fix bandcamp login

2026-05-17 19:15:03 +02:00
parent 8393271ee3
commit 560d95cfc0
3 changed files with 258 additions and 63 deletions
@@ -251,13 +251,15 @@ function SpotifySection() {
 // ── Bandcamp credentials ──────────────────────────────────────────────────────

 function BandcampSection() {
-  const [email,    setEmail]    = useState('');
-  const [password, setPassword] = useState('');
-  const [pwdSet,   setPwdSet]   = useState(false);
-  const [loaded,   setLoaded]   = useState(false);
-  const [saveState, setSaveState] = useState('idle');
-  const [testState, setTestState] = useState('idle');
-  const [testMsg,   setTestMsg]   = useState('');
+  const [email,      setEmail]      = useState('');
+  const [password,   setPassword]   = useState('');
+  const [cookies,    setCookies]    = useState('');
+  const [pwdSet,     setPwdSet]     = useState(false);
+  const [cookiesSet, setCookiesSet] = useState(false);
+  const [loaded,     setLoaded]     = useState(false);
+  const [saveState,  setSaveState]  = useState('idle');
+  const [testState,  setTestState]  = useState('idle');
+  const [testMsg,    setTestMsg]    = useState('');

  useEffect(() => {
    fetch('/api/bandcamp/credentials')
@@ -265,6 +267,7 @@ function BandcampSection() {
      .then(data => {
        setEmail(data.email || '');
        setPwdSet(!!data.password_set);
+        setCookiesSet(!!data.cookies_set);
        setLoaded(true);
      })
      .catch(() => setLoaded(true));
@@ -275,6 +278,7 @@ function BandcampSection() {
    try {
      const body = { email };
      if (password) body.password = password;
+      if (cookies)  body.cookies  = cookies;
      const r = await fetch('/api/bandcamp/credentials', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
@@ -282,16 +286,26 @@ function BandcampSection() {
      });
      if (!r.ok) throw new Error();
      setSaveState('ok');
-      if (password) setPwdSet(true);
-      setPassword('');
+      if (password) { setPwdSet(true);     setPassword(''); }
+      if (cookies)  { setCookiesSet(true); setCookies('');  }
    } catch {
      setSaveState('error');
    }
    setTimeout(() => setSaveState('idle'), 4000);
  };

-  const testLogin = async () => {
-    if (email || password) await save();
+  const clearCookies = async () => {
+    try {
+      const r = await fetch('/api/bandcamp/credentials', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ cookies: '' }),
+      });
+      if (r.ok) { setCookiesSet(false); setCookies(''); }
+    } catch {}
+  };
+
+  const testConnection = async () => {
    setTestState('testing');
    setTestMsg('');
    try {
@@ -299,8 +313,8 @@ function BandcampSection() {
      const data = await r.json();
      setTestState(data.ok ? 'ok' : 'error');
      setTestMsg(data.ok
-        ? `Logged in${data.username ? ` as ${data.username}` : ''}`
-        : (data.error || 'Login failed'));
+        ? `Connected${data.username ? ` as ${data.username}` : ''}`
+        : (data.error || 'Connection failed'));
    } catch {
      setTestState('error');
      setTestMsg('Could not reach bandcamp-api service');
@@ -310,10 +324,42 @@ function BandcampSection() {

