c-capcut 1.0.0

package/src/lib/capcut.js

@@ -0,0 +1,322 @@
+/**
+ * lib/capcut.js
+ * Full CapCut account registration via direct HTTP fetch.
+ * No browser required - pure API calls based on HAR analysis.
+ *
+ * CapCut uses the TikTok "passport" account system. Request bodies are
+ * obfuscated with "mix_mode" encoding: each character is XOR-ed with 0x05
+ * and emitted as 2-digit lowercase hex.
+ *
+ * Flow (login-row.www.capcut.com / www.capcut.com):
+ *  1. GET  www.capcut.com/                          → bootstrap `ttwid` cookie
+ *  2. POST /passport/web/region/                    → `passport_csrf_token` + region domain
+ *  3. POST /passport/web/user/check_email_registered → ensure email is free
+ *  4. POST /passport/web/email/send_code/  (type=34) → trigger OTP email
+ *  5. (poll mailbox for the 6-digit code)
+ *  6. POST /passport/web/email/register_verify_login → create account + session cookies
+ *  7. GET  /passport/web/account/info/              → confirm account
+ */
+
+import { randomBytes, randomUUID } from "crypto";
+import {
+  CookieJar,
+  fetchCookie,
+  fetchRedirect,
+  USER_AGENT,
+} from "./http-client.js";
+import {
+  CAPCUT_AID,
+  CAPCUT_SDK_VERSION,
+  CAPCUT_LANGUAGE,
+  CAPCUT_REGION,
+  CAPCUT_LOGIN_DOMAIN,
+} from "../config.js";
+
+export const TOTAL_STEPS = 6;
+
+// ─── mix_mode Encoding (XOR 0x05 → hex) ─────────────────────────────────────────
+
+/** Encode a plaintext value into CapCut/TikTok mix_mode hex. */
+export function mixEncode(str) {
+  let out = "";
+  for (let i = 0; i < str.length; i++) {
+    const x = (str.charCodeAt(i) ^ 0x05) & 0xff;
+    out += x.toString(16).padStart(2, "0");
+  }
+  return out;
+}
+
+/** Decode mix_mode hex back to plaintext (useful for debugging). */
+export function mixDecode(hex) {
+  let out = "";
+  for (let i = 0; i < hex.length; i += 2) {
+    out += String.fromCharCode(parseInt(hex.substr(i, 2), 16) ^ 0x05);
+  }
+  return out;
+}
+
+// ─── Anti-bot fingerprint helpers ───────────────────────────────────────────────
+
+/** Generate a TikTok-style `verifyFp` device fingerprint. */
+function genVerifyFp() {
+  const chars =
+    "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+  const t = chars.length;
+  const r = Date.now().toString(36);
+  const o = new Array(36);
+  o[8] = o[13] = o[18] = o[23] = "_";
+  o[14] = "4";
+  for (let i = 0; i < 36; i++) {
+    if (!o[i]) {
+      const n = Math.floor(Math.random() * t);
+      o[i] = chars[i === 19 ? (3 & n) | 8 : n];
+    }
+  }
+  return `verify_${r}_${o.join("")}`;
+}
+
+/** Generate a random `msToken` (best-effort; real one is produced by the SDK). */
+function genMsToken(len = 107) {
+  const chars =
+    "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+  let out = "";
+  const bytes = randomBytes(len);
+  for (let i = 0; i < len; i++) out += chars[bytes[i] % chars.length];
+  return out;
+}
+
+/** Random 32-byte hex device id used as `hashed_id` for the region call. */
+function genHashedId() {
+  return randomBytes(32).toString("hex");
+}
+
+// ─── Date of birth ──────────────────────────────────────────────────────────────
+
+function randomBirthday() {
+  const year = 1996 + Math.floor(Math.random() * 8); // 1996..2003
+  const month = Math.floor(Math.random() * 12) + 1;
+  const day = Math.floor(Math.random() * 28) + 1;
+  return `${year}-${String(month).padStart(2, "0")}-${String(day).padStart(2, "0")}`;
+}
+
+// ─── Registration ───────────────────────────────────────────────────────────────
+
+/**
+ * Register a CapCut account via fetch (no browser).
