bedrock-portal-nethernet 2.0.11 → 2.2.0

package/dist/handshake/authorizationKeys.d.ts

@@ -0,0 +1,5 @@
+import crypto from 'crypto';
+export declare function getAuthorizationKey(protocolVersion: number, keyId: string): Promise<{
+    issuer: string;
+    key: crypto.KeyObject;
+}>;

package/dist/handshake/authorizationKeys.js

@@ -0,0 +1,106 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAuthorizationKey = getAuthorizationKey;
+const crypto_1 = __importDefault(require("crypto"));
+const debug = require('debug')('bedrock-portal-nethernet');
+const AUTHORISATION_KEY_REFRESH_INTERVAL_MS = 30 * 60 * 1000;
+const AUTHORISATION_FETCH_TIMEOUT_MS = 10_000;
+const AUTHORISATION_SERVICE_URI_FALLBACK = 'https://authorization.franchise.minecraft-services.net';
+const AUTHORISATION_SERVICE_OPENID_CONFIGURATION_PATH = '/.well-known/openid-configuration';
+const AUTHORISATION_SERVICE_KEYS_PATH = '/.well-known/keys';
+const MINECRAFT_SERVICES_DISCOVERY_URL = 'https://client.discovery.minecraft-services.net/api/v1.0/discovery/MinecraftPE/builds/';
+let cachedAuthorizationKeyring = null;
+let inflightAuthorizationKeyring = null;
+async function fetchJson(url) {
+    let response;
+    try {
+        response = await fetch(url, { signal: AbortSignal.timeout(AUTHORISATION_FETCH_TIMEOUT_MS) });
+    }
+    catch (error) {
+        throw new Error(`Failed accessing ${url}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!response.ok) {
+        throw new Error(`Unexpected HTTP response code accessing ${url}: ${response.status}`);
+    }
+    return response.json();
+}
+async function resolveAuthorizationUrls(protocolVersion) {
+    let authServiceUrl = new URL(AUTHORISATION_SERVICE_URI_FALLBACK);
+    let issuer = authServiceUrl.toString();
+    try {
+        const discovery = await fetchJson(new URL(String(protocolVersion), MINECRAFT_SERVICES_DISCOVERY_URL));
+        const authService = discovery.result?.serviceEnvironments?.auth?.prod;
+        if (!authService?.serviceUri) {
+            throw new Error('Discovery response missing auth service URI');
+        }
+        authServiceUrl = new URL(authService.serviceUri);
+        issuer = authService.issuer ? new URL(authService.issuer).toString() : authServiceUrl.toString();
+    }
+    catch (error) {
+        debug('Failed to resolve auth service info, using fallback', error);
+    }
+    let jwksUrl = new URL(AUTHORISATION_SERVICE_KEYS_PATH, authServiceUrl);
+    try {
+        const openIdConfiguration = await fetchJson(new URL(AUTHORISATION_SERVICE_OPENID_CONFIGURATION_PATH, authServiceUrl));
+        issuer = openIdConfiguration.issuer ? new URL(openIdConfiguration.issuer).toString() : issuer;
+        jwksUrl = openIdConfiguration.jwks_uri ? new URL(openIdConfiguration.jwks_uri) : jwksUrl;
+    }
+    catch (error) {
+        debug('Failed to resolve OpenID configuration, using default JWKS endpoint', error);
+    }
+    return { issuer, jwksUrl };
+}
+async function fetchAuthorizationKeyring(protocolVersion) {
+    const { issuer, jwksUrl } = await resolveAuthorizationUrls(protocolVersion);
+    const payload = await fetchJson(jwksUrl);
+    const keys = new Map();
+    for (const jwk of payload.keys || []) {
+        if (!jwk.kid)
+            continue;
+        keys.set(jwk.kid, crypto_1.default.createPublicKey({ key: jwk, format: 'jwk' }));
+    }
+    if (keys.size === 0) {
+        throw new Error('No valid authentication keys returned by Microsoft');
+    }
+    return {
+        fetchedAt: Date.now(),
+        issuer,
+        keys,
+        protocolVersion,
+    };
+}
+function isAuthorizationKeyringFresh(protocolVersion) {
+    return cachedAuthorizationKeyring !== null &&
+        cachedAuthorizationKeyring.protocolVersion === protocolVersion &&
+        Date.now() - cachedAuthorizationKeyring.fetchedAt < AUTHORISATION_KEY_REFRESH_INTERVAL_MS;
+}
+async function refreshAuthorizationKeyring(protocolVersion) {
+    inflightAuthorizationKeyring ??= fetchAuthorizationKeyring(protocolVersion);
+    try {
+        const keyring = await inflightAuthorizationKeyring;
+        cachedAuthorizationKeyring = keyring;
+        return keyring;
+    }
+    finally {
+        inflightAuthorizationKeyring = null;
+    }
+}
+async function getAuthorizationKey(protocolVersion, keyId) {
+    let keyring = isAuthorizationKeyringFresh(protocolVersion)
+        ? cachedAuthorizationKeyring
+        : await refreshAuthorizationKeyring(protocolVersion);
+    if (!keyring || !keyring.keys.has(keyId)) {
+        keyring = await refreshAuthorizationKeyring(protocolVersion);
+    }
+    const key = keyring.keys.get(keyId);
+    if (!key) {
+        throw new Error(`Unrecognized authentication key ID: ${keyId}`);
+    }
+    return {
+        issuer: keyring.issuer,
+        key,
+    };
+}

