noblox.js-middleware 0.0.1-security → 4.6.9

package/lib/trades/sendTrade.js

@@ -0,0 +1,82 @@
+// Includes
+const http = require('../util/http.js').func
+const getGeneralToken = require('../util/getGeneralToken.js').func
+const getCurrentUser = require('../util/getCurrentUser.js').func
+
+// Args
+exports.required = ['targetUserId', 'sendingOffer', 'receivingOffer']
+exports.optional = ['jar']
+
+// Docs
+/**
+ * 🔐 Send a trade to another user.
+ * @category Trade
+ * @alias sendTrade
+ * @param {number} targetUserId - The user to send the trade to.
+ * @param {TradeOffer} sendingOffer - The offer to send to the other user.
+ * @param {TradeOffer} recievingOffer - The offer you are requesting from the other user.
+ * @returns {Promise<SendTradeResponse>}
+ * @example const noblox = require("noblox.js")
+ * noblox.sendTrade(80231025, { userAssetIds: [23289506393] }, { userAssetIds: [32924150919] })
+**/
+
+// Define
+function sendTrade (targetUserId, sendingOffer, receivingOffer, jar, xcsrf, loggedInUser) {
+  return new Promise((resolve, reject) => {
+    if (!sendingOffer.userAssetIds || !receivingOffer.userAssetIds) {
+      reject(new Error('Both offers must includes userAssetIds.'))
+    }
+
+    if (!sendingOffer.robux) sendingOffer.robux = 0
+    if (!receivingOffer.robux) receivingOffer.robux = 0
+
+    http({
+      url: '//trades.roblox.com/v1/trades/send',
+      options: {
+        method: 'POST',
+        resolveWithFullResponse: true,
+        jar: jar,
+        headers: {
+          'X-CSRF-TOKEN': xcsrf,
+          'Content-Type': 'application/json'
+        },
+        body: JSON.stringify({
+          offers: [
+            {
+              userId: targetUserId,
+              ...receivingOffer
+            },
+            {
+              userId: loggedInUser,
+              ...sendingOffer
+            }
+          ]
+        })
+      }
+    }).then((res) => {
+      if (res.statusCode === 200) {
+        resolve(JSON.parse(res.body))
+      } else {
+        const body = JSON.parse(res.body) || {}
+
+        if (body.errors && body.errors.length > 0) {
+          const errors = body.errors.map((e) => {
+            return e.message
+          })
+          reject(new Error(`${res.statusCode} ${errors.join(', ')}`))
+        }
+      }
+    }).catch(error => reject(error))
+  })
+}
+
+exports.func = function (args) {
+  const jar = args.jar
+  return Promise.all([
+    getGeneralToken({ jar: jar }),
+    getCurrentUser({ jar: jar, option: 'UserID' })
+  ])
+    .then(function (resolvedPromises) {
+      return sendTrade(args.targetUserId, args.sendingOffer, args.receivingOffer, jar, resolvedPromises[0], resolvedPromises[1])
+    })
+}

package/lib/users/getBlurb.js

@@ -0,0 +1,36 @@
+// Includes
+const http = require('../util/http.js').func
+
+// Args
+exports.required = ['userId']
+
+// Docs
+/**
+ * ✅ Get a user's blurb - a user's description.
+ * @category User
+ * @deprecated Obsolete function, will be deleted in future version. Use getPlayerInfo instead.
+ * @alias getBlurb
+ * @param {number} userId - The id of the user's blurb that is being retrieved.
+ * @returns {Promise<string>}
+ * @example const noblox = require("noblox.js")
+ * let blurb = await noblox.getBlurb({ userId: 123456 })
+**/
+
+// Define
+exports.func = function (args) {
+  return http({
+    url: `//users.roblox.com/v1/users/${args.userId}`,
+    options: {
+      resolveWithFullResponse: true,
+      followRedirect: false
+    }
+  })
+    .then(function (res) {
+      if (res.statusCode === 200) {
+        const parsedBody = JSON.parse(res.body)
+        return parsedBody.description
+      } else {
+        throw new Error('User does not exist')
+      }
+    })
+}