+ * @param {{ email: string, password: string, fullName: string }} account
+ * @param {{ askOtpFn: (email:string, opts?:{after?:number})=>Promise<string[]>, onProgress?: (step:number,msg:string)=>void }} opts
+ * @returns {Promise<Object>} account data with passport info
+ */
+export async function registerAccount(account, opts = {}) {
+  const { email, password } = account;
+  const { askOtpFn, onProgress } = opts;
+  const progress = (step, msg) => onProgress?.(step, msg);
+
+  const jar = new CookieJar();
+  const verifyFp = genVerifyFp();
+  const msToken = genMsToken();
+
+  let loginDomain = CAPCUT_LOGIN_DOMAIN;
+
+  // Shared query params for passport endpoints.
+  const baseQuery = () =>
+    new URLSearchParams({
+      aid: CAPCUT_AID,
+      account_sdk_source: "web",
+      sdk_version: CAPCUT_SDK_VERSION,
+      language: CAPCUT_LANGUAGE,
+      verifyFp,
+    });
+
+  const passportHeaders = (csrf) => ({
+    Accept: "application/json, text/javascript",
+    "Content-Type": "application/x-www-form-urlencoded",
+    Origin: "https://www.capcut.com",
+    Referer: "https://www.capcut.com/",
+    "x-tt-passport-csrf-token": csrf || "",
+    "User-Agent": USER_AGENT,
+  });
+
+  const post = (path, csrf, bodyParams, extraQuery = {}) => {
+    const q = baseQuery();
+    for (const [k, v] of Object.entries(extraQuery)) q.set(k, v);
+    const url = `${loginDomain}${path}?${q.toString()}`;
+    return fetchCookie(jar, url, {
+      method: "POST",
+      headers: passportHeaders(csrf),
+      body: new URLSearchParams(bodyParams).toString(),
+    });
+  };
+
+  // ── Step 1: Bootstrap device (ttwid) ─────────────────────────────────────
+  progress(1, "Bootstrapping device session...");
+  try {
+    const { response } = await fetchRedirect(jar, "https://www.capcut.com/", {
+      headers: {
+        Accept:
+          "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+        Referer: "https://www.capcut.com/",
+      },
+    });
+    await response.text().catch(() => {});
+  } catch {
+    // Non-fatal: ttwid may still be issued by the region call.
+  }
+  progress(1, "Device session ready ✓");
+
+  // ── Step 2: Region → CSRF token + regional login domain ──────────────────
+  progress(2, "Resolving region & CSRF token...");
+  const regionRes = await post("/passport/web/region/", "", {
+    type: "2",
+    hashed_id: genHashedId(),
+  });
+  const regionData = await regionRes.json().catch(() => ({}));
+  if (regionData?.data?.domain) loginDomain = regionData.data.domain;
+  const csrf = jar.getCookie("passport_csrf_token") || "";
+  if (!csrf) throw new Error("Failed to obtain passport CSRF token");
+  progress(
+    2,
+    `CSRF acquired ✓ (region: ${regionData?.data?.country_code || CAPCUT_REGION})`,
+  );
+
+  // ── Step 3: Check email availability ─────────────────────────────────────
+  progress(3, "Checking email availability...");
+  const checkRes = await post(
+    "/passport/web/user/check_email_registered",
+    csrf,
+    {
+      mix_mode: "1",
+      email: mixEncode(email),
+      fixed_mix_mode: "1",
+    },
+  );
+  const checkData = await checkRes.json().catch(() => ({}));
+  if (checkData?.data?.is_registered === 1) {
+    throw new Error("Email already registered");
+  }
+  progress(3, "Email available ✓");
+
+  // ── Step 4: Send OTP code ────────────────────────────────────────────────
+  // Record timestamp BEFORE triggering OTP (5s skew buffer for the mail server).