package/dist/handshake/loginVerify.js

@@ -6,12 +6,64 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = __importDefault(require("crypto"));
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
 const constants_1 = require("./constants");
+const authorizationKeys_1 = require("./authorizationKeys");
 const debug = require('debug')('bedrock-portal-nethernet');
+const AUTHORISATION_AUDIENCE = 'api://auth-minecraft-services/multiplayer';
+const AUTHORISATION_CLOCK_TOLERANCE_SECONDS = 60;
+function getJwtObject(decoded, errorMessage) {
+    if (!decoded || typeof decoded === 'string') {
+        throw new Error(errorMessage);
+    }
+    return decoded;
+}
+function normalizeToken(token) {
+    return token.replace(/^MCToken\s+/i, '').trim();
+}
+function getJwtHeader(token) {
+    const decoded = jsonwebtoken_1.default.decode(normalizeToken(token), { complete: true });
+    if (!decoded?.header || typeof decoded.header !== 'object') {
+        throw new Error('Missing JWT header');
+    }
+    return decoded.header;
+}
+function getTokenUserData(decoded) {
+    return {
+        extraData: {
+            XUID: decoded.xid || decoded.XUID || decoded.xuid || '0',
+            displayName: decoded.xname || decoded.displayName || 'Player',
+            identity: decoded.identity,
+            PlayFabID: decoded.pfbid || decoded.playFabId || decoded.PlayFabID,
+            PlayFabTitleID: decoded.pfbtid || decoded.playFabTitleId || decoded.PlayFabTitleID,
+        },
+    };
+}
 exports.default = (client) => {
     // Refer to the docs:
     // https://web.archive.org/web/20180917171505if_/https://confluence.yawk.at/display/PEPROTOCOL/Game+Packets#GamePackets-Login
     const getDER = (b64) => crypto_1.default.createPublicKey({ key: Buffer.from(b64, 'base64'), format: 'der', type: 'spki' });
-    function verifyAuth(chain) {
+    async function verifyTokenAuth(token) {
+        const normalizedToken = normalizeToken(token);
+        const header = getJwtHeader(normalizedToken);
+        if (!header.kid) {
+            throw new Error('Authorization token missing key id');
+        }
+        const { issuer, key } = await (0, authorizationKeys_1.getAuthorizationKey)(client.options.protocolVersion, header.kid);
+        const decoded = getJwtObject(jsonwebtoken_1.default.verify(normalizedToken, key, {
+            algorithms: ['RS256'],
+            clockTolerance: AUTHORISATION_CLOCK_TOLERANCE_SECONDS,
+            issuer,
+            audience: AUTHORISATION_AUDIENCE,
+        }), 'Invalid login token');
+        const publicKey = decoded.cpk || decoded.clientPublicKey;
+        if (!publicKey) {
+            throw new Error('Authorization token missing client public key');
+        }
+        return {
+            key: publicKey,
+            data: getTokenUserData(decoded),
+        };
+    }
+    function verifyChainAuth(chain) {
         let data = {};
         // There are three JWT tokens sent to us, one signed by the client
         // one signed by Mojang with the Mojang token we have and another one
@@ -20,9 +72,9 @@ exports.default = (client) => {
         // signed by Mojang by checking the x509 public key in the JWT headers
         let didVerify = false;
