feat: support feilian v1 login (platform "feilian_v1") (#89)

* feat: support feilian v1 login (platform "feilian_v1")

The newer feilian backend serves login at /api/v1/login with an
AES-CBC-encrypted password instead of the old /api/login (see #78).
Add an opt-in platform "feilian_v1" implementing it:

- utils::feilian_v1_encrypt_password: AES-256-CBC password encoding
  (key/iv derived from fixed constants), matching the official client
- POST requests now send Content-Type: application/json; the v1 login
  endpoint otherwise rejects the body with "参数错误"
- after login, fetch the TOTP secret from /api/v2/p/otp so 2fa codes
  are generated locally, the same way the existing login flow does
- on exit, log out the current terminal (/api/logout) to free the
  server-side terminal quota; only for feilian_v1, since SSO platforms
  would then need an interactive re-auth on the next run

Refs #78

* fix(client): recover from expired session instead of failing to parse

When the server-side session expires, the API returns a non-zero code
(e.g. 101) with a `data` whose shape no longer matches the success type
T — ListVPN, for example, returns an object where a VPN array is
expected. Deserializing the response straight into Resp<T> failed at
that point, so the run died with an opaque "invalid type: map, expected
a sequence" error and the existing code==101 logout/relogin path never
ran (it lives after the parse).

Parse the envelope into Resp<Value> first to read `code`, and only
coerce `data` into T when code == 0; otherwise carry the code/message
through with data=None. This lets the existing logout handling reset the
state to Init and trigger a (non-interactive, for feilian_v1) re-login
and retry, so an expired session self-heals instead of requiring the
user to manually flip `state` back to Init.

* review: drop redundant comments, hoist crypto imports to file level

Address @PinkD review on #89:
- remove the Content-Type explanatory comment (keep the header)
- shorten the logout comment to "only logout for feilian_v1"
- move aes/cbc/sha1 imports in utils.rs to file level

Author: wilinz

Cargo.lock

@@ -23,6 +23,10 @@ reqwest_cookie_store = "0.6"
 tinytemplate = "1.2"
 md5 = "0.7"
 sha2 = "0.10"
+sha1 = "0.10"
+aes = "0.8"
+cbc = { version = "0.1", features = ["alloc"] }
+hex = "0.4"
 base32 = "0.4"
 base64 = "0.21"
 rand = "0.8"

Cargo.toml

@@ -16,12 +16,18 @@ const URL_GET_CORPLINK_LOGIN_METHOD: &str = "{{url}}/api/lookup?os={{os}}&os_ver
 const URL_REQUEST_CODE: &str = "{{url}}/api/login/code/send?os={{os}}&os_version={{version}}";
 const URL_VERIFY_CODE: &str = "{{url}}/api/login/code/verify?os={{os}}&os_version={{version}}";
 const URL_LOGIN_PASSWORD: &str = "{{url}}/api/login?os={{os}}&os_version={{version}}";
+const URL_LOGIN_PASSWORD_V1: &str =
+    "{{url}}/api/v1/login?os={{os}}&os_version={{version}}&client_source=FeiLian";
 const URL_LIST_VPN: &str = "{{url}}/api/vpn/list?os={{os}}&os_version={{version}}";
 
 const URL_PING_VPN_HOST: &str = "{{url}}/vpn/ping?os={{os}}&os_version={{version}}";
 const URL_FETCH_PEER_INFO: &str = "{{url}}/vpn/conn?os={{os}}&os_version={{version}}";
 const URL_OPERATE_VPN: &str = "{{url}}/vpn/report?os={{os}}&os_version={{version}}";
 const URL_OTP: &str = "{{url}}/api/v2/p/otp?os={{os}}&os_version={{version}}";
+// log out the current terminal so it frees the server-side session/terminal
+// quota. logout_all=false only signs out this device. responds with a 302.
+const URL_LOGOUT: &str =
+    "{{url}}/api/logout?os={{os}}&os_version={{version}}&logout_all=false";
 
 #[derive(Clone, Hash, Eq, PartialEq, Debug)]
 pub enum ApiName {
@@ -31,6 +37,7 @@ pub enum ApiName {
     CorplinkLoginMethod,
     RequestEmailCode,
     LoginPassword,
+    LoginPasswordV1,
     LoginEmail,
     ListVPN,
 
@@ -39,6 +46,7 @@ pub enum ApiName {
     KeepAliveVPN,
     DisconnectVPN,
     Otp,
+    Logout,
 }
 
 #[derive(Clone, Serialize)]
@@ -84,12 +92,17 @@ impl ApiUrl {
         api_template.insert(ApiName::RequestEmailCode, Template::new(URL_REQUEST_CODE));
         api_template.insert(ApiName::LoginEmail, Template::new(URL_VERIFY_CODE));
         api_template.insert(ApiName::LoginPassword, Template::new(URL_LOGIN_PASSWORD));
+        api_template.insert(
+            ApiName::LoginPasswordV1,
+            Template::new(URL_LOGIN_PASSWORD_V1),
+        );
         api_template.insert(ApiName::ListVPN, Template::new(URL_LIST_VPN));
         api_template.insert(ApiName::PingVPN, Template::new(URL_PING_VPN_HOST));
         api_template.insert(ApiName::ConnectVPN, Template::new(URL_FETCH_PEER_INFO));
         api_template.insert(ApiName::KeepAliveVPN, Template::new(URL_OPERATE_VPN));
         api_template.insert(ApiName::DisconnectVPN, Template::new(URL_OPERATE_VPN));
         api_template.insert(ApiName::Otp, Template::new(URL_OTP));
+        api_template.insert(ApiName::Logout, Template::new(URL_LOGOUT));
 
         Ok(ApiUrl {
             user_param: UserUrlParam {
@@ -120,8 +133,10 @@ impl ApiUrl {
             ApiName::RequestEmailCode => self.api_template[name].render(user_param),
             ApiName::LoginEmail => self.api_template[name].render(user_param),
             ApiName::LoginPassword => self.api_template[name].render(user_param),
+            ApiName::LoginPasswordV1 => self.api_template[name].render(user_param),
             ApiName::ListVPN => self.api_template[name].render(user_param),
             ApiName::Otp => self.api_template[name].render(user_param),
+            ApiName::Logout => self.api_template[name].render(user_param),
 
             ApiName::PingVPN => self.api_template[name].render(vpn_param),
             ApiName::ConnectVPN => self.api_template[name].render(vpn_param),