zapo-js 0.2.0 → 0.3.0

package/dist/auth/{flow/WaAuthCredentialsFlow.js → credentials-flow.js}

@@ -3,14 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadOrCreateCredentials = loadOrCreateCredentials;
 exports.persistCredentials = persistCredentials;
 exports.buildCommsConfig = buildCommsConfig;
-const _crypto_1 = require("../../crypto/index.js");
-const keys_1 = require("../../crypto/core/keys");
-const X25519_1 = require("../../crypto/curves/X25519");
-const jid_1 = require("../../protocol/jid");
-const WaAdvSignature_1 = require("../../signal/crypto/WaAdvSignature");
-const utils_1 = require("../../signal/registration/utils");
-const proxy_1 = require("../../transport/proxy");
-const primitives_1 = require("../../util/primitives");
+const _crypto_1 = require("../crypto/index.js");
+const keys_1 = require("../crypto/core/keys");
+const X25519_1 = require("../crypto/curves/X25519");
+const jid_1 = require("../protocol/jid");
+const utils_1 = require("../signal/registration/utils");
+const WaMobileTcpSocket_1 = require("../transport/node/WaMobileTcpSocket");
+const WaMobileClientPayload_1 = require("../transport/noise/WaMobileClientPayload");
+const proxy_1 = require("../transport/proxy");
+const primitives_1 = require("../util/primitives");
 async function loadOrCreateCredentials(args) {
     args.logger.trace('auth credentials loadOrCreate start');
     const existing = await args.authStore.load();
@@ -23,13 +24,16 @@ async function loadOrCreateCredentials(args) {
         registered: existing.meJid !== null && existing.meJid !== undefined,
         hasServerStaticKey: existing.serverStaticKey !== null && existing.serverStaticKey !== undefined
     });
-    if (!existing.meJid && !(await hasValidSignedPreKey(args.logger, existing))) {
+    const skipSignedPreKeyCheck = args.skipSignedPreKeySignatureVerification === true;
+    if (!existing.meJid &&
+        !skipSignedPreKeyCheck &&
+        !(await hasValidSignedPreKey(args.logger, existing))) {
         args.logger.warn('signed pre-key is invalid, regenerating credentials');
         const fresh = await createFreshAndPersistCredentials(args);
         args.logger.info('regenerated credentials due to invalid signed pre-key');
         return fresh;
     }
-    await restoreSignalStore(args.signalStore, existing);
+    await restoreSignalStore(args.signalStore, args.preKeyStore, existing);
     args.logger.trace('auth credentials restored into signal store');
     return existing;
 }
@@ -39,15 +43,72 @@ async function persistCredentials(args, credentials) {
     });
     await args.authStore.save(credentials);
 }
+function mobileTransportFromCredentials(credentials) {
+    if (!credentials.deviceInfo)
+        return undefined;
+    return {
+        deviceInfo: credentials.deviceInfo,
+        ...(credentials.pushName !== undefined ? { pushName: credentials.pushName } : {}),
+        ...(credentials.yearClass !== undefined ? { yearClass: credentials.yearClass } : {}),
+        ...(credentials.memClass !== undefined ? { memClass: credentials.memClass } : {})
+    };
+}
 function buildCommsConfig(logger, credentials, socketOptions, clientOptions) {
     const meJid = credentials.meJid;
     const registered = meJid !== null && meJid !== undefined;
     const loginIdentity = registered ? (0, jid_1.getLoginIdentity)(meJid) : null;
     const wsProxy = socketOptions.proxy?.ws;
+    // Resolve the effective mobile transport: explicit option wins, otherwise
+    // synthesize one from persisted credentials.deviceInfo so a registered
+    // mobile session boots in mobile mode without the caller re-passing
+    // deviceInfo on every `new WaClient(...)` call.
