whalibmob 5.12.8 → 5.12.10

package/README.md

@@ -678,6 +678,11 @@ wa> /about Available 24/7 for support
 about updated
 ```
 
+`about updated` now means the about was read back from the server and matches
+what you typed. When the server accepts the stanza but still reports something
+else, it says so instead — and if the about is stored but hidden, it names the
+privacy setting that is hiding it.
+
 #### CLI Change Profile Picture
 
 Reads the image from disk, crops it square, scales it to 640×640 and uploads it
@@ -3402,6 +3407,9 @@ const results = await client.hasWhatsapp(['919634847671', '12345678901'])
 ```js
 const about = await client.queryAbout('919634847671@s.whatsapp.net')
 console.log(about)
+
+// your own, asked the same way
+console.log(await client.queryOwnAbout())
 ```
 
 ### Fetch Profile Picture
@@ -3435,6 +3443,22 @@ client.changeName('My Bot')
 
 ```js
 await client.changeAbout('Available 24/7')
+
+// what the server actually has now — the set IQ is answered before the new
+// text has to be visible anywhere, so this is the part worth reading
+const stored = await client.queryOwnAbout()
+```
+
+`changeAbout` throws when the server refuses the change or never answers; it
+used to hand back the reply unread, so a refusal looked exactly like a success.
+An about is limited to 139 characters — a longer one is dropped rather than
+refused, and that too is now a thrown error instead of silence.
+
+An about the server stores and nobody can see is a privacy setting rather than a
+failed write. The category that governs who may read it is `status`:
+
+```js
+await client.changePrivacySetting('status', 'all')
 ```
 
 ### Change Profile Picture

package/cli.js

@@ -1411,7 +1411,26 @@ async function handleLine(line) {
         const text = p.slice(1).join(' ');
         if (!text) { fail('usage: /about <text>'); break; }
         await _client.changeAbout(text);
-        out('about updated');
+
+        // The server answers the set IQ before the new about has to be visible
+        // anywhere, so "result" is not the same as "changed" — this used to
+        // report success on the strength of that empty reply alone. Read it
+        // back and say what is actually stored.
+        let stored = null;
+        try { stored = await _client.queryOwnAbout(); } catch (_) {}
+        if (stored === text)  out('about updated');
+        else if (stored)      out('sent, but the server still reports: ' + stored);
+        else                  out('sent, and the server accepted it — it reports no about for this number yet');
+
+        // An about that is stored and still nowhere to be seen is a privacy
+        // setting rather than a failed write: on the wire the category that
+        // governs who may read it is "status".
+        try {
+          const priv = await _client.queryPrivacySettings({ force: true });
+          if (priv && priv.status && priv.status !== 'all') {
+            out('  about visibility is "' + priv.status + '" — /privacy status all shows it to everyone');
+          }
+        } catch (_) {}
         break;
       }
 

package/lib/Client.js

@@ -59,6 +59,10 @@ const INVITE_LINK_PREFIX = 'https://chat.whatsapp.com/';
 // with a different query.
 const MEX_QUERY_REACHOUT_TIMELOCK = '23983697327930364';
 
+// How long an about is allowed to be. The apps stop you at this length; the
+// server takes a longer one, answers <iq type="result"/> and keeps the old text.
+const ABOUT_MAX_LENGTH = 139;
+
 // The names privacy settings actually go by on the wire, and the friendly
 // aliases this library has always accepted for them. The wire names are the
 // right-hand column.
@@ -4446,17 +4450,62 @@ class WhalibmobClient extends EventEmitter {
   }
 
   // Change bio/about text
+  //
+  // The <status> child is byte-for-byte what Baileys and whatsmeow send. The
+  // envelope was not: both of them address this IQ to the server as a *JID*
+  // with nobody in the user part — Baileys writes '@s.whatsapp.net', whatsmeow
+  // uses types.ServerJID — which goes out as JID_PAIR + empty user + the server
+  // token. This wrote the bare string 's.whatsapp.net', and a bare string is
+  // encoded as a plain dictionary token, so where every other client puts an
+  // address the server was reading text. That is the whole of the difference,
+  // and it is invisible in a stanza log, which prints the node before it is
+  // encoded: both spellings read `to="s.whatsapp.net"` on screen.
+  //
+  // The reply was thrown away as well. _sendIq answers null on a timeout and
+  // hands back error stanzas unread, so a refusal, a silence and a success all
+  // returned the same thing — which is how "about updated" came to be printed
+  // for a change that never happened.
   async changeAbout(text) {
-    const id   = this._genMsgId();
+    const body = String(text == null ? '' : text);
+    // The limit the apps impose. A longer one is dropped rather than refused,
+    // so it would otherwise look exactly like this bug.
+    if (Array.from(body).length > ABOUT_MAX_LENGTH) {
+      throw new Error('changeAbout: an about is limited to ' + ABOUT_MAX_LENGTH +
+        ' characters — the server drops a longer one instead of refusing it');
+    }
+
     const node = new BinaryNode('iq', {
-      id,
+      id:    this._genMsgId(),
       xmlns: 'status',
-      to:    's.whatsapp.net',
+      to:    jidStrToObj('@s.whatsapp.net'),
       type:  'set'
     }, [
-      new BinaryNode('status', {}, Buffer.from(text, 'utf8'))
