Add PCS/ADP cookie support to fix iCloud login for Advanced Data Protection users

[Copilot]

Apple's Advanced Data Protection (ADP) now requires PCS (Private Cloud Storage) cookies in addition to the standard auth token. Accounts with ADP enabled fail to sync because the existing auth flow doesn't request these cookies, causing silent failures or stalls.

Changes

src/sync.py — Three new functions + sync loop integration

• _check_webaccess_state(api) — Calls requestWebAccessState to detect whether ADP is enabled and if device consent is granted
• _request_pcs_cookies(api) — Acquires PCS cookies via requestPCS for iclouddrive after consent is granted
• _handle_pcs_required(config, api, username, sync_state) — Orchestrates the full flow:
  • No ADP → True (zero behavior change for most users)
  • ADP + consent granted → requests cookies, returns success/pending
  • ADP + no consent → calls enableDeviceConsentForPCS (triggers push notification to user's iPhone), fires configured notification channel (Discord/Telegram/etc.), returns False to retry on next cycle

Integrated into the sync loop after 2FA check, using the existing fall-through-to-sleep pattern:

if not api.requires_2sa:
    if _handle_pcs_required(config, api, username, sync_state):
        # ... perform drive/photos sync
    # else: PCS not ready — fall through to normal sleep/exit logic

tests/data/__init__.py — Mock infrastructure

• Two new test users: REQUIRES_PCS_CONSENT_USER, AUTHENTICATED_WITH_ADP_USER
• Mock data for all three PCS states (NO_ADP, ADP_NO_CONSENT, ADP_CONSENTED) plus PCS_REQUEST_SUCCESS/PENDING and PCS_CONSENT_NOTIFICATION_SENT
• Endpoint handlers for requestWebAccessState, enableDeviceConsentForPCS, requestPCS in ICloudPySessionMock, routing by user["accountName"]
• Fixed latent json.loads(None) bug in mock when requests.Session.post() passes data=None explicitly

tests/test_sync.py — 13 new tests

Covers: no-ADP passthrough, ADP with/without consent, cookies success/pending, exception handling in each PCS endpoint call, and full sync() loop integration for both PCS user types.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• gitclassic.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[github-actions]

🐳 Docker Image Built Successfully!

The Docker image for this PR has been built and pushed to GitHub Container Registry:

Image Tag: ghcr.io/mandarons/icloud-docker:pr-438

Usage:

docker pull ghcr.io/mandarons/icloud-docker:pr-438
docker run --name icloud-pr-test -v ${PWD}/icloud:/icloud -v ${PWD}/config:/config -e ENV_CONFIG_FILE_PATH=/config/config.yaml ghcr.io/mandarons/icloud-docker:pr-438

Build Info:

• Platforms: linux/arm64, linux/amd64
• Image Digest: sha256:4983f61bdacc1f2287fcc04b6ac424a67642fab3ac0b1a93584f9b62828fcab3
• Built from commit: 4be73ea

[Copilot]

Pull request overview

This PR updates the iCloud authentication/sync orchestration to support Apple Advanced Data Protection (ADP) accounts by detecting PCS requirements, triggering device consent when needed, and requesting PCS cookies before proceeding with Drive/Photos sync.

Changes:

• Added PCS/ADP detection + consent/cookie acquisition helpers and integrated them into the main sync() loop.
• Extended the iCloudPy mock session to emulate PCS endpoints/states and fixed a mock JSON parsing edge case (data=None).
• Added unit tests covering PCS state handling and sync-loop integration scenarios.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/sync.py	Adds PCS/ADP flow helpers and gates the sync cycle on successful PCS readiness for ADP accounts.
tests/data/__init__.py	Adds PCS mock payloads/users and routes new setup endpoints in ICloudPySessionMock; fixes json.loads(None) in mock request parsing.
tests/test_sync.py	Adds PCS-focused unit tests and new sync-loop integration tests for ADP/non-ADP scenarios.

[github-actions]

🐳 Docker Image Built Successfully!

The Docker image for this PR has been built and pushed to GitHub Container Registry:

Image Tag: ghcr.io/mandarons/icloud-docker:pr-438

Usage:

docker pull ghcr.io/mandarons/icloud-docker:pr-438
docker run --name icloud-pr-test -v ${PWD}/icloud:/icloud -v ${PWD}/config:/config -e ENV_CONFIG_FILE_PATH=/config/config.yaml ghcr.io/mandarons/icloud-docker:pr-438

Build Info:

• Platforms: linux/arm64, linux/amd64
• Image Digest: sha256:66119b6f5cd7e723fc3e46dfa0c62c6ece834c256e2f0d5f7cca5c24299952f2
• Built from commit: 805cf08

[mandarons]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Applied all three review comments in commit c377708:

1. Test isolation (unresolved thread): The three new PCS integration tests now patch src.sync.ICloudPyService with side_effect=data.ICloudPyServiceMock instead of icloudpy.ICloudPyService, so the mock actually intercepts the class used by the code under test.

2. SimpleNamespace api breakage: Two existing tests (test_sync_summary_notification_failure_logged, test_sync_notification_not_sent_when_both_services_not_synced) that used SimpleNamespace(requires_2sa=False) as the api mock were broken by the new PCS check (no session attribute → empty state → sync skipped). Fixed by adding @patch("src.sync._handle_pcs_required", return_value=True) to both.

3. New coverage test: Added test_handle_pcs_required_webaccess_state_failed to explicitly cover the empty-state path where _check_webaccess_state fails (e.g., network error), verifying _handle_pcs_required returns False and logs the appropriate error.

All 430 tests pass.

[github-actions]

🐳 Docker Image Built Successfully!

The Docker image for this PR has been built and pushed to GitHub Container Registry:

Image Tag: ghcr.io/mandarons/icloud-docker:pr-438

Usage:

docker pull ghcr.io/mandarons/icloud-docker:pr-438
docker run --name icloud-pr-test -v ${PWD}/icloud:/icloud -v ${PWD}/config:/config -v ${PWD}/home-abc-local:/home/abc/.local -e ENV_CONFIG_FILE_PATH=/config/config.yaml ghcr.io/mandarons/icloud-docker:pr-438

Build Info:

• Platforms: linux/amd64, linux/arm64
• Image Digest: sha256:678b62f5af33987d70da99c0b903fcc943bb57358c7e9f5288bb333705b28eb8
• Built from PR commit: 11baed7

[nicx]

@mandarons just tested this version, but I still get no iCloud validation code popup on my Apple devices.