fix(auth): make the address scan linear in the migrated-host probe

CHANGELOG.md

@@ -9,6 +9,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **The address scan in the migrated-host session probe was quadratic.** It reads a
+  1.28 MB `myaccount.google.com` response, and `[\w.+-]+@…` retries from every start
+  position and rescans its run before failing to find an `@` — so an unbroken run of
+  characters that class accepts cost O(n²). Measured: 5 000 chars 0.12 s, 10 000 0.48 s,
+  20 000 2.00 s, **40 000 12.07 s**. The class covers the entire URL-safe base64 alphabet,
+  which a Google page is full of, and the scan runs synchronously inside an `async def`,
+  so a stall blocks the event loop and cancellation cannot land until it returns.
+
+  Anchoring on the literal `@` (which lets CPython's `re` use its literal-prefix fast
+  search) and reading the local part backwards over a bounded 64-character window — the
+  RFC 5321 cap — makes the work proportional to the number of `@` in the document. Same
+  output for every address shape, including the Workspace and custom domains that #791
+  turned on: 40 000 chars now scan in under a millisecond, and 440 000 base64-shaped ones
+  in 0.2 ms. ([#852](https://github.com/ffroliva/gflow-cli/issues/852))
 - **The sign-in window never closed for an account Google serves from `flow.google.com`.**
   `gflow auth login --browser chrome` watches the `labs.google` session endpoint to know
   when to close Chrome — and for a migrated account labs hands off without ever minting a

src/gflow_cli/auth/verification.py

@@ -339,13 +339,59 @@ async def verify_flow_session(
 #: Any domain, not just gmail.com — an `@gmail.com`-only pattern declined every
 #: Google Workspace account (dev@axelate.io, user@mycompany.com, user@googlemail.com
 #: all failed to match), leaving #791 open for them with no signal it had refused.
-_EMAIL_RE = r"[\w.+-]+@[\w.-]+\.[A-Za-z]{2,}"
+#:
+#: Split in two, and anchored on the `@`, because one combined pattern was
+#: quadratic (#852). `[\w.+-]+@…` retries from every start position and rescans
+#: its run before failing to find an `@`, so an unbroken run of characters that
+#: class accepts costs O(n²) — measured 12.1 s for 40 000 of them, and the class
+#: covers the whole URL-safe base64 alphabet, which a Google page is full of.
+#: Leading with the literal `@` lets CPython's `re` use its literal-prefix fast
+#: search, so the work becomes proportional to the number of `@` in the document.
+_DOMAIN_RE = re.compile(r"@[\w.-]+\.[A-Za-z]{2,}")
+#: The non-alphanumeric half of `[\w.+-]`. Python's `\w` is exactly
+#: "`str.isalnum()` or underscore" (its own docs say so), so the two together
+#: reproduce that class character for character.
+#:
+#: Spelled out rather than left as a regex because `[\w.+-]+\Z` is itself
+#: super-linear (Sonar python:S8786) — the window below bounds it in practice,
+#: but a reader cannot see that from the pattern, and neither can a scanner. A
+#: backwards scan is O(1) per character and visibly so.
+_LOCAL_PART_PUNCT = "_.+-"
+#: RFC 5321 caps a local part at 64 octets. It is also what keeps the scan
+#: linear: the window is constant, so each `@` costs the same regardless of the
+#: page. ponytail: a longer local part is truncated rather than dropped — raise
+#: this if a real address is ever found past it.
+_MAX_LOCAL_PART = 64
 _MYACCOUNT_URL = f"{_MYACCOUNT_ORIGIN}/?hl=en"
 #: 15 s was measured too tight: the probe answers in 2.6-7.2 s idle but timed out under
 #: browser contention during a 10-profile sweep.
 _MIGRATED_PROBE_TIMEOUT_MS = 30_000
 
 
+def find_emails(body: str) -> list[str]:
+    """Every address in `body`, in document order, in one linear pass.
+
+    Behaviourally the same as the single pattern it replaces for anything that
+    looks like an address; see `_DOMAIN_RE` for why that pattern could not stay.
+    """
+    found: list[str] = []
+    consumed = 0  # end of the last address emitted — matches never overlap
+    for match in _DOMAIN_RE.finditer(body):
+        at = match.start()
+        # `findall` resumed scanning at the end of its previous match, so a local
+        # part could never reach back into one. Two `@` within 64 characters of
+        # each other is the only shape where that shows, and fuzzing against the
+        # old pattern is what turned it up: 2 differences in 4 000 random bodies.
+        floor = max(consumed, at - _MAX_LOCAL_PART)
+        start = at
+        while start > floor and (body[start - 1].isalnum() or body[start - 1] in _LOCAL_PART_PUNCT):
+            start -= 1
+        if start < at:  # an `@` with no local part in front of it is not an address
+            found.append(body[start:at] + match.group())
+            consumed = match.end()
+    return found
+
+
 def has_migrated_app_session(cookies: Iterable[Mapping[str, Any]]) -> bool:
     """Both halves of a migrated Flow session are present in this jar.
 
