@violetix/baileys 0.5.6 → 0.6.0

package/lib/Utils/messages-media.js

@@ -6,7 +6,6 @@ import { createReadStream, createWriteStream, promises as fs, WriteStream } from
 import { tmpdir } from 'os';
 import { join } from 'path';
 import { Readable, Transform } from 'stream';
-import { pipeline } from 'stream/promises';
 import { URL } from 'url';
 import { proto } from '../../WAProto/index.js';
 import { DEFAULT_ORIGIN, MEDIA_HKDF_KEY_MAPPING, MEDIA_PATH_MAP, NEWSLETTER_MEDIA_PATH_MAP } from '../Defaults/index.js';
@@ -303,31 +302,9 @@ export const getStream = async (item, opts) => {
     if (Buffer.isBuffer(item)) {
         return { stream: toReadable(item), type: 'buffer' };
     }
-    // A bare path or URL string is accepted, and the reason is the error it used to produce. The
-    // contract below is `Buffer | { stream } | { url }`, so `'stream' in item` throws on a string —
-    // and it throws with the path interpolated:
-    //
-    //   TypeError: Cannot use 'in' operator to search for 'stream' in /tmp/8cktb7o7x.webp
-    //
-    // Measured on a production fleet, 2026-10-10: five of those under [SEND_STICKER]. The message
-    // names a file, so it reads as a missing or unreadable one, while the real fault is the SHAPE of
-    // the argument — and the file was perfectly readable: `createReadStream(item.url)` at the end of
-    // this function handles exactly that string. Widening here costs nothing and removes the whole
-    // class, for every caller rather than the one that was caught.
-    if (typeof item === 'string') {
-        item = { url: item };
-    }
-    if (!item || typeof item !== 'object') {
-        throw new Boom(`media source must be a Buffer, a string, { stream } or { url }, got ${item === null ? 'null' : typeof item}`);
-    }
     if ('stream' in item) {
         return { stream: item.stream, type: 'readable' };
     }
-    // Named rather than left to throw "Cannot read properties of undefined (reading 'toString')",
-    // which says nothing about which field is missing.
-    if (item.url === undefined || item.url === null) {
-        throw new Boom('media source object has neither `stream` nor `url`');
-    }
     const urlStr = item.url.toString();
     if (urlStr.startsWith('data:')) {
         const buffer = Buffer.from(urlStr.split(',')[1], 'base64');
@@ -370,122 +347,18 @@ export const getHttpStream = async (url, options = {}) => {
     const response = await fetch(url.toString(), {
         dispatcher: options.dispatcher,
         method: 'GET',
-        headers: options.headers,
-        signal: options.signal
+        headers: options.headers
     });
     if (!response.ok) {
-        if (response.body instanceof Readable) {
-            response.body.destroy();
-        }
-        else {
-            await response.body?.cancel().catch(() => { });
-        }
         throw new Boom(`Failed to fetch stream from ${url}`, { statusCode: response.status, data: { url } });
     }
     // @ts-ignore Node18+ Readable.fromWeb exists
     return response.body instanceof Readable ? response.body : Readable.fromWeb(response.body);
 };
-const SIDECAR_CHUNK_SIZE = 65536;
-const SIDECAR_HMAC_SIZE = 10;
-const SIDECAR_IV_SIZE = 16;
-const CONTAINER_SCAN_MAX_BYTES = 1024;
-const SIDECAR_MEDIA_TYPES = new Set(['video', 'audio', 'ptt', 'gif']);
-const readU32 = (bytes, offset) => ((bytes[offset] << 24) | (bytes[offset + 1] << 16) | (bytes[offset + 2] << 8) | bytes[offset + 3]) >>> 0;
-/**
- * Walks the top-level ISO-BMFF boxes (mp4/mov/3gp/m4a) in the leading bytes. A file is
- * streamable only when `moov` precedes `mdat`; advertising a non-faststart mp4 as seekable
- * (by attaching a sidecar) makes the recipient's player fail instead of falling back to a
- * plain download. Non-ISO-BMFF payloads (ogg/opus voice notes) are streamable.
