378 lines
11 KiB
Go
378 lines
11 KiB
Go
package auth
|
||
|
||
import (
|
||
"fmt"
|
||
"os"
|
||
"strings"
|
||
"time"
|
||
|
||
"codex-pool/internal/proxyutil"
|
||
|
||
"github.com/go-rod/rod"
|
||
"github.com/go-rod/rod/lib/launcher"
|
||
"github.com/go-rod/rod/lib/proto"
|
||
"github.com/go-rod/stealth"
|
||
)
|
||
|
||
// RodAuth 使用 Rod + Stealth 完成 OAuth 授权
|
||
type RodAuth struct {
|
||
browser *rod.Browser
|
||
headless bool
|
||
proxy string
|
||
proxyUser string
|
||
proxyPass string
|
||
profile BrowserProfile // 随机浏览器配置
|
||
}
|
||
|
||
// getChromiumPath 获取 Chromium 路径
|
||
func getChromiumPath() string {
|
||
// 优先使用环境变量
|
||
if path := os.Getenv("CHROME_BIN"); path != "" {
|
||
if _, err := os.Stat(path); err == nil {
|
||
return path
|
||
}
|
||
}
|
||
if path := os.Getenv("CHROME_PATH"); path != "" {
|
||
if _, err := os.Stat(path); err == nil {
|
||
return path
|
||
}
|
||
}
|
||
// Alpine Linux 默认路径
|
||
paths := []string{
|
||
"/usr/bin/chromium-browser",
|
||
"/usr/bin/chromium",
|
||
"/usr/bin/google-chrome",
|
||
"/usr/bin/google-chrome-stable",
|
||
}
|
||
for _, path := range paths {
|
||
if _, err := os.Stat(path); err == nil {
|
||
return path
|
||
}
|
||
}
|
||
return "" // 让 Rod 自动下载
|
||
}
|
||
|
||
// NewRodAuth 创建 Rod 授权器
|
||
func NewRodAuth(headless bool, proxy string) (*RodAuth, error) {
|
||
// 获取随机浏览器配置
|
||
profile := GetRandomBrowserProfile()
|
||
|
||
var proxyServer string
|
||
var proxyUser string
|
||
var proxyPass string
|
||
if proxy != "" {
|
||
info, err := proxyutil.Parse(proxy)
|
||
if err != nil {
|
||
return nil, fmt.Errorf("代理格式错误: %v", err)
|
||
}
|
||
if info.URL != nil {
|
||
proxy = info.URL.String() // normalized
|
||
}
|
||
if info.Server != nil {
|
||
proxyServer = info.Server.String()
|
||
}
|
||
proxyUser = info.Username
|
||
proxyPass = info.Password
|
||
}
|
||
|
||
l := launcher.New().
|
||
Headless(headless).
|
||
Set("disable-blink-features", "AutomationControlled").
|
||
Set("disable-dev-shm-usage").
|
||
Set("no-sandbox").
|
||
Set("disable-gpu").
|
||
Set("disable-extensions").
|
||
Set("disable-background-networking").
|
||
Set("disable-sync").
|
||
Set("disable-translate").
|
||
Set("metrics-recording-only").
|
||
Set("no-first-run").
|
||
Set("disable-infobars").
|
||
Set("disable-automation").
|
||
// 使用随机语言和窗口大小
|
||
Set("lang", strings.Split(profile.AcceptLang, ",")[0]).
|
||
Set("window-size", fmt.Sprintf("%d,%d", profile.Width, profile.Height)).
|
||
// 随机 User-Agent
|
||
UserDataDir("").
