fix: revert CAS lck early-exit, bump outer login retries to 5

The /login early-exit added in e3c2bde caused worse failures than the
intermittent CAS hiccups it was meant to skip past — when the CAS chain
legitimately hops through a /login-shaped URL mid-redirect (which it
sometimes does even on a healthy session), the inner loop aborted
before reaching the eventual lck-bearing hop. Removed it; the chain is
now chased to completion as in dae2514.

Two small optimizations on top:
- bump login_with_retry from 3 to 5 outer attempts so the long tail of
  back-to-back transient CAS rejections (which the user has historically
  ridden out with ~5 retries) doesn't crash the whole run.
- when lck extraction fails, include the last 3 redirect Locations in
  the RuntimeError so future failures are debuggable without rerunning
  with extra prints. Also include the exception message in the outer
  retry log line.

Author: LeafCreeper

main.py

@@ -31,8 +31,16 @@
 from src.api.webvpn import WebVPNSession
 
 
-def login_with_retry(max_attempts: int = 3) -> WebVPNSession:
-    """Login to WebVPN + iCourse CAS, retrying on transient failures."""
+def login_with_retry(max_attempts: int = 5) -> WebVPNSession:
+    """Login to WebVPN + iCourse CAS, retrying on transient failures.
+
+    The iCourse CAS step (authenticate_icourse) has its own inner retry
+    loop for transient redirect-chain hiccups; this outer loop only runs
+    when those inner retries are exhausted, which generally means the
+    WebVPN session itself needs a fresh login.  5 attempts handles the
+    long tail of times when CAS rejects multiple fresh sessions in a
+    row before letting one through.
+    """
     for attempt in range(max_attempts):
         try:
             vpn = WebVPNSession()
@@ -43,8 +51,8 @@ def login_with_retry(max_attempts: int = 3) -> WebVPNSession:
             return vpn
         except Exception as e:
             if attempt < max_attempts - 1:
-                print(f"  Failed: {type(e).__name__}, retrying...")
-                time.sleep(3)
+                print(f"  Failed: {type(e).__name__}: {e}; retrying...")
+                time.sleep(5)
             else:
                 raise
 

src/api/webvpn.py

@@ -199,27 +199,26 @@ def authenticate_icourse(
         vpn_url = get_vpn_url(casapi_url)
 
         # Follow redirect chain to reach IDP login page and extract lck.
-        # The CAS gateway intermittently returns a 200 interstitial or
-        # bounces back to WebVPN's own /login (cookie not yet effective
-        # for the casapi vhost) right after a successful WebVPN login.
-        # Retry a few times in-place before letting login_with_retry()
-        # waste a full WebVPN re-login on a transient hiccup.
+        # The CAS gateway intermittently returns a 200 interstitial or a
+        # 302 to a `/login`-shaped page right after a successful WebVPN
+        # login.  Both are transient — chase the full redirect chain (lck
+        # often appears mid-chain even when an intermediate hop looks
+        # like a stale-session bounce) and retry a few times before
+        # letting login_with_retry() waste a full WebVPN re-login.
         import time as _time
         lck = None
+        last_locations: list[str] = []
         for cas_attempt in range(3):
             if cas_attempt > 0:
+                _time.sleep(2)
                 print(f"    CAS lck extract retry {cas_attempt}/2...")
-                _time.sleep(3)
             resp = self.session.get(vpn_url, allow_redirects=False, timeout=60)
+            last_locations = []
             for _ in range(15):
                 location = resp.headers.get("Location", "")
                 if resp.status_code not in (301, 302, 303, 307) or not location:
                     break
-                # WebVPN bouncing to its own /login means the session
-                # isn't recognised for this vhost — stop chasing the
-                # heavy login page and let the outer retry try again.
-                if "/login" in location:
-                    break
+                last_locations.append(location)
                 lck_match = re.search(r'lck=([^&#"]+)', location)
                 if lck_match:
                     lck = lck_match.group(1)
@@ -241,8 +240,12 @@ def authenticate_icourse(
             if lck:
                 break
         if not lck:
+            # Log the redirect trail so future failures are diagnosable
+            # without re-running with extra prints.
+            trail = " -> ".join(last_locations[-3:]) if last_locations else "<no redirects>"
             raise RuntimeError(
-                f"Failed to extract lck from CAS redirect chain (status={resp.status_code})"
+                f"Failed to extract lck from CAS redirect chain "
+                f"(status={resp.status_code}, last hops: {trail})"
             )
 
         entity_id = config.ICOURSE_BASE