warmpath 0.3.3__tar.gz → 0.3.4__tar.gz

{warmpath-0.3.3 → warmpath-0.3.4}/PKG-INFO

@@ -1,8 +1,9 @@
 Metadata-Version: 2.5
 Name: warmpath
-Version: 0.3.3
+Version: 0.3.4
 Summary: Local LinkedIn visible-connections scraper.
 Requires-Python: >=3.10
 Requires-Dist: browser-cookie3>=0.20.1
+Requires-Dist: curl-cffi>=0.16.3
 Requires-Dist: open-linkedin-api>=2.3.1
 Requires-Dist: platformdirs>=4.11.8

warmpath-0.3.4/README.md

@@ -0,0 +1,88 @@
+![Warmpath banner](warmpath.jpg)
+
+# Warmpath
+
+Find LinkedIn mutuals and warm paths using your logged-in browser session.
+
+## Usage
+
+Log in to LinkedIn in a regular browser window, then import that session. Replace `chrome` with your browser's name if needed.
+
+```sh
+# Import and check your browser session
+uvx warmpath auth import --browser chrome
+uvx warmpath auth status
+
+# Find people who can introduce you to a company
+uvx warmpath company HashiCorp
+uvx warmpath company https://www.linkedin.com/company/hashicorp/ --max-degree 2 --limit 5
+
+# List the current employers of all your direct connections
+uvx warmpath companies
+uvx warmpath companies --urls
+uvx warmpath companies --refresh-cache
+
+# Find reachable people with a skill
+uvx warmpath skill Flutter
+uvx warmpath skill Leadership --max-depth 2
+
+# Find mutual connections with a person
+uvx warmpath human https://www.linkedin.com/in/mitchellh/
+
+# Refresh cached results
+uvx warmpath human https://www.linkedin.com/in/mitchellh/ --refresh-cache
+
+# Show options for a command; also works with companies, auth, skill, and human
+uvx warmpath company --help
+```
+
+`companies` walks the complete 1st-degree connections list, looks up current
+employers, and deduplicates by company ID. It includes multiple current employers
+and keeps unlinked employer names; `--urls` prints only known LinkedIn company
+URLs. It does not infer employment from profile headlines.
+
+Connections are requested in pages of 1,000. Profiles are looked up once per
+unique connection when employer data is absent from the connection row. Company
+names and URLs come from those responses, with no separate company lookups.
+Completed lookups are cached so interrupted runs can resume, and repeating a
+completed snapshot makes no HTTP calls. Use `--refresh-cache` for updated
+connections and employment. Caches are scoped to the imported session.
+
+If LinkedIn restricts a profile or truncates its employment data, the command
+prints the known companies, reports the incomplete result on stderr, and exits
+with status 1. Cached snapshots preserve that status until refreshed.
+
+## Browser sessions
+
+Supported browsers are Chrome, Chromium, Firefox, Edge, Brave, Safari, Arc, Vivaldi, Opera, Opera GX (`opera-gx`), and LibreWolf; availability depends on your operating system. Your OS may ask for keychain/keyring access. If the cookie store is locked, close the browser and retry. Private-window sessions cannot be imported.
+
+Warmpath imports LinkedIn's `li_at` and `JSESSIONID` tokens together with its device, security, and routing cookies, and manages the saved session automatically. `company`, `companies`, `skill`, and `human` use it on subsequent runs. Failed imports preserve the previous session.
+
+`auth import` and `auth status` print only `Logged in as <name>` after confirming your session with LinkedIn. If `auth status` cannot confirm a login, it prints `Not logged in` and exits with status 1. Both commands require a connection to LinkedIn.
+
+Successful requests preserve updated cookies returned by LinkedIn. When a saved session expires or is rejected, Warmpath reads the current session from the previously imported browser and retries a read once. Healthy requests need no extra auth checks or browser access. If LinkedIn has also signed out the browser, sign in there again and retry; cookie expiry dates alone cannot indicate whether LinkedIn has revoked a session. Rate limits and server errors are reported rather than treated as empty search results.
+
+LinkedIn requests use [curl_cffi](https://curl-cffi.readthedocs.io/en/latest/impersonate/_index.html) to match the browser family's TLS and HTTP/2 behavior, rather than just changing the user-agent. Chrome, Chromium, and Edge imports use the installed browser version for the user-agent and client hints, with the closest supported transport preset. Requests are spaced at least half a second apart within a client; this does not add HTTP calls. The CLI reads the browser's cookie store without writing to it. Because the copied cookies share the browser's LinkedIn session, server-side revocation can still affect both.
+
+## Development
+
+Browser cookie import uses [browser-cookie3](https://github.com/borisbabic/browser_cookie3).
+
+To test changes in this checkout, use `uv run warmpath` instead of `uvx warmpath`,
+which runs the published package. For example:
+
+```sh
+uv run warmpath auth import --browser chrome
+uv run warmpath auth status
+```
+
+[go-task](https://taskfile.dev/) runs the repository checks. Install it with Homebrew on macOS, or follow the [installation guide](https://taskfile.dev/docs/installation) for other platforms. Then verify the tool, install the Python development dependencies, and run the checks:
+
+```sh
+# macOS
+brew install go-task
+
+task --version
+uv sync
+task check
+```

