清理虎牙登录旧数据依赖并统一动态环境

core/huya/app_login.py

@@ -68,21 +68,6 @@ _URL_TAIL_KEEP = set(
     "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~:/?#[]@!$&'()*+,;=%"
 )
 
-DEFAULT_GOLDEN_DEV = {
-    "app_version": "13.4.22",
-    "sdk_version": "1.0.80138",
-    "vendor": "xiaomi",
-    "model": "M2102J2SC",
-    "os": "android",
-    "ip": "127.0.0.1",
-    "fingerprint": "02df398797432eadefcc12767119ad5e80999389",
-    "screen": "M2102J2SC,30,11",
-    "width": "1080",
-    "height": "2120",
-    "device_id": "7c5387e0539c023c31c4ff0e807e7256117385ee",
-    "hdid": "ed0db8334cadd236c00cadf7e11ab5a5",  # HDID32 登录t1.t0 (勿与GUID32混)
-}
-
 
 class HuyaAppLoginError(HuyaLoginError):
     """虎牙 App 登录失败。"""
@@ -147,11 +132,14 @@ def wup_password_login_raw(
         except DfpRegistrationError as exc:
             raise HuyaAppLoginError(f"新设备注册失败: {exc}") from exc
         dev["device_id"] = registered_device_id
+    hdid_value = hdid or dev.get("hdid")
+    if not hdid_value:
+        raise HuyaAppLoginError("账号设备画像缺少 HDID32，拒绝使用固定金样本")
     pkt = build_password_login_wup(
         uid_str,
         hashlib.sha1(password.encode()).hexdigest(),
         safedeviceid,
-        hdid or dev.get("hdid") or "ed0db8334cadd236c00cadf7e11ab5a5",
+        str(hdid_value),
         mj["session"],
         mj["traceId"],
         ua,
@@ -227,6 +215,8 @@ def solve_safe_auth(
         HuyaVerificationSolver,
     )
 
+    if device_info is None:
+        raise HuyaAppLoginError("safe_auth 缺少当前账号设备画像")
     q = {
         k: v[0]
         for k, v in parse_qs(urlparse(risk_url).query, keep_blank_values=True).items()
@@ -235,7 +225,7 @@ def solve_safe_auth(
     last_err: Exception | None = None
     for attempt in range(max_retry):
         solver = HuyaVerificationSolver(
-            ua=mobile_user_agent(device_info or DEFAULT_GOLDEN_DEV),
+            ua=mobile_user_agent(device_info),
             proxies=proxies,
             app_id=app_id,
             page_url=risk_url,
@@ -357,6 +347,8 @@ class QrRole:
     ):
         self.pc = pc
         self.sdid = sdid
+        if not pc and device_info is None:
+            raise HuyaAppLoginError("移动端二维码角色缺少当前账号设备画像")
         self.s = requests.Session()
         self.s.trust_env = False
         if proxies:
@@ -370,9 +362,7 @@ class QrRole:
         self.req_counter = random.randint(40_000_000, 41_000_000)
         self.s.headers.update(
             {
-                "User-Agent": UA_PC
-                if pc
-                else mobile_user_agent(device_info or DEFAULT_GOLDEN_DEV),
+                "User-Agent": UA_PC if pc else mobile_user_agent(device_info),
                 "Origin": UDB_BASE,
                 "content-type": "application/json;charset=UTF-8",
                 "Accept": "*/*",
@@ -511,7 +501,15 @@ class HuyaAppPasswordLogin:
             raw[env.cert_off : env.cert_off + env.cert_len] = cert.encode("ascii")
             if env.uid != uid:
                 struct.pack_into(">Q", raw, env.uid_off, uid)
-            wup = base64.b64encode(bytes(raw)).decode("ascii")
+            # QR 信封只保留协议结构；不要重放抓包里的旧会话值。
+            qr_session = random.randint(1_000_000, 9_999_999)
+            qr_trace = (
+                f"{uuid.uuid4().hex[:16]}-{random.randint(10000, 99999)}-"
+                f"{time.time_ns():020d}"
+            )
+            env.raw = raw
+            env.patch_session(qr_session).patch_meta(qr_session, qr_trace)
+            wup = base64.b64encode(bytes(env.raw)).decode("ascii")
         except Exception as exc:  # noqa: BLE001 外部接口与任务边界需要保留宽泛异常兜底
             return HuyaLoginResult(
                 success=False,
@@ -524,11 +522,18 @@ class HuyaAppPasswordLogin:
             # 一号一设备: sdid 状态按账号隔离 (默认全局目录会让所有账号共享
             # 同一份 hydevice 设备状态, 服务端可跨账号关联 — 见 R40 缺口修复)
             sdid_obj = get_huya_sdid(
-                allow_fallback=True,
+                # App 主链只接受当前账号的 hydevice 高信任结果；旧版
+                # token+collect 降级没有账号画像，不再静默放行。
+                allow_fallback=False,
                 state_dir=account_state_dir(self.username),
                 device_hint=self.device_info,
             )
-            sdid = sdid_obj.sdid if sdid_obj else ""
+            if not sdid_obj or not sdid_obj.sdid or sdid_obj.source != "fingerprint":
+                detail = sdid_obj.message if sdid_obj else "未返回结果"
+                raise HuyaAppLoginError(
+                    f"账号设备指纹获取失败（必须为 hydevice）: {detail}"
+                )
+            sdid = sdid_obj.sdid
             logger.info("[huya-app] cred 已获取，开始二维码绑定流程")
             pc = QrRole(pc=True, sdid=sdid, proxies=self.proxies)
             ph = QrRole(