@eryxenx/insta-chat 2.0.11 → 2.1.1

package/src/methods/user.js

@@ -5,16 +5,37 @@
  * Original author credit must be retained in all copies and derivatives.
  */
 
-const { EP } = require("../constants");
+const { EP, WEB, DOC_ID } = require("../constants");
+const { parseProfilePage, normalizeWebProfileInfo, normalizeGraphqlUser, normalizeInboxUser, normalize } = require("../profileParse");
+
+// A small cache so a profile fetched once (from whichever source answered) is
+// reused instead of re-hit, and a per-user failure is not retried in a tight
+// loop. Instagram rate-limits profile reads aggressively for web sessions.
+const CACHE_TTL_MS = 10 * 60 * 1000;
 
 class UserMethods {
-  constructor(http) {
+  constructor(http, getSelf, getLearned) {
     this.http = http;
+    // Resolves the logged-in account ({ id, username }) so a profile lookup by
+    // the bot's own id can find its handle without a rate-limited REST call.
+    this.getSelf = typeof getSelf === "function" ? getSelf : null;
+    // Returns a raw user record already seen in the inbox/thread views for a pk,
+    // interop fbid or @handle — the offline source that survives rate-limiting.
+    this.getLearned = typeof getLearned === "function" ? getLearned : null;
+    this._profileCache = new Map(); // key -> { at, value }
   }
 
+  // The id-only lookup. /api/v1/users/<id>/info/ is a REST path Instagram 302s
+  // to the login page for a web session (the HTTP layer reads any 3xx as an
+  // expired session), so this is best-effort: callers that need a full profile
+  // should use getProfile().
   async getInfo(userID) {
-    const res = await this.http.get(EP.USER_INFO(userID));
-    return res?.user || null;
+    try {
+      const res = await this.http.get(EP.USER_INFO(userID));
+      return res?.user || null;
+    } catch (_) {
+      return null;
+    }
   }
 