         let pubKey = getDER(getX5U(chain[0])); // the first one is client signed, allow it
-        let finalKey = null;
+        let finalKey = '';
         for (const token of chain) {
-            const decoded = jsonwebtoken_1.default.verify(token, pubKey, { algorithms: ['ES384'] });
+            const decoded = getJwtObject(jsonwebtoken_1.default.verify(token, pubKey, { algorithms: ['ES384'] }), 'Invalid login token');
             // Check if signed by Mojang key
             const x5u = getX5U(token);
             if (x5u === constants_1.PUBLIC_KEY && !data.extraData?.XUID) {
@@ -39,12 +91,14 @@ exports.default = (client) => {
         return { key: finalKey, data };
     }
     function verifySkin(publicKey, token) {
+        if (getX5U(token) !== publicKey) {
+            throw new Error('Invalid JWT signature');
+        }
         const pubKey = getDER(publicKey);
-        const decoded = jsonwebtoken_1.default.verify(token, pubKey, { algorithms: ['ES384'] });
-        return decoded;
+        return getJwtObject(jsonwebtoken_1.default.verify(token, pubKey, { algorithms: ['ES384'] }), 'Invalid JWT payload');
     }
-    client.decodeLoginJWT = (authTokens, skinTokens) => {
-        const { key, data } = verifyAuth(authTokens);
+    client.decodeLoginJWT = async (authTokens, skinTokens, authToken = '') => {
+        const { key, data } = authToken ? await verifyTokenAuth(authToken) : verifyChainAuth(authTokens);
         const skinData = verifySkin(key, skinTokens);
         return { key, userData: data, skinData };
     };
@@ -58,8 +112,6 @@ exports.default = (client) => {
     };
 };
 function getX5U(token) {
-    const [header] = token.split('.');
-    const hdec = Buffer.from(header, 'base64').toString('utf-8');
-    const hjson = JSON.parse(hdec);
-    return hjson.x5u;
+    const hjson = getJwtHeader(token);
+    return hjson.x5u || '';
 }

package/dist/nethernet/server.d.ts

@@ -1,17 +1,29 @@
 import { Connection } from './connection';
 import { Signal } from '../signaling/signal';
 import { SignalStructure } from '../signaling/struct';
+type PendingCandidate = {
+    signal: SignalStructure;
+    attempts: number;
+};
 export declare class Server {
     networkId: bigint;
     connectionId: bigint;
     signaling: Signal;
     connections: Map<bigint, Connection>;
+    pendingCandidates: Map<bigint, PendingCandidate[]>;
+    remoteDescriptionReady: Set<bigint>;
+    pendingCandidateTimers: Map<bigint, NodeJS.Timeout>;
     onOpenConnection: (conn: Connection) => void;
     onCloseConnection: (id: bigint, reason: string) => void;
     onEncapsulated: (packet: Buffer, id: bigint) => void;
     constructor(signaling: Signal, networkId?: bigint, connectionId?: bigint);
     handleCandidate(signal: SignalStructure): Promise<void>;
+    queueCandidate(signal: SignalStructure, reason?: string): void;
+    schedulePendingCandidateFlush(connectionId: bigint): void;
+    flushPendingCandidates(connectionId: bigint): void;
+    requeueCandidate(candidate: PendingCandidate, remaining: PendingCandidate[], reason: string): void;
     handleOffer(signal: SignalStructure): Promise<void>;
     listen(): Promise<void>;
     close(): void;
 }
+export {};