  return (
    <>
+      <div className="settings-row-hint" style={{ marginBottom: 10 }}>
+        Session cookies bypass Bandcamp's login captcha and are used first when saved.
+        Log in at{' '}
+        <a href="https://bandcamp.com" target="_blank" rel="noreferrer" style={{ color: 'var(--accent)' }}>
+          bandcamp.com
+        </a>
+        {' '}in your browser, open DevTools (F12) → Network tab → click any bandcamp.com
+        request → Request Headers → copy the <code>Cookie</code> value and paste it below.
+      </div>
+
+      <div className="settings-row" style={{ alignItems: 'flex-start' }}>
+        <div className="settings-row-left" style={{ paddingTop: 4 }}>
+          <div className="settings-row-label">Session Cookies</div>
+          <div className="settings-row-hint">
+            {!loaded ? '…' : cookiesSet
+              ? <span>Saved — <button onClick={clearCookies} style={{ background: 'none', border: 'none', color: 'var(--accent)', cursor: 'pointer', padding: 0, fontSize: 'inherit' }}>clear</button></span>
+              : 'Not saved'}
+          </div>
+        </div>
+        <textarea
+          className="settings-input"
+          style={{ height: 60, resize: 'vertical', fontFamily: 'monospace', fontSize: 11 }}
+          value={cookies}
+          onChange={e => setCookies(e.target.value)}
+          placeholder={cookiesSet ? '(saved — paste new value to replace)' : 'client_id=…; csrf_token=…; js_account_details=…'}
+          spellCheck={false}
+        />
+      </div>
+
+      <div className="settings-row-hint" style={{ margin: '10px 0 6px', opacity: 0.55 }}>
+        Email and password are used as fallback when no cookies are saved.
+      </div>
+
      <div className="settings-row">
        <div className="settings-row-left">
          <div className="settings-row-label">Email</div>
-          <div className="settings-row-hint">Bandcamp account email</div>
        </div>
        <input
          className="settings-input"
@@ -329,7 +375,7 @@ function BandcampSection() {
        <div className="settings-row-left">
          <div className="settings-row-label">Password</div>
          <div className="settings-row-hint">
-            {loaded && !pwdSet ? 'Not saved yet' : loaded ? 'Saved (leave blank to keep)' : '…'}
+            {loaded && !pwdSet ? 'Not saved' : loaded ? 'Saved (leave blank to keep)' : '…'}
          </div>
        </div>
        <input
@@ -345,13 +391,13 @@ function BandcampSection() {
        <button className="settings-action-btn" onClick={save} disabled={saveState === 'saving'}>
          {saveState === 'saving' ? 'Saving…' : 'Save'}
        </button>
-        <button className="settings-action-btn" onClick={testLogin} disabled={testState === 'testing'}>
-          {testState === 'testing' ? 'Testing…' : 'Test Login'}
+        <button className="settings-action-btn" onClick={testConnection} disabled={testState === 'testing'}>
+          {testState === 'testing' ? 'Testing…' : 'Test Connection'}
        </button>
      </div>

-      {saveState === 'ok'    && <p className="settings-feedback settings-feedback--ok">✓ Credentials saved</p>}
-      {saveState === 'error' && <p className="settings-feedback settings-feedback--error">✗ Failed to save credentials</p>}
+      {saveState === 'ok'    && <p className="settings-feedback settings-feedback--ok">✓ Saved</p>}
+      {saveState === 'error' && <p className="settings-feedback settings-feedback--error">✗ Failed to save</p>}
      {testState === 'ok'    && <p className="settings-feedback settings-feedback--ok">✓ {testMsg}</p>}
      {testState === 'error' && <p className="settings-feedback settings-feedback--error">✗ {testMsg}</p>}
    </>
@@ -43,6 +43,68 @@ def _spotify_write(data: dict):
        json.dump(data, f, indent=2)


+# ── Bandcamp cookie auth ─────────────────────────────────────────────────────
+
+def _apply_cookies(session, cookie_str: str):
+    for part in cookie_str.split(';'):
+        part = part.strip()
+        if '=' in part:
+            name, _, value = part.partition('=')
+            session.cookies.set(name.strip(), value.strip(), domain='.bandcamp.com')
+
+
+def _bc_verify_cookies(cookie_str: str) -> dict:
+    session = _requests.Session()
+    session.headers["User-Agent"] = (
+        "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 "
+        "(KHTML, like Gecko) Chrome/124.0 Safari/537.36"
+    )
+    _apply_cookies(session, cookie_str)
+
+    # Try js_account_details cookie first (avoids an HTTP round-trip)
+    fan_id = None
+    username = ''
+    js_raw = session.cookies.get('js_account_details', '')
+    if js_raw:
+        try:
+            data = json.loads(unquote(js_raw))
+            fan_id = data.get('fan_id') or data.get('id')
+            username = data.get('username', '')
+        except Exception:
+            pass
+
+    # Fall back to fetching the homepage
+    if not fan_id:
+        try:
+            r = session.get("https://bandcamp.com/", timeout=15)
+            m = re.search(r'"fan_id"\s*:\s*(\d+)', r.text)
+            if m:
+                fan_id = int(m.group(1))
+            if not username:
+                m2 = re.search(r'"username"\s*:\s*"([^"]+)"', r.text)
+                if m2:
+                    username = m2.group(1)
+        except Exception as exc:
+            return {"ok": False, "error": f"Could not reach bandcamp.com: {exc}"}
+
+    if not fan_id:
+        return {"ok": False, "error": "Cookies invalid or expired — no fan account found"}
+
+    # Verify with a lightweight API call
+    try:
+        r = session.post(
+            "https://bandcamp.com/api/fan/2/collection_summary",
+            json={"fan_id": fan_id},
+            timeout=15,
+        )
+        if not r.ok:
+            return {"ok": False, "error": "Cookies rejected by Bandcamp (may have expired)"}
+    except Exception as exc:
+        return {"ok": False, "error": str(exc)}
+
+    return {"ok": True, "username": username}
+
+
 # ── Bandcamp login ────────────────────────────────────────────────────────────