   async getInfoByUsername(username) {
@@ -59,6 +80,161 @@ class UserMethods {
       return [];
     }
   }
+
+  // --------------------------------------------------------------- profiles
+  // Full profile for a user id or @handle. Tries every source a web session can
+  // actually read, in order, and merges whatever each returns so the result is
+  // as complete as Instagram allows:
+  //
+  //   1. the user record already learned from the inbox/thread views (free, and
+  //      the only source that still answers once the profile REST paths 429)
+  //   2. web_profile_info REST (canonical: follower/media counts, verified, ...)
+  //   3. the logged-in account's own page HTML (bio, hd picture, account flags)
+  //
+  // Never throws: an id that cannot be resolved returns null, and a source that
+  // 302s/429s is simply skipped — a profile lookup must not surface as a dead
+  // session.
+  async getProfile(idOrUsername, opts = {}) {
+    const raw = String(idOrUsername == null ? "" : idOrUsername).trim().replace(/^@/, "");
+    if (!raw) return null;
+    const byId = /^\d+$/.test(raw);
+    const key = (byId ? "id:" : "user:") + raw.toLowerCase();
+
+    const cached = this._profileCache.get(key);
+    if (!opts.refresh && cached && Date.now() - cached.at < CACHE_TTL_MS) return cached.value;
+
+    let username = byId ? null : raw;
+    const parts = [];
+
+    // 0) Whatever the inbox/thread views already told us about this user.
+    if (this.getLearned) {
+      const learned = this.getLearned(raw);
+      if (learned) {
+        const norm = normalizeInboxUser(learned);
+        if (norm) parts.push(norm);
+        if (!username && learned.username) username = learned.username;
+      }
+    }
+
+    // 1) Canonical REST profile (username only). Also resolves an id -> username.
+    if (!username && byId) {
+      const self = this.getSelf && this.getSelf();
+      if (self && String(self.id) === raw && self.username) {
+        // The logged-in account answers offline (the cookie carries its handle).
+        username = self.username;
+      } else {
+        const u = await this.getInfo(raw).catch(() => null);
+        if (u?.username) username = u.username;
+      }
+    }
+    if (username) {
+      const rest = await this._webProfileInfo(username);
+      if (rest) parts.push(rest);
+    }
+
+    // 1b) Profile GraphQL (PolarisProfilePageContentQuery). Usually rate-limited
+    // (429) for a web session, but when it does answer it carries the richest
+    // data: biography, counts, external url and the account flags.
+    if (username) {
+      const gql = await this._profileFromGraphQL(username);
+      if (gql) parts.push(gql);
+    }
+
+    // 2) Profile pages Instagram server-renders: the account's own profile and
+    // the home/inbox shell both embed the *viewer's* full PolarisViewer blob, so
+    // the logged-in account is always resolvable even when REST 302s/429s.
+    const self = this.getSelf && this.getSelf();
+    const isSelf = !!(self && self.id && String(self.id) === raw);
+    if (username) {
+      const page = await this._profileFromPage(username);
+      if (page) parts.push(page);
+    }
+    if (isSelf && !parts.some((p) => p && p.username)) {
+      const shell = await this._viewerProfileFromShell();
+      if (shell) parts.push(shell);
+    }
+
+    if (!parts.length) return null;
+
+    const merged = this._mergeProfiles(parts, { id: byId ? raw : null, username });
+    const entry = { at: Date.now(), value: merged };
+    this._profileCache.set(key, entry);
+    if (merged.username) this._profileCache.set("user:" + merged.username.toLowerCase(), entry);
+    if (merged.id) this._profileCache.set("id:" + merged.id, entry);
+    return merged;
+  }
+
+  async _webProfileInfo(username) {
+    try {
+      const res = await this.http.get(EP.WEB_PROFILE_INFO(username));
+      const user = res?.data?.user || res?.user;
+      return normalizeWebProfileInfo(user);
+    } catch (_) {
+      return null;
+    }
+  }
+
+  async _profileFromPage(username) {
+    try {
+      const res = await this.http.client.get(`${WEB}/${encodeURIComponent(username)}/`, { maxRedirects: 5 });
+      return parseProfilePage(typeof res.data === "string" ? res.data : "", username);
+    } catch (_) {
+      return null;
+    }
+  }
+
+  // The viewer's own profile, read from the home shell Instagram server-renders
+  // for a logged-in session (it embeds the full PolarisViewer blob).
+  async _viewerProfileFromShell() {
+    try {
+      const res = await this.http.client.get(`${WEB}/`, { maxRedirects: 5 });
+      return parseProfilePage(typeof res.data === "string" ? res.data : "");
+    } catch (_) {
+      return null;
+    }
+  }
+
+  // Profile GraphQL. Best-effort: a 429 / "Rate limit exceeded" / rotated doc_id
+  // is swallowed so the caller simply falls through to the next source.
+  async _profileFromGraphQL(username) {
+    const referer = `${WEB}/${encodeURIComponent(username)}/`;
+    const docs = [
+      ["PolarisProfilePageContentQuery", DOC_ID.PROFILE_PAGE_CONTENT],
+      ["PolarisUserRootQuery", DOC_ID.PROFILE_USER_ROOT]
+    ];
+    for (const [name, docId] of docs) {
+      try {
+        const res = await this.http.postGraphQL(name, docId, { username }, referer);
+        if (Array.isArray(res?.errors) && res.errors.length) continue;
+        const user = res?.data?.user;
+        const norm = normalizeGraphqlUser(user);
+        if (norm && norm.username) return norm;
+      } catch (_) {
+        // try the next operation
+      }
+    }
+    return null;
+  }
+
+  // Later sources fill only the fields earlier ones left null, so the canonical
+  // REST profile wins and the HTML/learned data tops it up.
+  _mergeProfiles(parts, fallback) {
+    const out = normalize({ id: fallback.id, username: fallback.username });
+    for (const part of parts) {
+      for (const [k, v] of Object.entries(part)) {
+        if (k === "raw") continue;
+        const empty = out[k] === null || out[k] === undefined || out[k] === "";
+        if (empty && v !== null && v !== undefined && v !== "") out[k] = v;
+      }
+      for (const flag of ["isVerified", "isPrivate", "isBusinessAccount", "isProfessionalAccount", "hasProfilePic"]) {
+        if (part[flag] === true) out[flag] = true;
+      }
+      if (!out.raw && part.raw) out.raw = part.raw;
+    }
+    if (!out.id && fallback.id) out.id = String(fallback.id);
+    if (!out.pk) out.pk = out.id;
+    return out;
+  }
 }
 
 module.exports = UserMethods;