+    const effectiveMobileTransport = clientOptions.mobileTransport ?? mobileTransportFromCredentials(credentials);
     logger.debug('building comms config from credentials', {
         registered,
-        hasServerStaticKey: credentials.serverStaticKey !== null && credentials.serverStaticKey !== undefined
+        hasServerStaticKey: credentials.serverStaticKey !== null && credentials.serverStaticKey !== undefined,
+        mobile: Boolean(effectiveMobileTransport),
+        mobileSource: clientOptions.mobileTransport
+            ? 'option'
+            : effectiveMobileTransport
+                ? 'credentials'
+                : 'none'
     });
+    if (effectiveMobileTransport) {
+        if (wsProxy) {
+            throw new Error('mobileTransport does not support socketOptions.proxy.ws — remove the proxy option or open an issue to add TCP proxy support');
+        }
+        if (!loginIdentity) {
+            throw new Error('mobileTransport requires registered credentials (meJid) — run the mobile bridge flow first');
+        }
+        const loginPayload = (0, WaMobileClientPayload_1.buildMobileLoginPayload)({
+            username: loginIdentity.username,
+            device: loginIdentity.device,
+            passive: effectiveMobileTransport.passive ?? false,
+            deviceInfo: effectiveMobileTransport.deviceInfo,
+            pushName: effectiveMobileTransport.pushName,
+            yearClass: effectiveMobileTransport.yearClass,
+            memClass: effectiveMobileTransport.memClass
+        });
+        return {
+            url: effectiveMobileTransport.tcpUrl ?? 'tcp://g.whatsapp.net:443',
+            rawWebSocketConstructor: WaMobileTcpSocket_1.WaMobileTcpSocketCtor,
+            connectTimeoutMs: socketOptions.connectTimeoutMs,
+            reconnectIntervalMs: socketOptions.reconnectIntervalMs,
+            timeoutIntervalMs: socketOptions.timeoutIntervalMs,
+            maxReconnectAttempts: socketOptions.maxReconnectAttempts,
+            noise: {
+                clientStaticKeyPair: credentials.noiseKeyPair,
+                isRegistered: true,
+                serverStaticKey: credentials.serverStaticKey,
+                routingInfo: credentials.routingInfo,
+                trustedRootCa: clientOptions.noiseTrustedRootCa,
+                verifyCertificateChain: clientOptions.disableNoiseCertificateChainVerification
+                    ? false
+                    : undefined,
+                loginPayload
+            }
+        };
+    }
     return {
         url: socketOptions.url,
         urls: socketOptions.urls,
@@ -63,6 +124,10 @@ function buildCommsConfig(logger, credentials, socketOptions, clientOptions) {
             isRegistered: registered,
             serverStaticKey: credentials.serverStaticKey,
             routingInfo: credentials.routingInfo,
+            trustedRootCa: clientOptions.noiseTrustedRootCa,
+            verifyCertificateChain: clientOptions.disableNoiseCertificateChainVerification
+                ? false
+                : undefined,
             loginPayloadConfig: loginIdentity
                 ? {
                     username: loginIdentity.username,
@@ -85,11 +150,11 @@ function buildCommsConfig(logger, credentials, socketOptions, clientOptions) {
         }
     };
 }
-async function createFreshCredentials(signalStore, logger) {
+async function createFreshCredentials(signalStore, preKeyStore, logger) {
     logger.trace('creating fresh credentials');
     const [noiseKeyPair, registrationBundle, advSecretKey] = await Promise.all([
         X25519_1.X25519.generateKeyPair(),
-        (0, utils_1.createAndStoreInitialKeys)(signalStore),
+        (0, utils_1.createAndStoreInitialKeys)(signalStore, preKeyStore),
         (0, _crypto_1.randomBytesAsync)(32)
     ]);
     return {
@@ -101,16 +166,16 @@ async function createFreshCredentials(signalStore, logger) {
     };
 }
 async function createFreshAndPersistCredentials(args) {
-    const credentials = await createFreshCredentials(args.signalStore, args.logger);
+    const credentials = await createFreshCredentials(args.signalStore, args.preKeyStore, args.logger);
     // Persist credentials first so signal restore never commits state for credentials that failed to save.
