wip

krichprollsch · krichprollsch · commit 58e923dbf0e5 · 2025-08-25T14:30:17.000+02:00
diff --git a/src/cdp/cdp.zig b/src/cdp/cdp.zig
@@ -477,12 +477,16 @@ pub fn BrowserContext(comptime CDP_T: type) type {
             self.cdp.browser.notification.unregister(.http_response_header_done, self);
         }
 
-        pub fn fetchEnable(self: *Self) !void {
+        pub fn fetchEnable(self: *Self, authRequests: bool) !void {
             try self.cdp.browser.notification.register(.http_request_intercept, self, onHttpRequestIntercept);
+            if (authRequests) {
+                try self.cdp.browser.notification.register(.http_request_auth_required, self, onHttpRequestAuthRequired);
+            }
         }
 
         pub fn fetchDisable(self: *Self) void {
             self.cdp.browser.notification.unregister(.http_request_intercept, self);
+            self.cdp.browser.notification.unregister(.http_request_auth_required, self);
         }
 
         pub fn onPageRemove(ctx: *anyopaque, _: Notification.PageRemove) !void {
@@ -548,6 +552,12 @@ pub fn BrowserContext(comptime CDP_T: type) type {
             try gop.value_ptr.appendSlice(arena, try arena.dupe(u8, msg.data));
         }
 
+        pub fn onHttpRequestAuthRequired(ctx: *anyopaque, data: *const Notification.RequestAuthRequired) !void {
+            const self: *Self = @alignCast(@ptrCast(ctx));
+            defer self.resetNotificationArena();
+            try @import("domains/fetch.zig").requestAuthRequired(self.notification_arena, self, data);
+        }
+
         fn resetNotificationArena(self: *Self) void {
             defer _ = self.cdp.notification_arena.reset(.{ .retain_with_limit = 1024 * 64 });
         }
diff --git a/src/cdp/domains/fetch.zig b/src/cdp/domains/fetch.zig
@@ -32,12 +32,14 @@ pub fn processMessage(cmd: anytype) !void {
         continueRequest,
         failRequest,
         fulfillRequest,
+        continueWithAuth,
     }, cmd.input.action) orelse return error.UnknownMethod;
 
     switch (action) {
         .disable => return disable(cmd),
         .enable => return enable(cmd),
         .continueRequest => return continueRequest(cmd),
+        .continueWithAuth => return continueWithAuth(cmd),
         .failRequest => return failRequest(cmd),
         .fulfillRequest => return fulfillRequest(cmd),
     }
@@ -144,12 +146,8 @@ fn enable(cmd: anytype) !void {
         return cmd.sendResult(null, .{});
     }
 
-    if (params.handleAuthRequests) {
-        log.warn(.cdp, "not implemented", .{ .feature = "Fetch.enable handleAuthRequests is not supported yet" });
-    }
-
     const bc = cmd.browser_context orelse return error.BrowserContextNotLoaded;
-    try bc.fetchEnable();
+    try bc.fetchEnable(params.handleAuthRequests);
 
     return cmd.sendResult(null, .{});
 }
@@ -276,6 +274,60 @@ fn continueRequest(cmd: anytype) !void {
     return cmd.sendResult(null, .{});
 }
 
+fn continueWithAuth(cmd: anytype) !void {
+    const bc = cmd.browser_context orelse return error.BrowserContextNotLoaded;
+    const params = (try cmd.params(struct {
+        requestId: []const u8, // "INTERCEPT-{d}"
+        authChallengeResponse: struct {
+            response: []const u8,
+            username: ?[]const u8,
+            password: ?[]const u8,
+        },
+    })) orelse return error.InvalidParams;
+
+    const page = bc.session.currentPage() orelse return error.PageNotLoaded;
+
+    var intercept_state = &bc.intercept_state;
+    const request_id = try idFromRequestId(params.requestId);
+    const transfer = intercept_state.remove(request_id) orelse return error.RequestNotFound;
+
+    log.debug(.cdp, "request intercept", .{
+        .state = "continue with auth",
+        .id = transfer.id,
+        .response = params.authChallengeResponse.response,
+    });
+
+    if (!std.mem.eql(u8, params.authChallengeResponse.response, "ProvideCredentials")) {
+        transfer.abort(); // Is it the correct way to cancel the transfer?
+        transfer.deinit();
+        return cmd.sendResult(null, .{});
+    }
+
+    // cancel the request, deinit the transfer on error.
+    errdefer {
+        transfer.abort(); // Is it the correct way to cancel the transfer?
+        transfer.deinit();
+    }
+
+    const username = params.authChallengeResponse.username orelse "";
+    const password = params.authChallengeResponse.password orelse "";
+
+    // restart the request with the provided credentials.
+    // we need to duplicate the cre
+    const arena = transfer.arena.allocator();
+    transfer.updateCredentials(
+        try std.fmt.allocPrintZ(arena, "{s}:{s}", .{ username, password }),
+    );
+
+    try bc.cdp.browser.http_client.process(transfer);
+
+    if (intercept_state.empty()) {
+        page.request_intercepted = false;
+    }
+
+    return cmd.sendResult(null, .{});
+}
+
 fn fulfillRequest(cmd: anytype) !void {
     const bc = cmd.browser_context orelse return error.BrowserContextNotLoaded;
 