+  let otpSentAt = Date.now() - 5_000;
+  progress(4, "Requesting verification code...");
+  const sendRes = await post("/passport/web/email/send_code/", csrf, {
+    mix_mode: "1",
+    email: mixEncode(email),
+    password: mixEncode(password),
+    type: "34",
+    fixed_mix_mode: "1",
+  });
+  const sendData = await sendRes.json().catch(() => ({}));
+  if (sendData?.message !== "success") {
+    const desc =
+      sendData?.data?.description || sendData?.data?.error_code || "unknown";
+    throw new Error(`send_code failed: ${desc}`);
+  }
+  progress(4, "Verification code sent ✓");
+
+  // ── Step 5: Wait for OTP (with resend) ───────────────────────────────────
+  const OTP_POLL_MS = 30_000;
+  const MAX_RESENDS = 2;
+  let otpCodes = null;
+
+  for (let attempt = 0; attempt <= MAX_RESENDS; attempt++) {
+    if (attempt > 0) {
+      otpSentAt = Date.now() - 5_000;
+      progress(5, `Resending code (${attempt}/${MAX_RESENDS})...`);
+      await post("/passport/web/email/send_code/", csrf, {
+        mix_mode: "1",
+        email: mixEncode(email),
+        password: mixEncode(password),
+        type: "34",
+        fixed_mix_mode: "1",
+      }).catch(() => {});
+      await new Promise((r) => setTimeout(r, 2000));
+    }
+
+    progress(
+      5,
+      attempt > 0
+        ? `Waiting for code (resend ${attempt})...`
+        : "Waiting for verification code...",
+    );
+
+    try {
+      const result = await Promise.race([
+        askOtpFn(email, { after: otpSentAt }),
+        new Promise((_, reject) =>
+          setTimeout(() => reject(new Error("timeout")), OTP_POLL_MS),
+        ),
+      ]);
+      otpCodes = Array.isArray(result) ? result : [result];
+      if (otpCodes.length > 0) break;
+    } catch {
+      if (attempt === MAX_RESENDS) {
+        throw new Error("OTP not received after 2 resends");
+      }
+    }
+  }
+
+  progress(5, `Code received ✓ (${otpCodes.length}: ${otpCodes.join(", ")})`);
+
+  // ── Step 6: Verify & register (try each code, newest first) ──────────────
+  const birthday = randomBirthday();
+  let regData = null;
+
+  for (const code of otpCodes) {
+    progress(6, `Verifying code (${code})...`);
+    const regRes = await post(
+      "/passport/web/email/register_verify_login/",
+      csrf,
+      {
+        mix_mode: "1",
+        email: mixEncode(email),
+        code: mixEncode(code.trim()),
+        password: mixEncode(password),
+        type: "34",
+        birthday,
+        force_user_region: CAPCUT_REGION,
+        biz_param: "{}",
+        fixed_mix_mode: "1",
+      },
+      { msToken },
+    );
+    regData = await regRes.json().catch(() => ({}));
+
+    if (regData?.data?.user_id || regData?.message === "success") break;
+
+    const errCode = regData?.data?.error_code;
+    progress(6, `Code ${code} rejected (err ${errCode}), trying next...`);
+  }
+
+  if (!(regData?.data?.user_id || regData?.message === "success")) {
+    const desc = regData?.data?.description || JSON.stringify(regData);
+    throw new Error(`Registration failed: ${desc}`);
+  }
+
+  const userId = regData.data.user_id_str || String(regData.data.user_id || "");
+  const screenName = regData.data.screen_name || regData.data.name || "";
+  const sessionId = jar.getCookie("sessionid") || "";
+
+  // ── Confirm account info (best-effort) ───────────────────────────────────
+  try {
+    const infoUrl = `https://www.capcut.com/passport/web/account/info/?${baseQuery().toString()}`;
+    await fetchCookie(jar, infoUrl, {
+      headers: passportHeaders(csrf),
+    });
+  } catch {
+    // optional
+  }
+
+  const birthdayDisplay = birthday;
+  progress(6, `Account created ✓ (uid: ${userId})`);
+
+  return {
+    ...account,
+    userId,
+    screenName,
+    birthday: birthdayDisplay,
+    sessionId,
+    status: "verified",
+  };
+}

package/src/lib/email-gen.js

@@ -0,0 +1,120 @@
+/**
+ * lib/email-gen.js
+ * Email account generator using GoMail API.