- * Returns true / false, or null while `head` is too short to decide.
- */
-export const scanStreamable = (head) => {
-    if (head.length < 8) {
-        return null;
-    }
-    if (readU32(head, 4) !== 0x66747970 /* ftyp */) {
-        return true;
-    }
-    let offset = 0;
-    while (offset + 8 <= head.length) {
-        const type = readU32(head, offset + 4);
-        if (type === 0x6d6f6f76 /* moov */) {
-            return true;
-        }
-        if (type === 0x6d646174 /* mdat */) {
-            return false;
-        }
-        let size = readU32(head, offset);
-        let headerSize = 8;
-        if (size === 1) {
-            if (offset + 16 > head.length) {
-                return null;
-            }
-            if (readU32(head, offset + 8) !== 0) {
-                return true;
-            }
-            size = readU32(head, offset + 12);
-            headerSize = 16;
-        }
-        else if (size === 0) {
-            return true;
-        }
-        if (size < headerSize) {
-            return true;
-        }
-        offset += size;
-        if (offset > CONTAINER_SCAN_MAX_BYTES) {
-            return true;
-        }
-    }
-    return offset > CONTAINER_SCAN_MAX_BYTES ? true : null;
-};
-/**
- * Streaming sidecar as WhatsApp Web builds it: HMAC-SHA256(macKey) truncated to 10 bytes over
- * each 64 KiB window of iv+ciphertext+mac, with the last 16 bytes of the previous window
- * prepended, so the recipient can verify and play a range without the whole file.
- */
-class SidecarAccumulator {
-    constructor(macKey) {
-        this.macKey = macKey;
-        this.window = Buffer.alloc(SIDECAR_IV_SIZE + SIDECAR_CHUNK_SIZE);
-        this.windowOffset = 0;
-        this.totalPushed = 0;
-        this.nextChunkStart = 0;
-        this.digests = [];
-    }
-    push(data) {
-        let srcOffset = 0;
-        while (srcOffset < data.length) {
-            const windowEnd = this.nextChunkStart + SIDECAR_IV_SIZE + SIDECAR_CHUNK_SIZE;
-            const toCopy = Math.min(windowEnd - this.totalPushed, data.length - srcOffset);
-            this.window.set(data.subarray(srcOffset, srcOffset + toCopy), this.windowOffset);
-            this.windowOffset += toCopy;
-            this.totalPushed += toCopy;
-            srcOffset += toCopy;
-            if (this.totalPushed === windowEnd) {
-                this.flushChunk();
-            }
-        }
-    }
-    finish() {
-        if (this.windowOffset > 0) {
-            this.flushChunk();
-        }
-        return Buffer.concat(this.digests);
-    }
-    flushChunk() {
-        const digest = Crypto.createHmac('sha256', this.macKey).update(this.window.subarray(0, this.windowOffset)).digest();
-        this.digests.push(digest.subarray(0, SIDECAR_HMAC_SIZE));
-        this.nextChunkStart += SIDECAR_CHUNK_SIZE;
-        this.window.copyWithin(0, this.windowOffset - SIDECAR_IV_SIZE, this.windowOffset);
-        this.windowOffset = SIDECAR_IV_SIZE;
-    }
-}
-export const encryptedStream = async (media, mediaType, { logger, saveOriginalFileIfRequired, opts, mediaKey: givenMediaKey } = {}) => {
+export const encryptedStream = async (media, mediaType, { logger, saveOriginalFileIfRequired, opts } = {}) => {
     const { stream, type } = await getStream(media, opts);
     logger?.debug('fetched media stream');
-    // sticker-pack thumbnails must reuse the pack's key, the message carries only that one
-    const mediaKey = givenMediaKey ?? Crypto.randomBytes(32);
+    const mediaKey = Crypto.randomBytes(32);
     const { cipherKey, iv, macKey } = await getMediaKeys(mediaKey, mediaType);
     const encFilePath = join(getTmpFilesDirectory(), mediaType + generateMessageIDV2() + '-enc');