     await args.authStore.save(credentials);
-    await restoreSignalStore(args.signalStore, credentials);
+    await restoreSignalStore(args.signalStore, args.preKeyStore, credentials);
     return credentials;
 }
 async function hasValidSignedPreKey(logger, credentials) {
     try {
         const serializedPubKey = (0, keys_1.toSerializedPubKey)(credentials.signedPreKey.keyPair.pubKey);
-        const valid = await (0, WaAdvSignature_1.verifySignalSignature)(credentials.registrationInfo.identityKeyPair.pubKey, serializedPubKey, credentials.signedPreKey.signature);
+        const valid = await (0, _crypto_1.xeddsaVerify)((0, _crypto_1.toRawPubKey)(credentials.registrationInfo.identityKeyPair.pubKey), serializedPubKey, credentials.signedPreKey.signature);
         logger.trace('signed pre-key validation completed', { valid });
         return valid;
     }
@@ -121,10 +186,10 @@ async function hasValidSignedPreKey(logger, credentials) {
         return false;
     }
 }
-async function restoreSignalStore(signalStore, credentials) {
+async function restoreSignalStore(signalStore, preKeyStore, credentials) {
     await Promise.all([
         signalStore.setRegistrationInfo(credentials.registrationInfo),
         signalStore.setSignedPreKey(credentials.signedPreKey),
-        signalStore.setServerHasPreKeys(credentials.serverHasPreKeys === true)
+        preKeyStore.setServerHasPreKeys(credentials.serverHasPreKeys === true)
     ]);
 }

package/dist/auth/pairing/WaPairingFlow.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WaPairingFlow = void 0;
-const WaPairingCodeCrypto_1 = require("../pairing/WaPairingCodeCrypto");
+const pairing_code_crypto_1 = require("../pairing/pairing-code-crypto");
 const _crypto_1 = require("../../crypto/index.js");
 const _proto_1 = require("../../proto.js");
+const browser_1 = require("../../protocol/browser");
 const constants_1 = require("../../protocol/constants");
 const jid_1 = require("../../protocol/jid");
 const WaAdvSignature_1 = require("../../signal/crypto/WaAdvSignature");
@@ -11,7 +12,6 @@ const global_1 = require("../../transport/node/builders/global");
 const pairing_1 = require("../../transport/node/builders/pairing");
 const helpers_1 = require("../../transport/node/helpers");
 const bytes_1 = require("../../util/bytes");
-const bytes_2 = require("../../util/bytes");
 class WaPairingFlow {
     constructor(options) {
         this.opts = options;
@@ -24,26 +24,19 @@ class WaPairingFlow {
         this.opts.logger.trace('pairing flow session cleared');
         this.pairingSession = null;
     }
-    async requestPairingCode(phoneNumber, shouldShowPushNotification = false) {
+    async requestPairingCode(phoneNumber, shouldShowPushNotification = false, customCode) {
         this.opts.logger.info('requesting pairing code', {
-            shouldShowPushNotification
+            shouldShowPushNotification,
+            hasCustomCode: customCode !== undefined
         });
+        const normalizedCustomCode = customCode !== undefined ? (0, pairing_code_crypto_1.normalizeCustomPairingCode)(customCode) : undefined;
         const credentials = this.requireCredentials();
         const phoneJid = (0, jid_1.parsePhoneJid)(phoneNumber);
         const [companionHello, refreshedCredentials] = await Promise.all([
-            (0, WaPairingCodeCrypto_1.createCompanionHello)(),
+            (0, pairing_code_crypto_1.createCompanionHello)({ customCode: normalizedCustomCode }),
             this.rotateAdvSecret(credentials)
         ]);
-        const browser = this.opts.device.browser;
-        const browserDisplayName = {
-            chrome: 'Chrome',