|
||
Set("user-agent", profile.UserAgent)
|
||
|
||
// 使用系统 Chromium（如果存在）
|
||
if chromiumPath := getChromiumPath(); chromiumPath != "" {
|
||
l = l.Bin(chromiumPath)
|
||
}
|
||
|
||
if proxyServer != "" {
|
||
l = l.Proxy(proxyServer)
|
||
}
|
||
|
||
controlURL, err := l.Launch()
|
||
if err != nil {
|
||
return nil, fmt.Errorf("启动浏览器失败: %v", err)
|
||
}
|
||
|
||
browser := rod.New().ControlURL(controlURL)
|
||
if err := browser.Connect(); err != nil {
|
||
return nil, fmt.Errorf("连接浏览器失败: %v", err)
|
||
}
|
||
|
||
return &RodAuth{
|
||
browser: browser,
|
||
headless: headless,
|
||
proxy: proxy,
|
||
proxyUser: proxyUser,
|
||
proxyPass: proxyPass,
|
||
profile: profile,
|
||
}, nil
|
||
}
|
||
|
||
// Close 关闭浏览器
|
||
func (r *RodAuth) Close() {
|
||
if r.browser != nil {
|
||
r.browser.Close()
|
||
}
|
||
}
|
||
|
||
// CompleteOAuth 完成 OAuth 授权
|
||
func (r *RodAuth) CompleteOAuth(authURL, email, password, teamID string) (string, error) {
|
||
return r.CompleteOAuthLogged(authURL, email, password, teamID, nil)
|
||
}
|
||
|
||
// CompleteOAuthLogged 完成 OAuth 授权（带日志回调）
|
||
func (r *RodAuth) CompleteOAuthLogged(authURL, email, password, teamID string, logger *AuthLogger) (string, error) {
|
||
// 日志辅助函数
|
||
logStep := func(step AuthStep, format string, args ...interface{}) {
|
||
if logger != nil {
|
||
logger.LogStep(step, format, args...)
|
||
}
|
||
}
|
||
logError := func(step AuthStep, format string, args ...interface{}) {
|
||
if logger != nil {
|
||
logger.LogError(step, format, args...)
|
||
}
|
||
}
|
||
|
||
// Handle proxy auth (407) in headless mode.
|
||
// When Fetch domain is enabled without patterns, requests will be paused and must be continued.
|
||
// 只在代理需要认证时才启用 Fetch 域
|
||
if r.proxy != "" && r.proxyUser != "" {
|
||
authBrowser, cancel := r.browser.WithCancel()
|
||
defer cancel()
|
||
|
||
restoreFetch := authBrowser.EnableDomain("", &proto.FetchEnable{HandleAuthRequests: true})
|
||
defer restoreFetch()
|
||
|
||
wait := authBrowser.EachEvent(
|
||
func(e *proto.FetchRequestPaused) {
|
||
_ = proto.FetchContinueRequest{RequestID: e.RequestID}.Call(authBrowser)
|
||
},
|
||
func(e *proto.FetchAuthRequired) {
|
||
resp := &proto.FetchAuthChallengeResponse{
|
||
Response: proto.FetchAuthChallengeResponseResponseDefault,
|
||
}
|
||
if e.AuthChallenge != nil && e.AuthChallenge.Source == proto.FetchAuthChallengeSourceProxy {
|
||
if r.proxyUser != "" {
|
||
resp.Response = proto.FetchAuthChallengeResponseResponseProvideCredentials
|
||
resp.Username = r.proxyUser
|
||
resp.Password = r.proxyPass
|
||
} else {
|
||
// Fail fast if the proxy requires auth but user didn't provide credentials.