     const encFileWriteStream = createWriteStream(encFilePath);
@@ -500,14 +373,9 @@ export const encryptedStream = async (media, mediaType, { logger, saveOriginalFi
     const hmac = Crypto.createHmac('sha256', macKey).update(iv);
     const sha256Plain = Crypto.createHash('sha256');
     const sha256Enc = Crypto.createHash('sha256');
-    const sidecar = SIDECAR_MEDIA_TYPES.has(mediaType) ? new SidecarAccumulator(macKey) : undefined;
-    sidecar?.push(iv);
-    let streamableVerdict = sidecar ? null : false;
-    let head = Buffer.alloc(0);
     const onChunk = async (buff) => {
         sha256Enc.update(buff);
         hmac.update(buff);
-        sidecar?.push(buff);
         // Handle backpressure: if write returns false, wait for drain
         if (!encFileWriteStream.write(buff)) {
             await once(encFileWriteStream, 'drain');
@@ -518,7 +386,7 @@ export const encryptedStream = async (media, mediaType, { logger, saveOriginalFi
             fileLength += data.length;
             if (type === 'remote' &&
                 opts?.maxContentLength &&
-                fileLength > opts.maxContentLength) {
+                fileLength + data.length > opts.maxContentLength) {
                 throw new Boom(`content length exceeded when encrypting "${type}"`, {
                     data: { media, type }
                 });
@@ -529,21 +397,11 @@ export const encryptedStream = async (media, mediaType, { logger, saveOriginalFi
                 }
             }
             sha256Plain.update(data);
-            if (streamableVerdict === null) {
-                head = Buffer.concat([head, data]);
-                streamableVerdict = scanStreamable(head);
-                if (streamableVerdict === null && head.length > CONTAINER_SCAN_MAX_BYTES) {
-                    streamableVerdict = true;
-                }
-            }
             await onChunk(aes.update(data));
         }
         await onChunk(aes.final());
         const mac = hmac.digest().slice(0, 10);
         sha256Enc.update(mac);
-        sidecar?.push(mac);
-        // a non-faststart mp4 (mdat before moov) must not advertise seekability
-        const streamingSidecar = sidecar && streamableVerdict !== false ? sidecar.finish() : undefined;
         const fileSha256 = sha256Plain.digest();
         const fileEncSha256 = sha256Enc.digest();
         encFileWriteStream.write(mac);
@@ -564,8 +422,7 @@ export const encryptedStream = async (media, mediaType, { logger, saveOriginalFi
             mac,
             fileEncSha256,
             fileSha256,
-            fileLength,
-            streamingSidecar
+            fileLength
         };
     }
     catch (error) {
@@ -591,6 +448,9 @@ export const encryptedStream = async (media, mediaType, { logger, saveOriginalFi
 };
 export const DEF_MEDIA_HOST = 'mmg.whatsapp.net';
 const AES_CHUNK_SIZE = 16;
+const toSmallestChunkSize = (num) => {
+    return Math.floor(num / AES_CHUNK_SIZE) * AES_CHUNK_SIZE;
+};
 export const getUrlFromDirectPath = (directPath, host = DEF_MEDIA_HOST) => `https://${host}${directPath}`;
 const extractHost = (url) => {
     if (!url)
@@ -614,83 +474,94 @@ export const downloadContentFromMessage = async ({ mediaKey, directPath, url },
     return downloadEncryptedContent(downloadUrl, keys, opts);
 };
 /**
- * Authenticates the complete iv+ciphertext against its trailing 10-byte HMAC before
- * returning plaintext. Downloads are spooled to a private temporary file, keeping
- * memory bounded. Ranges use an inclusive startByte and exclusive endByte and are
- * sliced after full authentication; they still download the complete media.
