nodejs-insta-private-api-mqt 1.3.87 → 1.3.88

package/dist/dist/repositories/account.repository.js

@@ -45,7 +45,7 @@ class AccountRepository extends Repository {
             }
         }
 
-        // Simpler: look for any header that contains ig-set-authorization
+        // 1) Try straight headers for IG-Set-Authorization
         for (const key of Object.keys(headers)) {
             const val = headers[key];
             if (!val) continue;
@@ -60,7 +60,6 @@ class AccountRepository extends Repository {
                     return token;
                 }
             }
-            // Some servers include the header value inside a JSON-like string in other headers
             if (typeof val === 'string' && val.includes('Bearer IGT:2:')) {
                 const token = this._findBearerInString(val);
                 if (token) {
@@ -120,10 +119,9 @@ class AccountRepository extends Repository {
             }
         }
 
-        // 2) Check response.body for common fields
+        // 2) Check response.body for common fields / embedded layout/login_response
         const body = response.body;
         if (body) {
-            // If body has headers string (some responses embed headers JSON as a string)
             if (body.headers && typeof body.headers === 'string') {
                 const token = this._findBearerInString(body.headers);
                 if (token) {
@@ -135,22 +133,20 @@ class AccountRepository extends Repository {
                 }
             }
 
-            // If body contains a layout object or string, stringify and search it
             try {
                 let layoutStr = null;
                 if (body.layout) {
-                    layoutStr =
-                        typeof body.layout === 'string'
-                            ? body.layout
-                            : JSON.stringify(body.layout);
+                    layoutStr = typeof body.layout === 'string'
+                        ? body.layout
+                        : JSON.stringify(body.layout);
                 } else if (body?.layout?.bloks_payload) {
                     layoutStr = JSON.stringify(body.layout.bloks_payload);
                 } else if (body?.bloks_payload) {
                     layoutStr = JSON.stringify(body.bloks_payload);
-                }
-                if (!layoutStr && typeof body === 'string') {
+                } else if (typeof body === 'string') {
                     layoutStr = body;
                 }
+
                 if (layoutStr) {
                     const token = this._findBearerInString(layoutStr);
                     if (token) {
@@ -161,12 +157,11 @@ class AccountRepository extends Repository {
                         return token;
                     }
 
-                    // Some responses embed a login_response JSON string inside layout; try to extract it
+                    // Embedded login_response JSON string
                     const loginResponseMatch = layoutStr.match(
                         /"login_response"\s*:\s*"(\\?{.*?\\?})"/s
                     );
                     if (loginResponseMatch) {
-                        // Unescape JSON string
                         let jsonStr = loginResponseMatch[1];
                         try {
                             jsonStr = jsonStr
@@ -174,23 +169,19 @@ class AccountRepository extends Repository {
                                 .replace(/\\n/g, '');
                             const parsed = JSON.parse(jsonStr);
                             if (parsed && parsed.headers) {
-                                const token = this._findBearerInString(
-                                    parsed.headers
-                                );
-                                if (token) {
-                                    this.client.state.authorization = token;
+                                const t = this._findBearerInString(parsed.headers);
+                                if (t) {
+                                    this.client.state.authorization = t;
                                     try {
                                         this.client.state.updateAuthorization();
                                     } catch (e) {}
-                                    return token;
+                                    return t;
                                 }
                             }
-                        } catch (e) {
-                            // ignore parse errors
-                        }
+                        } catch (e) {}
                     }
 
-                    // Also try to find IG-Set-Password-Encryption headers (not token but useful)
+                    // Encryption key id + pub key in layout
                     const encKeyIdMatch =
                         layoutStr.match(
                             /IG-Set-Password-Encryption-Key-Id[\\"\s:]+(\d+)/i
@@ -202,6 +193,7 @@ class AccountRepository extends Repository {
                         this.client.state.passwordEncryptionKeyId =
                             parseInt(encKeyIdMatch[1]);
                     }
+
                     const encPubKeyMatch =
                         layoutStr.match(
                             /IG-Set-Password-Encryption-Pub-Key[\\"\s:]+([A-Za-z0-9+\/=]+)/i
@@ -214,15 +206,13 @@ class AccountRepository extends Repository {
                             encPubKeyMatch[1];
                     }
 
