← back to Pattern Vault

capture-session: require POSITIVE auth marker (kill false-positive) + 15s time guard

4b93b714293ee9064a3af17d05f4a227b7e5ce97 · 2026-07-09 19:13:06 -0700 · Steve

Files touched

• M wpb-uploaders/capture-session.js

Diff

commit 4b93b714293ee9064a3af17d05f4a227b7e5ce97
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Jul 9 19:13:06 2026 -0700

    capture-session: require POSITIVE auth marker (kill false-positive) + 15s time guard
---
 wpb-uploaders/capture-session.js | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/wpb-uploaders/capture-session.js b/wpb-uploaders/capture-session.js
index 5c98287..798329e 100644
--- a/wpb-uploaders/capture-session.js
+++ b/wpb-uploaders/capture-session.js
@@ -26,16 +26,20 @@ const LOGIN = { creativemarket: 'https://creativemarket.com/login', redbubble: '
   society6: 'https://society6.com/login', patternbank: 'https://patternbank.com/login' }[platform];
 const sleep = ms => new Promise(r => setTimeout(r, ms));
 
-// logged-in heuristic (robust): off the login/auth URL AND no password field visible.
-// A logged-out page still shows the login form (password input); once you're in, it's gone.
+// logged-in heuristic — REQUIRES a POSITIVE authenticated marker (no weak domain/absence fallback,
+// which false-positived on 2026-07-09). Must be off the login URL, no password field, AND an actual
+// logout/sign-out control OR clear account-page text present.
 async function isLoggedIn(pg) {
   const u = pg.url();
   if (/\/login|\/signin|\/auth\/login|\/sign_in|\/sessions\/new|accounts\.google\.com/i.test(u)) return false;
-  const pwField = await pg.$('input[type=password]').catch(() => null);
-  if (pwField) return false;              // still on a login form somewhere
-  // extra confidence: an account/logout marker OR simply being on the platform's own domain
-  const marker = await pg.$('a[href*="logout" i], a[href*="sign_out" i], button:has-text("Log out"), button:has-text("Sign out"), a[href*="/account" i], a[href*="dashboard" i], [aria-label*="account" i], [class*="avatar" i]').catch(() => null);
-  return !!marker || /creativemarket\.com|redbubble\.com|society6\.com|patternbank\.com/i.test(u);
+  if (await pg.$('input[type=password]').catch(() => null)) return false; // login form still up
+  const logout = await pg.$('a[href*="logout" i], a[href*="sign_out" i], a[href*="signout" i], button:has-text("Log out"), button:has-text("Sign out"), button:has-text("Logout")').catch(() => null);
+  if (logout) return true;
+  // fallback POSITIVE signal: account-page words present AND no visible "Sign in" CTA
+  const signIn = await pg.$('a:has-text("Sign In"), a:has-text("Sign in"), a:has-text("Log In"), a:has-text("Log in")').catch(() => null);
+  if (signIn) return false;
+  const txt = (await pg.evaluate(() => document.body.innerText).catch(() => '') || '').toLowerCase();
+  return /sign out|log out|my account|my dashboard|my purchases|my downloads/.test(txt);
 }
 
 (async () => {
@@ -54,12 +58,14 @@ async function isLoggedIn(pg) {
   const { exec } = require('child_process');
   exec(`osascript -e 'tell application "System Events" to set frontmost of (first process whose name contains "Chrome for Testing") to true' 2>/dev/null`);
 
-  const deadline = Date.now() + 10 * 60 * 1000; // 10 min
+  const start = Date.now();
+  const deadline = start + 10 * 60 * 1000; // 10 min
   let stable = 0, saved = false;
   while (Date.now() < deadline) {
     await sleep(3000);
     let ok = false;
-    try { ok = await isLoggedIn(pg); } catch { /* page navigating */ }
+    // time guard: ignore the first 15s so a mid-load page can't false-trigger before you log in
+    if (Date.now() - start > 15000) { try { ok = await isLoggedIn(pg); } catch { /* navigating */ } }
     if (ok) { stable++; } else { stable = 0; }
     if (stable >= 2) { // logged-in confirmed across two checks
       await ctx.storageState({ path: OUT });

← 6800cc2 capture-session: robust login detect (no-password-field + do  ·  back to Pattern Vault  ·  capture-session: authoritative session probe (load account p 71d3222 →