fix: simplify F95 cookie setup and constrain auth dialog layout

backend/app/routers/metadata.py

@@ -1,3 +1,5 @@
+from urllib.parse import quote
+
 from fastapi import APIRouter, HTTPException, status
 from PIL import Image, UnidentifiedImageError
 from pydantic import BaseModel, SecretStr
@@ -16,7 +18,10 @@ class F95In(BaseModel):
 
 
 class F95SessionIn(BaseModel):
-    cookie: SecretStr
+    cookie: SecretStr = SecretStr("")  # Compatibility with previously saved clients.
+    xf_user: SecretStr = SecretStr("")
+    xf_session: SecretStr = SecretStr("")
+    cf_clearance: SecretStr = SecretStr("")
     user_agent: str = ""
 
 
@@ -63,7 +68,19 @@ def require_import(user: CurrentUser) -> None:
 @router.put("/f95/session", status_code=204)
 async def save_f95_session(body: F95SessionIn, user: CurrentUser, db: DB) -> None:
     require_import(user)
-    cookie = body.cookie.get_secret_value().strip()
+    values = {key: getattr(body, key).get_secret_value().strip()
+              for key in ("xf_user", "xf_session", "cf_clearance")}
+    if any(values.values()):
+        if not (values["xf_user"] or values["xf_session"]):
+            raise HTTPException(422, "Добавьте значение xf_user или xf_session для входа в F95zone")
+        if any(len(value) > 8192 or any(ord(c) < 33 or ord(c) > 126 or c == ";" for c in value)
+               for value in values.values()):
+            raise HTTPException(422, "Скопируйте только значение cookie, без имени и дополнительных строк")
+        # DevTools can display decoded values. Preserve existing escapes and encode delimiters.
+        cookie = "; ".join(f"{key}={quote(value, safe='%') if key.startswith('xf_') else value}"
+                           for key, value in values.items() if value)
+    else:
+        cookie = body.cookie.get_secret_value().strip()
     if cookie.lower().startswith("cookie:"):
         cookie = cookie[7:].strip()
     agent = body.user_agent.strip()