@zapo-js/fake-server 1.0.0 → 1.2.0

package/dist/esm/infra/socket-adapters.js

@@ -0,0 +1,79 @@
+/** Carrier adapters: WebSocket (companion transport) and raw TCP (mobile). */
+import { TEXT_DECODER } from '../transport/util.js';
+/**
+ * Adapts a `ws` socket to {@link WaFakeSocketLike}. Owns the two WebSocket
+ * quirks the rest of the server should not know about: a message can arrive as
+ * a fragment array, and a text frame is a protocol violation here because every
+ * WhatsApp frame is binary.
+ */
+export function createWebSocketAdapter(socket) {
+    return {
+        send: (frame) => socket.send(frame),
+        close: (code, reason) => socket.close(code, reason),
+        listen: (events) => {
+            socket.on('message', (data, isBinary) => {
+                if (!isBinary) {
+                    events.onError(new Error('received unexpected text frame'));
+                    return;
+                }
+                events.onFrame(toFrameBytes(data));
+            });
+            socket.on('close', (code, reason) => {
+                events.onClose({ code, reason: TEXT_DECODER.decode(reason) });
+            });
+            socket.on('error', (error) => {
+                events.onError(error);
+            });
+        }
+    };
+}
+/**
+ * Adapts a Node TCP socket to {@link WaFakeSocketLike} for the mobile
+ * transport. A TCP stream has no message boundaries and no close codes: every
+ * chunk is forwarded as-is (the frame codec above reassembles them) and the
+ * code/reason the server asked for is replayed when the socket finally closes.
+ */
+export function createTcpSocketAdapter(socket) {
+    let closeCode = 1000;
+    let closeReason = '';
+    return {
+        send: (frame) => {
+            socket.write(frame);
+        },
+        close: (code, reason) => {
+            closeCode = code;
+            closeReason = reason;
+            socket.end();
+        },
+        listen: (events) => {
+            socket.on('data', (chunk) => {
+                events.onFrame(chunk);
+            });
+            socket.on('close', () => {
+                events.onClose({ code: closeCode, reason: closeReason });
+            });
+            socket.on('error', (error) => {
+                events.onError(error);
+            });
+        }
+    };
+}
+function toFrameBytes(data) {
+    if (data instanceof Uint8Array) {
+        return data;
+    }
+    if (data instanceof ArrayBuffer) {
+        return new Uint8Array(data);
+    }
+    let total = 0;
+    for (const part of data) {
+        total += part.byteLength;
+    }
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const part of data) {
+        out.set(part, offset);
+        offset += part.byteLength;
+    }
+    return out;
+}

package/dist/esm/protocol/auth/cert-chain.js

@@ -1,6 +1,8 @@
 /** Fake noise certificate chain generator for handshake tests. */
 import { X25519, xeddsaSign } from '../../transport/crypto.js';
 import { proto } from '../../transport/protos.js';
+const WA_CERT_NOT_BEFORE_BACKDATE_SECONDS = 86400;
+const WA_CERT_NOT_AFTER_LIFETIME_SECONDS = 315360000;
 export async function generateFakeNoiseRootCa() {
     const keyPair = await X25519.generateKeyPair();
     return {
@@ -12,17 +14,26 @@ export async function generateFakeNoiseRootCa() {
 export async function buildFakeCertChain(input) {
     const intermediateSerial = input.intermediateSerial ?? 1;
     const leafSerial = input.leafSerial ?? 2;
+    // Strict clients (e.g. whatsmeow) enforce the validity window; leaving
+    // notBefore/notAfter unset decodes as 0 (1970) and reads as expired.
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    const notBefore = input.notBefore ?? nowSeconds - WA_CERT_NOT_BEFORE_BACKDATE_SECONDS;
+    const notAfter = input.notAfter ?? nowSeconds + WA_CERT_NOT_AFTER_LIFETIME_SECONDS;
     const intermediateKeyPair = await X25519.generateKeyPair();
     const intermediateDetails = proto.CertChain.NoiseCertificate.Details.encode({
         serial: intermediateSerial,
         issuerSerial: input.root.serial,
-        key: intermediateKeyPair.pubKey
+        key: intermediateKeyPair.pubKey,
+        notBefore,
+        notAfter
     }).finish();
     const intermediateSignature = await xeddsaSign(input.root.privateKey, intermediateDetails);
     const leafDetails = proto.CertChain.NoiseCertificate.Details.encode({
         serial: leafSerial,
         issuerSerial: intermediateSerial,
-        key: input.leafKey
+        key: input.leafKey,
+        notBefore,
+        notAfter
     }).finish();
     const leafSignature = await xeddsaSign(intermediateKeyPair.privKey, leafDetails);
     const encoded = proto.CertChain.encode({