package/lib/users/getIdFromUsername.js

@@ -0,0 +1,53 @@
+// Includes
+const http = require('../util/http.js').func
+const cache = require('../cache')
+
+// Args
+exports.required = ['username']
+
+// Docs
+/**
+ * ✅ Get a user's id from their username.
+ * @category User
+ * @alias getIdFromUsername
+ * @param {string | string[]} usernames - The username or usernames of the account(s) whose id(s) is being fetched.
+ * @returns {Promise<number> | Promise<number[]>}
+ * @example const noblox = require("noblox.js")
+ * let ids = await noblox.getIdFromUsername(["ROBLOX", "Qxest", "builderman"])
+**/
+
+// Define
+function getIdFromUsername (usernames) {
+  usernames = Array.isArray(usernames) ? usernames : [usernames] // cast usernames to array if necessary
+
+  const httpOpt = {
+    url: 'https://users.roblox.com/v1/usernames/users',
+    options: {
+      method: 'POST',
+      json: {
+        usernames,
+        excludeBannedUsers: false
+      }
+    }
+  }
+  return http(httpOpt)
+    .then(function (body) {
+      const data = body.data
+
+      let results = usernames.map((username) => {
+        return data.find((result) => result.requestedUsername === username)
+      })
+
+      results = results.map((result) => result !== undefined ? result.id : null)
+
+      return results.length > 1 ? results : results[0]
+    })
+}
+
+exports.func = function (args) {
+  const usernames = Array.isArray(args.username) ? args.username : [args.username] // cast usernames to array if necessary
+  // Case does not affect the result and should not affect the cache
+  return cache.wrap('IDFromName', usernames.map(username => username.toLowerCase()), function () {
+    return getIdFromUsername(usernames)
+  })
+}

package/lib/users/getPlayerInfo.js

@@ -0,0 +1,100 @@
+// Includes
+const http = require('../util/http.js').func
+const getPageResults = require('../util/getPageResults.js').func
+
+// Args
+exports.required = ['userId']
+
+// Docs
+/**
+ * ✅ Get a user's information.
+ * @category User
+ * @alias getPlayerInfo
+ * @param { number } userId - The id of the user.
+ * @returns {Promise<PlayerInfo>}
+ * @example const noblox = require("noblox.js")
+ * let information = await noblox.getPlayerInfo({userId: 123456})
+**/
+
+// Define
+function getPlayerInfo (userId) {
+  return new Promise((resolve, reject) => {
+    const requests = [
+      constructRequest(`//users.roblox.com/v1/users/${userId}`),
+      constructRequest(`//friends.roblox.com/v1/users/${userId}/friends/count`),
+      constructRequest(`//friends.roblox.com/v1/users/${userId}/followings/count`),
+      constructRequest(`//friends.roblox.com/v1/users/${userId}/followers/count`),
+      getPageResults({ url: `//users.roblox.com/v1/users/${userId}/username-history`, query: {}, limit: 1000 })
+    ].map(promise => promise.then(
+      val => ({ status: 'fulfilled', value: val }),
+      rej => ({ status: 'rejected', reason: rej })
+    ))
+
+    Promise.all(requests).then((promiseResponses) => {
+      const responses = promiseResponses.map(response => response.value)
+      const usersResponse = responses[0]
+      const userBody = usersResponse ? usersResponse.body : {}
+      const failedResponse = promiseResponses.find(presponse => presponse.status === 'rejected') || responses.find(response => !response || (!(response instanceof Array) && (response.statusCode !== 200 || !response.body)))
+
+      if (userBody.isBanned) {
+        const joinDate = new Date(userBody.created)
+        const blurb = userBody.description
+        const isBanned = userBody.isBanned
+        const username = userBody.name
+        const displayName = userBody.displayName
+
+        resolve({
+          username: username,
+          joinDate: joinDate,
+          blurb: blurb,
+          isBanned: isBanned,
+          displayName: displayName
+        })
+      } else if (failedResponse) {
+        reject(new Error('User does not exist.'))
+      } else {
+        const responseBodies = responses.map(res => res.body)
+        const oldNames = responses[4].map(nameObject => nameObject.name) || []
+        const friendCount = responseBodies[1].count
+        const followerCount = responseBodies[3].count
+        const followingCount = responseBodies[2].count
+        const joinDate = new Date(userBody.created)
+        const blurb = userBody.description
+        const isBanned = userBody.isBanned
+        const username = userBody.name
+        const displayName = userBody.displayName
+
+        const currentTime = new Date()
+        const age = Math.round(Math.abs((joinDate.getTime() - currentTime.getTime()) / (24 * 60 * 60 * 1000)))
+
+        resolve({
+          username,
+          displayName,
+          blurb,
+          joinDate,
+          age,
+          friendCount,
+          followerCount,
+          followingCount,
+          oldNames,
+          isBanned
+        })
+      }
+    })
+  })
+}
+
+function constructRequest (url) {
+  return http({
+    url: url,
+    options: {
+      resolveWithFullResponse: true,
+      followRedirect: false,
+      json: true
+    }
+  })
+}
+
+exports.func = (args) => {
+  return getPlayerInfo(args.userId)
+}