 def _bc_login(email: str, password: str) -> dict:
@@ -52,33 +114,41 @@ def _bc_login(email: str, password: str) -> dict:
        "(KHTML, like Gecko) Chrome/124.0 Safari/537.36"
    )

-    # Step 1 — obtain CSRF token
+    # Step 1 — obtain CSRF token from meta tag
    try:
        r = session.get("https://bandcamp.com/login", timeout=15)
    except Exception as exc:
        return {"ok": False, "error": f"Could not reach bandcamp.com: {exc}"}

-    csrf = unquote(r.cookies.get("csrf_token", ""))
-    if not csrf:
-        m = re.search(r'"csrf_token"\s*:\s*"([^"]+)"', r.text)
-        if m:
-            csrf = unquote(m.group(1))
-    if not csrf:
+    m = re.search(r'<meta\s+name=["\']csrf-token["\']\s+content=["\']([^"\']+)["\']', r.text, re.IGNORECASE)
+    if not m:
+        m = re.search(r'<meta\s+content=["\']([^"\']+)["\']\s+name=["\']csrf-token["\']', r.text, re.IGNORECASE)
+    if not m:
        return {"ok": False, "error": "Could not obtain CSRF token from Bandcamp"}
+    csrf = m.group(1)

-    # Step 2 — POST login
+    # Step 2 — POST login using field names from Bandcamp's login JS
    try:
        r = session.post(
            "https://bandcamp.com/login_cb",
-            data={"username": email, "password": password, "csrf_token": csrf},
+            data={
+                "user.name": email,
+                "login.password": password,
+                "login.twofactor": "",
+                "login.twofactor_remember": "",
+                "login.from": "",
+                "to_band_path": "",
+            },
            headers={
-                "X-CSRFToken": csrf,
+                "X-CSRF-TOKEN": csrf,
                "Referer": "https://bandcamp.com/login",
                "Accept": "application/json, text/javascript, */*",
                "Origin": "https://bandcamp.com",
            },
            timeout=15,
        )
+        if not r.text:
+            return {"ok": False, "error": "Empty response from Bandcamp"}
        payload = r.json()
    except Exception as exc:
        return {"ok": False, "error": str(exc)}
@@ -87,7 +157,16 @@ def _bc_login(email: str, password: str) -> dict:
        username = (payload.get("account") or {}).get("username", "")
        return {"ok": True, "username": username}

-    err = payload.get("error") or payload.get("error_message") or "Login failed"
+    # Extract error from various response shapes
+    err = payload.get("error") or payload.get("error_message")
+    if not err and payload.get("errors"):
+        errors = payload["errors"]
+        if isinstance(errors, list):
+            parts = [f"{e.get('field','')}: {e.get('reason','')}" for e in errors if isinstance(e, dict)]
+            err = "; ".join(parts) if parts else str(errors)
+        else:
+            err = str(errors)
+    err = err or "Login failed"
    return {"ok": False, "error": err}