package/dist/esm/protocol/auth/client-payload-validate.js

@@ -27,14 +27,90 @@ export function parseClientPayload(bytes) {
     if (raw.username === undefined || raw.username === null) {
         throw new ClientPayloadValidationError('missing_username', 'login ClientPayload is missing the username field');
     }
+    const flavor = resolveLoginFlavor(raw);
     return {
         kind: 'login',
         raw,
         username: String(raw.username),
         device: typeof raw.device === 'number' ? raw.device : 0,
-        loginCounter: typeof raw.lc === 'number' ? raw.lc : 0
+        loginCounter: typeof raw.lc === 'number' ? raw.lc : 0,
+        flavor,
+        mobile: flavor === 'mobile' ? parseMobileDetails(raw) : null
     };
 }
+/**
+ * Resolves the transport flavor of a login payload. `webInfo` and the `WEB`
+ * platform mark a companion; a phone is identified by the device fields only
+ * the mobile payload carries. Sniffing those fields (rather than the platform
+ * enum alone) is deliberate: `ANDROID` is the zero value of the enum, so a
+ * payload that omits `platform` entirely would otherwise read as mobile.
+ */
+function resolveLoginFlavor(raw) {
+    if (raw.webInfo) {
+        return 'web';
+    }
+    const userAgent = raw.userAgent;
+    if (!userAgent || userAgent.platform === proto.ClientPayload.UserAgent.Platform.WEB) {
+        return 'web';
+    }
+    return userAgent.manufacturer && userAgent.device ? 'mobile' : 'web';
+}
+function parseMobileDetails(raw) {
+    const userAgent = raw.userAgent;
+    if (!userAgent) {
+        throw new ClientPayloadValidationError('missing_field', 'mobile login ClientPayload is missing the userAgent');
+    }
+    const required = [
+        ['manufacturer', 'device manufacturer'],
+        ['device', 'device model'],
+        ['osVersion', 'os version'],
+        ['osBuildNumber', 'os build number'],
+        ['phoneId', 'phone id']
+    ];
+    for (const [field, label] of required) {
+        const value = userAgent[field];
+        if (value === undefined || value === null || value === '') {
+            throw new ClientPayloadValidationError('missing_field', `mobile login ClientPayload missing ${label} (userAgent.${String(field)})`);
+        }
+    }
+    const appVersion = userAgent.appVersion;
+    if (!appVersion || appVersion.primary === undefined || appVersion.primary === null) {
+        throw new ClientPayloadValidationError('missing_field', 'mobile login ClientPayload missing the app version (userAgent.appVersion)');
+    }
+    return {
+        manufacturer: String(userAgent.manufacturer),
+        device: String(userAgent.device),
+        osVersion: String(userAgent.osVersion),
+        osBuildNumber: String(userAgent.osBuildNumber),
+        appVersion: formatAppVersion(appVersion),
+        phoneId: String(userAgent.phoneId),
+        mcc: userAgent.mcc ? String(userAgent.mcc) : '000',
+        mnc: userAgent.mnc ? String(userAgent.mnc) : '000',
+        pushName: typeof raw.pushName === 'string' ? raw.pushName : null,
+        yearClass: toOptionalNumber(raw.yearClass),
+        memClass: toOptionalNumber(raw.memClass)
+    };
+}
+function formatAppVersion(version) {
+    const parts = [
+        version.primary,
+        version.secondary,
+        version.tertiary,
+        version.quaternary,
+        version.quinary
+    ];
+    const present = [];
+    for (const part of parts) {
+        if (part === undefined || part === null) {
+            break;
+        }
+        present.push(Number(part));
+    }
+    return present.join('.');
+}
+function toOptionalNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : null;
+}
 function validateRegistrationFields(devicePairingData) {
     const required = [
         ['eIdent', 'identity public key'],