package/src/profileParse.js

@@ -0,0 +1,250 @@
+/*!
+ * insta-chat - Unofficial Instagram Chat API
+ * Copyright (c) 2026 EryXenX (https://github.com/EryXenX)
+ * Licensed under the Apache License, Version 2.0. See LICENSE and NOTICE.
+ * Original author credit must be retained in all copies and derivatives.
+ */
+
+// Parsers for the two profile sources this package can read with a web session:
+//
+//  1. /api/v1/users/web_profile_info/ - the canonical profile JSON
+//     (`data.user` with edge_followed_by.count, biography, is_verified, ...).
+//  2. the profile page HTML - www.instagram.com/<username>/ embeds a
+//     `["PolarisViewer",[],{"data":{...}}]` blob with biography, full_name,
+//     profile_pic_url_hd and the account flags, but no follower counts.
+//
+// Both are normalized to one rich object so callers never branch on the source.
+// The /api/v1/users/<id>/info/ REST path is deliberately not used: for a web
+// session Instagram 302s it to the login page (which the HTTP layer reads as an
+// expired session) or 429s it.
+
+// Walks a JSON object literal starting at the first `{` at/after `from`,
+// honouring strings and escapes, and returns the parsed value (or null).
+function parseJsonAt(text, from) {
+  let i = text.indexOf("{", from);
+  if (i < 0) return null;
+  const start = i;
+  let depth = 0;
+  let inStr = false;
+  let esc = false;
+  for (; i < text.length; i++) {
+    const c = text[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (c === "\\") esc = true;
+      else if (c === '"') inStr = false;
+      continue;
+    }
+    if (c === '"') inStr = true;
+    else if (c === "{") depth++;
+    else if (c === "}") {
+      depth--;
+      if (depth === 0) {
+        try {
+          return JSON.parse(text.slice(start, i + 1));
+        } catch (_) {
+          return null;
+        }
+      }
+    }
+  }
+  return null;
+}
+
+function countOf(edge) {
+  const n = edge && edge.count;
+  return Number.isFinite(Number(n)) ? Number(n) : null;
+}
+
+// Accepts either a Relay field-count edge (`{ count: n }`) or a plain number.
+function countOrEdge(v) {
+  if (v == null) return null;
+  if (typeof v === "object") return countOf(v);
+  return Number.isFinite(Number(v)) ? Number(v) : null;
+}
+
+// Maps a web_profile_info `data.user` (REST) to the normalized shape.
+function normalizeWebProfileInfo(user) {
+  if (!user || typeof user !== "object") return null;
+  return normalize({
+    id: user.id || user.pk,
+    username: user.username,
+    fullName: user.full_name,
+    biography: user.biography,
+    externalUrl: user.external_url,
+    category: user.category_name || user.category,
+    isVerified: user.is_verified,
+    isPrivate: user.is_private,
+    isBusinessAccount: user.is_business_account,
+    isProfessionalAccount: user.is_professional_account,
+    profilePicUrl: user.profile_pic_url,
+    profilePicUrlHd: user.profile_pic_url_hd || user.profile_pic_url,
+    fbid: user.fbid,
+    followerCount: countOf(user.edge_followed_by),
+    followingCount: countOf(user.edge_follow),
+    mediaCount: countOf(user.edge_owner_to_timeline_media),
+    highlightReelCount: user.highlight_reel_count,
+    businessEmail: user.business_email,
+    businessPhone: user.business_phone_number,
+    publicEmail: user.public_email,
+    publicPhone: user.public_phone_number,
+    hasProfilePic: user.has_profile_pic,
+    raw: user
+  });
+}
+
+// Maps the GraphQL profile response (`data.user` from PolarisProfilePageContent-
+// Query / PolarisUserRootQuery) to the normalized shape. The field names are the
+// Relay ones, and the counts come back either as an edge or as a plain number,
+// so both are accepted.
+function normalizeGraphqlUser(user) {
+  if (!user || typeof user !== "object") return null;
+  const follower = user.follower_count ?? user.edge_followed_by;
+  const following = user.following_count ?? user.edge_follow;
+  const media = user.media_count ?? user.edge_owner_to_timeline_media;
+  return normalize({
+    id: user.id || user.pk || user.strong_id__,
+    username: user.username,
+    fullName: user.full_name,
+    biography: user.biography,
+    externalUrl: user.external_url || user.bio_links?.[0]?.url,
+    category: user.category_name || user.category,
+    isVerified: user.is_verified,
+    isPrivate: user.is_private,
+    isBusinessAccount: user.is_business_account,
+    isProfessionalAccount: user.is_professional_account,
+    profilePicUrl: user.profile_pic_url,
+    profilePicUrlHd: user.hd_profile_pic_url_info?.url || user.profile_pic_url_hd || user.profile_pic_url,
+    fbid: user.fbid,
+    followerCount: countOrEdge(follower),
+    followingCount: countOrEdge(following),
+    mediaCount: countOrEdge(media),
+    businessEmail: user.business_email,
+    businessPhone: user.business_phone_number,
+    publicEmail: user.public_email,