@@ -113,7 +192,11 @@ class _Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        if self.path in ("/credentials", "/credentials/"):
            cfg = _read()
-            self._json(200, {"email": cfg.get("email", ""), "password_set": bool(cfg.get("password"))})
+            self._json(200, {
+                "email": cfg.get("email", ""),
+                "password_set": bool(cfg.get("password")),
+                "cookies_set": bool(cfg.get("cookies")),
+            })
        elif self.path in ("/spotify/credentials", "/spotify/credentials/"):
            cfg = _spotify_read()
            self._json(200, {
@@ -139,15 +222,25 @@ class _Handler(BaseHTTPRequestHandler):
                cfg["email"] = body["email"].strip()
            if "password" in body and body["password"]:
                cfg["password"] = body["password"]
+            if "cookies" in body:
+                if body["cookies"]:
+                    cfg["cookies"] = body["cookies"].strip()
+                else:
+                    cfg.pop("cookies", None)
            _write(cfg)
            self._json(200, {"ok": True})

        elif self.path in ("/test-login", "/test-login/"):
            cfg = _read()
+            cookies = cfg.get("cookies", "")
+            if cookies:
+                result = _bc_verify_cookies(cookies)
+                self._json(200, result)
+                return
            email = cfg.get("email", "")
            password = cfg.get("password", "")
            if not email or not password:
-                self._json(400, {"ok": False, "error": "No credentials saved — save them first"})
+                self._json(400, {"ok": False, "error": "No credentials saved — save cookies or email/password first"})
                return
            result = _bc_login(email, password)
            self._json(200, result)
@@ -45,22 +45,21 @@ SESSION.headers["User-Agent"] = (

 # ── Credentials ───────────────────────────────────────────────────────────────

-def load_credentials() -> tuple[str, str]:
+def load_credentials() -> tuple[str, str, str]:
+    """Returns (email, password, cookies). Cookies take priority when present."""
    email = os.environ.get("BANDCAMP_EMAIL", "")
    password = os.environ.get("BANDCAMP_PASSWORD", "")
+    cookies = ""
+
    if email and password:
-        return email, password
+        return email, password, cookies

    try:
        r = requests.get("http://localhost:8091/credentials", timeout=3)
        if r.ok:
            data = r.json()
-            api_email = data.get("email", "")
-            # password_set=True but we can't retrieve the plaintext from GET;
-            # the service exposes /test-login but not the raw password.
-            # Fall through to the JSON file which stores plaintext.
-            if api_email:
-                email = api_email
+            if data.get("email"):
+                email = data["email"]
    except Exception:
        pass

@@ -70,19 +69,20 @@ def load_credentials() -> tuple[str, str]:
            cfg = json.load(f)
        email = cfg.get("email", email)
        password = cfg.get("password", password)
+        cookies = cfg.get("cookies", cookies)

-    # Also try the Docker volume path (running on host alongside Docker)
    docker_cfg = Path("/var/lib/docker/volumes/audioserver_bandcamp_config/_data/bandcamp.json")
-    if not password and docker_cfg.exists():
+    if not password and not cookies and docker_cfg.exists():
        try:
            with open(docker_cfg) as f:
                cfg = json.load(f)
            email = cfg.get("email", email)
            password = cfg.get("password", password)
+            cookies = cfg.get("cookies", cookies)
        except Exception:
            pass

-    return email, password
+    return email, password, cookies


 # ── Bandcamp auth ─────────────────────────────────────────────────────────────
@@ -90,20 +90,26 @@ def load_credentials() -> tuple[str, str]:
 def bc_login(email: str, password: str) -> dict:
    """Login to Bandcamp. Returns account dict with fan_id."""
    r = SESSION.get("https://bandcamp.com/login", timeout=15)
-    csrf = unquote(r.cookies.get("csrf_token", ""))
-    if not csrf:
-        m = re.search(r'"csrf_token"\s*:\s*"([^"]+)"', r.text)
-        if m:
-            csrf = unquote(m.group(1))
-    if not csrf:
+    m = re.search(r'<meta\s+name=["\']csrf-token["\']\s+content=["\']([^"\']+)["\']', r.text, re.IGNORECASE)
+    if not m:
+        m = re.search(r'<meta\s+content=["\']([^"\']+)["\']\s+name=["\']csrf-token["\']', r.text, re.IGNORECASE)
+    if not m:
        raise RuntimeError("Could not get CSRF token from Bandcamp login page")
+    csrf = m.group(1)