{warmpath-0.3.3 → warmpath-0.3.4}/pyproject.toml

@@ -1,10 +1,11 @@
 [project]
 name = "warmpath"
-version = "0.3.3"
+version = "0.3.4"
 description = "Local LinkedIn visible-connections scraper."
 requires-python = ">=3.10"
 dependencies = [
     "browser-cookie3>=0.20.1",
+    "curl-cffi>=0.16.3",
     "open-linkedin-api>=2.3.1",
     "platformdirs>=4.11.8",
 ]

{warmpath-0.3.3 → warmpath-0.3.4}/tests/test_auth.py

@@ -391,7 +391,7 @@ def test_invalid_stored_cookie_is_rejected(field, value, reader, auth_path):
         auth.load_cookies()
 
 
-def test_expired_session_is_reported_and_rejected_without_reimport(reader, capsys, profile_fetch):
+def test_expired_session_is_reported_when_browser_also_has_no_valid_session(reader, capsys, profile_fetch):
     session = auth.import_browser("chrome")
     next(cookie for cookie in session.cookies if cookie.name == "li_at").expires = 1
     auth.save_auth(session)
@@ -406,14 +406,73 @@ def test_expired_session_is_reported_and_rejected_without_reimport(reader, capsy
     assert output.err == ""
 
     with pytest.raises(SystemExit) as api_error:
-        cli.build_api()
+        cli.main(["company", "Acme"])
 
     assert api_error.value.code == 2
     assert "warmpath auth import --browser chrome" in capsys.readouterr().err
-    reader.assert_not_called()
+    assert reader.call_count == 2
     profile_fetch.assert_not_called()
 
 
+def test_expired_saved_session_is_replaced_by_valid_browser_session(reader, capsys):
+    from copy import deepcopy
+
+    session = auth.import_browser("chrome")
+    session.cookies = deepcopy(session.cookies)
+    next(cookie for cookie in session.cookies if cookie.name == "li_at").expires = 1
+    auth.save_auth(session)
+    reader.reset_mock()
+
+    cli.main(["auth", "status"])
+
+    assert capsys.readouterr().out == "Logged in as Ada Lovelace\n"
+    assert not auth.load_auth().missing_cookies()
+    reader.assert_called_once_with(domain_name="linkedin.com")
+
+
+def test_import_keeps_linkedin_device_security_and_routing_cookies(reader, browser_cookies):
+    for name in ("bcookie", "bscookie", "lidc", "liap", "dfpfpt", "fptctx2"):
+        browser_cookies.set(name, f"value-for-{name}", domain=".linkedin.com", secure=True)
+
+    auth.import_browser("chrome")
+
+    saved = auth.load_cookies()
+    for name in ("bcookie", "bscookie", "lidc", "liap", "dfpfpt", "fptctx2"):
+        assert saved.get(name) == f"value-for-{name}"
+
+
+def test_import_persists_browser_user_agent(reader, monkeypatch):
+    monkeypatch.setattr(auth, "browser_user_agent", lambda browser: "Browser/152.0.0.0")
+
+    auth.import_browser("chrome")
+
+    assert auth.load_auth().user_agent == "Browser/152.0.0.0"
+
+
+def test_chrome_user_agent_uses_installed_major_version(monkeypatch):
+    import plistlib
+
+    monkeypatch.setattr(auth.sys, "platform", "darwin")
+    monkeypatch.setattr(Path, "read_bytes", lambda self: plistlib.dumps({"CFBundleShortVersionString": "152.0.7977.83"}))
+
+    agent = auth.browser_user_agent("chrome")
+
+    assert agent is not None
+    assert "Chrome/152.0.0.0" in agent
+    assert "Macintosh; Intel Mac OS X 10_15_7" in agent
+
+
+@pytest.mark.parametrize("value", ["Browser\r\nInjected: private-token", "", 123, ["Browser"]])
+def test_invalid_stored_user_agent_is_rejected(value, reader, auth_path):
+    auth.import_browser("chrome")
+    payload = json.loads(auth_path.read_text())
+    payload["user_agent"] = value
+    auth_path.write_text(json.dumps(payload))
+
+    with pytest.raises(auth.AuthError, match="saved LinkedIn session is invalid"):
+        auth.load_auth()
+
+
 @pytest.mark.parametrize("arguments", [[], ["import"], ["import", "--browser", "unknown"], ["login"]])
 def test_auth_rejects_missing_and_unknown_arguments(arguments, reader):
     with pytest.raises(SystemExit) as error:

warmpath-0.3.4/tests/test_auth_http.py

@@ -0,0 +1,405 @@
+from copy import deepcopy
+from email.message import Message
+from types import SimpleNamespace
+from unittest.mock import Mock
+
+import pytest
+from requests import Response
+from requests.adapters import BaseAdapter
+from requests.exceptions import HTTPError, Timeout, TooManyRedirects
+
+from warmpath import auth, auth_http, cli
+
+
+def response(status=200, *, cookies=(), location=None):
+    result = Response()
+    result.status_code = status
+    result._content = b'{"miniProfile":{"firstName":"Ada","lastName":"Lovelace"}}'
+    result.headers["content-type"] = "application/json"
+    if location:
+        result.headers["location"] = location
+    message = Message()
+    for cookie in cookies:
+        message.add_header("Set-Cookie", cookie)
+    result.raw = Mock(_original_response=SimpleNamespace(msg=message))
+    return result
+
+
+class LinkedInAdapter(BaseAdapter):
+    def __init__(self, responses):
+        self.responses = iter(responses)
+        self.requests = []
+
+    def send(self, request, **kwargs):
+        self.requests.append(request)
+        result = next(self.responses)
+        if isinstance(result, Exception):
+            raise result
+        result.request = request
+        result.url = request.url
+        return result
+
+    def close(self):
+        pass
+
+
+@pytest.fixture
+def saved_session(tmp_path, monkeypatch):
+    from datetime import datetime, timezone
+    from requests.cookies import RequestsCookieJar
+
+    monkeypatch.setattr(auth, "auth_store_path", lambda: tmp_path / "auth.json")
+    monkeypatch.setattr(auth_http, "sleep", lambda _: None)
+    cookies = RequestsCookieJar()
+    for name, value in (
+        ("li_at", "old-auth-token"), ("JSESSIONID", '"ajax:old-csrf"'),
+        ("bcookie", "browser-device"), ("bscookie", "verified-device"),
+    ):
+        cookies.set(name, value, domain=".www.linkedin.com", path="/", secure=True)
+    session = auth.AuthSession("chrome", datetime.now(timezone.utc), cookies)
+    auth.save_auth(session)
+    return session
+
+
+@pytest.fixture
+def reader(saved_session, monkeypatch):
+    fresh = deepcopy(saved_session.cookies)
+    fresh.set("li_at", "new-auth-token", domain=".www.linkedin.com", path="/", secure=True)
+    fresh.set("JSESSIONID", '"ajax:new-csrf"', domain=".www.linkedin.com", path="/", secure=True)
+    reader = Mock(return_value=fresh)
+    monkeypatch.setattr(auth.browser_cookie3, "chrome", reader)
+    return reader
+
+
+def api_with_responses(responses):
+    api = cli.build_api()
+    adapter = LinkedInAdapter(responses)
+    api.client.session.mount("https://www.linkedin.com/", adapter)
+    return api, adapter
+
+
+def test_healthy_requests_use_device_cookies_without_auth_probe_or_browser_io(saved_session, reader):
+    before = auth.auth_store_path().read_bytes()
+    api, adapter = api_with_responses([response(), response()])
+
+    api._fetch("/example")
+    api._fetch("/example?page=2")
+
+    assert len(adapter.requests) == 2
+    assert all("bcookie=browser-device" in req.headers["Cookie"] for req in adapter.requests)
+    assert all("bscookie=verified-device" in req.headers["Cookie"] for req in adapter.requests)
+    reader.assert_not_called()
+    assert auth.auth_store_path().read_bytes() == before
+
+
+def test_imported_browser_user_agent_is_sent(saved_session, reader):
+    saved_session.user_agent = "Imported Chrome/152.0.0.0"
+    auth.save_auth(saved_session)
+    api, adapter = api_with_responses([response()])
+
+    api._fetch("/example")
+
+    assert adapter.requests[0].headers["user-agent"] == saved_session.user_agent
+
+
+def test_old_import_uses_installed_browser_user_agent(saved_session, reader, monkeypatch):
+    monkeypatch.setattr(auth, "browser_user_agent", lambda browser: "Installed Chrome/152.0.0.0")
