← back to Pattern Vault

capture-session: authoritative session probe (load account page in-context, verify real markers) instead of login-page DOM guessing

71d32227377079915b7569d6a5d0903e283efd72 · 2026-07-09 22:17:12 -0700 · Steve

Files touched

• M wpb-uploaders/capture-session.js

Diff

commit 71d32227377079915b7569d6a5d0903e283efd72
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Jul 9 22:17:12 2026 -0700

    capture-session: authoritative session probe (load account page in-context, verify real markers) instead of login-page DOM guessing
---
 wpb-uploaders/capture-session.js | 40 +++++++++++++++++++++++-----------------
 1 file changed, 23 insertions(+), 17 deletions(-)

diff --git a/wpb-uploaders/capture-session.js b/wpb-uploaders/capture-session.js
index 798329e..ba46b30 100644
--- a/wpb-uploaders/capture-session.js
+++ b/wpb-uploaders/capture-session.js
@@ -29,17 +29,23 @@ const sleep = ms => new Promise(r => setTimeout(r, ms));
 // logged-in heuristic — REQUIRES a POSITIVE authenticated marker (no weak domain/absence fallback,
 // which false-positived on 2026-07-09). Must be off the login URL, no password field, AND an actual
 // logout/sign-out control OR clear account-page text present.
-async function isLoggedIn(pg) {
-  const u = pg.url();
-  if (/\/login|\/signin|\/auth\/login|\/sign_in|\/sessions\/new|accounts\.google\.com/i.test(u)) return false;
-  if (await pg.$('input[type=password]').catch(() => null)) return false; // login form still up
-  const logout = await pg.$('a[href*="logout" i], a[href*="sign_out" i], a[href*="signout" i], button:has-text("Log out"), button:has-text("Sign out"), button:has-text("Logout")').catch(() => null);
-  if (logout) return true;
-  // fallback POSITIVE signal: account-page words present AND no visible "Sign in" CTA
-  const signIn = await pg.$('a:has-text("Sign In"), a:has-text("Sign in"), a:has-text("Log In"), a:has-text("Log in")').catch(() => null);
-  if (signIn) return false;
-  const txt = (await pg.evaluate(() => document.body.innerText).catch(() => '') || '').toLowerCase();
-  return /sign out|log out|my account|my dashboard|my purchases|my downloads/.test(txt);
+// AUTHORITATIVE session check — don't guess from the login page's DOM. Open a probe tab in the
+// SAME context (shares your cookies) and load the account URL: if it reaches the account page
+// with a real logout/account marker (not redirected to login, no password form), you're in.
+async function sessionAuthenticated(ctx) {
+  const probe = await ctx.newPage();
+  try {
+    await probe.goto(cfg.healthUrl, { waitUntil: 'domcontentloaded', timeout: 30000 }).catch(() => {});
+    await probe.waitForTimeout(2000);
+    const u = probe.url();
+    if (/\/login|\/signin|\/auth\/login|\/sign_in|accounts\.google\.com/i.test(u)) return false; // bounced to login
+    if (await probe.$('input[type=password]').catch(() => null)) return false;
+    const logout = await probe.$('a[href*="logout" i], a[href*="sign_out" i], a[href*="signout" i], button:has-text("Log out"), button:has-text("Sign out")').catch(() => null);
+    if (logout) return true;
+    const txt = (await probe.evaluate(() => document.body.innerText).catch(() => '') || '').toLowerCase();
+    return /sign out|log out|my account|dashboard|purchases|downloads|my shop|order history/.test(txt);
+  } catch { return false; }
+  finally { await probe.close().catch(() => {}); }
 }
 
 (async () => {
@@ -60,14 +66,14 @@ async function isLoggedIn(pg) {
 
   const start = Date.now();
   const deadline = start + 10 * 60 * 1000; // 10 min
-  let stable = 0, saved = false;
+  let saved = false;
   while (Date.now() < deadline) {
-    await sleep(3000);
+    await sleep(8000); // probe is authoritative but heavier; poll every 8s
+    // time guard: give you 20s to actually start logging in before the first probe
+    if (Date.now() - start < 20000) continue;
     let ok = false;
-    // time guard: ignore the first 15s so a mid-load page can't false-trigger before you log in
-    if (Date.now() - start > 15000) { try { ok = await isLoggedIn(pg); } catch { /* navigating */ } }
-    if (ok) { stable++; } else { stable = 0; }
-    if (stable >= 2) { // logged-in confirmed across two checks
+    try { ok = await sessionAuthenticated(ctx); } catch { /* navigating */ }
+    if (ok) { // one authoritative pass (real account-page check) is enough
       await ctx.storageState({ path: OUT });
       saved = true;
       break;

← 4b93b71 capture-session: require POSITIVE auth marker (kill false-po  ·  back to Pattern Vault  ·  capture-session: WebKit (Safari engine) default per Steve; c a0ae52d →