nodejs-insta-private-api-mqt 1.3.81 → 1.3.83

package/dist/repositories/account.repository.js

@@ -45,55 +45,11 @@ class AccountRepository extends Repository {
       }
     }
 
-    // 1) Check response headers first (server may set IG-Set-Authorization)
-    const headerCandidates = [
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'.toLowerCase()],
-      headers['ig-set-authorization'.toUpperCase()],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-      headers['ig-set-authorization'],
-    ]; // (we'll just check the normalized header below)
-
-    // Simpler: look for any header that contains 'IG-Set-Authorization' or 'ig-set-authorization'
+    // Simpler: look for any header that contains ig-set-authorization
     for (const key of Object.keys(headers)) {
       const val = headers[key];
       if (!val) continue;
-      if (key.includes('ig-set-authorization') || key === 'ig-set-authorization' || key === 'ig-set-authorization'.toLowerCase()) {
+      if (key.includes('ig-set-authorization')) {
         const token = this._normalizeTokenString(val);
         if (token) {
           this.client.state.authorization = token;
@@ -297,7 +253,7 @@ class AccountRepository extends Repository {
     const bearerPatterns = [
       /Bearer IGT:2:[A-Za-z0-9+\/=]+/,
       /Bearer\s+IGT:2:[A-Za-z0-9+\/=]+/,
-      /\\?"Bearer IGT:2:([A-Za-z0-9+\/=]+)\\?"/,
+      /\?"Bearer IGT:2:([A-Za-z0-9+\/=]+)\?"/,
       /ig-set-authorization[\\"\s:]*Bearer IGT:2:([A-Za-z0-9+\/=]+)/i,
       /"IG-Set-Authorization"\s*:\s*"(Bearer IGT:2:[A-Za-z0-9+\/=]+)"/i,
       /IG-Set-Authorization[\s:]+(Bearer IGT:2:[A-Za-z0-9+\/=]+)/i,
@@ -310,10 +266,10 @@ class AccountRepository extends Repository {
         // If capturing group present, prefer it
         if (m[1]) {
           const token = m[1].includes('Bearer IGT:2:') ? m[1] : `Bearer IGT:2:${m[1]}`;
-          return token.replace(/\\?"/g, '').trim();
+          return token.replace(/\?"/g, '').trim();
         }
         // Otherwise m[0] contains the full token
-        return m[0].replace(/\\?"/g, '').trim();
+        return m[0].replace(/\?"/g, '').trim();
       }
     }
 
@@ -347,7 +303,6 @@ class AccountRepository extends Repository {
     return null;
   }
 
-
   async login(credentialsOrUsername, passwordArg) {
     let username, password;
     if (typeof credentialsOrUsername === 'object' && credentialsOrUsername !== null) {
@@ -367,18 +322,53 @@ class AccountRepository extends Repository {
 
     const { encrypted, time } = this.encryptPassword(password);
 
-    
-    const csrfToken = await this.ensureCsrfToken();
-return this.requestWithRetry(async () => {
-      const aacInitTimestamp = Math.floor(Date.now() / 1000) - Math.floor(Math.random() * 50);
+    // optional CSRF warmup (like app does before login)
+    await this.ensureCsrfToken();
+
+    return this.requestWithRetry(async () => {
+      // ====== client_input_params (oglindă după traficul real) ======
+      const nowSec = Math.floor(Date.now() / 1000);
+      const aacInitTimestamp = nowSec - Math.floor(Math.random() * 50);
       const aacjid = crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4();
-      const aaccs = crypto.randomBytes(32).toString('base64url');
+      const aaccs = crypto.randomBytes(32).toString('base64').replace(/=/g, '');
+
+      const androidDeviceId =
+        this.client.state.androidDeviceId ||
+        this.client.state.deviceId ||
+        `android-${crypto.randomBytes(8).toString('hex')}`;
+
+      const machineId =
+        this.client.state.mid ||
+        this.client.state.machineId ||
+        `aZ${crypto.randomBytes(8).toString('hex')}`;
+
+      const familyDeviceId =
+        this.client.state.phoneId ||
+        this.client.state.familyDeviceId ||
+        crypto.randomUUID
+          ? crypto.randomUUID()
+          : require('uuid').v4();
+
+      const qeDeviceId =
+        this.client.state.deviceId ||
+        this.client.state.qeDeviceId ||
+        crypto.randomUUID
+          ? crypto.randomUUID()
+          : require('uuid').v4();
+
+      const accountsList = this.client.state.accountsList || [];
+
+      const flashCallPermissionStatus = {
+        READ_PHONE_STATE: 'GRANTED',
+        READ_CALL_LOG: 'GRANTED',
+        ANSWER_PHONE_CALLS: 'GRANTED',
+      };
 