+    api, adapter = api_with_responses([response()])
+
+    api._fetch("/example")
+
+    assert adapter.requests[0].headers["user-agent"] == "Installed Chrome/152.0.0.0"
+
+
+def test_requests_are_spaced_without_adding_http_calls(saved_session, reader, monkeypatch):
+    clock = [10.0]
+    monkeypatch.setattr(auth_http, "monotonic", lambda: clock[0])
+    monkeypatch.setattr(auth_http, "sleep", lambda seconds: clock.__setitem__(0, clock[0] + seconds))
+    api, adapter = api_with_responses([response(), response()])
+
+    api._fetch("/example")
+    api._fetch("/example?page=2")
+
+    assert clock[0] == 10.0 + auth_http.MIN_REQUEST_INTERVAL
+    assert len(adapter.requests) == 2
+
+
+def test_rejected_session_refreshes_once_and_retries_original_request(saved_session, reader):
+    api, adapter = api_with_responses([
+        response(401, cookies=["li_at=; Max-Age=0; Domain=.www.linkedin.com; Path=/; Secure"]),
+        response(), response(),
+    ])
+
+    api._fetch("/example", params={"start": 100})
+    api._fetch("/example", params={"start": 200})
+
+    assert len(adapter.requests) == 3
+    assert adapter.requests[0].url == adapter.requests[1].url
+    assert "start=100" in adapter.requests[1].url
+    assert "li_at=new-auth-token" in adapter.requests[1].headers["Cookie"]
+    assert adapter.requests[1].headers["csrf-token"] == "ajax:new-csrf"
+    reader.assert_called_once_with(domain_name="linkedin.com")
+    assert auth.load_cookies().get("li_at") == "new-auth-token"
+
+
+def test_successful_responses_persist_rotated_cookies_and_update_csrf(saved_session, reader):
+    api, adapter = api_with_responses([
+        response(cookies=[
+            "li_at=server-token; Domain=.www.linkedin.com; Path=/; Secure",
+            'JSESSIONID="ajax:server-csrf"; Domain=.www.linkedin.com; Path=/; Secure',
+        ]),
+        response(),
+    ])
+
+    api._fetch("/example")
+    assert auth.load_cookies().get("li_at") == "server-token"
+    api._fetch("/example")
+
+    assert adapter.requests[1].headers["csrf-token"] == "ajax:server-csrf"
+    assert 'JSESSIONID="ajax:server-csrf"' in adapter.requests[1].headers["Cookie"]
+    reader.assert_not_called()
+
+
+def test_long_running_client_can_recover_from_later_rotation(saved_session, reader):
+    second_rotation = deepcopy(reader.return_value)
+    second_rotation.set("li_at", "second-new-token", domain=".www.linkedin.com", path="/", secure=True)
+    reader.side_effect = [reader.return_value, second_rotation]
+    api, adapter = api_with_responses([response(401), response(), response(401), response()])
+
+    api._fetch("/example?page=1")
+    api._fetch("/example?page=2")
+
+    assert reader.call_count == 2
+    assert len(adapter.requests) == 4
+    assert "li_at=second-new-token" in adapter.requests[-1].headers["Cookie"]
+    assert auth.load_cookies().get("li_at") == "second-new-token"
+
+
+def test_rotated_csrf_cookie_at_more_specific_domain_replaces_old_header(saved_session, reader):
+    saved_session.cookies.clear(".www.linkedin.com", "/", "JSESSIONID")
+    saved_session.cookies.set("JSESSIONID", '"ajax:broad"', domain=".linkedin.com", path="/", secure=True)
+    auth.save_auth(saved_session)
+    api, adapter = api_with_responses([
+        response(cookies=['JSESSIONID="ajax:specific"; Domain=.www.linkedin.com; Path=/; Secure']),
+        response(),
+    ])
+
+    api._fetch("/example")
+    api._fetch("/example")
+
+    assert adapter.requests[1].headers["Cookie"].count("JSESSIONID=") == 1
+    assert 'JSESSIONID="ajax:specific"' in adapter.requests[1].headers["Cookie"]
+    assert adapter.requests[1].headers["csrf-token"] == "ajax:specific"
+
+
+def test_import_saves_cookies_returned_by_validation(saved_session, reader, monkeypatch, capsys):
+    adapter = LinkedInAdapter([response(cookies=[
