如何用 PHP 和 Symfony BrowserKit 识别 Capy Puzzle

# symfony/mime is needed for any POST, css-selector for filter()
composer require capskip/capskip symfony/browser-kit symfony/http-client symfony/mime symfony/css-selector

<?php
// composer require capskip/capskip symfony/browser-kit symfony/http-client symfony/mime symfony/css-selector
require __DIR__ . '/vendor/autoload.php';

use Symfony\Component\BrowserKit\HttpBrowser;
use Symfony\Component\HttpClient\HttpClient;

const PAGE_URL = 'https://example.com/login';

// HttpBrowser keeps the cookies, follows redirects and sends a Referer.
$browser = new HttpBrowser(HttpClient::create());
$page = $browser->request('GET', PAGE_URL);
$status = $browser->getInternalResponse()->getStatusCode();
if ($status !== 200) {
    throw new RuntimeException("The page answered {$status}, not the form.");
}

// The widget script's k= parameter is the key, and everything before
// /puzzle/get_js/ is the Capy host.
$script = $page->filter('script[src*="/puzzle/get_js/"]');
$src = $script->count() ? $script->attr('src') : '';
if (str_starts_with($src, '//')) {
    $src = 'https:' . $src;
}
parse_str((string) parse_url($src, PHP_URL_QUERY), $query);
$key = $query['k'] ?? $page->filter('input[name="capy_captchakey"]')->attr('value', '');
$apiServer = strstr($src, '/puzzle/get_js/', true) ?: null;

// The form around the widget, or else the page's first POST form.
$widget = $page->filter('script[src*="/puzzle/get_js/"], input[name="capy_captchakey"]');
$formNode = ($widget->count() ? $widget->closest('form') : null)
    ?? $page->filter('form')->reduce(fn ($f) => strtolower((string) $f->attr('method')) === 'post')->first();
echo $key, ' ', $apiServer ?? 'default host', ' ', $formNode->count(), PHP_EOL;

// composer require capskip/capskip
use CapSkip\CapSkip;

$solver = new CapSkip([
    'host' => '127.0.0.1',
    'port' => 8080,
    // Capy answers after a two second hold; poll often enough to catch it.
    'pollingInterval' => 0.5,
]);

// The page's real URL, after any redirect. A null api_server (no widget
// script in the HTML) is dropped, so CapSkip uses its default host.
$pageUrl = $browser->getHistory()->current()->getUri();
$result = $solver->capy($key, $pageUrl, ['api_server' => $apiServer]);

echo $result['captchakey'], PHP_EOL;     // goes in capy_captchakey
echo $result['challengekey'], PHP_EOL;   // goes in capy_challengekey
echo $result['answer'], PHP_EOL;         // goes in capy_answer

// The form's own fields, the hidden CSRF token included.
$form = $formNode->form();

// $form->setValues() would throw Unreachable field: the widget never
// ran, so the form has no capy_ fields. Send them through request().
$fields = array_replace($form->getPhpValues(), [
    // Use the page's own field names, password included.
    'username' => 'YOUR_USERNAME',
    'capy_captchakey' => $result['captchakey'],
    'capy_challengekey' => $result['challengekey'],
    'capy_answer' => $result['answer'],
]);
$browser->request($form->getMethod(), $form->getUri(), $fields);

// After a redirect, this is where the login landed.
echo $browser->getInternalResponse()->getStatusCode(), ' ',
    $browser->getHistory()->current()->getUri(), PHP_EOL;

function solveCapy(\CapSkip\CapSkip $solver, string $key, string $url, array $options = [], int $attempts = 3): array
{
    for ($attempt = 1; ; $attempt++) {
        try {
            return $solver->capy($key, $url, $options);
        } catch (\CapSkip\Exceptions\ApiException $e) {
            // A missed hole reads as unsolvable, and the next try draws a
            // new puzzle. Anything else, such as a wrong API key, is final.
            if (!str_contains($e->getMessage(), 'UNSOLVABLE') || $attempt >= $attempts) {
                throw $e;
            }
        }
    }
}

<?php
// composer require capskip/capskip symfony/browser-kit symfony/http-client symfony/mime symfony/css-selector
// login.php: run with php login.php
declare(strict_types=1);

require __DIR__ . '/vendor/autoload.php';

use CapSkip\CapSkip;
use CapSkip\Exceptions\ApiException;
use CapSkip\Exceptions\CapSkipError;
use CapSkip\Exceptions\TimeoutException;
use CapSkip\Exceptions\ValidationException;
use Symfony\Component\BrowserKit\HttpBrowser;
use Symfony\Component\HttpClient\HttpClient;

const PAGE_URL = 'https://example.com/login';