+    publicPhone: user.public_phone_number,
+    hasProfilePic: user.has_profile_pic ?? (!!user.profile_pic_url),
+    raw: user
+  });
+}
+
+// Maps the HTML-embedded PolarisViewer `data` to the normalized shape.
+function normalizePolarisViewer(data) {
+  if (!data || typeof data !== "object" || !data.username) return null;
+  return normalize({
+    id: data.id,
+    username: data.username,
+    fullName: data.full_name,
+    biography: data.biography,
+    externalUrl: data.external_url,
+    category: data.category_name,
+    isVerified: data.is_verified,
+    isPrivate: data.is_private,
+    isBusinessAccount: data.is_business_account,
+    isProfessionalAccount: data.is_professional_account,
+    profilePicUrl: data.profile_pic_url,
+    profilePicUrlHd: data.profile_pic_url_hd || data.profile_pic_url,
+    fbid: data.fbid,
+    hasProfilePic: data.has_profile_pic,
+    raw: data
+  });
+}
+
+// Maps an inbox/thread introspection user record (id, username, full_name,
+// profile_pic_url, is_verified, interop_messaging_user_fbid) to the normalized
+// shape. This is the data the DM GraphQL surface reliably returns for the
+// people a bot actually talks to, when the profile REST paths rate-limit.
+function normalizeInboxUser(u) {
+  if (!u || typeof u !== "object") return null;
+  const username = u.username || null;
+  const id = u.id || u.pk || u.interop_messaging_user_fbid || null;
+  if (!username && !id) return null;
+  return normalize({
+    id,
+    username,
+    fullName: u.full_name,
+    profilePicUrl: u.profile_pic_url,
+    profilePicUrlHd: u.profile_pic_url_hd || u.profile_pic_url,
+    isVerified: u.is_verified,
+    isPrivate: u.is_private,
+    fbid: u.interop_messaging_user_fbid,
+    raw: u
+  });
+}
+
+// Pulls the profile out of a profile page's HTML. Returns null when the page is
+// a login wall or carries no profile blob. `expectUsername`, when given, guards
+// against the SPA shell embedding the *viewer's* profile for a page Instagram
+// did not server-render: the blob is only trusted when it is the requested user.
+function parseProfilePage(html, expectUsername) {
+  const text = typeof html === "string" ? html : "";
+  if (!text || /accounts\/login/i.test(text.slice(0, 2000))) return null;
+  for (const marker of ['"PolarisViewer",[],', '"PolarisProfilePageContentQuery"']) {
+    const at = text.indexOf(marker);
+    if (at < 0) continue;
+    const obj = parseJsonAt(text, at + marker.length);
+    const data = obj && (obj.data || obj);
+    const profile = normalizePolarisViewer(data);
+    if (!profile) continue;
+    if (expectUsername && String(profile.username).toLowerCase() !== String(expectUsername).toLowerCase()) {
+      continue;
+    }
+    return profile;
+  }
+  return null;
+}
+
+// The single normalized profile shape every source maps to. Fields a source
+// cannot supply stay null, so a caller can tell "unknown" from "false".
+function normalize(p) {
+  if (!p) return null;
+  const id = p.id != null ? String(p.id) : null;
+  return {
+    id,
+    pk: id,
+    username: p.username || null,
+    fullName: p.fullName || null,
+    biography: p.biography || "",
+    externalUrl: p.externalUrl || null,
+    category: p.category || null,
+    isVerified: p.isVerified === true,
+    isPrivate: p.isPrivate === true,
+    isBusinessAccount: p.isBusinessAccount === true,
+    isProfessionalAccount: p.isProfessionalAccount === true,
+    hasProfilePic: p.hasProfilePic === true,
+    profilePicUrl: p.profilePicUrl || null,
+    profilePicUrlHd: p.profilePicUrlHd || p.profilePicUrl || null,
+    fbid: p.fbid != null ? String(p.fbid) : null,
+    followerCount: p.followerCount != null ? p.followerCount : null,
+    followingCount: p.followingCount != null ? p.followingCount : null,
+    mediaCount: p.mediaCount != null ? p.mediaCount : null,
+    highlightReelCount: p.highlightReelCount != null ? p.highlightReelCount : null,
+    businessEmail: p.businessEmail || null,
+    businessPhone: p.businessPhone || null,
+    publicEmail: p.publicEmail || null,
+    publicPhone: p.publicPhone || null,
+    raw: p.raw || null
+  };
+}
+
+// Instagram's CDN resizes a profile picture from the URL's stp= parameter. This
+// returns the same picture at a requested square size, so callers get a crisp
+// avatar without a second API call.
+function profilePictureAtSize(url, size) {
+  if (!url || !size) return url;
+  const px = Math.max(1, Math.round(Number(size) || 0));
+  if (!px) return url;
+  const stp = `dst-jpg_s${px}x${px}_tt6`;
+  if (/[?&]stp=[^&]+/.test(url)) return url.replace(/([?&])stp=[^&]+/, `$1stp=${stp}`);
+  return `${url}${url.includes("?") ? "&" : "?"}stp=${stp}`;
+}
+
+module.exports = {
+  parseProfilePage,
+  normalizeWebProfileInfo,
+  normalizeGraphqlUser,
+  normalizePolarisViewer,
+  normalizeInboxUser,
+  normalize,
+  profilePictureAtSize
+};