       const clientInputParams = {
         aac: JSON.stringify({
           aac_init_timestamp: aacInitTimestamp,
-          aacjid: aacjid,
-          aaccs: aaccs,
+          aacjid,
+          aaccs,
         }),
         sim_phones: [],
         aymh_accounts: [],
@@ -388,25 +378,77 @@ return this.requestWithRetry(async () => {
         auth_secure_device_id: '',
         has_whatsapp_installed: 1,
         password: `#PWD_INSTAGRAM:4:${time}:${encrypted}`,
-        sso_token_map_json_string: '{}',
+        sso_token_map_json_string: JSON.stringify({
+          [this.client.state.cookieUserId || '0']: [],
+        }),
         block_store_machine_id: '',
-        ig_vetted_device_nonces: '{}',
+        ig_vetted_device_nonces: JSON.stringify({}),
+        cloud_trust_token: null,
+        event_flow: 'login_manual',
+        password_contains_non_ascii: 'false',
+        client_known_key_hash: '',
+        encrypted_msisdn: '',
+        has_granted_read_phone_permissions: 0,
+        app_manager_id: '',
+        should_show_nested_nta_from_aymh: 0,
+        device_id: androidDeviceId,
+        zero_balance_state: '',
+        login_attempt_count: 1,
+        machine_id: machineId,
+        flash_call_permission_status: flashCallPermissionStatus,
+        accounts_list: accountsList,
+        gms_incoming_call_retriever_eligibility: 'client_not_supported',
+        family_device_id: familyDeviceId,
+        fb_ig_device_id: [],
+        device_emails: [],
+        try_num: 1,
+        lois_settings: { lois_token: '' },
+        event_step: 'home_page',
+        headers_infra_flow_id: '',
+        openid_tokens: {},
         contact_point: username,
-        machine_id: this.client.state.mid || '',
-        login_attempt_count: '0',
-        reg_flow_taken: 'phone',
-        device_id: this.client.state.uuid,
-        phone_id: this.client.state.phoneId,
-        family_device_id: this.client.state.phoneId,
-        encryption_enabled: '1',
-        has_dbl_tap_login: 0,
-        jazoest: AccountRepository.createJazoest(this.client.state.phoneId),
-        openid_tokens: '{}',
       };
 
+      // ====== server_params (oglindă după traficul real) ======
+      const waterfallId = crypto.randomUUID ? crypto.randomUUID() : require('uuid').v4();
+      const latencyMarkerId = 36707139;
+      const latencyInstanceId = Number(`${Date.now()}${Math.floor(Math.random() * 1000)}`);
+
       const serverParams = {
+        should_trigger_override_login_2fa_action: 0,
+        is_vanilla_password_page_empty_password: 0,
+        is_from_logged_out: 0,
+        should_trigger_override_login_success_action: 0,
+        login_credential_type: 'none',
+        server_login_source: 'login',
+        waterfall_id: waterfallId,
+        two_step_login_type: 'one_step_login',
+        login_source: 'Login',
+        is_platform_login: 0,
+        INTERNAL__latency_qpl_marker_id: latencyMarkerId,
+        is_from_aymh: 0,
+        offline_experiment_group: 'caa_iteration_v3_perf_ig_4',
+        is_from_landing_page: 0,
+        left_nav_button_action: 'NONE',
+        password_text_input_id: 'z0jejq:194',
+        is_from_empty_password: 0,
+        is_from_msplit_fallback: 0,
+        ar_event_source: 'login_home_page',
+        qe_device_id: qeDeviceId,
+        username_text_input_id: 'z0jejq:193',
+        layered_homepage_experiment_group: null,
+        device_id: androidDeviceId,
+        login_surface: 'switcher',
+        INTERNAL__latency_qpl_instance_id: latencyInstanceId,
+        reg_flow_source: 'login_home_native_integration_point',
+        is_caa_perf_enabled: 1,
         credential_type: 'password',
-        device_id: this.client.state.uuid,
+        is_from_password_entry_page: 0,
+        caller: 'gslr',
+        family_device_id: familyDeviceId,
+        is_from_assistive_id: 0,
+        access_flow_version: 'pre_mt_behavior',
+        is_from_logged_in_switcher: 1,
       };
 
       const paramsJson = JSON.stringify({
@@ -416,75 +458,102 @@ return this.requestWithRetry(async () => {
 
       const attestParams = AccountRepository.generateAttestParams(this.client.state);
 
