Reach the pages behind a login, and stay signed in

import { chromium } from "playwright";

// One CDP connection is one browser session. Exit selectors ride on the query
// string: "country" turns on a residential exit, "session" pins it for the run.
const browser = await chromium.connectOverCDP(
  `wss://api.wayfern.com/ws?token=${LINK_TOKEN}&country=us&session=run4711`,
);
const context = browser.contexts()[0];
const page = await context.newPage();

await page.goto("https://app.example.com/login");
await page.fill("#email", process.env.TARGET_EMAIL);
await page.fill("#password", process.env.TARGET_PASSWORD);

// A Turnstile widget guarding the form: solve it, then write the token into
// the field the form actually posts.
const widget = page.locator(".cf-turnstile[data-sitekey]").first();
if ((await widget.count()) > 0) {
  const websiteKey = await widget.getAttribute("data-sitekey");
  const headers = {
    // An API token (wf_...) carrying the "captcha" scope.
    Authorization: `Bearer ${WAYFERN_API_TOKEN}`,
    "Content-Type": "application/json",
  };

  // websiteURL is page.url(): Wayfern finds this session by the open page and
  // solves through its sticky exit.
  let res = await fetch("https://api.wayfern.com/api/captcha/solve", {
    method: "POST",
    headers,
    body: JSON.stringify({
      task: { type: "turnstile", websiteURL: page.url(), websiteKey },
    }),
  });
  let data = await res.json();
  // 202: not ready after about 90 seconds. Read the task again.
  while (res.status === 202) {
    res = await fetch(`https://api.wayfern.com/api/captcha/solve/${data.id}`, { headers });
    data = await res.json();
  }
  if (!res.ok) throw new Error(`${data.error}: ${data.message}`);

  // The answer is always solution.token.
  await page.evaluate((token) => {
    const field = document.querySelector('input[name="cf-turnstile-response"]');
    if (field instanceof HTMLInputElement) field.value = token;
  }, data.solution.token);
}

await page.click("button[type=submit]");
await page.waitForURL("**/dashboard");

// Logged in. Every later navigation reuses this context (same cookies, same
// sticky exit) until you close the connection.
await page.goto("https://app.example.com/reports/q1");
console.log(await page.title());
await browser.close();