package/dist/esm/protocol/auth/pair-device.js

@@ -1,5 +1,20 @@
 /** Pairing IQ builders/parsers (source: `WAWebHandlePairDevice*`, `/wa-web`). */
-import { decodeBase64Url } from '../../transport/util.js';
+import { randomBytesAsync } from '../../transport/crypto.js';
+import { bytesToBase64UrlSafe, decodeBase64Url } from '../../transport/util.js';
+const PAIR_DEVICE_REF_COUNT = 6;
+const PAIR_DEVICE_REF_BYTES = 16;
+/**
+ * Mints the rotating refs a `pair-device` push carries.
+ *
+ * They are printable on purpose. A client reads `<ref>` as text and pastes it
+ * into a comma-separated QR payload, so raw random bytes can decode into a
+ * comma or a newline and quietly corrupt whatever reads that payload back -
+ * including the primary that has to echo the ref in its upload.
+ */
+export async function mintPairingRefs(count = PAIR_DEVICE_REF_COUNT) {
+    const raw = await Promise.all(Array.from({ length: count }, () => randomBytesAsync(PAIR_DEVICE_REF_BYTES)));
+    return raw.map((bytes) => bytesToBase64UrlSafe(bytes));
+}
 export function buildPairDeviceIq(input) {
     if (input.refs.length !== 6) {
         throw new Error(`pair-device requires exactly 6 refs, got ${input.refs.length}`);

package/dist/esm/protocol/iq/companion-host.js

@@ -0,0 +1,104 @@
+/**
+ * Primary-side `md` IQ parsers: a phone hosting companion devices.
+ *
+ * These are the inverse of `protocol/auth/pair-device.ts`, which drives the
+ * companion side. Here the client is the primary: it signs a companion's device
+ * identity and uploads it, republishes its key-index list, and revokes devices.
+ */
+import { TEXT_DECODER } from '../../transport/util.js';
+/**
+ * Parses the primary's `<iq type="set" xmlns="md"><pair-device>` upload.
+ * Returns `null` when the stanza is not a well-formed pair-device upload, which
+ * lets the router fall through to another handler.
+ */
+export function parsePairDeviceUpload(iq) {
+    const pairDevice = findChild(iq, 'pair-device');
+    if (!pairDevice) {
+        return null;
+    }
+    const ref = readText(findChild(pairDevice, 'ref'));
+    const companionNoisePublicKey = readBytes(findChild(pairDevice, 'pub-key'));
+    const deviceIdentityBytes = readBytes(findChild(pairDevice, 'device-identity'));
+    const keyIndexList = findChild(pairDevice, 'key-index-list');
+    const keyIndexListBytes = readBytes(keyIndexList);
+    if (!ref || !companionNoisePublicKey || !deviceIdentityBytes || !keyIndexListBytes) {
+        return null;
+    }
+    return {
+        ref,
+        companionNoisePublicKey,
+        deviceIdentityBytes,
+        keyIndexListBytes,
+        keyIndexListTimestampSeconds: readTimestampSeconds(keyIndexList),
+        clientPropsBytes: readBytes(findChild(pairDevice, 'client-props')),
+        pemKeyBytes: readPemKey(pairDevice)
+    };
+}
+/**
+ * Parses the standalone key-index-list republish the primary sends whenever its
+ * companion set changes. Returns `null` when the stanza carries no list.
+ */
+export function parseKeyIndexListPublish(iq) {
+    const keyIndexList = findChild(iq, 'key-index-list');
+    const keyIndexListBytes = readBytes(keyIndexList);
+    if (!keyIndexListBytes) {
+        return null;
+    }
+    return {
+        keyIndexListBytes,
+        timestampSeconds: readTimestampSeconds(keyIndexList)
+    };
+}
+/**
+ * Parses `<remove-companion-device>`. The same stanza serves a companion
+ * logging itself out (`jid` = its own device) and a primary unlinking one of
+ * its companions, so the caller decides by comparing against the connection's
+ * own jid.
+ */
+export function parseRemoveCompanionDevice(iq) {
+    const remove = findChild(iq, 'remove-companion-device');
+    if (!remove) {
+        return null;
+    }
+    const jid = remove.attrs.jid;
+    return {
+        deviceJid: typeof jid === 'string' && jid.length > 0 ? jid : null,
+        all: remove.attrs.all === 'true',
+        reason: typeof remove.attrs.reason === 'string' ? remove.attrs.reason : '',
+        excludeHostedCompanion: remove.attrs.exclude_hosted_companion === 'true'
+    };
+}
+function findChild(parent, tag) {
+    if (!Array.isArray(parent.content)) {
+        return null;
+    }
+    return parent.content.find((child) => child.tag === tag) ?? null;
+}
+function readBytes(node) {
+    if (!node) {
+        return null;
+    }
+    return node.content instanceof Uint8Array ? node.content : null;
+}
+function readText(node) {
+    if (!node) {
+        return null;
+    }
+    if (typeof node.content === 'string') {
+        return node.content;
+    }
+    return node.content instanceof Uint8Array ? TEXT_DECODER.decode(node.content) : null;
+}
+function readTimestampSeconds(node) {
+    const raw = node?.attrs.ts;
+    const parsed = typeof raw === 'string' ? Number.parseInt(raw, 10) : Number.NaN;
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+/** The `<pem>` wrapper nests the key bytes in a second `<pem>` element. */
+function readPemKey(pairDevice) {
+    const pem = findChild(pairDevice, 'pem');
+    if (!pem) {
+        return null;
+    }
+    return readBytes(findChild(pem, 'pem'));
+}