+      const bkClientContext = JSON.stringify({
+        bloks_version: this.client.state.bloksVersionId,
+        styles_id: 'instagram',
+      });
+
+      // ====== HEADERS – modelate după request_i.instagram.com_mlwzj8x1.txt ======
+      const lang = (this.client.state.language || 'ro_RO');
+      const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+
+      const userAgent =
+        this.client.state.userAgent ||
+        'Instagram 371.0.0.0.23 Android (30/11; 320dpi; 720x1449; Xiaomi/Redmi; M2006C3MNG; angelican; mt6765; ro_RO; 703217507)';
+
       const bloksHeaders = {
-        ...(csrfToken ? { 'X-CSRFToken': csrfToken } : {}),
-        'Accept-Language': `${(this.client.state.language || 'ro_RO').replace('_', '-')} , en-US`,
-        'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
-
-        'IG-Intended-User-Id': '0',
-
-        'X-Bloks-Is-Layout-Rtl': 'false',
-        'X-Bloks-Prism-Ax-Base-Colors-Enabled': 'false',
-        'X-Bloks-Prism-Button-Version': 'CONTROL',
-        'X-Bloks-Prism-Colors-Enabled': 'true',
-        'X-Bloks-Prism-Font-Enabled': 'false',
-        'X-Bloks-Prism-Indigo-Link-Version': '0',
-        'X-Bloks-Version-Id': this.client.state.bloksVersionId,
-
-        'X-FB-Client-Ip': 'True',
-        'X-FB-Connection-Type': 'WIFI',
-        'X-FB-Friendly-Name': 'IgApi: bloks/async_action/com.bloks.www.bloks.caa.login.async.send_login_request/',
-        'X-FB-Network-Properties': 'VPN;Validated;LocalAddrs=/10.0.0.2,;',
-        'X-FB-Request-Analytics-Tags': JSON.stringify({
+        'accept-language': acceptLanguage,
+        'content-type': 'application/x-www-form-urlencoded; charset=UTF-8',
+        'ig-intended-user-id': '0',
+        'priority': 'u=3',
+
+        'x-bloks-is-layout-rtl': 'false',
+        'x-bloks-prism-ax-base-colors-enabled': 'false',
+        'x-bloks-prism-button-version': 'CONTROL',
+        'x-bloks-prism-colors-enabled': 'true',
+        'x-bloks-prism-font-enabled': 'false',
+        'x-bloks-prism-indigo-link-version': '0',
+        'x-bloks-version-id': this.client.state.bloksVersionId,
+
+        'x-fb-client-ip': 'True',
+        'x-fb-connection-type': 'WIFI',
+        'x-fb-friendly-name': 'IgApi: bloks/async_action/com.bloks.www.bloks.caa.login.async.send_login_request/',
+        'x-fb-network-properties': 'VPN;Validated;LocalAddrs=/10.0.0.2,;',
+        'x-fb-request-analytics-tags': JSON.stringify({
           network_tags: {
-            product: String(this.client.state.fbAnalyticsApplicationId || ''),
+            product: String(this.client.state.fbAnalyticsApplicationId || '567067343352427'),
             purpose: 'fetch',
             surface: 'undefined',
             request_category: 'api',
             retry_attempt: '0',
           },
         }),
-        'X-FB-Server-Cluster': 'True',
-        'X-FB-RMD': 'state=URL_ELIGIBLE',
-        'X-FB-Conn-UUID-Client': crypto.randomBytes(16).toString('hex'),
-        'X-FB-HTTP-Engine': 'MNS/TCP',
-
-        'X-IG-Client-Endpoint': 'com.bloks.www.caa.login.aymh_single_profile_screen_entry',
-        'X-IG-Connection-Type': 'WIFI',
-        'X-IG-Capabilities': '3brTv10=',
-        'X-IG-App-ID': String(this.client.state.fbAnalyticsApplicationId || ''),
-        'X-IG-App-Locale': (this.client.state.language || 'ro_RO'),
