Repository navigation
Conversation
Issue #179: adding a PikPak storage always failed unless the user supplied a client_id, and the storage form had no such field at all. Commit a316fb9 removed the PikPak client_id/client_secret defaults and left the constructor falling back to an empty string. Every storage init therefore sent `client_id=` to /v1/shield/captcha/init and /v1/auth/signin, which the server rejects, so the mount never came up and /pikpak returned 404. Restore the official PikPak web/android/pc application identifiers (the same values used by the Go backend and NextList) as defaults, document that they are public app identifiers rather than user-owned OAuth secrets, keep addition.client_id/client_secret as an override, and treat blank overrides as absent so a whitespace-only form value cannot wipe the credentials again. Also expose the two fields as optional inputs on the PikPak storage form. Validation: pikpak tests 8/8, test:drivers 200/200, test:server 220/220, tsc --noEmit clean. Co-authored-by: DeepSeek <noreply@deepseek.com>
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
openlist-tsworkers | 55395cb | Nov 09 2026, 11:34 AM |
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
openlist-work | 55395cb | Nov 10 2026, 03:32 AM |
After #186 restored the built-in client credentials, adding a PikPak storage can still fail with `PikPak login failed (4126): AccessProhibited`. The login path diverged from the Go backend and the web client in four ways: 1. login() only requested a captcha token when the client had none. The token is persisted into addition.captcha_token after the first login, so every later attempt signed in with an expired token. 2. The pre-login captcha/init call omitted client_version, package_name, timestamp and captcha_sign. 3. auth/signin sent X-Device-ID and X-Captcha-Token. Those headers belong to the native SDK; combined with web credentials PikPak answers AccessProhibited. 4. auth/token (refresh) sent a browser UA and X-Device-ID. Refresh the captcha token on every login, clear the stale access token first, add the missing captcha metas, keep only Content-Type/User-Agent on signin, and send an empty UA without X-Device-ID on refresh. A 4126 response retries once with a freshly issued captcha token before surfacing an actionable error. Validation: pikpak tests 13/13, test:drivers 205/205, tsc --noEmit clean. Co-authored-by: DeepSeek <noreply@deepseek.com>
Port the parts of OpenList-Backends/drivers/pikpak/util.go (upstream e73a80c7) that the TS driver still lacked: - refreshToken() 4126 now re-logins only when both username and password are present; otherwise it asks for a new refresh_token instead of a generic refresh error. - Add the skip_verification addition flag (same semantics as Go): a captcha response carrying a human verification url fails by default and is ignored only when the flag is explicitly enabled. - Expose skip_verification on the PikPak storage form. Keep the Go-vs-TS comparison table in the PR doc updated, including the one intentionally retained difference: Go makes a post-login captcha failure fatal in Init(), while TS logs a warning and relies on the code 9 retry path. Validation: pikpak tests 15/15, test:drivers 207/207, test:server 220/220, tsc --noEmit clean. Co-authored-by: DeepSeek <noreply@deepseek.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary / 摘要
PikPak 存储在 TSWorker 中「只填账号密码却永远添加失败」（#179）。
根因：a316fb9 删除了 PikPak 三平台的 client_id/client_secret 默认值，
构造器回退到空字符串，而表单没有 client_id 字段可填。于是 init() →
login()/refreshToken() → captcha/init 与 auth/signin 全部带空 client_id，
被服务端拒绝，存储初始化失败；未挂载时访问 /pikpak 即 404。
Go 版（drivers/pikpak/util.go）与 NextList 内置同一组官方客户端标识，
因此「只填用户名密码」可用。
用户可感知变化
实现
则回退；注释说明其为官方客户端公开应用标识（与 189_tv/thunder/pikpak_share
保留协议级固定密钥的口径一致）。
pc=YvtoWO6GNHiuCl7x，client_secret 同样逐字一致。
Fixes #179
Testing
npx tsx --test "src/backend/drivers/pikpak/*.test.ts" # 8/8
npm run test:drivers # 200/200
npm run test:server # 220/220
npm run lint # exit 0
新增 util.test.ts：三平台默认值、空白覆盖回退、只有账号密码即可登录且
captcha/signin 请求带非空 client_id 且 token 正常持久化。
未做真实账号端到端登录（CI 无凭据、会触发风控），建议合并前手动回归。
AI Disclosure
CodeBuddy（DeepSeek-V4.1-Flash），范围：代码 / 测试 / 文档，已人工复核。