way/pigway-frame-flow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 29 Wiki Activity

Record authorized device-key widget authentication verification

Browse Source
This commit is contained in:
Pigway
2026-10-02 23:35:13 +08:00
parent 59fbdf7c1a
commit b5a0614180
1 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/research/KOKONNA_CONTENT_SUBSCRIPTIONS.md
+20 -1
View File
@@ -49,7 +49,7 @@ Client category keys: Weather (天气), Lunar (农历), Calendar (单向历), Co
Authentication paths observed: `app.login` with username/password; `app.wxlogin` with WeChat login code returns user token. Frame Flow login account is unrelated. App code alone does not prove Android and WeChat versions use identical methods, nor guarantee this private API stays compatible.
No authenticated requests or live widget writes were sent. Next step is official-account read-only verification of device discovery and `getFrameCovers`; requires legitimate official session/account access. Keep session secret server-side and out of logs, front-end, SQLite plaintext, and Git. Do not send existing OpenAPI key to this separately authenticated transport speculatively.
No authenticated requests or live widget writes were sent. Next step is official-account read-only verification of device discovery and `getFrameCovers`; requires legitimate official session/account access. Keep session secret server-side and out of logs, front-end, SQLite plaintext, and Git. Device-key compatibility was subsequently tested with explicit user authorization; see the verification below.
## Live WeChat verification (2026-10-02)
@@ -94,3 +94,22 @@ Only `appFrame.getFrameCovers` is callable by this integration. Widget selection
subscription mutation and cancellation are not implemented or executed. A null
or unmatched current selection returns `CURRENT_UNVERIFIED`, not “no subscription”.
This private RPC contract is unofficial and may change independently of OpenAPI.
## Device API Key compatibility verification (2026-10-02)
At the user's explicit request, performed exactly three read-only calls from the
NAS using the configured device API Key, without logging or persisting the key:
| Query | HTTP | Result |
| --- | --- | --- |
| OpenAPI `/device` | 200 | Device key accepted |
| RPC `app.getRobots` | 500 | JSON-RPC error code -1, 请重新登陆 |
| RPC `appFrame.getFrameCovers` | 500 | JSON-RPC error code -1, 请重新登陆 |
No RPC result was returned, and no uploads, display changes or subscription
mutations were performed. The valid OpenAPI device key was not accepted as an
official account session by these RPC methods. This confirms the distinction
for the currently observed endpoints; it does not prove all future widget APIs
will require a WeChat-specific session. An official account login session may
also be supported, but has not been verified here.