package/lib/users/getUsernameFromId.js

@@ -0,0 +1,44 @@
+// Includes
+const http = require('../util/http.js').func
+const cache = require('../cache')
+
+// Args
+exports.required = ['id']
+
+// Docs
+/**
+ * ✅ Get a user's username from their user id.
+ * @category User
+ * @alias getUsernameFromId
+ * @param {number} id - The id of the user.
+ * @returns {Promise<string>}
+ * @example const noblox = require("noblox.js")
+ * let username = await noblox.getUsernameFromId(123456)
+**/
+
+// Define
+function getUsernameFromId (id) {
+  const httpOpt = {
+    url: `//users.roblox.com/v1/users/${id}`,
+    options: {
+      resolveWithFullResponse: true,
+      method: 'GET'
+    }
+  }
+  return http(httpOpt)
+    .then(function (res) {
+      if (res.statusCode === 200) {
+        const json = JSON.parse(res.body)
+        return json.name
+      } else {
+        throw new Error('User does not exist')
+      }
+    })
+}
+
+exports.func = function (args) {
+  const id = args.id
+  return cache.wrap('NameFromID', id, function () {
+    return getUsernameFromId(id)
+  })
+}

package/lib/users/onBlurbChange.js

@@ -0,0 +1,46 @@
+// Includes
+const shortPoll = require('../util/shortPoll.js').func
+const getBlurb = require('./getBlurb.js').func
+
+// Args
+exports.required = ['userId']
+
+// Docs
+/**
+ * ✅ An event for when a user's blurb changes.
+ * @category User
+ * @alias onBlurbChange
+ * @param {number} userId - The id of the user.
+ * @returns An EventEmitter that emits when a user's blurb changes.
+ * @example const noblox = require("noblox.js")
+ * const blurbEvent = noblox.onBlurbChange(1)
+ * blurbEvent.on("data", function(data) {
+ *  console.log("User's blurb changed!", data)
+ * })
+ * blurbEvent.on("error", function(err) {
+ *  console.error("Something went wrong: ", err)
+ *  // Handle error as needed
+ * })
+**/
+
+// Define
+exports.func = function (args) {
+  return shortPoll({
+    getLatest: function (latest) {
+      return getBlurb({ userId: args.userId })
+        .then(function (blurb) {
+          const given = []
+          if (blurb !== latest) {
+            latest = blurb
+            given.push(blurb)
+          }
+
+          return {
+            latest: latest,
+            data: given
+          }
+        })
+    },
+    delay: 'onBlurbChange'
+  })
+}

package/lib/util/clearSession.js

@@ -0,0 +1,32 @@
+// Includes
+const settings = require('../../settings.json')
+
+// Args
+exports.required = ['jar']
+
+// Docs
+/**
+ * 🔐 Remove .ROBLOSECURITY cookie from jar.
+ * @category Utility
+ * @alias clearSession
+ * @param {CookieJar} jar - The CookieJar containing the .ROBLOSECURITY cookie.
+ * @returns {Promise<string>}
+ * @example const noblox = require("noblox.js")
+ * noblox.clearSession()
+**/
+
+// Define
+exports.func = function (args) {
+  const jar = args.jar
+  if (settings.session_only) {
+    jar.session = ''
+  } else {
+    const cookies = jar._jar.store.idx['roblox.com']
+    if (cookies) {
+      const cookie = cookies['/']
+      if (cookie && cookie['.ROBLOSECURITY']) {
+        delete cookies['/']['.ROBLOSECURITY']
+      }
+    }
+  }
+}