$solver = new CapSkip([
    'apiKey' => getenv('CAPSKIP_API_KEY') ?: 'capskip',
    'host' => getenv('CAPSKIP_HOST') ?: '127.0.0.1',
    'port' => (int) (getenv('CAPSKIP_PORT') ?: 8080),
    'pollingInterval' => 0.5,
]);

function solveCapy(CapSkip $solver, string $key, string $url, array $options = [], int $attempts = 3): array
{
    for ($attempt = 1; ; $attempt++) {
        try {
            return $solver->capy($key, $url, $options);
        } catch (ApiException $e) {
            // A missed hole reads as unsolvable; the next try draws a new puzzle.
            if (!str_contains($e->getMessage(), 'UNSOLVABLE') || $attempt >= $attempts) {
                throw $e;
            }
            echo "attempt {$attempt}: {$e->getMessage()}", PHP_EOL;
        }
    }
}

function logIn(CapSkip $solver, string $pageUrl, array $credentials): HttpBrowser
{
    // One browser per login: it owns the cookie jar and the history.
    $browser = new HttpBrowser(HttpClient::create());
    $page = $browser->request('GET', $pageUrl);
    $status = $browser->getInternalResponse()->getStatusCode();
    if ($status !== 200) {
        throw new RuntimeException("The page answered {$status}, not the form.");
    }
    $pageUrl = $browser->getHistory()->current()->getUri();

    $script = $page->filter('script[src*="/puzzle/get_js/"]');
    $src = $script->count() ? $script->attr('src') : '';
    if (str_starts_with($src, '//')) {
        $src = 'https:' . $src;
    }
    parse_str((string) parse_url($src, PHP_URL_QUERY), $query);
    $key = $query['k'] ?? $page->filter('input[name="capy_captchakey"]')->attr('value', '');
    if (!str_starts_with($key, 'PUZZLE_')) {
        throw new RuntimeException('No PUZZLE_ key in the HTML; find it in DevTools.');
    }
    $apiServer = strstr($src, '/puzzle/get_js/', true) ?: null;

    $widget = $page->filter('script[src*="/puzzle/get_js/"], input[name="capy_captchakey"]');
    $formNode = $widget->closest('form')
        ?? $page->filter('form')->reduce(fn ($f) => strtolower((string) $f->attr('method')) === 'post')->first();
    if (!$formNode->count()) {
        throw new RuntimeException('No POST form on the page; select it by id.');
    }
    $form = $formNode->form();

    $result = solveCapy($solver, $key, $pageUrl, ['api_server' => $apiServer]);

    // All three together, straight away: the challenge key is single-use.
    $browser->request($form->getMethod(), $form->getUri(), array_replace(
        $form->getPhpValues(),
        $credentials,
        [
            'capy_captchakey' => $result['captchakey'],
            'capy_challengekey' => $result['challengekey'],
            'capy_answer' => $result['answer'],
        ],
    ));

    return $browser;
}

try {
    // Use the page's own field names.
    $browser = logIn($solver, PAGE_URL, ['username' => 'YOUR_USERNAME', 'password' => 'YOUR_PASSWORD']);
    // A redirect to the account page means it worked; $browser keeps that session.
    $status = $browser->getInternalResponse()->getStatusCode();
    echo $status, ' ', $browser->getHistory()->current()->getUri(), PHP_EOL;
    exit($status < 400 ? 0 : 1);
} catch (ValidationException $e) {
    fwrite(STDERR, "not sent: {$e->getMessage()}" . PHP_EOL);
    exit(1);
} catch (TimeoutException $e) {
    fwrite(STDERR, 'gave up after defaultTimeout' . PHP_EOL);
    exit(1);
} catch (CapSkipError $e) {
    fwrite(STDERR, 'solve failed: ' . get_class($e) . ": {$e->getMessage()}" . PHP_EOL);
    exit(1);
} catch (RuntimeException $e) {
    // The page itself, or the network on the way to it.
    fwrite(STDERR, get_class($e) . ": {$e->getMessage()}" . PHP_EOL);
    exit(1);
}