nodejs-insta-private-api-mqt 1.3.88 → 1.3.90

package/dist/dist/repositories/account.repository.js

@@ -586,6 +586,487 @@ class AccountRepository extends Repository {
         }
     }
 
+    /**
+     * Step 1: launcher/mobileconfig to fetch mobile config + encryption keys.
+     * Best effort – errors are ignored.
+     */
+    async _launcherMobileConfig(preLogin = true) {
+        const nowSec = Math.floor(Date.now() / 1000);
+        const state = this.client.state || {};
+
+        const androidDeviceId =
+            state.androidDeviceId ||
+            state.deviceId ||
+            `android-${crypto.randomBytes(8).toString('hex')}`;
+
+        const familyDeviceId =
+            state.phoneId ||
+            state.familyDeviceId ||
+            (crypto.randomUUID
+                ? crypto.randomUUID()
+                : require('uuid').v4());
+
+        const qeDeviceId =
+            state.deviceId ||
+            state.qeDeviceId ||
+            (crypto.randomUUID
+                ? crypto.randomUUID()
+                : require('uuid').v4());
+
+        const deviceUUID = state.uuid || qeDeviceId;
+        const userId = state.cookieUserId || '0';
+
+        const bloksVersionId =
+            state.bloksVersionId ||
+            '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
+
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+
+        const timezoneOffset =
+            typeof state.timezoneOffset === 'number'
+                ? state.timezoneOffset
+                : 7200;
+
+        const params = {
+            bool_opt_policy: '0',
+            mobileconfig: '',
+            api_version: '9',
+            client_context: '["opt,value_hash"]',
+            unit_type: '2',
+            use_case: 'STANDARD',
+            query_hash:
+                'f00b9d0869db3969378d8d06bfccb24b5ef078012c8e199cba961cd5dfedaa88',
+            ts: String(nowSec),
+            _uid: userId,
+            device_id: deviceUUID,
+            _uuid: deviceUUID,
+            fetch_mode: 'CONFIG_SYNC_ONLY',
+            fetch_type: 'ASYNC_FULL',
+        };
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'content-type':
+                'application/x-www-form-urlencoded; charset=UTF-8',
+            priority: 'u=3',
+
+            'x-bloks-is-layout-rtl': 'false',
+            'x-bloks-prism-ax-base-colors-enabled': 'false',
+            'x-bloks-prism-button-version': 'CONTROL',
+            'x-bloks-prism-colors-enabled': 'true',
+            'x-bloks-prism-font-enabled': 'false',
+            'x-bloks-prism-indigo-link-version': '0',
+            'x-bloks-version-id': bloksVersionId,
+
+            'x-fb-client-ip': 'True',
+            'x-fb-connection-type': 'WIFI',
+            'x-fb-server-cluster': 'True',
+            'x-fb-network-properties':
+                'VPN;Validated;LocalAddrs=/10.0.0.2,;',
+            'x-fb-http-engine': 'MNS/TCP',
+            'x-fb-rmd': 'state=URL_ELIGIBLE',
+
+            'x-ig-android-id': androidDeviceId,
+            'x-ig-app-id': String(
+                state.fbAnalyticsApplicationId || '567067343352427'
+            ),
+            'x-ig-app-locale': lang,
+            'x-ig-bandwidth-speed-kbps': (
+                Math.random() * 1500 +
+                800
+            ).toFixed(3),
+            'x-ig-bandwidth-totalbytes-b': '0',
+            'x-ig-bandwidth-totaltime-ms': '0',
+            'x-ig-client-endpoint':
+                'LockoutFragment:dogfooding_lockout',
+            'x-ig-capabilities': '3brTv10=',
+            'x-ig-connection-type': 'WIFI',
+            'x-ig-device-id': deviceUUID,
+            'x-ig-device-languages': '{"system_languages":"ro-RO"}',
+            'x-ig-device-locale': lang,
+            'x-ig-family-device-id': familyDeviceId,
+            'x-ig-mapped-locale': lang,
+            'x-ig-nav-chain':
+                'LockoutFragment:dogfooding_lockout:1:cold_start',
+            'x-ig-salt-ids':
+                '220140399,332020310,974466465,974460658',
+            'x-ig-timezone-offset': String(timezoneOffset),
+            'x-ig-www-claim': state.igWWWClaim || '0',
+            'x-mid':
+                state.mid ||
+                state.machineId ||
+                `aZ${crypto.randomBytes(8).toString('hex')}`,
+            'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(
+                Math.random() * 1000
+            )
+                .toString()
+                .padStart(3, '0')}`,
+            'x-pigeon-session-id':
+                state.pigeonSessionId ||
+                `UFS-${crypto.randomBytes(16).toString('hex')}-M`,
+            'x-tigon-is-retry': 'False',
+
+            'accept-encoding': 'gzip, deflate, br',
+            'user-agent': userAgent,
+        };
+
+        if (state.cookieUserId) {
+            headers['ig-intended-user-id'] = String(state.cookieUserId);
+            headers['ig-u-ds-user-id'] = String(state.cookieUserId);
+        }
+        if (state.igURur) {
+            headers['ig-u-rur'] = state.igURur;
+        }
+        if (state.authorization) {
+            headers['authorization'] = state.authorization;
+        }
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/launcher/mobileconfig/',
+                form: this.client.request.sign(params),
+                headers,
+            });
+
+            // NEW: salvăm cheia de criptare a parolei direct din headers de la mobileconfig
+            try {
+                const mcHeaders = response.headers || {};