-        'X-IG-Device-Locale': (this.client.state.language || 'ro_RO'),
-        'X-IG-Mapped-Locale': (this.client.state.language || 'ro_RO'),
-        'X-IG-Android-Id': this.client.state.androidDeviceId || this.client.state.deviceId || '',
-        'X-IG-Device-Id': this.client.state.deviceId,
-        'X-IG-Family-Device-Id': this.client.state.phoneId,
-        'X-IG-Timezone-Offset': String(typeof this.client.state.timezoneOffset === 'number' ? this.client.state.timezoneOffset : 7200),
-        'X-IG-WWW-Claim': this.client.state.igWWWClaim || '0',
-        'X-IG-Nav-Chain': 'LockoutFragment:dogfooding_lockout:1:cold_start:...caa.login.aymh_single_profile_screen_entry:9:button:0::0',
-
-        'X-IG-Attest-Params': JSON.stringify(attestParams),
-
-        'X-Mid': this.client.state.mid || '',
-        'X-Pigeon-Rawclienttime': (Date.now() / 1000).toFixed(3),
-        'X-Pigeon-Session-Id': this.client.state.pigeonSessionId || 'UFS-' + (crypto.randomBytes(16).toString('hex')),
-        'X-Tigon-Is-Retry': 'False',
-
-        'X-IG-Bandwidth-Speed-KBPS': (Math.random() * 1500 + 1500).toFixed(3),
-        'X-IG-Bandwidth-TotalBytes-B': '0',
-        'X-IG-Bandwidth-TotalTime-MS': '0',
-
-        'Accept-Encoding': 'gzip, deflate',
-        'User-Agent': this.client.state.userAgent || 'Instagram 371.0.0.0.23 Android (30/11; 320dpi; 720x1449; Xiaomi/Redmi; M2006C3MNG; angelican; mt6765; ro_RO; 703217507)',
+        'x-fb-server-cluster': 'True',
+
+        'x-ig-android-id': androidDeviceId,
+        'x-ig-app-id': String(this.client.state.fbAnalyticsApplicationId || '567067343352427'),
+        'x-ig-app-locale': lang,
+        'x-ig-attest-params': JSON.stringify(attestParams),
+        'x-ig-bandwidth-speed-kbps': (Math.random() * 1500 + 800).toFixed(3),
+        'x-ig-bandwidth-totalbytes-b': '0',
+        'x-ig-bandwidth-totaltime-ms': '0',
+        'x-ig-client-endpoint': 'com.bloks.www.caa.login.aymh_single_profile_screen_entry',
+        'x-ig-capabilities': '3brTv10=',
+        'x-ig-connection-type': 'WIFI',
+        'x-ig-device-id': qeDeviceId,
+        'x-ig-device-locale': lang,
+        'x-ig-family-device-id': familyDeviceId,
+        'x-ig-mapped-locale': lang,
+        'x-ig-nav-chain':
+          'LockoutFragment:dogfooding_lockout:1:cold_start:...,' +
+          'com.bloks.www.caa.login.aymh_single_profile_screen_entry:com.bloks.www.caa.login.aymh_single_profile_screen_entry:14:button:0:::0',
+        'x-ig-timezone-offset': String(
+          typeof this.client.state.timezoneOffset === 'number'
+            ? this.client.state.timezoneOffset
+            : 7200
+        ),
+        'x-ig-www-claim': this.client.state.igWWWClaim || '0',
+
+        'x-mid': machineId,
+        'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(Math.random() * 1000)
+          .toString()
+          .padStart(3, '0')}`,
+        'x-pigeon-session-id':
+          this.client.state.pigeonSessionId ||
+          `UFS-${crypto.randomBytes(16).toString('hex')}-1`,
+        'x-tigon-is-retry': 'False',
+
+       // ...
+'accept-encoding': 'gzip, deflate, br',
+// ...
+        'user-agent': userAgent,
+        'x-fb-conn-uuid-client': crypto.randomBytes(16).toString('hex'),
+        'x-fb-http-engine': 'MNS/TCP',
+        'x-fb-rmd': 'state=URL_ELIGIBLE',
       };
 