-                    // Extract user/account identifiers from layout string
+                    // User / pk id
                     const dsIdMatch =
                         layoutStr.match(
                             /ig-set-ig-u-ds-user-id[\\"\s:]+(\d+)/i
                         ) ||
                         layoutStr.match(/ig-u-ds-user-id[\\"\s:]+(\d+)/i) ||
-                        layoutStr.match(
-                            /"strong_id__"\s*:\s*"(\d+)"/i
-                        ) ||
+                        layoutStr.match(/"strong_id__"\s*:\s*"(\d+)"/i) ||
                         layoutStr.match(/"pk_id"\s*:\s*"(\d+)"/i) ||
                         layoutStr.match(/"pk"\s*:\s*(\d+)/i);
                     if (dsIdMatch) {
@@ -254,11 +244,8 @@ class AccountRepository extends Repository {
                         this.client.state.mid = midMatch[1];
                     }
                 }
-            } catch (e) {
-                // ignore
-            }
+            } catch (e) {}
 
-            // 3) If body.logged_in_user exists and we have authorization already, return it
             if (body.logged_in_user && this.client.state.authorization) {
                 return this.client.state.authorization;
             }
@@ -267,15 +254,12 @@ class AccountRepository extends Repository {
         return null;
     }
 
-    // Normalize token string: accept either raw token or "Bearer IGT:2:..." and return trimmed token string
     _normalizeTokenString(val) {
         if (!val || typeof val !== 'string') return null;
 
-        // If header already contains "Bearer IGT:2:..."
         const bearer = this._findBearerInString(val);
         if (bearer) return bearer;
 
-        // If header contains JSON with IG-Set-Authorization field
         try {
             const maybeJson = JSON.parse(val);
             if (maybeJson['IG-Set-Authorization']) {
@@ -283,19 +267,14 @@ class AccountRepository extends Repository {
                     maybeJson['IG-Set-Authorization']
                 );
             }
-        } catch (e) {
-            // not JSON
-        }
+        } catch (e) {}
 
-        // fallback: return trimmed value
         return val.trim();
     }
 
-    // Find bearer token in arbitrary string using multiple patterns
     _findBearerInString(str) {
         if (!str || typeof str !== 'string') return null;
 
-        // Patterns to match the Bearer token in many possible encodings/escapes
         const bearerPatterns = [
             /Bearer IGT:2:[A-Za-z0-9+\/=]+/,
             /Bearer\s+IGT:2:[A-Za-z0-9+\/=]+/,
@@ -309,14 +288,12 @@ class AccountRepository extends Repository {
         for (const pattern of bearerPatterns) {
             const m = str.match(pattern);
             if (m) {
-                // If capturing group present, prefer it
                 if (m[1]) {
                     const token = m[1].includes('Bearer IGT:2:')
                         ? m[1]
                         : `Bearer IGT:2:${m[1]}`;
                     return token.replace(/\?"/g, '').trim();
                 }
-                // Otherwise m[0] contains the full token
                 return m[0].replace(/\?"/g, '').trim();
             }
         }
@@ -324,8 +301,35 @@ class AccountRepository extends Repository {
         return null;
     }
 
+    /**
+     * NEW helper: resolve a valid User-Agent from state / request / deviceString
+     * so it works even if scriptul tău nu setează explicit state.userAgent.
+     */
+    _resolveUserAgent() {
+        const state = this.client.state || {};
+        const req = this.client.request || {};
+
+        const candidates = [
+            state.userAgent,
+            state.appUserAgent,
+            req.userAgent,
+            state.deviceString,
+        ].filter(Boolean);
+
+        let userAgent = candidates.length > 0 ? candidates[0] : null;
+
+        if (!userAgent) {
+            // Fallback – Pixel 9 Pro style UA (nu mai e Xiaomi)
+            userAgent =
+                'Instagram 371.0.0.0.23 Android (35/15; 505dpi; 1440x3120; google; Pixel 9 Pro; pixel9pro; qcom; ro_RO; 703217507)';
+        }
+
+        // Sincronizăm în state ca să fie disponibil peste tot
+        this.client.state.userAgent = userAgent;
+        return userAgent;
+    }
+
     // Ensure we have a valid csrftoken cookie (and mid) before sensitive endpoints.
-    // Instagram typically sets csrftoken via /api/v1/si/fetch_headers/.
     async ensureCsrfToken() {
         const cookieToken = this.client.state.cookieCsrfToken;
         if (
@@ -339,15 +343,12 @@ class AccountRepository extends Repository {
             return cookieToken;
         }
 