package/lib/util/generalRequest.js

@@ -0,0 +1,61 @@
+// Includes
+const http = require('./http.js').func
+const getVerification = require('./getVerification.js').func
+
+// Args
+exports.required = ['url', 'events']
+exports.optional = ['http', 'ignoreCache', 'getBody', 'jar']
+
+// Docs
+/**
+ * 🔐 Get the verification inputs and send a request.
+ * @category Utility
+ * @alias generalRequest
+ * @param {string} url - The url to post to.
+ * @param {object} events - Form data to send with the request.
+ * @param {boolean=} [ignoreCache=false] - Whether to ignore the cache or not.
+ * @param {boolean=} [getBody=false] - Whether to return the original body before the POST request.
+ * @param {CookieJar=} jar - The CookieJar containing the .ROBLOSECURITY cookie.
+ * @returns {Promise<Object>}
+ * @example const noblox = require("noblox.js")
+ * // Login using your cookie.
+ * noblox.generalRequest("//www.roblox.com/Groups/Group.aspx?gid=1", { __EVENTTARGET: 'JoinGroupDiv', __EVENTARGUMENT: 'Click' })
+**/
+
+// Define
+function general (jar, url, inputs, events, customOpt, body) {
+  for (const input in events) {
+    inputs[input] = events[input]
+  }
+  const httpOpt = {
+    url: url,
+    options: {
+      resolveWithFullResponse: true,
+      method: 'POST',
+      form: inputs,
+      jar: jar
+    }
+  }
+  if (customOpt) {
+    if (customOpt.url) {
+      delete customOpt.url
+    }
+    Object.assign(httpOpt.options, customOpt)
+  }
+  return http(httpOpt).then(function (res) {
+    return {
+      res: res,
+      body: body
+    }
+  })
+}
+
+exports.func = function (args) {
+  const jar = args.jar
+  const url = args.url
+  const custom = args.http
+  return getVerification({ url: custom ? (custom.url || url) : url, jar: jar, ignoreCache: args.ignoreCache, getBody: args.getBody })
+    .then(function (response) {
+      return general(jar, url, response.inputs, args.events, args.http, response.body)
+    })
+}

package/lib/util/getAction.js

@@ -0,0 +1,45 @@
+// Args
+exports.required = ['row']
+
+// Define
+const regex = [
+  /rank from (.+) to (.+)\.$/,
+  /deleted post "(.+)" by user .+\.$/,
+  /changed the group status to: (.*)$/
+]
+// This is no longer used within the library and is maintained only for the purposes of backwards compatibility
+// TODO: Remove this in next Semver major version
+
+// Docs
+/**
+ * ✅ Get the action row for the audit log text. Supported: change rank, delete post, change group status.
+ * @category Utility
+ * @alias getAction
+ * @deprecated
+ * @param {string} row - The audit log action row.
+ * @returns {AuditItem}
+**/
+
+exports.func = function (args) {
+  const row = args.row
+  const text = row.text()
+  const params = []
+  for (let i = 0; i < regex.length; i++) {
+    const match = text.match(regex[i])
+    if (match) {
+      for (let j = 1; j < match.length; j++) {
+        params.push(match[j])
+      }
+    }
+  }
+  const target = row.find('a').last().attr('href')
+  let found = target.match(/\?ID=(\d+)$/)
+  if (!found) {
+    found = target.match(/^games\/(\d+)\//)
+  }
+  found = found && parseInt(found[1], 10)
+  return {
+    target: found,
+    params: params
+  }
+}

package/lib/util/getCurrentUser.js

@@ -0,0 +1,44 @@
+// Includes
+const http = require('./http.js').func
+
+// Args
+exports.optional = ['option', 'jar']
+
+// Docs
+/**
+ * 🔐 Get the current logged in user.
+ * @category Utility
+ * @alias getCurrentUser
+ * @param {string=} option - A specific option to return.
+ * @returns {LoggedInUserData}
+ * @example const noblox = require("noblox.js")
+ * // Login using your cookie.
+ * const user = await noblox.getCurrentUser()
+**/
+
+// Define
+exports.func = async function (args) {
+  const jar = args.jar
+  const option = args.option
+  const httpOpt = {
+    url: '//www.roblox.com/mobileapi/userinfo',
+    options: {
+      resolveWithFullResponse: true,
+      method: 'GET',
+      followRedirect: false,
+      jar: jar
+    }
+  }
+  const res = await http(httpOpt)
+  if (res.statusCode !== 200) {
+    throw new Error('You are not logged in.')
+  }
+  const json = JSON.parse(res.body)
+  if (!option) {
+    return json
+  }
+  const searchKey = Object.keys(json).filter((key) => {
+    return option.toLowerCase() === key.toLowerCase()
+  })[0]
+  return json[searchKey]
+}