+        "li_at=validated-token; Domain=.www.linkedin.com; Path=/; Secure",
+    ])])
+    original_build_api = cli.build_api
+
+    def build(*args, **kwargs):
+        api = original_build_api(*args, **kwargs)
+        api.client.session.mount("https://www.linkedin.com/", adapter)
+        return api
+
+    monkeypatch.setattr(cli, "build_api", build)
+    cli.main(["auth", "import", "--browser", "chrome"])
+
+    assert capsys.readouterr().out == "Logged in as Ada Lovelace\n"
+    assert auth.load_cookies().get("li_at") == "validated-token"
+    assert len(adapter.requests) == 1
+    reader.assert_called_once()
+
+
+def test_import_then_separate_status_clients_reuse_saved_rotation(saved_session, reader, monkeypatch, capsys):
+    adapters = []
+    replies = [
+        response(cookies=[
+            "li_at=validated-token; Domain=.www.linkedin.com; Path=/; Secure",
+            'JSESSIONID="ajax:validated-csrf"; Domain=.www.linkedin.com; Path=/; Secure',
+            "lidc=routing; Domain=.linkedin.com; Path=/; Secure",
+        ]),
+        response(cookies=[
+            'JSESSIONID="ajax:status-csrf"; Domain=.www.linkedin.com; Path=/; Secure',
+        ]),
+        response(),
+    ]
+    original_build_api = cli.build_api
+
+    def build(*args, **kwargs):
+        api = original_build_api(*args, **kwargs)
+        adapter = LinkedInAdapter([replies[len(adapters)]])
+        adapters.append(adapter)
+        api.client.session.mount("https://www.linkedin.com/", adapter)
+        return api
+
+    monkeypatch.setattr(cli, "build_api", build)
+    cli.main(["auth", "import", "--browser", "chrome"])
+    cli.main(["auth", "status"])
+    cli.main(["auth", "status"])
+
+    assert capsys.readouterr().out == "Logged in as Ada Lovelace\n" * 3
+    reader.assert_called_once()
+    assert len(adapters) == 3
+    for adapter, csrf in zip(adapters[1:], ("ajax:validated-csrf", "ajax:status-csrf")):
+        assert len(adapter.requests) == 1
+        request = adapter.requests[0]
+        assert "li_at=validated-token" in request.headers["Cookie"]
+        assert "bcookie=browser-device" in request.headers["Cookie"]
+        assert "bscookie=verified-device" in request.headers["Cookie"]
+        assert "lidc=routing" in request.headers["Cookie"]
+        assert request.headers["csrf-token"] == csrf
+        assert f'JSESSIONID="{csrf}"' in request.headers["Cookie"]
+
+
+@pytest.mark.parametrize("failure", [response(401), response(403), response(429), Timeout("secret")])
+def test_failed_recovery_preserves_saved_session(saved_session, reader, failure):
+    before = auth.auth_store_path().read_bytes()
+    api, adapter = api_with_responses([response(401), failure])
+
+    with pytest.raises((auth.AuthError, HTTPError, Timeout)):
+        api._fetch("/example")
+
+    assert auth.auth_store_path().read_bytes() == before
+    assert len(adapter.requests) == 2
+    reader.assert_called_once()
+
+
+def test_same_revoked_browser_cookie_is_not_retried(saved_session, reader):
+    reader.return_value = saved_session.cookies
+    api, adapter = api_with_responses([response(401)])
+
+    with pytest.raises(auth.AuthError, match="same cookies"):
+        api._fetch("/example")
+
+    assert len(adapter.requests) == 1
+
+
+@pytest.mark.parametrize("status", [429, 500, 503])
+def test_server_errors_are_not_empty_results_or_auth_retries(saved_session, reader, status):
+    api, adapter = api_with_responses([response(status)])
+
+    with pytest.raises(HTTPError):
+        api._fetch("/example")
+
+    assert len(adapter.requests) == 1
+    reader.assert_not_called()
+
+
+def test_profile_permission_error_does_not_refresh_valid_auth(saved_session, reader):
+    api, adapter = api_with_responses([response(403), response()])
+
+    with pytest.raises(HTTPError):
+        api._fetch("/identity/dash/profiles")
+