@@ -346,6 +398,92 @@ fn failRequest(cmd: anytype) !void {
     return cmd.sendResult(null, .{});
 }
 
+const AuthChallenge = struct {
+    scheme: enum { basic, digest },
+    realm: []const u8,
+
+    // https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/WWW-Authenticate
+    // Supports only basic and digest schemes.
+    pub fn parse(header: []const u8) !AuthChallenge {
+        var ac: AuthChallenge = .{
+            .scheme = undefined,
+            .realm = "",
+        };
+
+        const pos = std.mem.indexOfPos(u8, std.mem.trim(u8, header, std.ascii.whitespace[0..]), 0, " ") orelse header.len;
+        const _scheme = header[0..pos];
+        if (std.ascii.eqlIgnoreCase(_scheme, "basic")) {
+            ac.scheme = .basic;
+        } else if (std.ascii.eqlIgnoreCase(_scheme, "digest")) {
+            ac.scheme = .digest;
+        } else {
+            return error.UnknownAuthChallengeScheme;
+        }
+
+        // TODO get the realm
+
+        return ac;
+    }
+};
+
+pub fn requestAuthRequired(arena: Allocator, bc: anytype, intercept: *const Notification.RequestAuthRequired) !void {
+    // unreachable because we _have_ to have a page.
+    const session_id = bc.session_id orelse unreachable;
+    const target_id = bc.target_id orelse unreachable;
+    const page = bc.session.currentPage() orelse unreachable;
+
+    // We keep it around to wait for modifications to the request.
+    // NOTE: we assume whomever created the request created it with a lifetime of the Page.
+    // TODO: What to do when receiving replies for a previous page's requests?
+
+    const transfer = intercept.transfer;
+    try bc.intercept_state.put(transfer);
+
+    var challenge: AuthChallenge = undefined;
+    var source: enum { server, proxy } = undefined;
+    var it = transfer.responseHeaderIterator();
+    while (it.next()) |hdr| {
+        if (std.ascii.eqlIgnoreCase("WWW-Authenticate", hdr.name)) {
+            source = .server;
+            challenge = try AuthChallenge.parse(hdr.value);
+            break;
+        }
+        if (std.ascii.eqlIgnoreCase("Proxy-Authenticate", hdr.name)) {
+            source = .proxy;
+            challenge = try AuthChallenge.parse(hdr.value);
+            break;
+        }
+    }
+
+    try bc.cdp.sendEvent("Fetch.authRequired", .{
+        .requestId = try std.fmt.allocPrint(arena, "INTERCEPT-{d}", .{transfer.id}),
+        .request = network.TransferAsRequestWriter.init(transfer),
+        .frameId = target_id,
+        .resourceType = switch (transfer.req.resource_type) {
+            .script => "Script",
+            .xhr => "XHR",
+            .document => "Document",
+        },
+        .authChallenge = .{
+            .source = if (source == .server) "Server" else "Proxy",
+            .origin = "", // TODO get origin, could be the proxy address for example.
+            .scheme = if (challenge.scheme == .digest) "digest" else "basic",
+            .realm = challenge.realm,
+        },
+        .networkId = try std.fmt.allocPrint(arena, "REQ-{d}", .{transfer.id}),
+    }, .{ .session_id = session_id });
+
+    log.debug(.cdp, "request auth required", .{
+        .state = "paused",
+        .id = transfer.id,
+        .url = transfer.uri,
+    });
+    // Await continueWithAuth
+
+    intercept.wait_for_interception.* = true;
+    page.request_intercepted = true;
+}
+
 // Get u64 from requestId which is formatted as: "INTERCEPT-{d}"
 fn idFromRequestId(request_id: []const u8) !u64 {
     if (!std.mem.startsWith(u8, request_id, "INTERCEPT-")) {
diff --git a/src/http/Client.zig b/src/http/Client.zig
@@ -331,6 +331,11 @@ fn makeRequest(self: *Client, handle: *Handle, transfer: *Transfer) !void {
             try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_COOKIE, cookies));
         }
 
