autoreg-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok60915d52e8425
@@ -0,0 +1,98 @@
|
||||
# API-First Registration + Turnstile Bypass — Lovable.dev Example
|
||||
|
||||
## Context
|
||||
|
||||
Session: 2026-08-04. Goal: register accounts on lovable.dev. The signup is blocked by Cloudflare Turnstile (CDP detection). The site uses SolidStart (SolidJS) with Firebase Auth backend.
|
||||
|
||||
## Signup Flow
|
||||
|
||||
1. `GET https://lovable.dev/signup` — initial page with email-only field
|
||||
2. Enter email → hits `POST https://api.lovable.dev/auth/check-auth-provider` `{email}`
|
||||
- Returns provider list, userExists flag, domainLock, recoveryState
|
||||
3. Password form appears → Turnstile widget rendered with sitekey `0x4AAAAAAChnKAZBY0iFpFHC`
|
||||
4. Form submit:
|
||||
- Calls `POST https://api.lovable.dev/auth/turnstile-signup` `{email, token}` → 204
|
||||
- Then Firebase `createUserWithEmailAndPassword(email, password)`
|
||||
5. After account creation → redirect to `/verify-email` or login
|
||||
|
||||
## SolidStart Server Function Pattern
|
||||
|
||||
The form uses SolidStart RPC: `/_serverFn/<sha256hash>`. These hash-based endpoints proxy to `api.lovable.dev`.
|
||||
|
||||
- `/_serverFn/[REDACTED-KEY]` — email check (GET)
|
||||
- Refresh between page loads — hashes change per deploy
|
||||
|
||||
## 2captcha Configuration
|
||||
|
||||
```python
|
||||
import requests, time
|
||||
|
||||
def solve_turnstile(sitekey, pageurl, action="signup_email_password", api_key="[REDACTED-KEY]", timeout=60):
|
||||
r = requests.get("https://2captcha.com/in.php", params={
|
||||
"key": api_key, "method": "turnstile",
|
||||
"sitekey": sitekey, "pageurl": pageurl,
|
||||
"action": action, "json": 1
|
||||
}, timeout=10)
|
||||
if r.json().get("status") != 1:
|
||||
return None
|
||||
cid = r.json()["request"]
|
||||
for _ in range(timeout // 3):
|
||||
time.sleep(3)
|
||||
r2 = requests.get("https://2captcha.com/res.php", params={
|
||||
"key": api_key, "action": "get", "id": cid, "json": 1
|
||||
}, timeout=10)
|
||||
if r2.json().get("status") == 1:
|
||||
return r2.json()["request"]
|
||||
return None
|
||||
```
|
||||
|
||||
**Key params**: `method=turnstile`, `action=signup_email_password` (must match the widget's action). Token is ~837 chars.
|
||||
|
||||
## Turnstile CDP Detection
|
||||
|
||||
- Chrome DevTools Protocol is detected by Turnstile's implicit challenge mode
|
||||
- Clicking the checkbox via CDP tools (`mcp__chrome_devtools__click`) produces: URL changes from `/new/normal` to `/failure_retry/normal`, iframe shows "Сбой проверки" (Verification failure)
|
||||
- Multiple retries with 2captcha tokens still fail because the form framework (`turnstile.getResponse()`) returns empty even when the hidden input is set
|
||||
- The Turnstile iframe also resets itself between clicks, each time showing `/new/normal`
|
||||
|
||||
## Key API Endpoint
|
||||
|
||||
`POST https://api.lovable.dev/auth/turnstile-signup`
|
||||
|
||||
Headers required:
|
||||
- `Content-Type: application/json`
|
||||
- `Origin: https://lovable.dev`
|
||||
- `User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36`
|
||||
|
||||
Body: `{"email": "user@example.com", "token": "<2captcha-solved-token>"}`
|
||||
|
||||
Returns: `204 No Content` on success.
|
||||
|
||||
Rate limit: 2000/hour (x-ratelimit-remaining starts at 2000).