-            firefox: 'Firefox',
-            ie: 'IE',
-            opera: 'Opera',
-            safari: 'Safari',
-            edge: 'Edge',
-            chromium: 'Chromium'
-        }[browser.trim().toLowerCase()] ?? browser;
+        const browserDisplayName = (0, browser_1.getWaBrowserDisplayName)(this.opts.device.browser);
         const response = await this.opts.socket.query((0, pairing_1.buildCompanionHelloRequestNode)({
             phoneJid,
             shouldShowPushNotification,
@@ -133,7 +126,7 @@ class WaPairingFlow {
                 return true;
             }
             const ref = (0, helpers_1.decodeNodeContentUtf8OrBytes)(refNode.content, 'refresh_code.link_code_pairing_ref');
-            if ((0, bytes_2.uint8Equal)(ref, this.pairingSession.ref)) {
+            if ((0, bytes_1.uint8Equal)(ref, this.pairingSession.ref)) {
                 this.opts.logger.info('received pairing refresh notification', {
                     forceManualRefresh: linkCodeNode.attrs.force_manual_refresh === 'true'
                 });
@@ -189,13 +182,15 @@ class WaPairingFlow {
         const wrappedHmac = (0, bytes_1.decodeProtoBytes)(wrappedIdentity.hmac, 'ADVSignedDeviceIdentityHMAC.hmac');
         const accountType = wrappedIdentity.accountType ?? _proto_1.proto.ADVEncryptionType.E2EE;
         const isHosted = accountType === _proto_1.proto.ADVEncryptionType.HOSTED;
-        const hmacInput = isHosted
-            ? (0, bytes_2.concatBytes)([WaAdvSignature_1.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, wrappedDetails])
-            : wrappedDetails;
-        const expectedHmac = await (0, WaAdvSignature_1.computeAdvIdentityHmac)(credentials.advSecretKey, hmacInput);
-        if (!(0, bytes_2.uint8Equal)(expectedHmac, wrappedHmac)) {
-            this.opts.logger.error('pair-success hmac mismatch');
-            throw new Error('pair-success HMAC validation failed');
+        if (this.opts.dangerous?.disablePairSuccessHmacVerification !== true) {
+            const hmacInput = isHosted
+                ? (0, bytes_1.concatBytes)([WaAdvSignature_1.ADV_PREFIX_HOSTED_ACCOUNT_SIGNATURE, wrappedDetails])
+                : wrappedDetails;
+            const expectedHmac = await (0, WaAdvSignature_1.computeAdvIdentityHmac)(credentials.advSecretKey, hmacInput);
+            if (!(0, bytes_1.uint8Equal)(expectedHmac, wrappedHmac)) {
+                this.opts.logger.error('pair-success hmac mismatch');
+                throw new Error('pair-success HMAC validation failed');
+            }
         }
         const { signedIdentity, keyIndex, responseIdentityBytes } = await this.buildPairSuccessResponseIdentity(credentials, wrappedDetails, isHosted);
         const nextCredentials = {
@@ -244,10 +239,12 @@ class WaPairingFlow {
         const accountSignature = (0, bytes_1.decodeProtoBytes)(signedIdentity.accountSignature, 'ADVSignedDeviceIdentity.accountSignature');
         const accountSignatureKey = (0, bytes_1.decodeProtoBytes)(signedIdentity.accountSignatureKey, 'ADVSignedDeviceIdentity.accountSignatureKey');
         const localIdentity = credentials.registrationInfo.identityKeyPair;
-        const validAccountSignature = await (0, WaAdvSignature_1.verifyDeviceIdentityAccountSignature)(details, accountSignature, localIdentity.pubKey, accountSignatureKey, isHosted);
-        if (!validAccountSignature) {
-            this.opts.logger.error('pair-success account signature invalid');
-            throw new Error('pair-success account signature validation failed');
+        if (this.opts.dangerous?.disableAdvSignatureVerification !== true) {