|
||
resp.Response = proto.FetchAuthChallengeResponseResponseCancelAuth
|
||
}
|
||
}
|
||
_ = proto.FetchContinueWithAuth{RequestID: e.RequestID, AuthChallengeResponse: resp}.Call(authBrowser)
|
||
},
|
||
)
|
||
go wait()
|
||
}
|
||
|
||
page, err := stealth.Page(r.browser)
|
||
if err != nil {
|
||
return "", fmt.Errorf("创建页面失败: %v", err)
|
||
}
|
||
defer page.Close()
|
||
|
||
// 设置随机窗口大小
|
||
_ = page.SetViewport(&proto.EmulationSetDeviceMetricsOverride{
|
||
Width: r.profile.Width,
|
||
Height: r.profile.Height,
|
||
DeviceScaleFactor: r.profile.PixelRatio,
|
||
Mobile: false,
|
||
})
|
||
|
||
// 注入额外的反检测脚本
|
||
antiDetectionJS := GetAntiDetectionJS(r.profile)
|
||
_, _ = page.Evaluate(&rod.EvalOptions{
|
||
JS: antiDetectionJS,
|
||
ByValue: true,
|
||
AwaitPromise: false,
|
||
ThisObj: nil,
|
||
})
|
||
|
||
// 设置合理的超时时间 60 秒
|
||
page = page.Timeout(60 * time.Second)
|
||
|
||
if err := page.Navigate(authURL); err != nil {
|
||
logError(StepNavigate, "访问授权页失败: %v", err)
|
||
return "", fmt.Errorf("访问授权URL失败: %v", err)
|
||
}
|
||
|
||
page.MustWaitDOMStable()
|
||
|
||
// 获取当前URL
|
||
info, _ := page.Info()
|
||
currentURL := info.URL
|
||
logStep(StepNavigate, "页面加载完成 | URL: %s", currentURL)
|
||
|
||
if code := r.checkForCode(page); code != "" {
|
||
logStep(StepComplete, "授权成功（快速通道）")
|
||
return code, nil
|
||
}
|
||
|
||
// 使用10秒超时查找邮箱输入框
|
||
emailInput, err := page.Timeout(10 * time.Second).Element("input[name='email'], input[type='email'], input[name='username'], input[id='email'], input[autocomplete='email']")
|
||
if err != nil {
|
||
info, _ := page.Info()
|
||
logError(StepInputEmail, "未找到邮箱输入框 | URL: %s", info.URL)
|
||
return "", fmt.Errorf("未找到邮箱输入框")
|
||
}
|
||
|
||
logStep(StepInputEmail, "邮箱已填写")
|
||
emailInput.MustSelectAllText().MustInput(email)
|
||
time.Sleep(200 * time.Millisecond)
|
||
|
||
// 点击提交按钮
|
||
if btn, _ := page.Timeout(2 * time.Second).Element("button[type='submit'], div._ctas_1alro_13 button, button[name='action']"); btn != nil {
|
||
btn.MustClick()
|
||
}
|
||
|
||
// 等待页面跳转（等待 URL 变化或密码框出现，最多 10 秒）
|
||
passwordSelector := "input[name='current-password'], input[autocomplete='current-password'], input[type='password'], input[name='password'], input[id='password']"
|
||
var passwordFound bool
|
||
for i := 0; i < 20; i++ {
|
||
time.Sleep(500 * time.Millisecond)
|
||
|
||
if code := r.checkForCode(page); code != "" {
|
||
logStep(StepComplete, "授权成功")
|
||
return code, nil
|
||
}
|
||
|
||
info, _ = page.Info()
|
||
// 检查是否有密码输入框（页面已跳转）
|
||
if pwdInput, _ := page.Timeout(100 * time.Millisecond).Element(passwordSelector); pwdInput != nil {
|
||
passwordFound = true
|
||
break
|
||
}
|
||
|
||
// 如果 URL 已经变化（包含 password），也跳出
|
||
if strings.Contains(info.URL, "password") {
|
||
break
|
||
}
|
||
}
|
||
|
||
// 获取当前URL用于调试
|
||
info, _ = page.Info()
|
||
logStep(StepInputPassword, "查找密码框 | URL: %s", info.URL)
|
||
|
||
// 使用10秒超时查找密码输入框（优先使用 current-password）
|
||
var passwordInput *rod.Element
|
||
if passwordFound {
|
||
passwordInput, err = page.Timeout(2 * time.Second).Element(passwordSelector)
|
||
} else {
|
||
passwordInput, err = page.Timeout(10 * time.Second).Element(passwordSelector)
|
||
}
|
||
if err != nil {
|
||
info, _ := page.Info()
|
||
logError(StepInputPassword, "未找到密码输入框 | URL: %s", info.URL)
|
||
return "", fmt.Errorf("未找到密码输入框")
|
||
}
|
||
|
||
logStep(StepInputPassword, "密码已填写")
|
||
passwordInput.MustSelectAllText().MustInput(password)
|
||
time.Sleep(200 * time.Millisecond)
|
||
|
||
logStep(StepSubmitPassword, "正在登录...")
