not None
 
 
 @pytest.mark.integration
 def test_public_comments() -> None:
+    """Live public endpoint responds without a signature."""
     with Client(crypto=False, timeout=15) as client:
         data = client.comments(limit=2)
         assert data is not None
@@ -80,6 +89,7 @@ def test_public_comments() -> None:
 
 @pytest.mark.integration
 def test_signed_chapters_decrypt() -> None:
+    """Live chapters endpoint signs and decrypts x-enc payloads."""
     with Client(crypto=True, timeout=20) as client:
         data = client.chapters("zgk6j", page=1, limit=3, v=0, w=0)
         assert data is not None
@@ -90,12 +100,14 @@ def test_signed_chapters_decrypt() -> None:
 
 @pytest.mark.integration
 def test_manga_detail() -> None:
+    """Live manga detail resolves."""
     with Client(crypto=True, timeout=20) as client:
         data = client.manga("zgk6j")
         assert data is not None
 
 
 def test_waf_score_synthetic() -> None:
+    """NCC angle finder recovers a known synthetic rotation."""
     size = 80
     base = Image.new("RGBA", (size, size), (0, 0, 0, 0))
     cx = cy = size // 2
@@ -127,6 +139,34 @@ def test_waf_score_synthetic() -> None:
     assert score > 0.8
 
 
+@pytest.mark.integration
+def test_waf_detect_turnstile() -> None:
+    """Live challenge page is Cloudflare Turnstile, not broken rotation."""
+    solver = ComixSolver(verbose=False)
+    html = solver.fetch_challenge_page("/")
+    kind = solver.detect_kind(html=html)
+    assert kind == "turnstile"
+    sitekey = solver.extract_sitekey(html=html)
+    assert sitekey.startswith("0x")
+
+
+@pytest.mark.integration
+def test_waf_solve_without_token_is_graceful() -> None:
+    """solve() must not raise when Turnstile needs an external token."""
+    result = solve_waf(source="/", verbose=False, max_attempts=2)
+    assert result["success"] is False
+    assert result.get("kind") == "turnstile"
+    assert "error" in result or result.get("sitekey")
+
+
+def test_waf_verify_bad_token() -> None:
+    """Invalid Turnstile token yields success=false, not an exception."""
+    solver = ComixSolver(verbose=False)
+    body = solver.verify_turnstile("not-a-real-token")
+    assert body.get("success") in (False, None) or "success" in body
+
+
 def test_api_error() -> None:
+    """APIError stores status and body."""
     err = APIError(403, {"msg": "forbidden"})
     assert err.status_code == 403

comixto-0.3.0/comixto/__init__.py

@@ -1,24 +0,0 @@
-"""comixto — pure-Python comix.to client: signing, x-enc decrypt, WAF solver."""
-
-from .client import Client
-from .crypto import Crypto, CryptoSession, canonical_message, b64url_encode, b64url_decode
-from .exceptions import APIError, ComixError, CryptoError, WAFError
-from .waf import ComixSolver, solve as solve_waf
-
-__all__ = [
-    "Client",
-    "Crypto",
-    "CryptoSession",
-    "ComixSolver",
-    "canonical_message",
-    "b64url_encode",
-    "b64url_decode",
-    "solve_waf",
-    "ComixError",
-    "CryptoError",
-    "WAFError",
-    "APIError",
-]
-
-__version__ = "0.3.0"
-__author__ = "fratboys"

comixto-0.3.0/comixto/exceptions.py

@@ -1,22 +0,0 @@
-"""Package-level exceptions."""
-
-
-class ComixError(Exception):
-    """Base exception for all comix errors."""
-
-
-class CryptoError(ComixError):
-    """Raised when signing or decryption fails."""
-
-
-class WAFError(ComixError):
-    """Raised when the WAF solver cannot complete."""
-
-
-class APIError(ComixError):
-    """Raised for non-success API responses."""
-
-    def __init__(self, status_code: int, body: object) -> None:
-        self.status_code = status_code
-        self.body = body
-        super().__init__(f"{status_code}: {body}")

