Repository navigation
Conversation
Two additions, ported from the `dsh-codearts-auth` implementation of the same protocol. * New `onboarding.py` — claim the eight newbie tasks (10 000 points total) through the API. The upstream does **not** verify the prerequisite behaviour: the completion conditions live in the Electron client (`onboarding-service.js`), and the server only does "idempotent set + add points". Eight bare `POST /onboarding/tasks/complete` calls therefore take a fresh account from 0 to 10 000 points without spending a single model token. Measured on a real account: 8/8 claimed, balance 0 → 10 000, and the points land in the *permanent* pool (not the daily grant). * SMS login in the web panel (`POST /api/panel/sms/send` and `POST /api/panel/sms/verify`). The CLI already had `sms` / `verify`, but the panel only offered phone+password and a raw session — so an account without a password set, or one blocked by the password-login risk control, could not be added from the UI at all. The panel keeps the `msgid` in the browser between the two steps (it is only valid for 5 minutes), so no server-side login state is needed. Also included: * `loomy2api onboarding [name ...]` CLI command. * A "领任务" button on every account row in the panel. Semantics carried over from the reference implementation, each of which is a measured trap rather than a style choice: * idempotency is judged by the response body's `alreadyCompleted` — not by the HTTP status, not by `code` (a replay counts as success); * the server's `earned` is **not** trusted; points are recomputed locally from the task table (the official client does the same); * the report body carries **only** `key` — no device fingerprint, no version, no channel; * an auth failure (`100002`) aborts the whole batch instead of firing a string of doomed requests. Tests: `python -m loomy2api onboarding <name>` on a real account (8/8, +10 000), re-run for idempotency (0 requested, 8 skipped), plus manual verification of both panel endpoints with and without the API-key gate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
这个 PR 加了什么
两个功能，都是照
dsh-codearts-auth里同协议实现移植过来的（那份实现踩过的坑已经写进代码注释）。1. 新手任务一键领取（
loomy2api/onboarding.py）Loomy 的 8 个新手任务合计 10 000 积分，而服务端不校验前置行为 —— 完成条件在 Electron 客户端本地判定（
onboarding-service.js），服务端只做「幂等置位 + 加分」。所以 8 个裸POST /onboarding/tasks/complete就能把新账号从 0 分打到 10 000 分，一个模型 token 都不用花。实测（真实账号）：
积分进的是永久池（
余额 10000 + 每日 4571），不是每日额度 —— 这点对新账号很值。重跑幂等：
本次 +0，已完成 8/8（已完成的不发请求）。2. 面板短信验证码登录（
/api/panel/sms/send+/api/panel/sms/verify）CLI 本来就有
sms/verify，但面板只能填「手机号+密码」或裸 session —— 没设过密码的账号、或者密码登录被风控拦的账号，在 UI 上根本加不进来。现在面板有了完整的两步流程：msgid存在浏览器里（只 5 分钟有效），所以服务端不需要任何登录态；同名账号走续期而不是重复添加。3. 顺带
loomy2api onboarding [name ...]从参考实现带过来的四条语义（每条都是实测踩出来的，不是风格选择）
alreadyCompletedcode；重放算成功earnedkeyOnboardingService构造参数里就没有getDeviceId）100002）立即中止整批测试
python -m loomy2api onboarding main→ 8/8，+10 000（真实账号实测）说明
改动只有 6 个文件（
onboarding.py新增，其余 5 个接线），没有包含任何部署脚本或账号数据（accounts.json/config.json本来就在.gitignore里）。