package/dist/nethernet/server.js

@@ -5,6 +5,8 @@ const node_datachannel_1 = require("node-datachannel");
 const connection_1 = require("./connection");
 const struct_1 = require("../signaling/struct");
 const debugFn = require('debug')('bedrock-portal-nethernet');
+const MAX_PENDING_CANDIDATE_ATTEMPTS = 50;
+const PENDING_CANDIDATE_RETRY_MS = 100;
 const getRandomUint64 = () => {
     const high = Math.floor(Math.random() * 0xFFFFFFFF);
     const low = Math.floor(Math.random() * 0xFFFFFFFF);
@@ -15,6 +17,9 @@ class Server {
     connectionId;
     signaling;
     connections;
+    pendingCandidates;
+    remoteDescriptionReady;
+    pendingCandidateTimers;
     onOpenConnection;
     onCloseConnection;
     onEncapsulated;
@@ -23,18 +28,78 @@ class Server {
         this.networkId = networkId;
         this.connectionId = connectionId;
         this.connections = new Map();
+        this.pendingCandidates = new Map();
+        this.remoteDescriptionReady = new Set();
+        this.pendingCandidateTimers = new Map();
         this.onOpenConnection = () => { };
         this.onCloseConnection = () => { };
         this.onEncapsulated = () => { };
     }
     async handleCandidate(signal) {
         const conn = this.connections.get(signal.connectionId);
-        if (conn) {
+        if (!conn || !this.remoteDescriptionReady.has(signal.connectionId)) {
+            this.queueCandidate(signal);
+            return;
+        }
+        try {
             conn.rtcConnection.addRemoteCandidate(signal.data, '0');
         }
+        catch (error) {
+            this.queueCandidate(signal, formatCandidateError(error));
+        }
+    }
+    queueCandidate(signal, reason = 'connection is not ready') {
+        const candidates = this.pendingCandidates.get(signal.connectionId) || [];
+        candidates.push({ signal, attempts: 0 });
+        this.pendingCandidates.set(signal.connectionId, candidates);
+        debugFn('Queued ICE candidate', signal.connectionId, reason);
+        this.schedulePendingCandidateFlush(signal.connectionId);
+    }
+    schedulePendingCandidateFlush(connectionId) {
+        if (this.pendingCandidateTimers.has(connectionId))
+            return;
+        const timer = setTimeout(() => {
+            this.pendingCandidateTimers.delete(connectionId);
+            this.flushPendingCandidates(connectionId);
+        }, PENDING_CANDIDATE_RETRY_MS);
+        timer.unref?.();
+        this.pendingCandidateTimers.set(connectionId, timer);
+    }
+    flushPendingCandidates(connectionId) {
+        const candidates = this.pendingCandidates.get(connectionId);
+        if (!candidates?.length)
+            return;
+        const conn = this.connections.get(connectionId);
+        const remaining = [];
+        for (const candidate of candidates) {
+            if (!conn || !this.remoteDescriptionReady.has(connectionId)) {
+                this.requeueCandidate(candidate, remaining, 'connection is not ready');
+                continue;
+            }
+            try {
+                conn.rtcConnection.addRemoteCandidate(candidate.signal.data, '0');
+            }
+            catch (error) {
+                this.requeueCandidate(candidate, remaining, formatCandidateError(error));
+            }
+        }
+        if (remaining.length) {
+            this.pendingCandidates.set(connectionId, remaining);
+            this.schedulePendingCandidateFlush(connectionId);
+        }
         else {
-            debugFn('Received candidate for unknown connection', signal);
+            this.pendingCandidates.delete(connectionId);
+        }
+    }
+    requeueCandidate(candidate, remaining, reason) {
+        if (candidate.attempts >= MAX_PENDING_CANDIDATE_ATTEMPTS) {
+            debugFn('Dropping ICE candidate after retries', candidate.signal.connectionId, reason);
+            return;
         }
+        remaining.push({
+            signal: candidate.signal,
+            attempts: candidate.attempts + 1,
+        });
     }
     async handleOffer(signal) {
         if (!this.signaling.credentials) {
@@ -55,10 +120,15 @@ class Server {
         rtcConnection.onIceStateChange(state => {
             if (state === 'connected')
                 this.onOpenConnection(connection);
-            if (state === 'disconnected')
+            if (state === 'disconnected') {
+                this.remoteDescriptionReady.delete(signal.connectionId);
+                this.pendingCandidates.delete(signal.connectionId);
                 this.onCloseConnection(signal.connectionId, 'disconnected');
+            }
         });
         rtcConnection.setRemoteDescription(signal.data, 'offer');
+        this.remoteDescriptionReady.add(signal.connectionId);
+        this.flushPendingCandidates(signal.connectionId);
         const answer = rtcConnection.localDescription();
         if (!answer) {
             throw new Error('No answer');
@@ -70,10 +140,14 @@ class Server {
         this.signaling.on('signal', (signal) => {
             switch (signal.type) {
                 case struct_1.SignalType.ConnectRequest:
-                    this.handleOffer(signal);
+                    this.handleOffer(signal).catch(error => {
+                        debugFn('Failed to handle connect offer', signal, error);
+                    });
                     break;
                 case struct_1.SignalType.CandidateAdd:
-                    this.handleCandidate(signal);
+                    this.handleCandidate(signal).catch(error => {
+                        debugFn('Failed to handle ICE candidate', signal, error);
+                    });
                     break;
                 default:
                     debugFn('Received signal for unknown type', signal);
@@ -81,9 +155,18 @@ class Server {
         });
     }
     close() {
+        for (const timer of this.pendingCandidateTimers.values()) {
+            clearTimeout(timer);
+        }
+        this.pendingCandidateTimers.clear();
+        this.pendingCandidates.clear();
+        this.remoteDescriptionReady.clear();
         for (const conn of this.connections.values()) {
             conn.close();
         }
     }
 }
 exports.Server = Server;
+function formatCandidateError(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/options.d.ts