+            const validAccountSignature = await (0, WaAdvSignature_1.verifyDeviceIdentityAccountSignature)(details, accountSignature, localIdentity.pubKey, accountSignatureKey, isHosted);
+            if (!validAccountSignature) {
+                this.opts.logger.error('pair-success account signature invalid');
+                throw new Error('pair-success account signature validation failed');
+            }
         }
         signedIdentity.deviceSignature = await (0, WaAdvSignature_1.generateDeviceSignature)(details, localIdentity, accountSignatureKey, isHosted);
         const advDeviceIdentity = _proto_1.proto.ADVDeviceIdentity.decode(details);
@@ -285,7 +282,7 @@ class WaPairingFlow {
             throw new Error('primary_hello notification is missing fields');
         }
         const ref = (0, helpers_1.decodeNodeContentUtf8OrBytes)(refNode.content, 'primary_hello.link_code_pairing_ref');
-        if (!pairingSession.ref || !(0, bytes_2.uint8Equal)(ref, pairingSession.ref)) {
+        if (!pairingSession.ref || !(0, bytes_1.uint8Equal)(ref, pairingSession.ref)) {
             this.opts.logger.warn('primary_hello ref mismatch ignored');
             return;
         }
@@ -294,7 +291,7 @@ class WaPairingFlow {
             constants_1.WA_DEFAULTS.PAIRING_CODE_MAX_AGE_SECONDS) {
             throw new Error('primary_hello received for an expired pairing code');
         }
-        const finish = await (0, WaPairingCodeCrypto_1.completeCompanionFinish)({
+        const finish = await (0, pairing_code_crypto_1.completeCompanionFinish)({
             pairingCode: pairingSession.pairingCode,
             wrappedPrimaryEphemeralPub: (0, helpers_1.decodeNodeContentUtf8OrBytes)(wrappedPrimaryNode.content, 'primary_hello.link_code_pairing_wrapped_primary_ephemeral_pub'),
             primaryIdentityPub: (0, helpers_1.decodeNodeContentUtf8OrBytes)(primaryIdentityNode.content, 'primary_hello.primary_identity_pub'),

package/dist/auth/pairing/{WaPairingCodeCrypto.js → pairing-code-crypto.js}

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.PBKDF2_ITERATIONS = exports.CROCKFORD_ALPHABET = void 0;
+exports.normalizeCustomPairingCode = normalizeCustomPairingCode;
 exports.createCompanionHello = createCompanionHello;
 exports.completeCompanionFinish = completeCompanionFinish;
-const constants_1 = require("../pairing/constants");
 const _crypto_1 = require("../../crypto/index.js");
 const X25519_1 = require("../../crypto/curves/X25519");
-const constants_2 = require("../../protocol/constants");
+const constants_1 = require("../../protocol/constants");
 const bytes_1 = require("../../util/bytes");
+exports.CROCKFORD_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTVWXYZ';
+exports.PBKDF2_ITERATIONS = 2 << 16;
 function bytesToCrockford(bytes) {
     let bitCount = 0;
     let value = 0;
@@ -15,24 +18,37 @@ function bytesToCrockford(bytes) {
         value = (value << 8) | bytes[i];
         bitCount += 8;
         while (bitCount >= 5) {
-            out += constants_1.CROCKFORD_ALPHABET[(value >>> (bitCount - 5)) & 31];
+            out += exports.CROCKFORD_ALPHABET[(value >>> (bitCount - 5)) & 31];
             bitCount -= 5;
         }
     }
     if (bitCount > 0) {
-        out += constants_1.CROCKFORD_ALPHABET[(value << (5 - bitCount)) & 31];
+        out += exports.CROCKFORD_ALPHABET[(value << (5 - bitCount)) & 31];
     }
     return out;
 }
-async function createCompanionHello() {
-    const [codeBytes, companionEphemeralKeyPair, salt, counter] = await Promise.all([
-        (0, _crypto_1.randomBytesAsync)(5),
+function normalizeCustomPairingCode(input) {
+    const stripped = input.replace(/-/g, '').toUpperCase();
+    if (stripped.length !== 8) {