comixto-0.3.0/comixto/waf.py

@@ -1,237 +0,0 @@
-"""WAF rotation captcha solver for comix.to."""
-
-from __future__ import annotations
-
-import base64
-import io
-import time
-from typing import Any, Optional
-
-import numpy as np
-import orjson
-import requests
-from PIL import Image
-
-from .exceptions import WAFError
-
-
-class ComixSolver:
-    """
-    Pure-Python rotation captcha solver.
-
-    Uses normalized cross-correlation on the alpha-masked inner disk
-    to recover the correct CSS clockwise rotation angle.
-    """
-
-    __slots__ = ("base", "verbose", "timeout", "session")
-
-    def __init__(
-        self,
-        base: str = "https://comix.to",
-        *,
-        verbose: bool = True,
-        timeout: float = 12.0,
-    ) -> None:
-        self.base = base.rstrip("/")
-        self.verbose = verbose
-        self.timeout = timeout
-        self.session = requests.Session()
-        self.session.headers.update(
-            {
-                "User-Agent": "Mozilla/5.0 (Linux; Android 10) AppleWebKit/537.36",
-                "Accept": "application/json, text/html, */*",
-            }
-        )
-
-    def _log(self, msg: str) -> None:
-        if self.verbose:
-            print(msg)
-
-    @staticmethod
-    def _decode(b64: str) -> Image.Image:
-        if "," in b64:
-            b64 = b64.split(",", 1)[1]
-
-        return Image.open(io.BytesIO(base64.b64decode(b64))).convert("RGBA")
-
-    def _score(
-        self,
-        thumb: Image.Image,
-        gray: np.ndarray,
-        mask0: np.ndarray,
-        angle: float,
-        resample: int,
-        min_pix: int,
-    ) -> float:
-        rot = thumb.rotate(-angle, resample=resample, expand=False, fillcolor=(0, 0, 0, 0))
-        ra = np.asarray(rot, dtype=np.float32)
-        tg = ra[:, :, 0] * 0.299 + ra[:, :, 1] * 0.587 + ra[:, :, 2] * 0.114
-        ta = ra[:, :, 3]
-        mask = mask0 & (ta > 114.75)
-
-        if int(mask.sum()) < min_pix:
-            return -1.0
-
-        a = gray[mask]
-        a = a - a.mean()
-        b = (tg * (ta / 255.0))[mask]
-        b = b - b.mean()
-        denom = float(np.sqrt((a * a).sum() * (b * b).sum())) + 1e-12
-        return float((a * b).sum() / denom)
-
-    def find_angle(self, main: Image.Image, thumb: Image.Image) -> tuple[float, float]:
-        """
-        Recover the rotation angle of ``thumb`` relative to the center of ``main``.
-
-        Returns ``(angle_degrees, ncc_score)``.
-        """
-        mw, mh = main.size
-        tw, th = thumb.size
-
-        sm = main.resize((max(1, mw // 2), max(1, mh // 2)), Image.BILINEAR)
-        st = thumb.resize((max(1, tw // 2), max(1, th // 2)), Image.BILINEAR)
-
-        sma = np.asarray(sm, dtype=np.float32)
-        sth, stw = st.size[1], st.size[0]
-        sy0 = (sma.shape[0] - sth) // 2
-        sx0 = (sma.shape[1] - stw) // 2
-        sc = sma[sy0 : sy0 + sth, sx0 : sx0 + stw]
-
-        smg = (
-            (sc[:, :, 0] * 0.299 + sc[:, :, 1] * 0.587 + sc[:, :, 2] * 0.114)
-            * (sc[:, :, 3] / 255.0)
-        )
-        smask = sc[:, :, 3] > 114.75
-
-        best = -1.0
-        ba = 0
-
-        for a in range(0, 360, 5):
-            s = self._score(st, smg, smask, float(a), Image.NEAREST, 40)
-
-            if s > best:
-                best = s
-                ba = a
-
-        ma = np.asarray(main, dtype=np.float32)
-        y0 = (ma.shape[0] - th) // 2
-        x0 = (ma.shape[1] - tw) // 2
-        center = ma[y0 : y0 + th, x0 : x0 + tw]
-
-        mg = (
-            (center[:, :, 0] * 0.299 + center[:, :, 1] * 0.587 + center[:, :, 2] * 0.114)
-            * (center[:, :, 3] / 255.0)
-        )
-        mask0 = center[:, :, 3] > 114.75
-
-        best2 = -1.0
-        ba2 = float(ba)
-
-        for a in range(ba - 7, ba + 8):
-            for f in (0.0, 0.5):
-                ang = (a + f) % 360.0
-                s = self._score(thumb, mg, mask0, ang, Image.BILINEAR, 80)
-
-                if s > best2:
-                    best2 = s
-                    ba2 = ang
-
-        return ba2, best2
-
-    def solve(
-        self,
-        source: str = "/",
-        *,
-        max_attempts: int = 12,
-        min_score: float = 0.85,
-    ) -> dict[str, Any]:
-        """
-        Solve the WAF challenge and return cookies + session.
-
-        Returns a dict with ``success`` flag; does not raise on failure.
-        """
-        out: dict[str, Any] = {
-            "success": False,
-            "angle": None,
-            "captcha_id": None,
-            "score": None,
-            "attempts": 0,
-            "verify": None,
-            "response": None,
-            "cookies": {},
-            "session": self.session,
-            "source": source,
-        }
-
-        self.session.get(
-            f"{self.base}/@waf/challenge",
-            params={"return": source},
-            timeout=self.timeout,
-        )
-
-        for attempt in range(1, max_attempts + 1):
-            out["attempts"] = attempt
-
-            gr = self.session.get(
-                f"{self.base}/@waf/generate",
-                headers={"Accept": "application/json"},
-                timeout=self.timeout,
-            )
-
-            try:
-                data = orjson.loads(gr.content)
-            except Exception:
-                self._log(f"generate non-json status={gr.status_code}")
-                time.sleep(0.3)
-                continue
-
-            cid = data.get("captcha_id")
-
-            if not cid:
-                continue
-
-            main = self._decode(data["image_base64"])
-            thumb = self._decode(data["thumb_base64"])
-            angle, score = self.find_angle(main, thumb)
-
-            out["angle"] = angle
-            out["score"] = score
-            out["captcha_id"] = cid
-            self._log(f"angle={angle:.2f} score={score:.4f}")
-
-            vr = self.session.post(
-                f"{self.base}/@waf/verify",
-                data=orjson.dumps({"captcha_id": cid, "angle": int(round(angle))}),
-                headers={"Content-Type": "application/json"},
-                timeout=self.timeout,
-            )
-            body = orjson.loads(vr.content)
-            out["verify"] = body
-
-            if body.get("success"):
-                out["success"] = True
-                out["response"] = self.session.get(
-                    f"{self.base}{source}",
-                    timeout=self.timeout,
-                )
-                out["cookies"] = dict(self.session.cookies)
-                return out
-
-            time.sleep(0.2)
-
-        out["cookies"] = dict(self.session.cookies)
-        return out
-
-
-def solve(
-    source: str = "/",
-    *,
-    base: str = "https://comix.to",
-    verbose: bool = True,
-    max_attempts: int = 12,
-) -> dict[str, Any]:
-    """Convenience wrapper around ``ComixSolver.solve``."""
-    return ComixSolver(base=base, verbose=verbose).solve(
-        source=source,
-        max_attempts=max_attempts,
-    )