+                const mcLower = {};
+                for (const k of Object.keys(mcHeaders)) {
+                    mcLower[k.toLowerCase()] = mcHeaders[k];
+                }
+
+                const mcKeyIdStr =
+                    mcLower['ig-set-password-encryption-key-id'];
+                const mcPubKey =
+                    mcLower['ig-set-password-encryption-pub-key'];
+
+                if (mcKeyIdStr) {
+                    const parsedKeyId = parseInt(mcKeyIdStr, 10);
+                    if (!Number.isNaN(parsedKeyId)) {
+                        state.passwordEncryptionKeyId = parsedKeyId;
+                    }
+                }
+
+                if (mcPubKey) {
+                    state.passwordEncryptionPubKey = mcPubKey;
+                }
+            } catch (e) {}
+
+            try {
+                const fs = require('fs');
+                const path = require('path');
+                const debugDir = path.join(
+                    process.cwd(),
+                    'authinfo_instagram'
+                );
+                const debugFile = path.join(
+                    debugDir,
+                    'launcher-mobileconfig-debug.json'
+                );
+                try {
+                    fs.mkdirSync(debugDir, { recursive: true });
+                } catch (e) {}
+                const debugPayload = {
+                    at: new Date().toISOString(),
+                    statusCode:
+                        response.statusCode || response.status || null,
+                    headers: response.headers || null,
+                    body: response.body || null,
+                };
+                fs.writeFileSync(
+                    debugFile,
+                    JSON.stringify(debugPayload, null, 2),
+                    'utf8'
+                );
+            } catch (e) {}
+
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    /**
+     * Step 2: Android Keystore attestation – moves x-ig-attest-params
+     * payload to dedicated endpoint /api/v1/attestation/create_android_keystore/.
+     */
+    async _createAndroidKeystoreAttestation() {
+        const state = this.client.state || {};
+        const nowSec = Math.floor(Date.now() / 1000);
+
+        const androidDeviceId =
+            state.androidDeviceId ||
+            state.deviceId ||
+            `android-${crypto.randomBytes(8).toString('hex')}`;
+
+        const familyDeviceId =
+            state.phoneId ||
+            state.familyDeviceId ||
+            (crypto.randomUUID
+                ? crypto.randomUUID()
+                : require('uuid').v4());
+
+        const qeDeviceId =
+            state.deviceId ||
+            state.qeDeviceId ||
+            (crypto.randomUUID
+                ? crypto.randomUUID()
+                : require('uuid').v4());
+
+        const deviceUUID = state.uuid || qeDeviceId;
+        const userId = state.cookieUserId || '0';
+
+        const attestParams =
+            AccountRepository.generateAttestParams(state);
+
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+        const timezoneOffset =
+            typeof state.timezoneOffset === 'number'
+                ? state.timezoneOffset
+                : 7200;
+
+        const params = {
+            _uid: userId,
+            _uuid: deviceUUID,
+            device_id: androidDeviceId,
+            family_device_id: familyDeviceId,
+            ts: String(nowSec),
+            ...attestParams,
+        };
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'content-type':
+                'application/x-www-form-urlencoded; charset=UTF-8',
+            priority: 'u=3',
+
+            'x-ig-android-id': androidDeviceId,
+            'x-ig-device-id': qeDeviceId,
+            'x-ig-family-device-id': familyDeviceId,
+            'x-ig-timezone-offset': String(timezoneOffset),
+            'x-ig-app-id': String(
+                state.fbAnalyticsApplicationId || '567067343352427'
+            ),
+            'x-ig-app-locale': lang,
+            'x-ig-device-locale': lang,
+            'x-ig-mapped-locale': lang,
+            'x-ig-connection-type': 'WIFI',
+            'x-ig-capabilities': '3brTv10=',
+            'x-ig-www-claim': state.igWWWClaim || '0',
+
+            'x-pigeon-rawclienttime': `${nowSec}.${Math.floor(
+                Math.random() * 1000
+            )
+                .toString()
+                .padStart(3, '0')}`,
+            'x-pigeon-session-id':
+                state.pigeonSessionId ||
+                `UFS-${crypto.randomBytes(16).toString('hex')}-A`,
+            'x-mid':
+                state.mid ||
+                state.machineId ||
+                `aZ${crypto.randomBytes(8).toString('hex')}`,
+
+            'x-fb-client-ip': 'True',
+            'x-fb-connection-type': 'WIFI',
+            'x-fb-server-cluster': 'True',
+            'x-fb-http-engine': 'MNS/TCP',
+            'x-fb-network-properties':
+                'VPN;Validated;LocalAddrs=/10.0.0.2,;',
+            'x-fb-rmd': 'state=URL_ELIGIBLE',
+
+            'accept-encoding': 'gzip, deflate, br',
+            'user-agent': userAgent,
+        };
+
+        if (state.cookieUserId) {
+            headers['ig-intended-user-id'] = String(state.cookieUserId);
+        }
+        if (state.authorization) {
+            headers['authorization'] = state.authorization;
+        }
+        if (state.igURur) {
+            headers['ig-u-rur'] = state.igURur;
+        }
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/attestation/create_android_keystore/',