+        throw new Error(`custom pairing code must be 8 characters, got ${stripped.length}`);
+    }
+    for (let i = 0; i < stripped.length; i += 1) {
+        if (exports.CROCKFORD_ALPHABET.indexOf(stripped[i]) < 0) {
+            throw new Error(`custom pairing code contains invalid character "${stripped[i]}" (allowed: ${exports.CROCKFORD_ALPHABET})`);
+        }
+    }
+    return stripped;
+}
+async function createCompanionHello(options = {}) {
+    const normalizedCustomCode = options.customCode !== undefined ? normalizeCustomPairingCode(options.customCode) : null;
+    const [companionEphemeralKeyPair, salt, counter, codeBytes] = await Promise.all([
         X25519_1.X25519.generateKeyPair(),
         (0, _crypto_1.randomBytesAsync)(32),
-        (0, _crypto_1.randomBytesAsync)(16)
+        (0, _crypto_1.randomBytesAsync)(16),
+        normalizedCustomCode !== null ? Promise.resolve(null) : (0, _crypto_1.randomBytesAsync)(5)
     ]);
-    const pairingCode = bytesToCrockford(codeBytes);
-    const cipher = await (0, _crypto_1.pbkdf2DeriveAesCtrKey)(bytes_1.TEXT_ENCODER.encode(pairingCode), salt, constants_1.PBKDF2_ITERATIONS);
+    const pairingCode = normalizedCustomCode ?? bytesToCrockford(codeBytes);
+    const cipher = await (0, _crypto_1.pbkdf2DeriveAesCtrKey)(bytes_1.TEXT_ENCODER.encode(pairingCode), salt, exports.PBKDF2_ITERATIONS);
     const encrypted = await (0, _crypto_1.aesCtrEncrypt)(cipher, counter, companionEphemeralKeyPair.pubKey);
     return {
         pairingCode,
@@ -44,7 +60,7 @@ async function completeCompanionFinish(args) {
     if (args.wrappedPrimaryEphemeralPub.length <= 48) {
         throw new Error('invalid wrapped primary payload');
     }
-    const pairingCipher = await (0, _crypto_1.pbkdf2DeriveAesCtrKey)(bytes_1.TEXT_ENCODER.encode(args.pairingCode), args.wrappedPrimaryEphemeralPub.subarray(0, 32), constants_1.PBKDF2_ITERATIONS);
+    const pairingCipher = await (0, _crypto_1.pbkdf2DeriveAesCtrKey)(bytes_1.TEXT_ENCODER.encode(args.pairingCode), args.wrappedPrimaryEphemeralPub.subarray(0, 32), exports.PBKDF2_ITERATIONS);
     const primaryEphemeralPub = await (0, _crypto_1.aesCtrDecrypt)(pairingCipher, args.wrappedPrimaryEphemeralPub.subarray(32, 48), args.wrappedPrimaryEphemeralPub.subarray(48));
     if (primaryEphemeralPub.length === 0) {
         throw new Error('empty primary ephemeral public key');
@@ -55,7 +71,7 @@ async function completeCompanionFinish(args) {
         (0, _crypto_1.randomBytesAsync)(32),
         (0, _crypto_1.randomBytesAsync)(12)
     ]);
-    const bundleEncryptionKeyRaw = await (0, _crypto_1.hkdf)(sharedEphemeral, bundleSalt, constants_2.WA_PAIRING_KDF_INFO.LINK_CODE_BUNDLE, 32);
+    const bundleEncryptionKeyRaw = await (0, _crypto_1.hkdf)(sharedEphemeral, bundleSalt, constants_1.WA_PAIRING_KDF_INFO.LINK_CODE_BUNDLE, 32);
     const bundleEncryptionKey = await (0, _crypto_1.importAesGcmKey)(bundleEncryptionKeyRaw, ['encrypt']);
     const plaintextBundle = (0, bytes_1.concatBytes)([
         args.registrationIdentityKeyPair.pubKey,
@@ -68,7 +84,7 @@ async function completeCompanionFinish(args) {
     ]);
     const wrappedKeyBundle = (0, bytes_1.concatBytes)([bundleSalt, bundleIv, encryptedBundle]);
     const advMaterial = (0, bytes_1.concatBytes)([sharedEphemeral, sharedIdentity, bundleSecret]);
-    const advSecret = await (0, _crypto_1.hkdf)(advMaterial, null, constants_2.WA_PAIRING_KDF_INFO.ADV_SECRET, 32);
+    const advSecret = await (0, _crypto_1.hkdf)(advMaterial, null, constants_1.WA_PAIRING_KDF_INFO.ADV_SECRET, 32);
     return {
         wrappedKeyBundle,
         companionIdentityPublic: args.registrationIdentityKeyPair.pubKey,