package/dist/esm/protocol/iq/link-code.js

@@ -0,0 +1,90 @@
+/**
+ * Link-code (pairing-code) relay stanzas.
+ *
+ * The handshake runs between two clients with the server in the middle: the
+ * companion asks for a code (`companion_hello`), the primary answers with its
+ * wrapped ephemeral (`primary_hello`), and the companion closes with the key
+ * bundle (`companion_finish`). Each stage arrives as an IQ from one client and
+ * leaves as a notification to the other; the server only routes and mints the
+ * ref that ties the three together.
+ */
+import { TEXT_DECODER } from '../../transport/util.js';
+const RELAYED_STAGES = new Set([
+    'companion_hello',
+    'primary_hello',
+    'companion_finish'
+]);
+/**
+ * Parses a `<link_code_companion_reg>` IQ. Returns `null` for a stage this
+ * server does not relay (for example `get_country_code`), letting the router
+ * fall through to another handler.
+ */
+export function parseLinkCodeStanza(iq) {
+    const node = findChild(iq, 'link_code_companion_reg');
+    const stage = node?.attrs.stage;
+    if (!node || typeof stage !== 'string' || !RELAYED_STAGES.has(stage)) {
+        return null;
+    }
+    const jid = node.attrs.jid;
+    return {
+        stage: stage,
+        phoneJid: typeof jid === 'string' && jid.length > 0 ? jid : null,
+        ref: readText(findChild(node, 'link_code_pairing_ref')),
+        children: Array.isArray(node.content) ? node.content : []
+    };
+}
+/**
+ * Builds the `companion_hello` IQ result carrying the ref the server minted.
+ * The companion keys its whole pairing session off it.
+ */
+export function buildCompanionHelloResultContent(ref) {
+    return [
+        {
+            tag: 'link_code_companion_reg',
+            attrs: { stage: 'companion_hello' },
+            content: [{ tag: 'link_code_pairing_ref', attrs: {}, content: ref }]
+        }
+    ];
+}
+/**
+ * Wraps a relayed stage as the notification the receiving client handles. The
+ * ref is (re)stamped so the receiver can match it against its pairing session,
+ * replacing any copy carried by the source stanza.
+ */
+export function buildLinkCodeNotification(input) {
+    const children = input.children.filter((child) => child.tag !== 'link_code_pairing_ref');
+    return {
+        tag: 'notification',
+        attrs: {
+            id: input.id ?? `link-code-${Math.random().toString(36).slice(2, 10)}`,
+            from: 's.whatsapp.net',
+            type: 'link_code_companion_reg',
+            ...(input.to !== undefined ? { to: input.to } : {})
+        },
+        content: [
+            {
+                tag: 'link_code_companion_reg',
+                attrs: { stage: input.stage },
+                content: [
+                    { tag: 'link_code_pairing_ref', attrs: {}, content: input.ref },
+                    ...children
+                ]
+            }
+        ]
+    };
+}
+function findChild(parent, tag) {
+    if (!Array.isArray(parent.content)) {
+        return null;
+    }
+    return parent.content.find((child) => child.tag === tag) ?? null;
+}
+function readText(node) {
+    if (!node) {
+        return null;
+    }
+    if (typeof node.content === 'string') {
+        return node.content;
+    }
+    return node.content instanceof Uint8Array ? TEXT_DECODER.decode(node.content) : null;
+}