+ *
+ * Flow:
+ *  1. GET  /api/v1/domains       → list available domains
+ *  2. Generate random username + pick random domain
+ *  3. POST /api/v1/auth/signup   → create email account
+ *  4. Return ready-to-use email address
+ */
+
+import { faker } from "@faker-js/faker";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+function apiHeaders(apiKey) {
+  return {
+    "X-API-Key": apiKey,
+    "Content-Type": "application/json",
+    Accept: "application/json",
+  };
+}
+
+function generateSafeNamePart(generator) {
+  let name = "";
+  do {
+    name = generator().replace(/\s+/g, " ").trim();
+  } while (!/^[A-Za-z]+(?: [A-Za-z]+)*$/.test(name));
+  return name;
+}
+
+function toEmailPart(name) {
+  return name
+    .replace(/[^A-Za-z\s]/g, " ")
+    .replace(/\s+/g, "")
+    .toLowerCase();
+}
+
+// ─── API Calls ────────────────────────────────────────────────────────────────
+
+/**
+ * Fetch available domains from email service.
+ * @param {string} apiUrl  - Base URL, e.g. "https://mail.gopretstudio.com"
+ * @param {string} apiKey  - X-API-Key
+ * @returns {Promise<string[]>} array of domain strings
+ */
+export async function fetchDomains(apiUrl, apiKey) {
+  const res = await fetch(`${apiUrl}/api/v1/domains`, {
+    headers: apiHeaders(apiKey),
+  });
+  const data = await res.json();
+  if (!res.ok) throw new Error(data.error || "Failed to fetch domains");
+  const domains = (data.domains || data.data || [])
+    .filter((d) => d.is_active !== false)
+    .map((d) => d.domain);
+  if (domains.length === 0) throw new Error("No active domains available");
+  return domains;
+}
+
+/**
+ * Create an email account via the email service API.
+ * @param {string} apiUrl
+ * @param {string} apiKey
+ * @param {string} emailAlias  - e.g. "john@domain.com"
+ * @param {string} password
+ * @param {string} [displayName]
+ * @returns {Promise<object>} user data from API
+ */
+export async function createEmailAccount(
+  apiUrl,
+  apiKey,
+  emailAlias,
+  password,
+  displayName,
+) {
+  const res = await fetch(`${apiUrl}/api/v1/auth/signup`, {
+    method: "POST",
+    headers: apiHeaders(apiKey),
+    body: JSON.stringify({
+      email_alias: emailAlias,
+      password,
+      display_name: displayName,
+    }),
+  });
+  const data = await res.json();
+  if (!res.ok) throw new Error(data.error || "Failed to create email account");
+  return data;
+}
+
+// ─── Generator ────────────────────────────────────────────────────────────────
+
+/**
+ * Create a configured account generator.
+ * @param {{ apiUrl: string, apiKey: string, password: string, suffix?: string }} config
+ */
+export function createAccountGenerator(config) {
+  const { apiUrl, apiKey, password, suffix = "" } = config;
+
+  /**
+   * Generate a random account and create it on the email service.
+   * @returns {Promise<{ email, password, firstName, lastName, fullName }>}
+   */
+  return async function generateAccount() {
+    // 1. Fetch available domains
+    const domains = await fetchDomains(apiUrl, apiKey);
+    const domain = faker.helpers.arrayElement(domains);
+
+    // 2. Generate name + username
+    const firstName = generateSafeNamePart(() => faker.person.firstName());
+    const lastName = generateSafeNamePart(() => faker.person.lastName());
+    const fullName = `${firstName} ${lastName}`;
+    const username = `${toEmailPart(firstName)}${toEmailPart(lastName)}${suffix}`;
+    const email = `${username}@${domain}`;
+
+    // 3. Create email account on the service
+    await createEmailAccount(apiUrl, apiKey, email, password, fullName);
+
+    return { email, password, firstName, lastName, fullName };
+  };
+}

package/src/lib/http-client.js

@@ -0,0 +1,149 @@
+/**
+ * lib/http-client.js
+ * Cookie-aware HTTP client for cross-domain request chains.
+ * Handles cookie persistence across capcut.com ↔ login-row.www.capcut.com.