+      new BinaryNode('status', {}, Buffer.from(body, 'utf8'))
     ]);
-    return this._sendIq(node);
+
+    const resp = await this._sendIq(node);
+    if (!resp) throw new Error('changeAbout: no reply from server (IQ timed out)');
+    if (resp.attrs && resp.attrs.type === 'error') {
+      const errNode = findChild(resp, 'error');
+      const code    = errNode && errNode.attrs && errNode.attrs.code;
+      const errText = errNode && errNode.attrs && errNode.attrs.text;
+      throw new Error('changeAbout: server rejected the change' +
+        (code ? ' (' + code + (errText ? ' ' + errText : '') + ')' : ''));
+    }
+    return resp;
+  }
+
+  // The about this account currently has, as the server reports it.
+  //
+  // The set IQ is answered before the new text has to be visible anywhere, so
+  // an empty result proves only that the stanza was understood. Reading it back
+  // is the only way to tell an about the server stored from one it took and
+  // dropped — and it is asked exactly the way a contact's is.
+  async queryOwnAbout() {
+    const me = this._store &&
+      (this._store.phoneNumber || (this._store.me && this._store.me.id));
+    if (!me) throw new Error('queryOwnAbout: not connected');
+    return this.queryAbout(String(me));
   }
 
   // Change profile picture

package/lib/Registration.js

@@ -4,10 +4,45 @@ const crypto = require('crypto');
 const https  = require('https');
 const tls    = require('tls');
 const curveJs = require('curve25519-js');
+const { v4: uuidv4 } = require('uuid');
 const { getDeviceConfig } = require('./DeviceConfig');
 const attestation = require('./Attestation');
 const { dbg: _whaDbg } = require('./logger');
 
+// ---------- Request envelope ----------
+//
+// The registration server reads which platform is calling out of the
+// User-Agent. There is no form field for it — neither this library nor Cobalt
+// sends one — so a request whose User-Agent does not name a platform it knows is
+// refused with {"param":"platform","reason":"bad_param"} on every endpoint. The
+// giveaway is that /client_log is refused the same way, and its body carries no
+// device fields at all: nothing about the platform is in the body to begin with.
+//
+// Android used to be sent as `WhatsApp/<version> A`, which names nothing, and
+// was refused everywhere. iOS has always sent the full form and has always
+// worked, which is why only one of the two platforms was broken.
+//
+// The three extra Android headers come from Cobalt's AndroidClientRegistration,
+// which records them as observed on a live native Android registration. Its iOS
+// counterpart documents that the native iOS client omits all three, so the iOS
+// envelope stays exactly as it was.
+function registrationHeaders(device, waVersion) {
+  if (device.os === 'android') {
+    return {
+      'User-Agent':     `WhatsApp/${waVersion} Android/${device.osVersion} Device/${device.manufacturer}-${device.modelId}`,
+      'Content-Type':   'application/x-www-form-urlencoded',
+      'Accept':         'text/json',
+      'WaMsysRequest':  '1',
+      // A fresh one per request, the way the native client mints it.
+      'request_token':  uuidv4()
+    };
+  }
+  return {
+    'User-Agent':   `WhatsApp/${waVersion} iOS/${device.osVersion} Device/${device.model}`,
+    'Content-Type': 'application/x-www-form-urlencoded'
+  };
+}
+
 // ---------- SOCKS4 / SOCKS5 / Tor support ----------
 //
 // Set SOCKS_PROXY (or TOR_PROXY) to route registration traffic through a proxy:
@@ -125,15 +160,11 @@ async function httpPostViaSocks(path, body, waVersion, proxyUrl, authHeader) {
     tlsSocket.once('error', rej);
   });
 
-  const _dev = getDeviceConfig();
-  const userAgent = _dev.os === 'android'
-    ? `WhatsApp/${waVersion} A`
-    : `WhatsApp/${waVersion} iOS/${_dev.osVersion} Device/${_dev.model}`;
+  const headers  = registrationHeaders(getDeviceConfig(), waVersion);
   const reqLines = [
     `POST /v2${path} HTTP/1.1`,
     `Host: ${dHost}`,
-    `User-Agent: ${userAgent}`,
-    `Content-Type: application/x-www-form-urlencoded`,
+    ...Object.keys(headers).map(k => `${k}: ${headers[k]}`),
     `Content-Length: ${Buffer.byteLength(body)}`
   ];
   if (authHeader) reqLines.push(`Authorization: ${authHeader}`);
@@ -703,16 +734,11 @@ function httpPost(path, body, waVersion, authHeader) {
   if (proxy) return httpPostViaSocks(path, body, waVersion, proxy, authHeader);
 
   return new Promise((resolve, reject) => {
-    const _httpDev  = getDeviceConfig();
-    const userAgent = _httpDev.os === 'android'
-      ? `WhatsApp/${waVersion} A`
-      : `WhatsApp/${waVersion} iOS/${_httpDev.osVersion} Device/${_httpDev.model}`;
     const bodyBuf = Buffer.from(body, 'utf8');
-    const headers = {
-      'User-Agent':      userAgent,
-      'Content-Type':   'application/x-www-form-urlencoded',
-      'Content-Length': bodyBuf.length
-    };
+    const headers = Object.assign(
+      registrationHeaders(getDeviceConfig(), waVersion),
+      { 'Content-Length': bodyBuf.length }
+    );
     // Attestation cert-chain / App Attest header (Android cert chain, iOS
     // <attestation>|<keyId>). Only present when body attestation is available.
     if (authHeader) headers['Authorization'] = authHeader;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.12.8",
+  "version": "5.12.10",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API no web",
   "author": "Kunboruto20",
   "main": "index.js",