+                form: this.client.request.sign(params),
+                headers,
+            });
+
+            try {
+                const fs = require('fs');
+                const path = require('path');
+                const debugDir = path.join(
+                    process.cwd(),
+                    'authinfo_instagram'
+                );
+                const debugFile = path.join(
+                    debugDir,
+                    'attestation-debug.json'
+                );
+                try {
+                    fs.mkdirSync(debugDir, { recursive: true });
+                } catch (e) {}
+                const debugPayload = {
+                    at: new Date().toISOString(),
+                    statusCode:
+                        response.statusCode || response.status || null,
+                    headers: response.headers || null,
+                    body: response.body || null,
+                };
+                fs.writeFileSync(
+                    debugFile,
+                    JSON.stringify(debugPayload, null, 2),
+                    'utf8'
+                );
+            } catch (e) {}
+
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    /**
+     * Step 3 & 4 & 5 helpers: Terms of service preload, process client data,
+     * and (optional) phone number prefill.
+     * These are best-effort calls; failures are ignored.
+     */
+    async _preloadTermsOfService() {
+        const state = this.client.state || {};
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+        const bloksVersionId =
+            state.bloksVersionId ||
+            '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
+
+        const paramsJson = JSON.stringify({});
+        const bkClientContext = JSON.stringify({
+            bloks_version: bloksVersionId,
+            styles_id: 'instagram',
+        });
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'content-type':
+                'application/x-www-form-urlencoded; charset=UTF-8',
+            priority: 'u=3',
+            'x-bloks-version-id': bloksVersionId,
+            'user-agent': userAgent,
+        };
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/bloks/apps/com.bloks.www.caa.login.oxygen_preloads_terms_of_service/',
+                form: {
+                    params: paramsJson,
+                    bk_client_context: bkClientContext,
+                    bloks_versioning_id: bloksVersionId,
+                },
+                headers,
+            });
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    async _processClientDataAndRedirect(username) {
+        const state = this.client.state || {};
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+        const bloksVersionId =
+            state.bloksVersionId ||
+            '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
+
+        const paramsJson = JSON.stringify({
+            username_input: username || '',
+        });
+        const bkClientContext = JSON.stringify({
+            bloks_version: bloksVersionId,
+            styles_id: 'instagram',
+        });
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'content-type':
+                'application/x-www-form-urlencoded; charset=UTF-8',
+            priority: 'u=3',
+            'x-bloks-version-id': bloksVersionId,
+            'user-agent': userAgent,
+        };
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/bloks/async_action/com.bloks.www.bloks.caa.login.process_client_data_and_redirect/',
+                form: {
+                    params: paramsJson,
+                    bk_client_context: bkClientContext,
+                    bloks_versioning_id: bloksVersionId,
+                },
+                headers,
+            });
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
+
+    async _phoneNumberPrefill() {
+        const state = this.client.state || {};
+        const lang = state.language || 'ro_RO';
+        const acceptLanguage = `${lang.replace('_', '-')}, en-US`;
+        const userAgent = this._resolveUserAgent();
+        const bloksVersionId =
+            state.bloksVersionId ||
+            '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
+
+        const paramsJson = JSON.stringify({});
+        const bkClientContext = JSON.stringify({
+            bloks_version: bloksVersionId,
+            styles_id: 'instagram',
+        });
+
+        const headers = {
+            'accept-language': acceptLanguage,
+            'content-type':
+                'application/x-www-form-urlencoded; charset=UTF-8',
+            priority: 'u=3',
+            'x-bloks-version-id': bloksVersionId,
+            'user-agent': userAgent,
+        };
+
+        try {
+            const response = await this.client.request.send({
+                method: 'POST',
+                url: '/api/v1/bloks/async_action/com.bloks.www.bloks.caa.phone.number.prefill.async.controller/',
+                form: {
+                    params: paramsJson,
+                    bk_client_context: bkClientContext,
+                    bloks_versioning_id: bloksVersionId,
+                },
+                headers,
+            });
+            return response.body;
+        } catch (e) {
+            return null;
+        }
+    }
+
     async login(credentialsOrUsername, passwordArg) {
         let username, password;
         if (
@@ -603,18 +1084,42 @@ class AccountRepository extends Repository {
             throw new Error('Username and password are required');
         }
 