@@ -440,7 +486,7 @@ async def _verify_migrated_host_fallback(
     # noreply address rendered above the account's would silently relabel the user.
     # Counting costs nothing and removes the coin flip. Ties keep document order, so
     # the single-candidate case is unchanged.
-    found = re.findall(_EMAIL_RE, page_body)
+    found = find_emails(page_body)
     email = Counter(found).most_common(1)[0][0] if found else None
     return FlowSessionStatus(
         outcome=FlowSessionOutcome.AUTHENTICATED,

tests/auth/test_verification.py

@@ -818,3 +818,75 @@ async def test_a_probe_that_cannot_run_never_upgrades(
 
         self._patch(monkeypatch, _migrated_mock(get_side_effect=TimeoutError("slow")))
         assert await _verify_migrated_host_fallback(tmp_path, "t") is None
+
+
+class TestFindEmails:
+    """#852 — the address scan must stay linear.
+
+    It reads a 1.28 MB `myaccount` response synchronously inside an `async def`,
+    so a stall there blocks the event loop and `CancelledError` cannot land until
+    it returns.
+    """
+
+    @pytest.mark.parametrize(
+        ("body", "expected"),
+        [
+            ("hello dev@axelate.io world", ["dev@axelate.io"]),
+            # Workspace and custom domains — the #791 regression this must not undo.
+            ("user@mycompany.com", ["user@mycompany.com"]),
+            ("user@googlemail.com", ["user@googlemail.com"]),
+            ("first.last+tag@sub.example.co.uk", ["first.last+tag@sub.example.co.uk"]),
+            # Document order preserved, duplicates kept: `Counter.most_common`
+            # upstream depends on both.
+            (
+                "<a>noreply@google.com</a> me@corp.io and me@corp.io",
+                ["noreply@google.com", "me@corp.io", "me@corp.io"],
+            ),
+            (
+                "edge@x.io,other_one@y-z.com;third@a.b.cd",
+                ["edge@x.io", "other_one@y-z.com", "third@a.b.cd"],
+            ),
+            ("no addresses here at all", []),
+            # Matches never overlap: the local part of the second address may
+            # not reach back into the first. Found by fuzzing this against the
+            # pattern it replaces — 2 differences in 4 000 random bodies, all of
+            # this shape, two `@` within the 64-character window.
+            ("a@b.co7-x+y@d.com", ["a@b.co", "7-x+y@d.com"]),
+            # An `@` with nothing usable on either side yields nothing, not a crash.
+            ("@", []),
+            ("@example.com", []),
+            ("trailing@", []),
+        ],
+    )
+    def test_matches_what_the_single_pattern_matched(self, body: str, expected: list[str]) -> None:
+        from gflow_cli.auth.verification import find_emails
+
+        assert find_emails(body) == expected
+
+    def test_a_long_unbroken_run_does_not_stall(self) -> None:
+        r"""The exact shape that made the old pattern quadratic.
+
+        `[\w.+-]` accepts every character of the URL-safe base64 alphabet, so a
+        Google page's blobs are precisely this. Measured on the old pattern:
+        5k->0.12s, 10k->0.48s, 20k->2.0s, 40k->12.1s — clean 4x per doubling, so
+        200k would be minutes. The bound below is ~300x the linear cost and still
+        orders of magnitude under the old curve; it fails loudly on a regression
+        without being a stopwatch race.
+        """
+        import time
+
+        from gflow_cli.auth.verification import find_emails
+
+        blob = "abcDEF012_-" * 20_000  # 220 000 chars, no `@` anywhere
+        started = time.perf_counter()
+        assert find_emails(blob) == []
+        assert time.perf_counter() - started < 1.0
+
+    def test_a_local_part_is_read_over_a_bounded_window(self) -> None:
+        """What keeps it linear: the scan left of each `@` is capped, so one `@`
+        costs the same whatever precedes it. RFC 5321 caps a local part at 64,
+        so no real address is truncated by this."""
+        from gflow_cli.auth.verification import _MAX_LOCAL_PART, find_emails
+
+        local = "x" * (_MAX_LOCAL_PART + 10)
+        assert find_emails(f"{local}@example.com") == ["x" * _MAX_LOCAL_PART + "@example.com"]