fix(appstore): use slashed authenticate path from bag

[x44ylan]

Fixes #50 (failed to unmarshal xml on login).

Apple only answers the signed authenticate request on /WebObjects/MZFinance.woa/wa/authenticate/. The bare path returns unusable responses (204/301/HTML), which the decoder then fails on. Mirrors majd/ipatool#609 (see majd/ipatool#598).

• Accept the trailing slash in validateAuthenticationEndpoint, so pod redirects that include it still validate
• Normalise the bag's auth endpoint path to end in / after validation, keeping host and query
• Match the redirect-suppression referer check with or without the slash

[hadongguk]

Built from source with the trailing-slash auth fix and login works now. Thanks.

The September 13 release, 2.6.0, still failed with HTTP 302: authentication redirect is missing Location. Command Line Tools could not build the current main because CoreFoundation.h was missing, so I installed Xcode, accepted the license, and built it.

auth login then returned success=true. This Mac is already trusted, so Apple did not ask for a 2FA code. After that I could purchase and download an older build with --external-version-id, including one that list-versions no longer shows.

Thanks for the authenticate-path fix.

[Write]

Thanks !

For ze lazy

git clone https://github.com/x44ylan/ipadecrypt
cd ipadecrypt
git checkout fix/auth-trailing-slash
go install ./cmd/ipadecrypt

[londek]

LGTM, thank you for the patch!