package/dist/esm/protocol/iq/router.js

@@ -19,18 +19,24 @@ export class WaFakeIqRouter {
     setEvents(events) {
         this.events = events;
     }
-    async route(iq) {
+    async route(iq, context) {
         if (iq.tag !== 'iq') {
             return null;
         }
         for (const handler of this.highPriorityHandlers) {
             if (matches(iq, handler.matcher)) {
-                return handler.respond(iq);
+                const response = await handler.respond(iq, context);
+                if (response !== null) {
+                    return response;
+                }
             }
         }
         for (const handler of this.handlers) {
             if (matches(iq, handler.matcher)) {
-                return handler.respond(iq);
+                const response = await handler.respond(iq, context);
+                if (response !== null) {
+                    return response;
+                }
             }
         }
         this.events.onUnhandled?.(iq);

package/dist/esm/protocol/push/mobile-notification.js

@@ -0,0 +1,97 @@
+/**
+ * Push notifications only a phone receives.
+ *
+ * `account_sync` carries the account's live device set: the primary keys its
+ * companion bookkeeping off it, allocating a fresh key index for the next link
+ * and dropping companions the server no longer lists. The registration
+ * notifications carry the login code and the takeover warning that fire while
+ * a number is being moved to another phone.
+ */
+/**
+ * Builds `<notification type="account_sync">` with the account's `<devices>`
+ * list. Every device the account still owns must be present: the primary reads
+ * this as authoritative and prunes anything missing from it.
+ */
+export function buildAccountSyncDevicesNotification(input) {
+    return {
+        tag: 'notification',
+        attrs: {
+            id: input.id ?? `account-sync-${Math.random().toString(36).slice(2, 10)}`,
+            from: input.from ?? 's.whatsapp.net',
+            type: 'account_sync',
+            t: String(input.timestampSeconds ?? Math.floor(Date.now() / 1000))
+        },
+        content: [
+            {
+                tag: 'devices',
+                attrs: {},
+                content: input.devices.map((device) => ({
+                    tag: 'device',
+                    attrs: {
+                        jid: device.deviceJid,
+                        ...(device.keyIndex !== undefined
+                            ? { 'key-index': String(device.keyIndex) }
+                            : {}),
+                        ...(device.deviceLid !== undefined ? { lid: device.deviceLid } : {})
+                    }
+                }))
+            }
+        ]
+    };
+}
+/**
+ * Builds the `<notification type="registration">` carrying a login code, which
+ * the client surfaces as `mobile_registration_code`.
+ */
+export function buildRegistrationCodeNotification(input) {
+    const nowSeconds = Math.floor(Date.now() / 1000);
+    return {
+        tag: 'notification',
+        attrs: {
+            id: input.id ?? `registration-${Math.random().toString(36).slice(2, 10)}`,
+            from: input.from ?? 's.whatsapp.net',
+            type: 'registration'
+        },
+        content: [
+            {
+                tag: 'wa_old_registration',
+                attrs: {
+                    code: input.code,
+                    expiry_t: String(input.expirySeconds ?? nowSeconds + 300),
+                    device_id: input.fromDeviceId
+                }
+            }
+        ]
+    };
+}
+/**
+ * Builds the `<notification type="registration">` warning that the number is
+ * being registered on another phone, surfaced as
+ * `mobile_account_takeover_notice`.
+ */
+export function buildAccountTakeoverNotice(input) {
+    return {
+        tag: 'notification',
+        attrs: {
+            id: input.id ?? `takeover-${Math.random().toString(36).slice(2, 10)}`,
+            from: input.from ?? 's.whatsapp.net',
+            type: 'registration'
+        },
+        content: [
+            {
+                tag: 'device_logout',
+                attrs: {
+                    id: input.serverToken,
+                    t: String(input.attemptTimestampSeconds ?? Math.floor(Date.now() / 1000)),
+                    ...(input.newDeviceName !== undefined ? { device: input.newDeviceName } : {}),
+                    ...(input.newDevicePlatform !== undefined
+                        ? { new_device_platform: input.newDevicePlatform }
+                        : {}),
+                    ...(input.newDeviceAppVersion !== undefined
+                        ? { new_device_app_version: input.newDeviceAppVersion }
+                        : {})
+                }
+            }
+        ]
+    };
+}