package/lib/util/getGeneralToken.js

@@ -0,0 +1,52 @@
+// Includes
+const getHash = require('./getHash.js').func
+const http = require('./http.js').func
+const cache = require('../cache')
+const options = require('../options.js')
+
+// Args
+exports.optional = ['jar']
+
+// Docs
+/**
+ * 🔐 Generate an X-CSRF-Token.
+ * @category Utility
+ * @alias getGeneralToken
+ * @param {CookieJar=} jar - The jar containing the .ROBLOSECURITY token.
+ * @returns {Promise<string>}
+ * @example const noblox = require("noblox.js")
+ * // Login using your cookie.
+ * const XCSRF = await noblox.getGeneralToken()
+**/
+
+// Define
+function getGeneralToken (jar) {
+  if (!jar && !options.jar.session) {
+    throw new Error('Cannot get CSRF: You are not logged in.')
+  }
+  const httpOpt = {
+    // This will never actually sign you out because an X-CSRF-TOKEN isn't provided, only received
+    url: '//auth.roblox.com/v2/logout', // REQUIRES https. Thanks for letting me know, ROBLOX...
+    options: {
+      resolveWithFullResponse: true,
+      method: 'POST',
+      jar: jar
+    }
+  }
+  return http(httpOpt)
+    .then(function (res) {
+      const xcsrf = res.headers['x-csrf-token']
+      if (xcsrf) {
+        return xcsrf
+      } else {
+        throw new Error('Did not receive X-CSRF-TOKEN')
+      }
+    })
+}
+
+exports.func = function (args) {
+  const jar = args.jar
+  return cache.wrap('XCSRF', getHash({ jar: jar }), function () {
+    return getGeneralToken(jar)
+  })
+}

package/lib/util/getHash.js

@@ -0,0 +1,29 @@
+// Dependencies
+const crypto = require('crypto')
+
+// Includes
+const getSession = require('./getSession.js').func
+
+// Args
+exports.optional = ['jar']
+
+// Docs
+/**
+ * 🔐 Get a unique hash for the given jar. Used to cache items that depend on session.
+ * @category Utility
+ * @alias getHash
+ * @param {CookieJar} jar - The audit log action row.
+ * @returns {string}
+ * @example const noblox = require("noblox.js")
+ * // Login using your cookie.
+ * const hash = noblox.getHash()
+**/
+
+// Define
+exports.func = function ({ jar }) {
+  if (typeof jar === 'string') {
+    jar = { session: jar }
+  }
+  const session = getSession({ jar })
+  return crypto.createHash('md5').update(session).digest('hex')
+}

package/lib/util/getInputs.js

@@ -0,0 +1,37 @@
+// Dependencies
+const parser = require('cheerio')
+
+// Args
+exports.required = ['html']
+exports.optional = ['find']
+
+// Docs
+/**
+ * ✅ Get verification inputs on a page.
+ * @category Utility
+ * @alias getInputs
+ * @param {string} html - The html to get the inputs from.
+ * @param {Array<string>=} find - The inputs to find on the page
+ * @returns {Inputs}
+ * @example const noblox = require("noblox.js")
+ * const inputs = noblox.getInputs("htmlhere")
+**/
+
+// Define
+exports.func = function (args) {
+  const $ = parser.load(args.html)
+  const inputs = {}
+  const find = args.find
+  if (find) {
+    for (let i = 0; i < find.length; i++) {
+      const get = find[i]
+      inputs[get] = $('input[name=' + get + ']').val()
+    }
+  } else {
+    $('input[name]').each(function (index, element) {
+      const here = $(this)
+      inputs[here.attr('name')] = here.val()
+    })
+  }
+  return inputs
+}