feat(ext): verify cookies in-browser before uploading (1.0.7) #57

Merged

bvandeusen merged 1 commits from dev into main 2026-06-03 14:17:42 -04:00

Conversation 0 Commits 1 Files Changed 6

+78 -5

bvandeusen commented 2026-06-03 14:17:38 -04:00

Owner

Copy Link

Copy Source

Summary

Operator hit a 401 from HentaiFoundry today — the browser's HF session had expired, the extension faithfully captured the stale cookie jar, FC stored it, gallery-dl tried to use it, HF said no. The extension has no cookie cache between clicks (every export is a live read from browser.cookies.getAll), so the only place to catch a stale jar is to actually use it against the platform before pushing it to FC.

This change adds a pre-upload verify request from the extension's background context. With host_permissions for the platform domain, the browser auto-attaches the user's current cookies to fetch() — same set gallery-dl will later use.

• lib/platforms.js — verify config per cookie-auth platform:
  • hentaifoundry: HEAD /?enterAgree=1 (mirrors gallery-dl's _init_site_filters; same 401 path the operator hit)
  • patreon: GET /api/current_user (clean 401 when logged out)
  • subscribestar / deviantart: skipped — no stable auth-only endpoint surfaced yet, and a wrong check would false-positive-fail good cookies
• lib/cookies.js — verifyCookiesForPlatform(key) returns tri-state {ok: true | false | null}. null = no verify config, caller proceeds (legacy behavior); false = explicit fail with reason
• background.js — EXPORT_COOKIES + EXPORT_ALL_COOKIES gate the upload on verify; on fail, error bubbles up without overwriting FC-side credentials
• popup.js — success message appends "(verified ✓)" when applicable
• manifest.json + package.json — 1.0.6 → 1.0.7 (triggers build.yml's sign-extension on this merge so the new XPI lands in :latest)

Test plan

• extension.yml lint green (run 351)
• ci.yml green (run 350) — backend untouched
• After merge: build.yml signs v1.0.7 via AMO → build-web bundles it into :latest
• Operator manual: HF login → click HF tile → expect "Hentai Foundry: N cookies exported (verified ✓)". Then log out of HF in browser, click again → expect explicit "doesn't appear authenticated" error, no upload

Related: scribe task #590 (today's ML normalization, also shipped).

## Summary Operator hit a 401 from HentaiFoundry today — the browser's HF session had expired, the extension faithfully captured the stale cookie jar, FC stored it, gallery-dl tried to use it, HF said no. The extension has no cookie cache between clicks (every export is a live read from `browser.cookies.getAll`), so the only place to catch a stale jar is to actually *use* it against the platform before pushing it to FC. This change adds a pre-upload verify request from the extension's background context. With `host_permissions` for the platform domain, the browser auto-attaches the user's current cookies to `fetch()` — same set gallery-dl will later use. - `lib/platforms.js` — `verify` config per cookie-auth platform: - **hentaifoundry**: `HEAD /?enterAgree=1` (mirrors gallery-dl's `_init_site_filters`; same 401 path the operator hit) - **patreon**: `GET /api/current_user` (clean 401 when logged out) - **subscribestar / deviantart**: skipped — no stable auth-only endpoint surfaced yet, and a wrong check would false-positive-fail good cookies - `lib/cookies.js` — `verifyCookiesForPlatform(key)` returns tri-state `{ok: true | false | null}`. `null` = no verify config, caller proceeds (legacy behavior); `false` = explicit fail with reason - `background.js` — `EXPORT_COOKIES` + `EXPORT_ALL_COOKIES` gate the upload on verify; on fail, error bubbles up without overwriting FC-side credentials - `popup.js` — success message appends "(verified ✓)" when applicable - `manifest.json` + `package.json` — 1.0.6 → 1.0.7 (triggers `build.yml`'s `sign-extension` on this merge so the new XPI lands in `:latest`) ## Test plan - [x] `extension.yml` lint green (run 351) - [x] `ci.yml` green (run 350) — backend untouched - [ ] After merge: `build.yml` signs v1.0.7 via AMO → `build-web` bundles it into `:latest` - [ ] Operator manual: HF login → click HF tile → expect "Hentai Foundry: N cookies exported (verified ✓)". Then log out of HF in browser, click again → expect explicit "doesn't appear authenticated" error, no upload Related: scribe task #590 (today's ML normalization, also shipped).

bvandeusen added 1 commit 2026-06-03 14:17:38 -04:00

feat(ext): verify cookies in-browser before uploading (1.0.7) ... d3245f0c22

Pre-upload verify request: after capturing the live browser cookies,
hit a known authenticated endpoint with credentials:'include' from the
extension's background context. If the platform reports we're not
logged in, abort the upload so we don't overwrite FC-side credentials
with stale data.

- platforms.js: add `verify` config per cookie-auth platform
  - hentaifoundry: HEAD /?enterAgree=1 (mirrors gallery-dl's HF
    _init_site_filters; same 401 path the operator hit 2026-06-03)
  - patreon: GET /api/current_user (clean 401 when logged out)
  - subscribestar, deviantart: no stable auth endpoint, skip verify
- cookies.js: verifyCookiesForPlatform() returns {ok, status, reason}.
  ok=true/false/null tri-state — null = verify not configured, caller
  treats as "proceed".
- background.js EXPORT_COOKIES + EXPORT_ALL_COOKIES: verify gates the
  upload; failures bubble up with the platform's name + reason.
- popup.js: success message now appends "(verified ✓)" when applicable.
- manifest + package.json: 1.0.6 → 1.0.7.

bvandeusen merged commit 0533807669 into main 2026-06-03 14:17:42 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

renovate-bot bvandeusen

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bvandeusen/FabledCurator#57