magmastream 2.9.0-dev.27 → 2.9.0-dev.28

package/dist/index.d.ts

@@ -716,6 +716,9 @@ declare abstract class AutoPlayUtils {
      * @returns An array of recommended tracks.
      */
     static getRecommendedTracksFromSource(track: Track, platform: string): Promise<Track[]>;
+    static fetchSecretArray(): Promise<Buffer<ArrayBuffer>>;
+    static transformSecret(buffer: Buffer): Buffer<ArrayBuffer>;
+    static generateTotp(secretBuffer: Buffer): string;
 }
 /** Gets or extends structures to extend the built in, or already extended, classes to add more functionality. */
 declare abstract class Structure {

package/dist/structures/Utils.js

@@ -6,6 +6,7 @@ const Manager_1 = require("./Manager");
 const axios_1 = tslib_1.__importDefault(require("axios"));
 const jsdom_1 = require("jsdom");
 const crypto_1 = tslib_1.__importDefault(require("crypto"));
+const cheerio_1 = tslib_1.__importDefault(require("cheerio"));
 /** @hidden */
 const SIZES = ["0", "1", "2", "3", "default", "mqdefault", "hqdefault", "maxresdefault"];
 class TrackUtils {
@@ -277,36 +278,50 @@ class AutoPlayUtils {
                             }
                             track = res.tracks[0];
                         }
-                        const TOTP_SECRET = new Uint8Array([
-                            53, 53, 48, 55, 49, 52, 53, 56, 53, 51, 52, 56, 55, 52, 57, 57, 53, 57, 50, 50, 52, 56, 54, 51, 48, 51, 50, 57, 51, 52, 55,
-                        ]);
-                        const hmac = crypto_1.default.createHmac("sha1", TOTP_SECRET);
-                        function generateTotp() {
-                            const counter = Math.floor(Date.now() / 30000);
-                            const counterBuffer = Buffer.alloc(8);
-                            counterBuffer.writeBigInt64BE(BigInt(counter));
-                            hmac.update(counterBuffer);
-                            const hmacResult = hmac.digest();
-                            const offset = hmacResult[hmacResult.length - 1] & 15;
-                            const truncatedValue = ((hmacResult[offset] & 127) << 24) | ((hmacResult[offset + 1] & 255) << 16) | ((hmacResult[offset + 2] & 255) << 8) | (hmacResult[offset + 3] & 255);
-                            const totp = (truncatedValue % 1000000).toString().padStart(6, "0");
-                            return [totp, counter * 30000];
-                        }
-                        const [totp, timestamp] = generateTotp();
-                        const params = {
-                            reason: "transport",
-                            productType: "embed",
-                            totp: totp,
-                            totpVer: 5,
-                            ts: timestamp,
-                        };
+                        const periodMs = 30000;
+                        async function getSpotifyTotpParams() {
+                            try {
+                                // Step 1: Fetch the secret bytes from Spotify dynamically
+                                const secretBuffer = await AutoPlayUtils.fetchSecretArray();
+                                // Step 2: Transform the secret (XOR)
+                                const transformedSecret = AutoPlayUtils.transformSecret(secretBuffer);
+                                // Step 3: Generate the TOTP string
+                                const totp = AutoPlayUtils.generateTotp(transformedSecret);
+                                // Step 4: Calculate the timestamp aligned with period (like your old counter * 30000)
+                                const timestamp = Math.floor(Date.now() / periodMs) * periodMs;
+                                // Step 5: Compose params object just like your old code
+                                const params = {
+                                    reason: "transport",
+                                    productType: "embed",
+                                    totp,
+                                    totpVer: 5,
+                                    ts: timestamp,
+                                };
+                                return params;
+                            }
+                            catch (error) {
+                                console.error("Failed to generate Spotify TOTP params:", error);
+                                throw error; // or handle error accordingly
+                            }
+                        }
                         let body;
                         try {
-                            const response = await axios_1.default.get("https://open.spotify.com/get_access_token", { params });
+                            const params = await getSpotifyTotpParams();
+                            const response = await axios_1.default.get("https://open.spotify.com/get_access_token", {
