CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

console fill: sign-in only by the top-level URL, the main frame's form or an Apple sign-in frame

Browse source 
Google's account widget and cookie rotation frames (accounts.google.com /
ogs.google.com) on a signed-in Play Console no longer count as a sign-in
page. Each detection logs its rule and URL; heartbeats name the page; a
copied Chrome session that lands on a sign-in URL is said plainly; the
sign-in wait gets a watchdog dump, and --debug-dump up to 3 dumps.
Fixtures and tests for the chooser and home with the widget frames and a
top-level accounts.google.com page; pitfall 16.
This commit is contained in:
CRTkafa 2026-10-12 07:28:42 +08:00
parent b48407115e
commit 3aedf9e137
10 changed files with 294 additions and 44 deletions
Download patch file Download diff file Expand all files Collapse all files

16
tests/fixtures/console/google-account-widget.html vendored Normal file
View file

@ -0,0 +1,16 @@
<!doctype html>
<!-- MODELED, not recorded: what Google pages (Play Console included) embed from accounts.google.com / ogs.google.com
while the owner IS signed in: the account widget (avatar, name, email, Manage your Google Account, Sign out) and
the hidden cookie rotation frame. Its URL is a sign-in host, but it is a third-party frame, never a sign-in page.
Placeholder data only. -->
<html lang="en"><head><meta charset="utf-8"><title>Google Account</title></head>
<body>
<div aria-label="Google Account: Example Owner (owner@example.com)">
<img alt="Example Owner" width="32" height="32" src="data:image/gif;base64,R0lGODlhAQABAAAAACw=">
<p>Example Owner</p>
<p>owner@example.com</p>
<a href="https://myaccount.google.com/">Manage your Google Account</a>
<a href="https://accounts.google.com/AddSession">Add another account</a>
<a href="https://accounts.google.com/Logout">Sign out</a>
</div>
</body></html>

12
tests/fixtures/console/google-signin.html vendored Normal file
View file

@ -0,0 +1,12 @@
<!doctype html>
<!-- MODELED, not recorded: Google's sign-in page as a top-level page on accounts.google.com (where Play Console sends
a signed-out browser). storebound must detect it by its top-level URL, never type or click there. -->
<html lang="en"><head><meta charset="utf-8"><title>Sign in - Google Accounts</title><script src="/_common.js"></script></head>
<body>
<h1>Sign in</h1>
<p>to continue to Google Play Console</p>
<p><input id="identifier" type="email" aria-label="Email or phone"></p>
<a href="https://accounts.google.com/signin/v2/usernamerecovery">Forgot email?</a>
<button type="button">Create account</button>
<button type="button">Next</button>
</body></html>

24
tests/fixtures/console/play-chooser-ogb.html vendored Normal file
View file

@ -0,0 +1,24 @@
<!doctype html>
<!-- MODELED, not recorded: Play Console's "Choose developer account" page as a signed-in owner sees it, with what every
Google page carries: a header with the avatar, name and email (the account widget, OGB), the widget's frame from
ogs.google.com and a hidden accounts.google.com cookie rotation frame. Signed in: NOT a sign-in page, although a
frame sits on accounts.google.com. One developer account. Ids and names are placeholders. -->
<html lang="en"><head><meta charset="utf-8"><title>Choose developer account - Play Console</title><script src="/_common.js"></script>
<style>.sub { display: block; color: #666; font-size: 12px; } .row { display: flex; gap: 8px; align-items: center; padding: 6px; }</style></head>
<body>
<header role="banner">
<a href="https://play.google.com/console">Google Play Console</a>
<a href="https://accounts.google.com/SignOutOptions" aria-label="Google Account: Example Owner (owner@example.com)"><img alt="Example Owner" width="32" height="32" src="data:image/gif;base64,R0lGODlhAQABAAAAACw="></a>
<span>owner@example.com</span>
<iframe title="Google Account" src="https://ogs.google.com/widget/account?origin=https%3A%2F%2Fplay.google.com" width="320" height="120"></iframe>
</header>
<iframe title="" src="https://accounts.google.com/RotateCookiesPage?og_pid=1&amp;rot=3&amp;origin=https%3A%2F%2Fplay.google.com" width="0" height="0" style="display:none"></iframe>
<iframe title="Google Account" src="https://accounts.google.com/o/oauth2/iframe" width="1" height="1"></iframe>
<main>
<h1>Choose developer account</h1>
<div role="list">
<div role="listitem"><a class="row" href="./developers/7000000001/app-list"><span><span>Example Studio</span><span class="sub">Developer account</span></span></a></div>
<div role="listitem"><a class="row" href="/signup"><span>Create a new developer account</span></a></div>
</div>
</main>
</body></html>

20
tests/fixtures/console/play-home-ogb.html vendored Normal file
View file

@ -0,0 +1,20 @@
<!doctype html>
<!-- MODELED, not recorded: Play Console > Home (All apps) of a signed-in owner with the Google account widget (avatar,
name, email in the header, its ogs.google.com frame) and the accounts.google.com cookie rotation frame. NOT a
sign-in page. "Create app" opens the Create app form. Placeholder data only. -->
<html lang="en"><head><meta charset="utf-8"><title>All apps - Play Console</title><script src="/_common.js"></script></head>
<body>
<header role="banner">
<a href="https://play.google.com/console">Google Play Console</a>
<a href="https://accounts.google.com/SignOutOptions" aria-label="Google Account: Example Owner (owner@example.com)"><img alt="Example Owner" width="32" height="32" src="data:image/gif;base64,R0lGODlhAQABAAAAACw="></a>
<iframe title="Google Account" src="https://ogs.google.com/widget/account?origin=https%3A%2F%2Fplay.google.com" width="320" height="120"></iframe>
</header>
<iframe title="" src="https://accounts.google.com/RotateCookiesPage?og_pid=1&amp;rot=3&amp;origin=https%3A%2F%2Fplay.google.com" width="0" height="0" style="display:none"></iframe>
<h1>All apps</h1>
<label>Search apps <input type="search"></label>
<button type="button" onclick="location.href='/play-create-app.html'">Create app</button>
<table>
<tr><th>App</th><th>Package</th></tr>
<tr><td><a href="/play-dashboard.html">Other App</a></td><td>com.example.other</td></tr>
</table>
</body></html>

7
tests/fixtures/console/play-signed-out.html vendored Normal file
View file

@ -0,0 +1,7 @@
<!doctype html>
<!-- MODELED, not recorded: Play Console for a browser whose copied session did not carry over: it sends the window on
to Google's sign-in page (a top-level accounts.google.com URL). -->
<html lang="en"><head><meta charset="utf-8"><title>Play Console</title></head>
<body>
<script>location.replace('https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fplay.google.com%2Fconsole&service=androiddeveloper');</script>
</body></html>