feat: add Nox-API upstream support

backend/app/services/auth_capture_service.py

@@ -90,6 +90,11 @@ def _curate_candidates(
     """Scan extracted data for likely credentials with confidence scoring."""
     candidates: list[dict[str, Any]] = []
 
+    if not new_api_user:
+        new_api_user = _find_user_header(auth_headers)
+    if not new_api_user:
+        new_api_user = _find_new_api_user(local_storage, session_storage)
+
     # 0. 完整 Cookie Bundle（最高优先级）
     # 按页面 origin 收集所有相关 cookie，包含 cf_clearance 等 Cloudflare cookie
     cookie_string, cookie_names = _build_cookie_bundle(cookies, page_url)
@@ -100,6 +105,7 @@ def _curate_candidates(
         }
         if new_api_user:
             bundle_extra["new_api_user"] = new_api_user
+            bundle_extra["user_id"] = new_api_user
         _add(
             candidates, "cookie_bundle",
             f"bundle:{page_url[:60]}",
@@ -113,18 +119,21 @@ def _curate_candidates(
     # 1. CDP-captured network headers (high confidence)
     seen = set()
     for h in auth_headers:
+        htype = h.get("type", "authorization")
+        if htype == "user_id":
+            continue
         dedup_key = h["value"]
         if dedup_key in seen:
             continue
         seen.add(dedup_key)
-        htype = h.get("type", "authorization")
         preview = _preview(h["value"])
         if htype == "api_key":
             _add(candidates, "api_key", f"network:{h['url'][:60]}", h["value"], preview,
                  f"X-API-Key — {h['url'][:40]}", 95)
         else:
             _add(candidates, "bearer_token", f"network:{h['url'][:60]}", h["value"], preview,
-                 f"Authorization — {h['url'][:40]}", 95)
+                 f"Authorization — {h['url'][:40]}", 95,
+                 extra={"new_api_user": new_api_user, "user_id": new_api_user} if new_api_user else None)
 
     # 2. localStorage/sessionStorage items
     for store_name, store in [("localStorage", local_storage), ("sessionStorage", session_storage)]:
@@ -155,9 +164,6 @@ def _curate_candidates(
                 _add(candidates, "bearer_token", f"{store_name}.{key}", val, _preview(val),
                      f"{store_name}.{key} (API Key)", 90)
 
-    if not new_api_user:
-        new_api_user = _find_new_api_user(local_storage, session_storage)
-
     # 3. 单个 Session cookie（保留，供独立 fallback / bearer 降级使用）
     for c in cookies:
         cname = c["name"].lower()
@@ -168,6 +174,7 @@ def _curate_candidates(
             extra = {"cookie_name": c["name"], "cookie_value": c["value"]}
             if cname == "session" and new_api_user:
                 extra["new_api_user"] = new_api_user
+                extra["user_id"] = new_api_user
             _add(candidates, "cookie", f"cookie:{c['name']}", cookie_val, preview,
                  f"Cookie {c['name']} ({c['domain']})", confidence,
                  extra=extra)
@@ -182,6 +189,15 @@ def _curate_candidates(
     return candidates
 
 
+def _find_user_header(headers: list[dict[str, str]]) -> str:
+    for header in headers:
+        if header.get("type") == "user_id":
+            value = str(header.get("value") or "").strip()
+            if value:
+                return value
+    return ""
+
+
 def _find_storage_value(*stores: dict[str, str], key: str) -> str:
     for store in stores:
         value = store.get(key)