package/src/realtime/bridge.js

@@ -0,0 +1,76 @@
+/*!
+ * insta-chat - Unofficial Instagram Chat API
+ * Copyright (c) 2026 EryXenX (https://github.com/EryXenX)
+ * Licensed under the Apache License, Version 2.0. See LICENSE and NOTICE.
+ * Original author credit must be retained in all copies and derivatives.
+ */
+
+// Turns a realtime MQTT message-sync patch into the same raw inbox event the
+// poller produces, so listen() can hand either source to the same callback and
+// the EventNormalizer never needs to know which one delivered it.
+//
+// The broker pushes a patch per Direct change:
+//   { op: "add", path: "/direct_v2/threads/<tid>/items/<iid>",
+//     value: "<json item>" }
+// Only a new item under /items/ is an inbound message; activity indicators,
+// seen state and reactions share the /direct_v2/threads/ prefix and are ignored.
+
+"use strict";
+
+const { attachmentsFromContent } = require("../messageContent");
+
+const ITEM_PATH_RE = /^\/direct_v2\/threads\/([^/]+)\/items\/([^/]+)$/;
+
+function isMessagePatch(path, op) {
+  if (!ITEM_PATH_RE.test(String(path || ""))) return false;
+  // op is "add" for a new item; older captures omit it, so an absent op is fine.
+  return !op || String(op).toLowerCase() === "add";
+}
+
+// Builds a raw event from a message-sync patch, or null when the patch is not an
+// actionable inbound message (our own send, a reaction, a non-item change).
+function rawEventFromMessageSync(event, selfId) {
+  const message = event && event.message ? event.message : event;
+  if (!message || typeof message !== "object") return null;
+
+  const match = String(message.path || "").match(ITEM_PATH_RE);
+  if (!match || !isMessagePatch(message.path, message.op)) return null;
+
+  const threadID = String(match[1]);
+  const messageID = String(message.item_id || match[2]);
+
+  const senderID = message.user_id != null ? String(message.user_id) : null;
+  // The broker echoes our own sends back over message-sync; drop them.
+  if (senderID && selfId && senderID === String(selfId)) return null;
+
+  const itemType = String(message.item_type || message.content_type || "text").toLowerCase();
+  if (/reaction|action_log|like|video_call/.test(itemType)) return null;
+
+  const body = message.text || message.text_body || "";
+  let attachments = [];
+  if (itemType !== "text") {
+    attachments = attachmentsFromContent(message.media || message.content || message);
+  }
+  if (itemType !== "text" && attachments.length === 0) {
+    // The item carried no parseable media URL; let the normalizer/bot fetch the
+    // thread history instead of emitting a message with nothing actionable.
+    return null;
+  }
+
+  return {
+    type: "message",
+    threadID,
+    senderID,
+    messageID,
+    body,
+    attachments,
+    itemType,
+    repliedToItemId: message.replied_to_item_id || null,
+    repliedToMessage: null,
+    clientContext: message.client_context || null,
+    offlineThreadingId: message.offline_threading_id != null ? String(message.offline_threading_id) : null,
+    timestamp: Number(message.timestamp || message.timestamp_ms) || Date.now()
+  };
+}
+
+module.exports = { rawEventFromMessageSync, isMessagePatch, ITEM_PATH_RE };