       const response = await this.client.request.send({
         method: 'POST',
         url: '/api/v1/bloks/async_action/com.bloks.www.bloks.caa.login.async.send_login_request/',
-        form: { params: paramsJson },
+        form: {
+          params: paramsJson,
+          bk_client_context: bkClientContext,
+          bloks_versioning_id: this.client.state.bloksVersionId,
+        },
         headers: bloksHeaders,
       });
-   // === DEBUG LOGIN: salvați răspunsul brut de la server pentru analiză ===
+
+      // === DEBUG LOGIN: salvăm răspunsul pentru analiză ===
       try {
         const fs = require('fs');
         const path = require('path');
@@ -492,7 +561,6 @@ return this.requestWithRetry(async () => {
         const debugDir = path.join(process.cwd(), 'authinfo_instagram');
         const debugFile = path.join(debugDir, 'login-debug.json');
 
-        // asigură-te că folderul există
         try {
           fs.mkdirSync(debugDir, { recursive: true });
         } catch (e) {}
@@ -508,12 +576,11 @@ return this.requestWithRetry(async () => {
       } catch (e) {
         // nu stricăm login-ul dacă nu merge debug-ul
       }
-      // === SFÂRȘIT DEBUG LOGIN ===   
+      // === SFÂRȘIT DEBUG LOGIN ===
 
       const body = response.body;
 
       // Immediately attempt to extract and save authorization token from the response
-      // This covers tokens returned in headers, in layout payloads, or embedded login_response headers.
       this._extractAndSaveAuthorization(response);
 
       if (body && body.two_factor_required) {
@@ -1071,34 +1138,74 @@ return this.requestWithRetry(async () => {
     });
   }
 
-  static generateAttestParams(state) {
+    static generateAttestParams(state) {
+    // Emulate Instagram's keystore attestation as closely as possible:
+    // - version: 2
+    // - type: "keystore"
+    // - errors: [0]
+    // - challenge_nonce: random base64url
+    // - signed_nonce: ECDSA signature over the nonce
+    // - key_hash: sha256(spki(publicKey))
+    // - certificate_chain: 4 PEM certificates concatenated (leaf + 2 intermediates + root)
+    //
+    // NOTE: This is *not* a real hardware-backed attestation chain, but it mirrors
+    // the structure of the official app very closely so the server sees the same
+    // shape: a single attestation object with a 4‑certificate chain.
     const challengeNonce = crypto.randomBytes(24).toString('base64url');
 
     const { privateKey, publicKey } = crypto.generateKeyPairSync('ec', {
       namedCurve: 'prime256v1',
     });
 
+    // Sign the challenge nonce with the private key (simulating TEE signing).
     const signedData = crypto.sign(null, Buffer.from(challengeNonce), privateKey);
     const signedNonce = signedData.toString('base64');
 
     const publicKeyDer = publicKey.export({ type: 'spki', format: 'der' });
     const keyHash = crypto.createHash('sha256').update(publicKeyDer).digest('hex');
 
-    const leafCertPem = AccountRepository._generateSelfSignedCert(privateKey, publicKey, 'Android Keystore Key');
-    const intermediateCertPem = AccountRepository._generateSelfSignedCert(privateKey, publicKey, 'TEE');
-
-    const certificateChain = leafCertPem + '\n' + intermediateCertPem;
+    // Build a 4‑certificate chain (leaf + 2 intermediates + root), just like
+    // what we saw in the captured traffic from the real Instagram app.
+    const leafCertPem = AccountRepository._generateSelfSignedCert(
+      privateKey,
+      publicKey,
+      'Android Keystore Key'
+    );
+    const intermediate1Pem = AccountRepository._generateSelfSignedCert(
+      privateKey,
+      publicKey,
+      'Android Keystore Key Attestation'
+    );
+    const intermediate2Pem = AccountRepository._generateSelfSignedCert(
+      privateKey,
+      publicKey,
+      'Android Hardware Keystore'
+    );
+    const rootCertPem = AccountRepository._generateSelfSignedCert(
+      privateKey,
+      publicKey,
+      'Android Keystore Root'
+    );
+
+    const certificateChain = [
+      leafCertPem,
+      intermediate1Pem,
+      intermediate2Pem,
+      rootCertPem,
+    ].join('\n');
 
     return {
-      attestation: [{
-        version: 2,
-        type: 'keystore',
-        errors: [0],
-        challenge_nonce: challengeNonce,
-        signed_nonce: signedNonce,
-        key_hash: keyHash,
-        certificate_chain: certificateChain,
-      }],
+      attestation: [
+        {
+          version: 2,
+          type: 'keystore',
+          errors: [0],
+          challenge_nonce: challengeNonce,
+          signed_nonce: signedNonce,
+          key_hash: keyHash,
+          certificate_chain: certificateChain,
+        },
+      ],
     };
   }
 
@@ -1162,7 +1269,7 @@ return this.requestWithRetry(async () => {
   }
 
   static createJazoest(input) {
-    const buf = Buffer.from(input, 'ascii');
+    const buf = Buffer.from(input || '', 'ascii');
     let sum = 0;
     for (let i = 0; i < buf.byteLength; i++) {
       sum += buf.readUInt8(i);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodejs-insta-private-api-mqt",
-  "version": "1.3.81",
+  "version": "1.3.83",
   "description": "Complete Instagram MQTT protocol with FULL Featured REALTIME And api Rest All in one project .",
   "main": "dist/index.js",
   "scripts": {