+        // 0: ne asigurăm că avem csrf + cookies de bază
+        await this.ensureCsrfToken();
+
+        // 1: încercăm să luăm cheia de criptare a parolei din /launcher/mobileconfig/
+        try {
+            await this._launcherMobileConfig(true);
+        } catch (e) {}
+
+        // Fallback: dacă mobileconfig nu a setat cheia, folosim mecanismul vechi de LOGIN_EXPERIMENTS
         if (!this.client.state.passwordEncryptionPubKey) {
             await this.syncLoginExperiments();
         }
 
+        // Acum parola este criptată CU cheia venită din mobileconfig (dacă a existat)
         const { encrypted, time } = this.encryptPassword(password);
 
-        await this.ensureCsrfToken();
+        // Step 2–5: keystore attestation, TOS preload, process client data, phone prefill
+        try {
+            await this._createAndroidKeystoreAttestation();
+        } catch (e) {}
+        try {
+            await this._preloadTermsOfService();
+        } catch (e) {}
+        try {
+            await this._processClientDataAndRedirect(username);
+        } catch (e) {}
+        try {
+            await this._phoneNumberPrefill();
+        } catch (e) {}
 
+        // Step 6: OAuth token fetch
         try {
             await this._prefetchOauthTokenForLogin(username);
         } catch (e) {}
 
+        // Step 7: real login
         return this.requestWithRetry(async () => {
             const nowSec = Math.floor(Date.now() / 1000);
             const aacInitTimestamp =
@@ -754,10 +1259,6 @@ class AccountRepository extends Repository {
                 server_params: serverParams,
             });
 
-            const attestParams =
-                AccountRepository.generateAttestParams(
-                    this.client.state
-                );
             const bloksVersionId =
                 this.client.state.bloksVersionId ||
                 '5e47baf35c5a270b44c8906c8b99063564b30ef69779f3dee0b828bee2e4ef5b';
@@ -812,7 +1313,6 @@ class AccountRepository extends Repository {
                         '567067343352427'
                 ),
                 'x-ig-app-locale': lang,
-                'x-ig-attest-params': JSON.stringify(attestParams),
                 'x-ig-bandwidth-speed-kbps': (
                     Math.random() * 1500 +
                     800
@@ -1821,7 +2321,7 @@ class AccountRepository extends Repository {
                     phone_id: this.client.state.phoneId,
                     device_token: '',
                     guid: this.client.state.uuid,
-                    users: preferences,
+                    users: preferen1gces,
                 }),
             });
             return response.body;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodejs-insta-private-api-mqt",
-  "version": "1.3.88",
+  "version": "1.3.90",
   "description": "Complete Instagram MQTT protocol with full-featured REALTIME and REST API — all in one project.",
 
   "main": "dist/dist/index.js",