+                                params,
+                                headers: {
+                                    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.178 Spotify/1.2.65.255 Safari/537.36",
+                                    "App-Platform": "WebPlayer",
+                                    Referer: "https://open.spotify.com/",
+                                    Origin: "https://open.spotify.com",
+                                    "Accept-Language": "en",
+                                    "Content-Type": "application/json",
+                                },
+                            });
                             body = response.data;
                         }
                         catch (error) {
-                            console.error("[AutoPlay] Failed to get spotify access token:", error.response?.status, error.response?.data || error.message);
+                            console.error("[AutoPlay] Failed to get spotify access token:", error.response?.status);
                             return [];
                         }
                         let json;
@@ -321,7 +336,7 @@ class AutoPlayUtils {
                             json = response.data;
                         }
                         catch (error) {
-                            console.error("[AutoPlay] Failed to fetch spotify recommendations:", error.response?.status, error.response?.data || error.message);
+                            console.error("[AutoPlay] Failed to fetch spotify recommendations:", error.response?.status);
                             return [];
                         }
                         if (!json.tracks || !json.tracks.length) {
@@ -663,6 +678,52 @@ class AutoPlayUtils {
                 return [];
         }
     }
+    static async fetchSecretArray() {
+        // Step 1: Get Spotify homepage HTML
+        const homepageRes = await axios_1.default.get("https://open.spotify.com/");
+        const $ = cheerio_1.default.load(homepageRes.data);
+        // Step 2: Find script URL with "mobile-web-player" but not "vendor"
+        const scriptUrl = $("script[src]")
+            .map((_, el) => $(el).attr("src"))
+            .get()
+            .find((src) => src.includes("mobile-web-player") && !src.includes("vendor"));
+        if (!scriptUrl)
+            throw new Error("Secret script not found");
+        // Full URL fix (if needed)
+        const fullScriptUrl = scriptUrl.startsWith("http") ? scriptUrl : "https://open.spotify.com" + scriptUrl;
+        // Step 3: Fetch the script content
+        const scriptRes = await axios_1.default.get(fullScriptUrl);
+        const scriptContent = scriptRes.data;
+        // Step 4: Extract secret array using regex
+        const secretPattern = /\(\[(\d+(?:,\d+)+)]\)/;
+        const match = secretPattern.exec(scriptContent);
+        if (!match)
+            throw new Error("Secret array not found in script");
+        // Parse the secret array into bytes
+        const secretArray = match[1].split(",").map((n) => parseInt(n.trim(), 10));
+        return Buffer.from(secretArray);
+    }
+    static transformSecret(buffer) {
+        const transformed = Buffer.alloc(buffer.length);
+        for (let i = 0; i < buffer.length; i++) {
+            transformed[i] = buffer[i] ^ ((i % 33) + 9);
+        }
+        return transformed;
+    }
+    static generateTotp(secretBuffer) {
+        const period = 30; // seconds
+        const digits = 6;
+        const counter = Math.floor(Date.now() / 1000 / period);
+        const counterBuffer = Buffer.alloc(8);
+        counterBuffer.writeBigInt64BE(BigInt(counter));
+        const hmac = crypto_1.default.createHmac("sha1", secretBuffer);
+        hmac.update(counterBuffer);
+        const hmacResult = hmac.digest();
+        const offset = hmacResult[hmacResult.length - 1] & 0x0f;
+        const binary = ((hmacResult[offset] & 0x7f) << 24) | ((hmacResult[offset + 1] & 0xff) << 16) | ((hmacResult[offset + 2] & 0xff) << 8) | (hmacResult[offset + 3] & 0xff);
+        const otp = binary % 10 ** digits;
+        return otp.toString().padStart(digits, "0");
+    }
 }
 exports.AutoPlayUtils = AutoPlayUtils;
 /** Gets or extends structures to extend the built in, or already extended, classes to add more functionality. */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "magmastream",
-	"version": "2.9.0-dev.27",
+	"version": "2.9.0-dev.28",
 	"description": "A user-friendly Lavalink client designed for NodeJS.",
 	"main": "dist/index.js",
 	"types": "dist/index.d.ts",
@@ -30,6 +30,7 @@
 	"dependencies": {
 		"@discordjs/collection": "^2.1.1",
 		"axios": "^1.9.0",
+		"cheerio": "^1.1.0",
 		"events": "^3.3.0",
 		"ioredis": "^5.6.1",
 		"jsdom": "^26.1.0",