fix(drivers/139): optimize login flow with cookie reuse and robust fallback

[UcnacDx2]

Summary / 摘要

Fix the 139Yun driver login loop and risk-control failures by avoiding unnecessary full password login attempts and making the credential fallback path explicit.

修复 139 云盘驱动在初始化时反复走完整密码登录、容易触发风控或登录死循环的问题。

User-visible behavior changes:

• Existing Authorization is preferred; if present, the login flow is skipped and the normal refresh path handles renewal.
• MailCookies can be reused through a fast path only when both required cookies exist: Os_SSo_Sid and RMKEY.
• Full password login is used as fallback only when MailCookies, Username, and Password are all configured.
• Partial username/password configuration now returns a clear validation error.

Important implementation changes:

• Centralized cookie parsing, sanitizing, merging, and deterministic ordering.

• Dropped stale JSESSIONID during password login when a fresh one cannot be fetched, because sending an expired value can trigger mail.10086.cn risk control.

• Replaced resty redirect error string matching with explicit HTTP 3xx response status handling.

• Removed sensitive login values from logs, including password/hash, cookies, passId/token/dycpwd/authToken, and decrypted auth response bodies.

• Updated meta.go help text to match supported credential combinations.

• Added unit tests for cookie sanitizing/merging, credential-state detection, and redirect status handling.

• This PR has breaking changes.
  / 此 PR 包含破坏性变更。

• This PR changes public API, config, storage format, or migration behavior.
  / 此 PR 修改了公开 API、配置、存储格式或迁移行为。

  This changes driver configuration validation/help text for 139Yun credentials, but it does not require storage migration.

• This PR requires corresponding changes in related repositories.
  / 此 PR 需要关联仓库同步修改。

Related repository PRs / 关联仓库 PR:

• OpenList-Frontend: N/A
• OpenList-Docs: docs(drivers): update 139Yun driver guide OpenList-Docs#336

Related Issues / 关联 Issue

Relates to #1534 comment

Testing / 测试

• go test ./...

• go test ./drivers/139

• Manual test / 手动测试:

  • Ran gofmt on the changed Go files.
  • Performed a local real-account smoke test with temporary environment variables only:
    • confirmed the supplied cookie set did not contain RMKEY, so the fast path was correctly skipped;
    • confirmed the full password flow Step 1 -> Step 2 -> Step 3 completed successfully;
    • no real cookie, token, authorization, username, or password values were committed or added to this PR description.

Checklist / 检查清单

• I have read CONTRIBUTING.
  / 我已阅读 CONTRIBUTING。

• I confirm this contribution follows the repository license, contribution policy, and code of conduct.
  / 我确认此贡献符合仓库许可证、贡献规范和行为准则。

• I have formatted the changed code with gofmt, go fmt, or prettier where applicable.
  / 我已按适用情况使用 gofmt、go fmt 或 prettier 格式化变更代码。

• I have requested review from relevant maintainers or code owners where applicable.
  / 我已在适用情况下请求相关维护者或代码所有者审查。

  No specific code owner was identified from the PR page; maintainers, please review when convenient.

AI Disclosure / AI 使用声明

• This PR includes AI-assisted content.
  / 此 PR 包含 AI 辅助内容。

Tools used / 使用工具:

• ChatGPT
• Codex
• GitHub Copilot
• Claude
• Gemini
• Other (please specify) / 其他（请注明）:

Usage scope / 使用范围:

• Code generation / 代码生成

• Refactoring / 重构

• Documentation / 文档

• Tests / 测试

• Translation / 翻译

• Review assistance / 审查辅助

• I have reviewed and validated all AI-assisted content included in this PR.
  / 我已审核并验证此 PR 中的所有 AI 辅助内容。

• I have ensured that all AI-assisted commits include Co-Authored-By attribution.
  / 我已确保所有 AI 辅助提交都包含 Co-Authored-By 归属信息。

• I can reproduce all AI-assisted content included in this PR without any AI tools.
  / 我可以在没有任何 AI 工具的情况下重现此 PR 中包含的 AI 辅助内容。

[Copilot]

Pull request overview

This pull request optimizes the 139 cloud drive driver's authentication flow to address login loop errors and risk control triggers. The changes implement a prioritized login strategy: Authorization → Cookie reuse → Password login fallback.

Changes:

• Introduced validateAndInitCredentials() to implement flexible credential validation with priority-based login attempts
• Added sanitizeLoginCookies() to enforce strict cookie ordering and prevent authentication failures from stale session data
• Enhanced step1_password_login() to fetch fresh JSESSIONID, detect risk control errors, and properly manage cookie state
• Refactored error handling in the request() method to eliminate goto statements and streamline special case handling

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
drivers/139/driver.go	Simplified Init() to delegate credential validation to new helper function
drivers/139/util.go	Core changes including new validation logic, cookie sanitization, enhanced password login with risk control detection, and cleaner error handling

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jyxjjj]

不好意思 刚刚回复前没看到你是新建了新的PR 但确实还是需要团队再看的
另外下次建议在不同PR之间进行引用 如井号开头的ID

[leishenws]

大佬🐂。我时刻待命协助逆向解决风控

[mengnichangnb]

在文档里没有MailCookies的获取方式，该如何获取

[UcnacDx2]

@xrgzs 已优化代码，补充文档和测试，可以麻烦审查合并一下吗