-        // Warmup endpoint that returns/set cookies (csrftoken, mid, etc.)
         try {
             await this.client.request.send({
                 method: 'GET',
                 url: `/api/v1/si/fetch_headers/?challenge_type=signup&guid=${this.client.state.uuid}`,
             });
-        } catch (e) {
-            // ignore warmup failures
-        }
+        } catch (e) {}
 
         const token = this.client.state.cookieCsrfToken;
         if (
@@ -365,9 +366,8 @@ class AccountRepository extends Repository {
     }
 
     /**
-     * Internal: perform the Bloks OAuth token fetch step that the official app does
-     * just before password login (com.bloks.www.caa.login.oauth.token.fetch.async).
-     * This is best-effort only and never throws to the caller.
+     * Internal: pre-login Bloks OAuth token fetch, imită exact apelul oficial
+     * com.bloks.www.caa.login.oauth.token.fetch.async
      */
     async _prefetchOauthTokenForLogin(username) {
         if (!username) return null;
@@ -375,7 +375,6 @@ class AccountRepository extends Repository {
         try {
             const nowSec = Math.floor(Date.now() / 1000);
 
-            // Device identifiers – keep them consistent with the main login flow
             const androidDeviceId =
                 this.client.state.androidDeviceId ||
                 this.client.state.deviceId ||
@@ -404,7 +403,6 @@ class AccountRepository extends Repository {
                 `${Date.now()}${Math.floor(Math.random() * 1000)}`
             );
 
-            // AAC object as seen in real traffic: timestamp + UUID + random token
             const aacInitTimestamp =
                 nowSec - Math.floor(Math.random() * 50);
             const aacjid = crypto.randomUUID
@@ -460,9 +458,7 @@ class AccountRepository extends Repository {
 
             const lang = this.client.state.language || 'ro_RO';
             const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
-            const userAgent =
-                this.client.state.userAgent ||
-                'Instagram 371.0.0.0.23 Android (30/11; 320dpi; 720x1449; Xiaomi/Redmi; M2006C3MNG; angelican; mt6765; ro_RO; 703217507)';
+            const userAgent = this._resolveUserAgent();
 
             const timezoneOffset =
                 typeof this.client.state.timezoneOffset === 'number'
@@ -474,7 +470,6 @@ class AccountRepository extends Repository {
                 'content-type':
                     'application/x-www-form-urlencoded; charset=UTF-8',
                 'ig-intended-user-id': '0',
-                // Critical: matches the captured request header
                 priority: 'u=3',
 
                 'x-bloks-is-layout-rtl': 'false',
@@ -556,7 +551,6 @@ class AccountRepository extends Repository {
                 headers: bloksHeaders,
             });
 
-            // Optional debug dump so you can inspect the exact server response.
             try {
                 const fs = require('fs');
                 const path = require('path');
@@ -584,13 +578,10 @@ class AccountRepository extends Repository {
                     JSON.stringify(debugPayload, null, 2),
                     'utf8'
                 );
-            } catch (e) {
-                // Never break login on debug error
-            }
+            } catch (e) {}
 
             return response.body;
         } catch (e) {
-            // Completely swallow any errors; this step should never break login.
             return null;
         }
     }
@@ -618,19 +609,13 @@ class AccountRepository extends Repository {
 
         const { encrypted, time } = this.encryptPassword(password);
 
-        // optional CSRF warmup (like app does before login)
         await this.ensureCsrfToken();
 
-        // Pre-login Bloks OAuth token fetch (mirrors captured request).
-        // This helps the flow look closer to the real app, but is best-effort only.
         try {
             await this._prefetchOauthTokenForLogin(username);
-        } catch (e) {
-            // Ignore any errors from the prefetch step.
-        }
+        } catch (e) {}
 
         return this.requestWithRetry(async () => {
-            // ====== client_input_params (mirror of real traffic with password) ======
             const nowSec = Math.floor(Date.now() / 1000);
             const aacInitTimestamp =
                 nowSec - Math.floor(Math.random() * 50);
@@ -717,7 +702,6 @@ class AccountRepository extends Repository {
                 contact_point: username,
             };
 