+        // Proxy credentials
+        if (req.credentials) |creds| {
+            try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_PROXYUSERPWD, creds.ptr));
+        }
+
         try errorCheck(c.curl_easy_setopt(easy, c.CURLOPT_PRIVATE, transfer));
     }
 
@@ -372,10 +377,24 @@ fn perform(self: *Client, timeout_ms: c_int) !void {
         const easy = msg.easy_handle.?;
         const transfer = try Transfer.fromEasy(easy);
 
+        var code: c_long = undefined;
+        try errorCheck(c.curl_easy_getinfo(easy, c.CURLINFO_RESPONSE_CODE, &code));
+        std.debug.print("FAILED REQ: {any}\n", .{code});
+
         // release it ASAP so that it's available; some done_callbacks
         // will load more resources.
         self.endTransfer(transfer);
 
+        // If the transfer is waiting for auth challenge interception, don't
+        // deinit the transfer and don't call the callbacks. All will be done
+        // later during the interception's response.
+        // we only reset the transfer to release the handle and be reused later.
+        if (transfer._auth_challenge) {
+            log.debug(.http, "transfer reset", .{});
+            transfer.reset();
+            continue;
+        }
+
         defer transfer.deinit();
 
         if (errorCheck(msg.data.result)) {
@@ -540,6 +559,7 @@ pub const Request = struct {
     body: ?[]const u8 = null,
     cookie_jar: *CookieJar,
     resource_type: ResourceType,
+    credentials: ?[:0]const u8 = null,
 
     // arbitrary data that can be associated with this request
     ctx: *anyopaque = undefined,
@@ -577,6 +597,9 @@ pub const Transfer = struct {
     _handle: ?*Handle = null,
 
     _redirecting: bool = false,
+    // True when a request returns a 401 or 407 and we wait for a request
+    // interception to continue with auth.
+    _auth_challenge: bool = false,
 
     // use_proxy is set when the transfer has been associated to a given
     // connection in makeRequest().
@@ -585,7 +608,7 @@ pub const Transfer = struct {
     // stateful variables used to parse responses headers.
     _resp_header_status: enum { empty, first, next, end } = .empty,
 
-    fn deinit(self: *Transfer) void {
+    pub fn deinit(self: *Transfer) void {
         self.req.headers.deinit();
         if (self._handle) |handle| {
             self.client.handles.release(handle);
@@ -594,6 +617,21 @@ pub const Transfer = struct {
         self.client.transfer_pool.destroy(self);
     }
 
+    fn reset(self: *Transfer) void {
+        if (self._handle) |handle| {
+            self.client.handles.release(handle);
+            self._handle = null;
+        }
+        self.bytes_received = 0;
+        self.proxy_response_header = null;
+        self.response_header = null;
+        self._notified_fail = false;
+        self._redirecting = false;
+        self._auth_challenge = false;
+        self._use_proxy = false;
+        self._resp_header_status = .empty;
+    }
+
     pub fn format(self: *const Transfer, comptime _: []const u8, _: std.fmt.FormatOptions, writer: anytype) !void {
         const req = self.req;
         return writer.print("{s} {s}", .{ @tagName(req.method), req.url });
@@ -609,6 +647,10 @@ pub const Transfer = struct {
         self._request_header_list = c.curl_slist_append(self._request_header_list, value);
     }
 
+    pub fn updateCredentials(self: *Transfer, userpwd: [:0]const u8) void {
+        self.req.credentials = userpwd;
+    }
+
     pub fn updateURL(self: *Transfer, url: [:0]const u8) !void {
         // for cookies
         self.uri = try std.Uri.parse(url);
@@ -796,6 +838,25 @@ pub const Transfer = struct {
                     if (i >= ct.?.amount) break;
                 }
 