+ */
+
+const UA =
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0";
+
+export const USER_AGENT = UA;
+
+// ─── CookieJar ────────────────────────────────────────────────────────────────
+
+export class CookieJar {
+  constructor() {
+    /** @type {Record<string, Record<string, {name:string,value:string,expires?:string}>>} */
+    this.store = {};
+  }
+
+  /** Parse Set-Cookie headers from response and store them. */
+  parseResponse(requestUrl, response) {
+    const url = new URL(requestUrl);
+    const headers =
+      typeof response.headers.getSetCookie === "function"
+        ? response.headers.getSetCookie()
+        : [];
+
+    for (const h of headers) this._parseAndStore(h, url);
+  }
+
+  /** Build Cookie header string for a given request URL. */
+  getCookieString(requestUrl) {
+    const hostname = new URL(requestUrl).hostname;
+    const pairs = [];
+
+    for (const [dom, cookies] of Object.entries(this.store)) {
+      if (!this._domainMatch(dom, hostname)) continue;
+      for (const c of Object.values(cookies)) {
+        if (c.expires && new Date(c.expires) < new Date()) continue;
+        pairs.push(`${c.name}=${c.value}`);
+      }
+    }
+
+    return pairs.join("; ");
+  }
+
+  /** Read a single cookie value by name (across all domains). */
+  getCookie(name) {
+    for (const cookies of Object.values(this.store)) {
+      if (cookies[name]) return cookies[name].value;
+    }
+    return null;
+  }
+
+  /** Manually set a cookie for a domain. */
+  setCookie(domain, name, value) {
+    const dom = domain.startsWith(".") ? domain : "." + domain;
+    if (!this.store[dom]) this.store[dom] = {};
+    this.store[dom][name] = { name, value };
+  }
+
+  _domainMatch(cookieDomain, hostname) {
+    if (cookieDomain === hostname) return true;
+    if (cookieDomain.startsWith(".")) {
+      return (
+        hostname === cookieDomain.slice(1) || hostname.endsWith(cookieDomain)
+      );
+    }
+    return false;
+  }
+
+  _parseAndStore(header, url) {
+    const parts = header.split(";").map((s) => s.trim());
+    const eqIdx = parts[0].indexOf("=");
+    if (eqIdx < 0) return;
+
+    const name = parts[0].substring(0, eqIdx).trim();
+    const value = parts[0].substring(eqIdx + 1).trim();
+    const cookie = { name, value };
+    let domain = url.hostname;
+
+    for (let i = 1; i < parts.length; i++) {
+      const [k, ...v] = parts[i].split("=");
+      const key = k.trim().toLowerCase();
+      const val = v.join("=").trim();
+
+      if (key === "domain") {
+        domain = val.startsWith(".") ? val : "." + val;
+      } else if (key === "expires") {
+        cookie.expires = val;
+      } else if (key === "max-age") {
+        const ma = parseInt(val);
+        cookie.expires =
+          ma <= 0
+            ? new Date(0).toUTCString()
+            : new Date(Date.now() + ma * 1000).toUTCString();
+      }
+    }
+
+    // Delete expired / null cookies
+    if (
+      value === "null" ||
+      value === "" ||
+      (cookie.expires && new Date(cookie.expires) < new Date())
+    ) {
+      if (this.store[domain]) delete this.store[domain][name];
+      return;
+    }
+
+    if (!this.store[domain]) this.store[domain] = {};
+    this.store[domain][name] = cookie;
+  }
+}
+
+// ─── Fetch Helpers ────────────────────────────────────────────────────────────
+
+/** Single fetch with cookie jar (no auto-redirect). */
+export async function fetchCookie(jar, url, opts = {}) {
+  const cookies = jar.getCookieString(url);
+  const headers = {
+    "User-Agent": UA,
+    "Accept-Language": "en-US,en;q=0.9",
+    ...opts.headers,
+  };
+  if (cookies) headers["Cookie"] = cookies;
+
+  const res = await fetch(url, { ...opts, headers, redirect: "manual" });
+  jar.parseResponse(url, res);
+  return res;
+}
+
+/** Fetch following redirects, capturing cookies at each hop. */
+export async function fetchRedirect(jar, url, opts = {}, max = 15) {
+  let res = await fetchCookie(jar, url, opts);
+  let cur = url;
+  let n = 0;
+
+  while ([301, 302, 303, 307, 308].includes(res.status) && n++ < max) {
+    const loc = res.headers.get("location");
+    if (!loc) break;
+    await res.text().catch(() => {});
+    cur = new URL(loc, cur).href;
+    const method =
+      res.status === 307 || res.status === 308 ? opts.method || "GET" : "GET";
+    res = await fetchCookie(jar, cur, { headers: opts.headers, method });
+  }
+
+  return { response: res, url: cur };
+}