-            // ====== server_params (mirror after reverse engineering) ======
             const waterfallId = crypto.randomUUID
                 ? crypto.randomUUID()
                 : require('uuid').v4();
@@ -783,12 +767,9 @@ class AccountRepository extends Repository {
                 styles_id: 'instagram',
             });
 
-            // ====== HEADERS – modelled after real traffic ======
             const lang = this.client.state.language || 'ro_RO';
             const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
-            const userAgent =
-                this.client.state.userAgent ||
-                'Instagram 371.0.0.0.23 Android (30/11; 320dpi; 720x1449; Xiaomi/Redmi; M2006C3MNG; angelican; mt6765; ro_RO; 703217507)';
+            const userAgent = this._resolveUserAgent();
 
             const bloksHeaders = {
                 'accept-language': acceptLanguage,
@@ -887,7 +868,7 @@ class AccountRepository extends Repository {
                 headers: bloksHeaders,
             });
 
-            // === DEBUG LOGIN: save response for offline analysis ===
+            // DEBUG login response
             try {
                 const fs = require('fs');
                 const path = require('path');
@@ -915,14 +896,10 @@ class AccountRepository extends Repository {
                     JSON.stringify(debugPayload, null, 2),
                     'utf8'
                 );
-            } catch (e) {
-                // don't break login on debug failure
-            }
-            // === END DEBUG LOGIN ===
+            } catch (e) {}
 
             const body = response.body;
 
-            // Immediately attempt to extract and save authorization token from the response
             this._extractAndSaveAuthorization(response);
 
             if (body && body.two_factor_required) {
@@ -956,7 +933,6 @@ class AccountRepository extends Repository {
                         ? body.layout
                         : JSON.stringify(body.layout);
 
-                // If layout contains two-factor markers, parse and throw
                 if (
                     layoutStr.includes('two_factor_required') ||
                     layoutStr.includes('"two_factor_info"')
@@ -1000,7 +976,6 @@ class AccountRepository extends Repository {
                     throw err;
                 }
 
-                // Additional attempt to extract token from layout string
                 const tokenFromLayout =
                     this._findBearerInString(layoutStr);
                 if (tokenFromLayout) {
@@ -1011,7 +986,6 @@ class AccountRepository extends Repository {
                     } catch (e) {}
                 }
 
-                // Extract pk (user id) from layout if present
                 const pkPatterns = [
                     /\\"pk\\":\s*(\d+)/,
                     /"pk":\s*(\d+)/,
@@ -1032,7 +1006,6 @@ class AccountRepository extends Repository {
                     }
                 }
 
-                // Extract IG-Set-WWW-Claim if present
                 const wwwClaimPatterns = [
                     /IG-Set-WWW-Claim[\\"\s:]+([a-f0-9]+)/i,
                     /ig-set-www-claim[\\"\s:]+([a-f0-9]+)/i,
@@ -1048,43 +1021,41 @@ class AccountRepository extends Repository {
                     }
                 }
 
-                // Extract encryption key id and pub key (already attempted earlier)
-                const encKeyIdMatch =
+                const encKeyIdMatch2 =
                     layoutStr.match(
                         /IG-Set-Password-Encryption-Key-Id[\\"\s:]+(\d+)/i
                     ) ||
                     layoutStr.match(
                         /password.encryption.key.id[\\"\s:]+(\d+)/i
                     );
-                if (encKeyIdMatch) {
+                if (encKeyIdMatch2) {
                     this.client.state.passwordEncryptionKeyId =
-                        parseInt(encKeyIdMatch[1]);
+                        parseInt(encKeyIdMatch2[1]);
                 }
 
-                const encPubKeyMatch =
+                const encPubKeyMatch2 =
                     layoutStr.match(
                         /IG-Set-Password-Encryption-Pub-Key[\\"\s:]+([A-Za-z0-9+\/=]+)/i
                     ) ||
                     layoutStr.match(
                         /password.encryption.pub.key[\\"\s:]+([A-Za-z0-9+\/=]+)/i
                     );
-                if (encPubKeyMatch) {
+                if (encPubKeyMatch2) {
                     this.client.state.passwordEncryptionPubKey =
-                        encPubKeyMatch[1];
+                        encPubKeyMatch2[1];
                 }
 