- * Consume or destroy the returned stream to remove its temporary file.
+ * Decrypts and downloads an AES256-CBC encrypted file given the keys.
+ * Assumes the SHA256 of the plaintext is appended to the end of the ciphertext
  * */
-export const downloadEncryptedContent = async (downloadUrl, { cipherKey, iv, macKey }, { startByte = 0, endByte, options } = {}) => {
-    if (!macKey) {
-        throw new Boom('Media MAC key is required', { statusCode: 400 });
-    }
-    if (!Number.isSafeInteger(startByte) || startByte < 0 ||
-        (endByte !== undefined && (!Number.isSafeInteger(endByte) || endByte < startByte))) {
-        throw new Boom('Invalid media byte range', { statusCode: 400 });
-    }
-    const headers = new Headers(options?.headers);
-    headers.set('Origin', DEFAULT_ORIGIN);
-    // A caller-supplied Range would prevent verification of the full-file MAC.
-    headers.delete('Range');
-    let fetched;
-    let tempDirectory;
-    let filePath;
-    const cleanup = async () => {
-        if (filePath) {
-            await fs.rm(filePath, { force: true });
+export const downloadEncryptedContent = async (downloadUrl, { cipherKey, iv }, { startByte, endByte, options } = {}) => {
+    let bytesFetched = 0;
+    let startChunk = 0;
+    let firstBlockIsIV = false;
+    // if a start byte is specified -- then we need to fetch the previous chunk as that will form the IV
+    if (startByte) {
+        const chunk = toSmallestChunkSize(startByte || 0);
+        if (chunk) {
+            startChunk = chunk - AES_CHUNK_SIZE;
+            bytesFetched = chunk;
+            firstBlockIsIV = true;
+        }
+    }
+    const endChunk = endByte ? toSmallestChunkSize(endByte || 0) + AES_CHUNK_SIZE : undefined;
+    const headersInit = options?.headers ? options.headers : undefined;
+    const headers = {
+        ...(headersInit
+            ? Array.isArray(headersInit)
+                ? Object.fromEntries(headersInit)
+                : headersInit
+            : {}),
+        Origin: DEFAULT_ORIGIN
+    };
+    if (startChunk || endChunk) {
+        headers.Range = `bytes=${startChunk}-`;
+        if (endChunk) {
+            headers.Range += endChunk;
         }
-        if (tempDirectory) {
-            await fs.rmdir(tempDirectory);
+    }
+    // download the message
+    const fetched = await getHttpStream(downloadUrl, {
+        ...(options || {}),
+        headers
+    });
+    let remainingBytes = Buffer.from([]);
+    let aes;
+    const pushBytes = (bytes, push) => {
+        if (startByte || endByte) {
+            const start = bytesFetched >= startByte ? undefined : Math.max(startByte - bytesFetched, 0);
+            const end = bytesFetched + bytes.length < endByte ? undefined : Math.max(endByte - bytesFetched, 0);
+            push(bytes.slice(start, end));
+            bytesFetched += bytes.length;
+        }
+        else {
+            push(bytes);
         }
     };
-    try {
-        tempDirectory = await fs.mkdtemp(join(getTmpFilesDirectory(), 'baileys-media-'));
-        filePath = join(tempDirectory, 'media');
-        fetched = await getHttpStream(downloadUrl, { ...options, headers });
-        const hmac = Crypto.createHmac('sha256', macKey).update(iv);
-        let trailingMac = Buffer.alloc(0);
-        let ciphertextLength = 0;
-        const authenticate = new Transform({
-            transform(chunk, _, callback) {
-                const data = Buffer.concat([trailingMac, chunk]);
-                const length = Math.max(data.length - 10, 0);
-                trailingMac = data.subarray(length);
-                const ciphertext = data.subarray(0, length);
-                ciphertextLength += length;
-                hmac.update(ciphertext);
-                callback(null, ciphertext);
-            },
-            flush(callback) {