    time.sleep(REQUEST_DELAY)
    r = SESSION.post(
        "https://bandcamp.com/login_cb",
-        data={"username": email, "password": password, "csrf_token": csrf},
+        data={
+            "user.name": email,
+            "login.password": password,
+            "login.twofactor": "",
+            "login.twofactor_remember": "",
+            "login.from": "",
+            "to_band_path": "",
+        },
        headers={
-            "X-CSRFToken": csrf,
+            "X-CSRF-TOKEN": csrf,
            "Referer": "https://bandcamp.com/login",
            "Accept": "application/json, text/javascript, */*",
            "Origin": "https://bandcamp.com",
@@ -112,12 +118,53 @@ def bc_login(email: str, password: str) -> dict:
    )
    payload = r.json()
    if payload.get("ok") != 1:
-        err = payload.get("error") or payload.get("error_message") or json.dumps(payload)
+        errors = payload.get("errors")
+        if errors and isinstance(errors, list):
+            err = "; ".join(f"{e.get('field','')}: {e.get('reason','')}" for e in errors if isinstance(e, dict))
+        else:
+            err = payload.get("error") or payload.get("error_message") or json.dumps(payload)
        raise RuntimeError(f"Bandcamp login failed: {err}")

    return payload.get("account", {})


+def apply_cookies(session: requests.Session, cookie_str: str):
+    for part in cookie_str.split(';'):
+        part = part.strip()
+        if '=' in part:
+            name, _, value = part.partition('=')
+            session.cookies.set(name.strip(), value.strip(), domain='.bandcamp.com')
+
+
+def get_session_info(session: requests.Session) -> tuple[int, str]:
+    """Returns (fan_id, username) from session cookies or homepage."""
+    js_raw = session.cookies.get('js_account_details', '')
+    fan_id = None
+    username = ''
+    if js_raw:
+        try:
+            data = json.loads(unquote(js_raw))
+            fan_id = data.get('fan_id') or data.get('id')
+            username = data.get('username', '')
+            if fan_id:
+                return int(fan_id), username
+        except Exception:
+            pass
+
+    time.sleep(REQUEST_DELAY)
+    r = session.get("https://bandcamp.com/", timeout=15)
+    m = re.search(r'"fan_id"\s*:\s*(\d+)', r.text)
+    if m:
+        fan_id = int(m.group(1))
+    if not username:
+        m2 = re.search(r'"username"\s*:\s*"([^"]+)"', r.text)
+        if m2:
+            username = m2.group(1)
+    if not fan_id:
+        raise RuntimeError("Could not determine fan_id from session cookies — they may have expired")
+    return fan_id, username
+
+
 def get_fan_id(account: dict) -> int:
    fan_id = account.get("fan_id") or account.get("id")
    if fan_id:
@@ -317,18 +364,27 @@ def main():

    music_dir = args.music_dir

-    # Load credentials
-    email, password = load_credentials()
-    if not email or not password:
-        print("✗ No credentials found. Save them in the Settings → Bandcamp section, or set")
-        print("  BANDCAMP_EMAIL / BANDCAMP_PASSWORD environment variables.")
-        sys.exit(1)
+    email, password, cookies = load_credentials()

-    print(f"Logging in as {email}…")
-    account = bc_login(email, password)
-    fan_id = get_fan_id(account)
-    username = account.get("username", str(fan_id))
-    print(f"✓ Logged in — {username} (fan_id={fan_id})")
+    if cookies:
+        apply_cookies(SESSION, cookies)
+        print("Using saved session cookies…")
+        try:
+            fan_id, username = get_session_info(SESSION)
+            print(f"✓ Session active — {username or 'unknown'} (fan_id={fan_id})")
+        except RuntimeError as exc:
+            print(f"✗ {exc}")
+            sys.exit(1)
+    elif email and password:
+        print(f"Logging in as {email}…")
+        account = bc_login(email, password)
+        fan_id = get_fan_id(account)
+        username = account.get("username", str(fan_id))
+        print(f"✓ Logged in — {username} (fan_id={fan_id})")
+    else:
+        print("✗ No credentials found. Save session cookies or email/password in Settings → Bandcamp,")
+        print("  or set BANDCAMP_EMAIL / BANDCAMP_PASSWORD environment variables.")
+        sys.exit(1)

    print("Fetching collection…")
    items = fetch_collection(fan_id)