-                const midMatch =
+                const midMatch2 =
                     layoutStr.match(
                         /ig-set-x-mid[\\"\s:]+([A-Za-z0-9+\/=_-]+)/i
                     ) ||
                     layoutStr.match(
                         /\\"x-mid\\"[\\"\s:]+([A-Za-z0-9+\/=_-]+)/i
                     );
-                if (midMatch) {
-                    this.client.state.mid = midMatch[1];
+                if (midMatch2) {
+                    this.client.state.mid = midMatch2[1];
                 }
 
-                // If layout contains a direct logged_in_user JSON, extract and return it
                 const loginResponsePatterns = [
                     /\\"logged_in_user\\":\{[^}]*\\"pk\\":(\d+)[^}]*\\"username\\":\\"([^"\\]+)\\"/,
                     /"logged_in_user":\{[^}]*"pk":(\d+)[^}]*"username":"([^"]+)"/,
@@ -1106,7 +1077,6 @@ class AccountRepository extends Repository {
                     }
                 }
 
-                // If we have extracted a pk and we also have authorization, try to fetch current user
                 if (
                     extractedPk &&
                     this.client.state.authorization
@@ -1130,19 +1100,16 @@ class AccountRepository extends Repository {
                 }
             }
 
-            // If server returned logged_in_user directly in body
             if (body && body.logged_in_user) {
                 const lu = body.logged_in_user;
                 if (lu.pk) {
                     this.client.state.cookieUserId = String(lu.pk);
                     this.client.state._userId = String(lu.pk);
                 }
-                // Ensure authorization is saved if present in response headers
                 this._extractAndSaveAuthorization(response);
                 return lu;
             }
 
-            // If we already have authorization, try to fetch current user to populate state
             if (this.client.state.authorization) {
                 try {
                     const userInfo = await this.currentUser();
@@ -1154,7 +1121,6 @@ class AccountRepository extends Repository {
                     }
                     return user;
                 } catch (e) {
-                    // fallback: return raw body
                     return body;
                 }
             }
@@ -1184,7 +1150,6 @@ class AccountRepository extends Repository {
                     phone_id: this.client.state.phoneId,
                 }),
             });
-            // Save authorization if present in two-factor response
             this._extractAndSaveAuthorization(response);
             return response.body;
         });
@@ -1572,18 +1537,6 @@ class AccountRepository extends Repository {
     }
 
     static generateAttestParams(state) {
-        // Emulate Instagram's keystore attestation as closely as possible:
-        // - version: 2
-        // - type: "keystore"
-        // - errors: [0]
-        // - challenge_nonce: random base64url
-        // - signed_nonce: ECDSA signature over the nonce
-        // - key_hash: sha256(spki(publicKey))
-        // - certificate_chain: 4 PEM certificates concatenated (leaf + 2 intermediates + root)
-        //
-        // NOTE: This is *not* a real hardware-backed attestation chain, but it mirrors
-        // the structure of the official app very closely so the server sees the same
-        // shape: a single attestation object with a 4-certificate chain.
         const challengeNonce = crypto
             .randomBytes(24)
             .toString('base64url');
@@ -1593,7 +1546,6 @@ class AccountRepository extends Repository {
                 namedCurve: 'prime256v1',
             }
         );
-        // Sign the challenge nonce with the private key (simulating TEE signing).
         const signedData = crypto.sign(
             null,
             Buffer.from(challengeNonce),
@@ -1609,7 +1561,6 @@ class AccountRepository extends Repository {
             .update(publicKeyDer)
             .digest('hex');
 
-        // Build a 4-certificate chain (leaf + 2 intermediates + root)
         const leafCertPem =
             AccountRepository._generateSelfSignedCert(
                 privateKey,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodejs-insta-private-api-mqt",
-  "version": "1.3.87",
+  "version": "1.3.88",
   "description": "Complete Instagram MQTT protocol with full-featured REALTIME and REST API — all in one project.",
 
   "main": "dist/dist/index.js",