fix: detect Cults3D clearance cookie in Cloudflare partitions

backend/src/services/cults3dSessionService.ts

@@ -103,6 +103,12 @@ export const CULTS3D_CONNECT =
   "Thingport reads Cults3D with your own API key: make one at cults3d.com/en/api/keys, then enter it with your " +
   "nickname in Configuration > Providers.";
 
+/** Shown when the browser's sign-in came without Cloudflare's clearance cookie, which the download pages need. */
+export const CULTS3D_NO_CLEARANCE =
+  "Thingport has your Cults3D sign-in but not Cloudflare's clearance for it, which the downloads need. Update " +
+  "Thingport Grab, then visit cults3d.com signed in again -- or paste a signed-in request's headers, with the " +
+  "cf_clearance cookie, in Configuration > Providers.";
+
 /** Shown wherever a download needs the browser's sign-in, and there's none. */
 export const CULTS3D_SIGN_IN =
   "Cults3D only gives its files to a signed-in user: visit cults3d.com signed in with Thingport Grab, then import " +

backend/src/services/importService.ts

@@ -156,6 +156,7 @@ import {
 } from "./cults3dApi";
 import {
   CULTS3D_CONNECT,
+  CULTS3D_NO_CLEARANCE,
   CULTS3D_SIGN_IN,
   getUserCults3dBrowser,
   getUserCults3dCredentials,
@@ -2114,6 +2115,8 @@ async function importCults3dModel(
     if (!downloadUrl && resolved.priceCents > 0) throw cults3dPaid(resolved);
     const browser = await getUserCults3dBrowser(userId);
     if (!browser) throw new HttpError(400, CULTS3D_SIGN_IN, CULTS3D_SESSION_CODE);
+    // Without it every site page is a Cloudflare challenge.
+    if (!browser.clearance) throw new HttpError(400, CULTS3D_NO_CLEARANCE, CULTS3D_SESSION_CODE);
     if (!downloadUrl) {
       await placeCults3dFreeOrder(resolved.slug, browser);
       downloadUrl = (await fetchCults3dOrders(credentials)).get(resolved.slug) ?? null;

extension/src/background/cults3dSession.ts

@@ -9,7 +9,15 @@ const SITE = "https://cults3d.com";
 
 async function cookieValue(name: string): Promise<string> {
   try {
-    return (await chrome.cookies.get({ url: SITE, name }))?.value ?? "";
+    const plain = (await chrome.cookies.get({ url: SITE, name }))?.value;
+    if (plain) return plain;
+    // Cloudflare sets cf_clearance partitioned (CHIPS), keyed to the site itself; a plain lookup doesn't see those, and
+    // an exact partition key would have to match its cross-site flag too. An empty one lists every partition's.
+    const partitioned = await chrome.cookies.getAll({ domain: "cults3d.com", name, partitionKey: {} });
+    const own = partitioned.find((cookie) =>
+      /^https:\/\/(www\.)?cults3d\.com$/i.test(cookie.partitionKey?.topLevelSite ?? ""),
+    );
+    return (own ?? partitioned[0])?.value ?? "";
   } catch {
     return "";
   }