-                if (trailingMac.length !== 10 || ciphertextLength === 0 || ciphertextLength % AES_CHUNK_SIZE !== 0) {
-                    callback(new Boom('Invalid or truncated media payload', { statusCode: 400 }));
-                }
-                else if (!Crypto.timingSafeEqual(hmac.digest().subarray(0, 10), trailingMac)) {
-                    callback(new Boom('Media MAC verification failed', { statusCode: 400 }));
+    const output = new Transform({
+        transform(chunk, _, callback) {
+            let data = remainingBytes.length ? Buffer.concat([remainingBytes, chunk]) : chunk;
+            const decryptLength = toSmallestChunkSize(data.length);
+            remainingBytes = data.slice(decryptLength);
+            data = data.slice(0, decryptLength);
+            if (!aes) {
+                let ivValue = iv;
+                if (firstBlockIsIV) {
+                    ivValue = data.slice(0, AES_CHUNK_SIZE);
+                    data = data.slice(AES_CHUNK_SIZE);
                 }
-                else {
-                    callback();
+                aes = Crypto.createDecipheriv('aes-256-cbc', cipherKey, ivValue);
+                // if an end byte that is not EOF is specified
+                // stop auto padding (PKCS7) -- otherwise throws an error for decryption
+                if (endByte) {
+                    aes.setAutoPadding(false);
                 }
             }
-        });
-        await pipeline(fetched, authenticate, Crypto.createDecipheriv('aes-256-cbc', cipherKey, iv),
-            createWriteStream(filePath, { flags: 'wx', mode: 0o600 }), { signal: options?.signal });
-        const { size } = await fs.stat(filePath);
-        const end = Math.min(endByte ?? size, size);
-        if (startByte >= end) {
-            await cleanup();
-            return Readable.from([]);
+            try {
+                pushBytes(aes.update(data), b => this.push(b));
+                callback();
+            }
+            catch (error) {
+                callback(error);
+            }
+        },
+        final(callback) {
+            try {
+                pushBytes(aes.final(), b => this.push(b));
+                callback();
+            }
+            catch (error) {
+                callback(error);
+            }
         }
-        const output = createReadStream(filePath, { start: startByte, end: end - 1, signal: options?.signal });
-        output.once('close', () => {
-            void cleanup().catch(() => { });
-        });
-        return output;
-    }
-    catch (error) {
-        fetched?.destroy();
-        await cleanup().catch(() => { });
-        throw error;
-    }
+    });
+    return fetched.pipe(output, { end: true });
 };
 export function extensionForMediaMessage(message) {
     const getExtension = (mimetype) => mimetype.split(';')[0]?.split('/')[1];
@@ -977,4 +848,4 @@ const MEDIA_RETRY_STATUS_MAP = {
     [proto.MediaRetryNotification.ResultType.NOT_FOUND]: 404,
     [proto.MediaRetryNotification.ResultType.GENERAL_ERROR]: 418
 };
-//# sourceMappingURL=messages-media.js.map
+//# sourceMappingURL=messages-media.js.map

package/lib/Utils/messages.d.ts

@@ -19,7 +19,6 @@ export function getAggregateResponsesInEventMessage({ eventResponses }: {
 }, meId: any): any[];
 export function extractUrlFromText(text: any): any;
 export function generateLinkPreviewIfRequired(text: any, getUrlInfo: any, logger: any): Promise<any>;
-export function hashImagePollOption(optionName: any, fileSha256?: Uint8Array | null): string;
 export function prepareWAMessageMedia(message: any, options: any): Promise<proto.Message>;
 export function prepareDisappearingMessageSettingContent(ephemeralExpiration: any): proto.Message;
 export function generateForwardMessageContent(message: any, forceForward: any): any;