|
||
if btn, _ := page.Timeout(2 * time.Second).Element("button[type='submit'], div._ctas_1alro_13 button, button[name='action']"); btn != nil {
|
||
btn.MustClick()
|
||
}
|
||
|
||
// 等待授权回调（最多20秒）
|
||
for i := 0; i < 40; i++ {
|
||
time.Sleep(500 * time.Millisecond)
|
||
|
||
if code := r.checkForCode(page); code != "" {
|
||
logStep(StepComplete, "授权成功")
|
||
return code, nil
|
||
}
|
||
|
||
info, _ := page.Info()
|
||
currentURL := info.URL
|
||
|
||
if strings.Contains(currentURL, "consent") {
|
||
logStep(StepConsent, "处理授权同意... | URL: %s", currentURL)
|
||
// 同意页面的确认按钮（第二个按钮）
|
||
if btn, _ := page.Timeout(500 * time.Millisecond).Element("div._ctas_1alro_13 div:nth-child(2) button, button[type='submit'], div._ctas_1alro_13 button"); btn != nil {
|
||
btn.Click(proto.InputMouseButtonLeft, 1)
|
||
}
|
||
}
|
||
|
||
if strings.Contains(currentURL, "authorize") && teamID != "" {
|
||
logStep(StepSelectWorkspace, "选择工作区...")
|
||
wsSelector := fmt.Sprintf("[data-workspace-id='%s'], [data-account-id='%s']", teamID, teamID)
|
||
if wsBtn, _ := page.Timeout(500 * time.Millisecond).Element(wsSelector); wsBtn != nil {
|
||
wsBtn.Click(proto.InputMouseButtonLeft, 1)
|
||
}
|
||
}
|
||
}
|
||
|
||
logError(StepWaitCallback, "授权超时")
|
||
return "", fmt.Errorf("授权超时")
|
||
}
|
||
|
||
// checkForCode 检查 URL 中是否包含 code
|
||
func (r *RodAuth) checkForCode(page *rod.Page) string {
|
||
info, err := page.Info()
|
||
if err != nil {
|
||
return ""
|
||
}
|
||
if strings.Contains(info.URL, "code=") {
|
||
return ExtractCodeFromCallbackURL(info.URL)
|
||
}
|
||
return ""
|
||
}
|
||
|
||
// CompleteWithRod 使用 Rod + Stealth 完成 S2A 授权
|
||
func CompleteWithRod(authURL, email, password, teamID string, headless bool, proxy string) (string, error) {
|
||
return CompleteWithRodLogged(authURL, email, password, teamID, headless, proxy, nil)
|
||
}
|
||
|
||
// CompleteWithRodLogged 使用 Rod + Stealth 完成 S2A 授权（带日志回调）
|
||
func CompleteWithRodLogged(authURL, email, password, teamID string, headless bool, proxy string, logger *AuthLogger) (string, error) {
|
||
// 日志辅助函数
|
||
logStep := func(step AuthStep, format string, args ...interface{}) {
|
||
if logger != nil {
|
||
logger.LogStep(step, format, args...)
|
||
}
|
||
}
|
||
logError := func(step AuthStep, format string, args ...interface{}) {
|
||
if logger != nil {
|
||
logger.LogError(step, format, args...)
|
||
}
|
||
}
|
||
|
||
logStep(StepBrowserStart, "正在启动 Rod 浏览器...")
|
||
auth, err := NewRodAuth(headless, proxy)
|
||
if err != nil {
|
||
logError(StepBrowserStart, "启动失败: %v", err)
|
||
return "", err
|
||
}
|
||
defer auth.Close()
|
||
|
||
logStep(StepBrowserStart, "浏览器启动成功")
|
||
return auth.CompleteOAuthLogged(authURL, email, password, teamID, logger)
|
||
}
|
||
|
||
// CompleteWithBrowser 使用 Rod 完成 S2A 授权 (别名)
|
||
func CompleteWithBrowser(authURL, email, password, teamID string, headless bool, proxy string) (string, error) {
|
||
return CompleteWithRod(authURL, email, password, teamID, headless, proxy)
|
||
}
|