@@ -1,6 +1,7 @@
 import { CompressionAlgorithm } from './transforms/framer';
 export type Options = {
     version: string;
+    signalingMode: 'rpc' | 'legacy';
     autoInitPlayer: boolean;
     offline: boolean;
     connectTimeout: number;
@@ -9,14 +10,5 @@ export type Options = {
     compressionThreshold: number;
     protocolVersion: number;
 };
-export declare const CURRENT_VERSION = "1.26.0";
-export declare const defaultOptions: {
-    version: string;
-    autoInitPlayer: boolean;
-    offline: boolean;
-    connectTimeout: number;
-    compressionAlgorithm: CompressionAlgorithm;
-    compressionLevel: number;
-    compressionThreshold: number;
-    protocolVersion: number;
-};
+export declare const CURRENT_VERSION = "1.26.20";
+export declare const defaultOptions: Options;

package/dist/options.js

@@ -3,10 +3,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.defaultOptions = exports.CURRENT_VERSION = void 0;
 const framer_1 = require("./transforms/framer");
 // Currently supported verson. Note, clients with newer versions can still connect as long as data is in minecraft-data
-exports.CURRENT_VERSION = '1.26.0';
+exports.CURRENT_VERSION = '1.26.20';
 exports.defaultOptions = {
     // https://minecraft.wiki/w/Protocol_version#Bedrock_Edition_2
     version: exports.CURRENT_VERSION,
+    signalingMode: 'rpc',
     // client: If we should send SetPlayerInitialized to the server after getting play_status spawn.
     // if this is disabled, no 'spawn' event will be emitted, you should manually set
     // client.status to ClientStatus.Initialized after sending the init packet.
@@ -22,5 +23,5 @@ exports.defaultOptions = {
     // server: If true, only compress if a payload is larger than compressionThreshold
     compressionThreshold: 512,
     // server and client: The protocol version to use
-    protocolVersion: 924,
+    protocolVersion: 975,
 };