虎牙网页Cookie来源驱动合并与WSS传输门禁

tests/test_huya_app_login.py

@@ -12,7 +12,11 @@ from sqlalchemy.orm import sessionmaker
 from core.huya import (
     HuyaAppLoginError,
 )
-from core.huya.app_login import login_cred_with_flow, wup_password_login_raw
+from core.huya.app_login import (
+    HuyaAppPasswordLogin,
+    login_cred_with_flow,
+    wup_password_login_raw,
+)
 from core.huya.cert_forge import build_p1, decrypt_cert, forge_cert, parse_p1
 from core.huya.device_fingerprint import account_state_dir, reset_account_state
 from core.huya.device_profile import (
@@ -39,6 +43,110 @@ from web.backend.schemas import (
 )
 
 
+def test_app_login_merges_web_biztoken_and_device_state():
+    session = MagicMock()
+    session.cookies = []
+    cookie = HuyaAppPasswordLogin._merge_web_cookie(
+        session,
+        "web-token",
+        "sdid-value",
+        "hdid-value",
+        {"guid": "a" * 32, "udb_guiddata": "b" * 32},
+    )
+    assert "udb_biztoken=web-token" in cookie
+    assert "sdid=sdid-value" in cookie
+    assert "hdid=hdid-value" in cookie
+    assert "guid=" + "a" * 32 in cookie
+    assert "udb_guiddata=" + "b" * 32 in cookie
+    assert "udb_deviceid=" not in cookie
+
+
+def test_app_login_cookie_injects_app_credentials_and_drops_transient_id():
+    session = MagicMock()
+    session.cookies = {"web_qrlogin_confirm_id": "one-time"}
+    cookie = HuyaAppPasswordLogin._merge_web_cookie(
+        session,
+        "b" * 344,
+        "s" * 193,
+        "h" * 40,
+        {"guid32": "a" * 64, "device_id": "d" * 40},
+        cred=b"c" * 114,
+        uid=1199666914671,
+        username="hy_300023887",
+        include_transient=False,
+    )
+    assert "udb_cred=" in cookie
+    assert "udb_uid=1199666914671" in cookie
+    assert "yyuid=1199666914671" in cookie
+    assert "udb_passport=hy_300023887" in cookie
+    assert "web_qrlogin_confirm_id" not in cookie
+
+
+def test_app_login_cookie_does_not_fabricate_browser_state():
+    session = MagicMock()
+    session.cookies = {}
+    cookie = HuyaAppPasswordLogin._merge_web_cookie(
+        session,
+        "b" * 344,
+        "s" * 193,
+        "h" * 40,
+        {"guid32": "a" * 64, "device_id": "d" * 40},
+        cred=b"c" * 114,
+        uid=1199666914671,
+        username="hy_300023887",
+        include_transient=False,
+    )
+    values = dict(item.split("=", 1) for item in cookie.split("; "))
+    assert set(values) == {
+        "udb_cred", "udb_uid", "yyuid", "udb_version", "udb_biztoken",
+        "udb_origin", "udb_status", "sdid", "hdid", "udb_passport", "username",
+    }
+    assert not {"_qimei_uuid42", "_qimei_fingerprint", "_qimei_h38", "udb_anobiztoken"} & set(values)
+
+
+def test_app_login_cookie_overwrites_auth_but_keeps_distinct_explicit_device_values():
+    session = MagicMock()
+    session.cookies = {
+        "udb_uid": "old",
+        "udb_biztoken": "old-token",
+        "guid": "old-guid",
+        "udb_guiddata": "old-device-guid",
+        "__yamid_new": "persisted",
+    }
+    cookie = HuyaAppPasswordLogin._merge_web_cookie(
+        session,
+        "new-token",
+        "s" * 193,
+        "h" * 40,
+        {"guid": "a" * 32, "udb_guiddata": "b" * 32},
+        cred=b"c" * 114,
+        uid=1199666914671,
+        username="19507362959",
+        include_transient=False,
+    )
+    values = dict(item.split("=", 1) for item in cookie.split("; "))
+    assert values["udb_uid"] == "1199666914671"
+    assert values["udb_biztoken"] == "new-token"
+    assert values["guid"] == "a" * 32
+    assert values["udb_guiddata"] == "b" * 32
+    assert values["__yamid_new"] == "persisted"
+    assert "udb_passport" not in values
+
+
+def test_app_login_cookie_contains_web_session_shape():
+    session = MagicMock()
+    session.cookies = {"udb_uid": "123"}
+    cookie = HuyaAppPasswordLogin._merge_web_cookie(
+        session, "web-token", "s" * 193, "h" * 40,
+        {"guid": "a" * 32, "udb_guiddata": "b" * 32},
+    )
+    keys = {item.split("=", 1)[0] for item in cookie.split("; ")}
+    expected = {
+        "udb_biztoken", "sdid", "hdid", "guid", "udb_guiddata",
+    }
+    assert expected <= keys
+
+
 class TestHuyaAppLogin:
     def setup_method(self):
         self.engine = create_engine("sqlite://")