+                // If the response requires an auth challenge and the auth
+                // interception is enable, we must create a new request and wait
+                // for the interception's response.
+                // We won't call the req's callbacks now, but for the following request only.
+                const status = transfer.response_header.?.status;
+                if (status == 401 or status == 407) {
+                    log.debug(.http, "FORBIDDEN", .{});
+                    if (transfer.client.notification) |notification| {
+                        var wait_for_interception = false;
+                        notification.dispatch(.http_request_auth_required, &.{ .transfer = transfer, .wait_for_interception = &wait_for_interception });
+                        if (wait_for_interception) {
+                            log.debug(.http, "WAIT FOR INTERCEPT", .{});
+                            transfer._auth_challenge = true;
+                            // The user is send an invitation to intercept this request.
+                            return buf_len;
+                        }
+                    }
+                }
+
                 transfer.req.header_callback(transfer) catch |err| {
                     log.err(.http, "header_callback", .{ .err = err, .req = transfer });
                     // returning < buf_len terminates the request
@@ -824,7 +885,7 @@ pub const Transfer = struct {
             return c.CURL_WRITEFUNC_ERROR;
         };
 
-        if (transfer._redirecting) {
+        if (transfer._redirecting or transfer._auth_challenge) {
             return chunk_len;
         }
 
diff --git a/src/http/Http.zig b/src/http/Http.zig
@@ -22,7 +22,7 @@ pub const c = @cImport({
     @cInclude("curl/curl.h");
 });
 
-pub const ENABLE_DEBUG = false;
+pub const ENABLE_DEBUG = true;
 pub const Client = @import("Client.zig");
 pub const Transfer = Client.Transfer;
 
diff --git a/src/notification.zig b/src/notification.zig
@@ -64,6 +64,7 @@ pub const Notification = struct {
         http_request_start: List = .{},
         http_request_intercept: List = .{},
         http_request_done: List = .{},
+        http_request_auth_required: List = .{},
         http_response_data: List = .{},
         http_response_header_done: List = .{},
         notification_created: List = .{},
@@ -77,6 +78,7 @@ pub const Notification = struct {
         http_request_fail: *const RequestFail,
         http_request_start: *const RequestStart,
         http_request_intercept: *const RequestIntercept,
+        http_request_auth_required: *const RequestAuthRequired,
         http_request_done: *const RequestDone,
         http_response_data: *const ResponseData,
         http_response_header_done: *const ResponseHeaderDone,
@@ -106,6 +108,11 @@ pub const Notification = struct {
         wait_for_interception: *bool,
     };
 
+    pub const RequestAuthRequired = struct {
+        transfer: *Transfer,
+        wait_for_interception: *bool,
+    };
+
     pub const ResponseData = struct {
         data: []const u8,
         transfer: *Transfer,

Original file line number	Diff line number	Diff line change
`@@ -477,12 +477,16 @@ pub fn BrowserContext(comptime CDP_T: type) type {`
`477`	`477`	`self.cdp.browser.notification.unregister(.http_response_header_done, self);`
`478`	`478`	`}`
`479`	`479`
`480`		`- pub fn fetchEnable(self: *Self) !void {`
	`480`	`+ pub fn fetchEnable(self: *Self, authRequests: bool) !void {`
`481`	`481`	`try self.cdp.browser.notification.register(.http_request_intercept, self, onHttpRequestIntercept);`
	`482`	`+ if (authRequests) {`
	`483`	`+ try self.cdp.browser.notification.register(.http_request_auth_required, self, onHttpRequestAuthRequired);`
	`484`	`+ }`
`482`	`485`	`}`
`483`	`486`
`484`	`487`	`pub fn fetchDisable(self: *Self) void {`
`485`	`488`	`self.cdp.browser.notification.unregister(.http_request_intercept, self);`
	`489`	`+ self.cdp.browser.notification.unregister(.http_request_auth_required, self);`
`486`	`490`	`}`
`487`	`491`
`488`	`492`	`pub fn onPageRemove(ctx: *anyopaque, _: Notification.PageRemove) !void {`
`@@ -548,6 +552,12 @@ pub fn BrowserContext(comptime CDP_T: type) type {`
`548`	`552`	`try gop.value_ptr.appendSlice(arena, try arena.dupe(u8, msg.data));`
`549`	`553`	`}`
`550`	`554`
	`555`	`+ pub fn onHttpRequestAuthRequired(ctx: anyopaque, data: const Notification.RequestAuthRequired) !void {`
	`556`	`+ const self: *Self = @alignCast(@ptrCast(ctx));`
	`557`	`+ defer self.resetNotificationArena();`
	`558`	`+ try @import("domains/fetch.zig").requestAuthRequired(self.notification_arena, self, data);`
	`559`	`+ }`
	`560`	`+`
`551`	`561`	`fn resetNotificationArena(self: *Self) void {`
`552`	`562`	`defer _ = self.cdp.notification_arena.reset(.{ .retain_with_limit = 1024 * 64 });`
`553`	`563`	`}`