From dbd480b0f4af3d377d7cc5643c87adba19adb8fc Mon Sep 17 00:00:00 2001
From: Brandon Thomas <echelon@gmail.com>
Date: Wed, 17 Dec 2025 16:25:17 -0500
Subject: [PATCH] script to extract accesss token

---
 .../credentials/world_labs_bearer_token.rs    | 23 ++++++++
 .../state/worldlabs_credential_manager.rs     |  6 +--
 .../worldlabs_login_window_thread.rs          | 54 ++++++++++++++++++-
 3 files changed, 79 insertions(+), 4 deletions(-)

diff --git a/crates/api_clients/world_labs_client/src/credentials/world_labs_bearer_token.rs b/crates/api_clients/world_labs_client/src/credentials/world_labs_bearer_token.rs
index 563209ae17..4a86724ffd 100644
--- a/crates/api_clients/world_labs_client/src/credentials/world_labs_bearer_token.rs
+++ b/crates/api_clients/world_labs_client/src/credentials/world_labs_bearer_token.rs
@@ -1,4 +1,27 @@
 
+/*
+
+This is issued by Google, even for email+password login:
+
+  https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key={ENTROPY}
+
+Value:
+
+{
+    "kind": "identitytoolkit#VerifyPasswordResponse",
+    "localId": "{{WorldLabsUserId}}",
+    "email": "{{email@whatever.com}}",
+    "displayName": "",
+    "idToken": "{{BEARER_TOKEN}}",
+    "registered": true,
+    "refreshToken": "{{REFRESH_TOKEN}}",
+    "expiresIn": "3600"
+}
+
+
+
+*/
+
 #[derive(Clone)]
 pub struct WorldLabsBearerToken {
   /// The bearer token
diff --git a/crates/desktop/artcraft/src/services/worldlabs/state/worldlabs_credential_manager.rs b/crates/desktop/artcraft/src/services/worldlabs/state/worldlabs_credential_manager.rs
index 59e0d99c37..d13baaa522 100644
--- a/crates/desktop/artcraft/src/services/worldlabs/state/worldlabs_credential_manager.rs
+++ b/crates/desktop/artcraft/src/services/worldlabs/state/worldlabs_credential_manager.rs
@@ -42,10 +42,10 @@ impl WorldlabsCredentialManager {
         let maybe_browser_cookies = state.user_cookies
             .as_ref()
             .map(|cookies| cookies.to_cookie_store());
-        
+
         let maybe_bearer = state.bearer_token
             .map(|bearer| WorldLabsBearerToken::new(bearer));
-        
+
         let maybe_cookies = maybe_browser_cookies
             .as_ref()
             .map(|cookies| cookies.to_cookie_string())
@@ -188,7 +188,7 @@ impl WorldlabsCredentialManager {
     // TODO: This is just for building the client and testing.
     if let Some(cookies) = creds.browser_cookies.as_ref() {
       let cookies_header = cookies.to_cookie_string();
-      let path = self.app_data_root.credentials_dir().get_worldlabs_state_path();
+      let path = self.app_data_root.credentials_dir().get_worldlabs_cookies_path();
       std::fs::write(path, cookies_header)?;
     }
 
diff --git a/crates/desktop/artcraft/src/services/worldlabs/windows/worldlabs_login_window/worldlabs_login_window_thread.rs b/crates/desktop/artcraft/src/services/worldlabs/windows/worldlabs_login_window/worldlabs_login_window_thread.rs
index 59004374dd..5b4e01ca83 100644
--- a/crates/desktop/artcraft/src/services/worldlabs/windows/worldlabs_login_window/worldlabs_login_window_thread.rs
+++ b/crates/desktop/artcraft/src/services/worldlabs/windows/worldlabs_login_window/worldlabs_login_window_thread.rs
@@ -65,6 +65,8 @@ pub async fn worldlabs_login_window_thread(
   }
 }
 
+/// NOTE: THERE IS THIS - https://marble.worldlabs.ai/sign-in?redirect=%2Fworlds
+
 /// Returns true if we can exit.
 async fn check_login_window(
   app_handle: &AppHandle,
@@ -77,7 +79,7 @@ async fn check_login_window(
   // World labs has no distinct login page. Everything is in a single SPA.
 
   let mut is_logged_in = false;
-  
+
   // See if pricing exists.
   // We'll use redirection to detect if we're done.
   let pricing_script = r#"
@@ -90,6 +92,56 @@ async fn check_login_window(
     })();
   "#;
 
+  let indexed_db_access = r#"
+    (() => {
+      let db;
+
+      const request = indexedDB.open("firebaseLocalStorageDb");
+      request.onerror = (event) => {
+        console.error("Indexed DB Error", event);
+      };
+
+      request.onsuccess = (event) => {
+        db = event.target.result;
+        let tx = db.transaction("firebaseLocalStorage", "readonly");
+        let store = tx.objectStore("firebaseLocalStorage");
+
+        let keysRequest = store.getAllKeys();
+
+        keysRequest.onerror = (event) => {
+          console.error("Error with getting all keys", error);
+        };
+
+        keysRequest.onsuccess = () => {
+          console.error('keys', keysRequest.result); // array of keys
+
+          let keys = keysRequest.result; // array of keys
+          let key = keys[0];
+
+          const getKeyRequest = store.getKey(key);
+
+          getKeyRequest.onsuccess = () => {
+            console.error('key result', getKeyRequest.result);
+          };
+
+          store.openCursor().onsuccess = (event) => {
+            const cursor = event.target.result;
+            if (cursor) {
+              console.error('cursor value', cursor.value);
+              let tokens = cursor.value?.value?.stsTokenManager;
+              console.error('tokens', tokens);
+
+              cursor.continue();
+            } else {
+              console.error("Entries all displayed.");
+            }
+          };
+
+        };
+      };
+    })();
+  "#;
+
   webview_window.eval(pricing_script)?;
 
   let hostname = get_webview_window_hostname(webview_window)?;