|
||||
|
||||
## Temp-Mail Domain Blocklist
|
||||
|
||||
Lovable maintains a large blocked-domain Set (`po`) with ~300 entries in the JS bundle. Common blocked patterns:
|
||||
- `yopmail.com`, `guerrillamail.com`, `mail.tm`, `tempmail` domains
|
||||
- Any `.sbs`, `.rest` TLDs
|
||||
- Domains with `+` in the local part (plus-addressing) unless on whitelist (`lovable.dev` only)
|
||||
- Full list visible in the `LoginSignupForm*` JS bundle under `po = new Set([...])`
|
||||
|
||||
## JS Bundle Discovery Pattern
|
||||
|
||||
1. Load page → extract modulepreloads from `<link rel="modulepreload">`
|
||||
2. Read importmap `<script type="importmap">` — maps old hash names to current ones
|
||||
3. Target files: `signup-*.js`, `LoginSignupForm-*.js`, `_auth-*.js`
|
||||
4. Search for turnstile-sitekey, serverFn calls, API endpoints
|
||||
5. The importmap format: `{"/assets/old-name.js": "/assets/new-name.js"}`
|
||||
|
||||
## Firebase Auth Integration
|
||||
|
||||
After turnstile validation, the client-side bundle calls Firebase Auth REST API via `identitytoolkit.googleapis.com/v1/accounts:signUp?key=<API_KEY>`. The API key is embedded in the webpack/rolldown bundle (not on `window.firebase`).
|
||||
|
||||
## What Didn't Work
|
||||
|
||||
- Setting `cf-turnstile-response` input value directly — form still shows disabled button
|
||||
- Clicking Turnstile checkbox via CDP — detected and rejected
|
||||
- Puppeteer-extra-stealth via browser_navigate tool — Chrome crashes with sandbox error
|
||||
- Standard HTTP client (`requests`) — blocked by Cloudflare
|
||||
@@ -0,0 +1,55 @@
|
||||
# Vercel / v0 referral signup notes
|
||||
|
||||
Date: 2026-07-12
|
||||
Target: `https://v0.app/ref/03TUF8` -> redirects into `https://vercel.com/signup/v0?...`
|
||||
Script: `C:\Users\User\Downloads\Telegram Desktop\bot_hybrid.py`
|
||||
|
||||
## What was changed in the script
|
||||
- Set `REF_CODE = "03TUF8"`.
|
||||
- Added top-level `HEADLESS` flag.
|
||||
- Added `--ref`, `--workers`, `--headless`, `--menu` argparse interface.
|
||||
- Removed `sys.argv.append("-n")` because argparse then fails with `unrecognized arguments: -n`.
|
||||
- Added Chrome args `--no-sandbox` and `--disable-gpu`.
|
||||
- Strengthened form submit fallback from only button/Enter to `form.requestSubmit()` / `form.submit()`.
|
||||
|
||||
## Observed runtime behavior
|
||||
- Browser successfully opened Vercel signup URL.
|
||||
- Email field became visible and accepted the temp-mail address.
|
||||
- `Continue with Email` click logged as successful.
|
||||
- The page stayed on the email form for 60+ seconds.
|
||||
- OTP screen never appeared.
|
||||
|
||||
## Important interpretation
|
||||
This session did NOT prove the referral flow works end-to-end. It only proved:
|
||||
1. navigation works,
|
||||
2. email field fill works,
|
||||
3. initial submit interaction happens.
|
||||
|
||||
It did NOT prove that Vercel accepted the temp mail or actually sent an OTP.
|
||||
|
||||
## Likely causes when this exact symptom appears
|
||||
- Temp-mail domain rejected silently.
|
||||
- Hidden anti-bot/challenge after submit.
|
||||
- Frontend accepted the click but backend refused progression.
|
||||
- The form needs a different post-submit interaction than the visible button path exposed.
|
||||
|
||||
## Recommended next diagnostic pass
|
||||
1. Capture DOM text immediately after submit.
|
||||
2. Capture screenshot after 5s and 30s.
|
||||
3. Log all visible error banners / helper text.
|
||||
4. Swap temp-mail provider before changing the browser stack, unless the user explicitly constrained the provider.
|
||||
5. Only start OTP polling after positive evidence that the page entered verification state.
|
||||
|
||||
## Provider-specific note — mail.tm only
|
||||
|
||||
If the user says to use `mail.tm` only for v0/Vercel signup, do not silently fall back to Gmail aliases, AnyMessage, or another temp-mail provider. Probe `https://api.mail.tm/domains` first and log the returned domains.
|
||||
|
||||
Observed 2026-07-13:
|
||||
- `mail.tm /domains` returned HTTP 200.
|
||||
- Only one domain was available: `web-library.net`.
|
||||
- v0/Vercel did not progress to OTP with that domain; treat this as a target-side domain rejection or anti-bot block until DOM/screenshot proves otherwise.
|
||||
|
||||
Operational rule: when constrained to a single mail provider, report the exact provider/domain status and stop at the verified blocker instead of inventing an alternate inbox path.
|
||||
|
||||
## Known good launch note
|
||||
SeleniumBase first run may spend time auto-downloading `uc_driver.exe` / `chromedriver.exe`; do not misread that bootstrap noise as app behavior.
|
||||
Reference in New Issue
Block a user