Zebra: Can't login to Spark.dev store on Zebra beta6a

[xxHoBoZxx]

Describe the bug
I am having a problem logging in to Spark.dev store in the latest beta. It takes me to the website to login and I do, but it just stays there and I can not continue. All I see is a "cancel" button. His is the only store that I can not login to. I may be missing something, if so tell me.

Also I have to login to each yourepo source individually. Is this the way it has to be? If so, then I can live with that.

To Reproduce
Try to login to Spark.dev store in Zebra beta

Expected behavior
To login and Zebra continues.

Screenshots

Device Information:

• iOS Version: <13.5>
• Zebra Version: < beta6a>
• Device Type:
• Jailbreak Type: < checkra1n>

[gkeep]

Can confirm. Though, it's been like this since forever.

I think this might be on SparkDev's end since his DRM system is unlike others I've seen: you can download all packages (doesn't matter if it's free or paid), but once installed you have to login to sparkdev.me via tweak preferences to verify the purchase. Which might confuse Zebra, since it can't identify if the package is actually free or not.

On the other hand Zebra should open login page instead of main page. Manually navigating to the login page will result to the issue above.

[absidue]

Zebra opens the URIs provided by the source. Can you please check if it works correctly in Sileo?

[xxHoBoZxx]

I don't use Sileo, sorry. Maybe someone else could try.

[gkeep]

Can you please check if it works correctly in Sileo?

I wouldn't say correctly, but it certainly does it differently.

Sileo opens following URL: https://www.sparkdev.me/sileo/authenticate?udid=$UDID&model=$MODEL, where $UDID is device's UDID and $MODEL is device's model.
It just logs in as a blank user without any tweaks.

Screen recording.

[wstyres]

We call the same URL as you can see here every other source seems to work fine so I don't think this is necessarily a problem on Zebra's end.

[gkeep]

CC @SparkDev97

[SparkDev97]

CC @SparkDev97

I simply implemented it as Sileo expected it, but returned a dummy account. Just so that I could mark my packages as commercial (Because apparently setting that from the control file isn't enough, like it is for Cydia).
I have no need for these payment/store endpoints, and therefore have no intention to implement them fully.

I did however set it up for Sileo and it's been this way for years. I can confirm it works fine in the latest version of Sileo and other package managers.

The authenticate end point returns just as Sileo expects, but the information is just dummy info - there's no reason for it not to work.

I believe, maybe, the usage of this api may not be the same in Zebra. The other managers may be pulling the price from "/sileo/payments/package/info" and the verification of whether a user owns a package is likely done from "/sileo/payments/package/authorize_download". Where as (and this is a guess - I haven't looked at the source), maybe Zebra is relying on the information returned when the account is returned? Or something along those lines...

I hope this can be of some help.

[wstyres]

@SparkDev97 the problem here is more that when Zebra calls the authenticate URL we're not getting returned the same "dummy login" page that Sileo has. It takes us to your homepage instead and therefore users can't "log in" with the dummy account. That is what the issue is describing. The usage of the API is the same as Sileo so I don't really see why this is happening as everything works properly with other sources.

We also check the price from /sileo/payments/package/info and also authorize the package from authorize_download. However, this can't be done without account information due to how the API is structured. We simply don't have the account information so we can't check price or authorize downloads.

[SparkDev97]

@SparkDev97 the problem here is more that when Zebra calls the authenticate URL we're not getting returned the same "dummy login" page that Sileo has. It takes us to your homepage instead and therefore users can't "log in" with the dummy account. That is what the issue is describing. The usage of the API is the same as Sileo so I don't really see why this is happening as everything works properly with other sources.

We also check the price from /sileo/payments/package/info and also authorize the package from authorize_download. However, this can't be done without account information due to how the API is structured. We simply don't have the account information so we can't check price or authorize downloads.

It’s clearly something specific with the handling of the API from Zebra considering it’s fine from a Sileo and other package managers that are using this API. I’m happy to try and figure out why, but I simply cannot see how it’s something on my end at this point..

Browsing to “ https://www.sparkdev.me/sileo/authenticate” can even be done from a standard browser. There’s no reason it shouldn’t work from Zebra.

When the button is clicked from the authenticate page, all it does is navigate to “sileo://authentication_success?token=BEARER%20TEST&payment_secret=TEST”.

The authorize_download end point will accept anything as the bearer, but the authenticate login will return just a dummy bearer which Zebra should be able to use

Couple of questions:

Would you be able to tell me what URL exactly Zebra is trying to browse to?

Does this actually prevent the usage of my repo through Zebra?

=== EDIT ===

So I just tried the latest Zebra beta myself.
Firstly, I just wanted to say - it's been a long time since I've tried out Zebra and it seems to have come a long way. Looking and running really nicely.
Secondly, it seems my tweaks can be downloaded and installed just fine. So I don't see a particular issue with it. It marks them as paid where necessary. The fact you can't login is not an issue, as there is no login.
I'm just having a look to see if I can figure out what URL it's hitting now.

[wstyres]

The URL it is trying to access is https://sparkdev.me/sileo/payments/authenticate?udid=<udid>&model=<model> Whereas you're saying it should be https://www.sparkdev.me/sileo/authenticate but the payment_endpoint you provide is https://www.sparkdev.me/sileo/payments. I haven't tried downloads so I don't know, the user is reporting just an issue with login.

EDIT: If there is no login then I don't really see an issue here 😛

[SparkDev97]

Yep as I just said, there's no issue here then.
Strange about that 'payment_endpoint' though. Why aren't the other package managers having issues with that?... But thanks for pointing it out, I can handle it from my end then.

I'll change it for now and hope it doesn't break anything else, and then at least users will see my warning page.

Thanks for discussing this with me, and keep up the great work with Zebra. It really is looking and working really well now.

=== EDIT ===
I have now updated it so it can provide the login page from both "/sileo/payments/authenticate" and "/sileo/authenticate". So now the page is showing up in Zebra.
You should now be able to close this issue.

[wstyres]

Thanks for the help @SparkDev97! I'll close the issue.

[xxHoBoZxx]

I just bought TapticKeys from Spark's repo. I downloaded it fine and then was able to purchase it through his payment API. I had no problem downloading it with Zebra since his packages do not require you to purchase before downloading.

The problem in Zebra is when you go to the Stores section and try to login to Spark.dev repo, that is when it would not continue even though I was showing as being logged in to the site, the page never redirected me back to Zebra. There was only a cancel button.

EDIT: Sorry, by the time I posted my comment I see you closed this issue.

[xxHoBoZxx]

Just checked with Zebra and I was able to login to Spark's repo, even though it just says "[email protected]". But it doesn't matter since you don't purchase anything from Zebra anyways.

Thanks @SparkDev97 and @wstyres for you help in this matter.

[SparkDev97]

Just checked with Zebra and I was able to login to Spark's repo, even though it just says "[email protected]". But it doesn't matter since you don't purchase anything from Zebra anyways.

Thanks @SparkDev97 and @wstyres for you help in this matter.

Cool, thanks for the confirmation :)