+    assert adapter.requests[1].url == "https://www.linkedin.com/voyager/api/me"
+    reader.assert_not_called()
+
+
+def test_login_redirect_is_recovered_without_following_it(saved_session, reader):
+    api, adapter = api_with_responses([response(302, location="/checkpoint/lg/login"), response()])
+
+    api._fetch("/example")
+
+    assert len(adapter.requests) == 2
+    assert adapter.requests[0].url == adapter.requests[1].url
+    reader.assert_called_once()
+
+
+def test_api_cookie_redirect_is_followed_with_new_cookie(saved_session, reader):
+    api, adapter = api_with_responses([
+        response(302, location="https://www.linkedin.com/voyager/api/example?start=100", cookies=[
+            "__cf_bm=updated; Domain=.linkedin.com; Path=/; Secure",
+        ]),
+        response(),
+    ])
+
+    api._fetch("/example", params={"start": 100})
+
+    assert len(adapter.requests) == 2
+    assert adapter.requests[0].url == adapter.requests[1].url
+    assert "__cf_bm=updated" in adapter.requests[1].headers["Cookie"]
+    reader.assert_not_called()
+
+
+def test_repeated_api_redirects_stop_without_reimport(saved_session, reader):
+    api, adapter = api_with_responses([
+        response(302, location="/voyager/api/example") for _ in range(4)
+    ])
+
+    with pytest.raises(TooManyRedirects):
+        api._fetch("/example")
+
+    assert len(adapter.requests) == 4
+    reader.assert_not_called()
+
+
+@pytest.mark.parametrize("url", ["/m/logout", "/uas/logout", "/%6Cogout"])
+def test_logout_is_never_requested(saved_session, reader, url):
+    api, adapter = api_with_responses([])
+    before = auth.auth_store_path().read_bytes()
+
+    with pytest.raises(auth.AuthError, match="logout"):
+        api.client.session.get(f"https://www.linkedin.com{url}")
+
+    assert adapter.requests == []
+    assert auth.auth_store_path().read_bytes() == before
+    reader.assert_not_called()
+
+
+def test_profile_redirect_cannot_log_out_the_shared_session(saved_session, reader):
+    api, adapter = api_with_responses([response(302, location="/m/logout")])
+    before = auth.auth_store_path().read_bytes()
+
+    with pytest.raises(auth.AuthError, match="logout"):
+        api.client.session.get("https://www.linkedin.com/in/example/")
+
+    assert len(adapter.requests) == 1
+    assert auth.auth_store_path().read_bytes() == before
+    reader.assert_not_called()
+
+
+def test_profile_login_redirect_is_recovered_without_following_login(saved_session, reader):
+    api, adapter = api_with_responses([response(302, location="/login"), response()])
+
+    api.client.session.get("https://www.linkedin.com/in/example/")
+
+    assert len(adapter.requests) == 2
+    assert adapter.requests[0].url == adapter.requests[1].url
+    reader.assert_called_once()
+
+
+def test_post_is_never_replayed(saved_session, reader):
+    api, adapter = api_with_responses([response(401)])
+
+    with pytest.raises(auth.AuthError):
+        api._post("/example", json={"value": 1})
+
+    assert len(adapter.requests) == 1
+    reader.assert_not_called()
+
+
+def test_newer_import_is_reused_instead_of_browser_read(saved_session, reader):
+    api, adapter = api_with_responses([response(401), response()])
+    newer = deepcopy(saved_session)
+    newer.cookies = reader.return_value
+    auth.save_auth(newer)
+
+    api._fetch("/example")
+
+    assert "li_at=new-auth-token" in adapter.requests[1].headers["Cookie"]
+    reader.assert_not_called()
+
+
+def test_cookie_rotation_does_not_overwrite_newer_import(saved_session, reader):
+    api, _ = api_with_responses([response(cookies=[
+        "li_at=old-session-rotated; Domain=.www.linkedin.com; Path=/; Secure",
+    ])])
+    newer = deepcopy(saved_session)
+    newer.cookies = reader.return_value
+    auth.save_auth(newer)
+
+    api._fetch("/example")
+
+    assert auth.load_cookies().get("li_at") == "new-auth-token"