3.45.2

Fix: New rate limit rule from steam

.idea/codeStyles/Project.xml

@@ -1,8 +1,5 @@
 <component name="ProjectCodeStyleConfiguration">
   <code_scheme name="Project" version="173">
-    <XML>
-      <option name="XML_LEGACY_SETTINGS_IMPORTED" value="true" />
-    </XML>
     <codeStyleSettings language="JSON">
       <indentOptions>
         <option name="USE_TAB_CHARACTER" value="true" />

.idea/codeStyles/codeStyleConfig.xml

@@ -1,5 +1,6 @@
 <component name="ProjectCodeStyleConfiguration">
   <state>
+    <option name="USE_PER_PROJECT_SETTINGS" value="true" />
     <option name="PREFERRED_PROJECT_CODE_STYLE" value="Default" />
   </state>
 </component>

.idea/modules.xml

@@ -2,6 +2,7 @@
 <project version="4">
   <component name="ProjectModuleManager">
     <modules>
+      <module fileurl="file://$PROJECT_DIR$/../node-steamcommunity Wiki/.idea/node-steamcommunity Wiki.iml" filepath="$PROJECT_DIR$/../node-steamcommunity Wiki/.idea/node-steamcommunity Wiki.iml" />
       <module fileurl="file://$PROJECT_DIR$/.idea/steamcommunity.iml" filepath="$PROJECT_DIR$/.idea/steamcommunity.iml" />
     </modules>
   </component>

.idea/steamcommunity.iml

@@ -5,5 +5,6 @@
     <content url="file://$MODULE_DIR$" />
     <orderEntry type="inheritedJdk" />
     <orderEntry type="sourceFolder" forTests="false" />
+    <orderEntry type="module" module-name="node-steamcommunity Wiki" />
   </component>
 </module>

.idea/vcs.xml

@@ -2,5 +2,6 @@
 <project version="4">
   <component name="VcsDirectoryMappings">
     <mapping directory="" vcs="Git" />
+    <mapping directory="$PROJECT_DIR$/../node-steamcommunity Wiki" vcs="Git" />
   </component>
 </project>

classes/CConfirmation.js

@@ -3,7 +3,7 @@ var SteamCommunity = require('../index.js');
 module.exports = CConfirmation;
 
 function CConfirmation(community, data) {
-	Object.defineProperty(this, "_community", {"value": community});
+	Object.defineProperty(this, '_community', {value: community});
 
 	this.id = data.id.toString();
 	this.type = data.type;
@@ -11,7 +11,9 @@ function CConfirmation(community, data) {
 	this.key = data.key;
 	this.title = data.title;
 	this.receiving = data.receiving;
+	this.sending = data.sending;
 	this.time = data.time;
+	this.timestamp = data.timestamp;
 	this.icon = data.icon;
 	this.offerID = this.type == SteamCommunity.ConfirmationType.Trade ? this.creator : null;
 }
@@ -19,7 +21,7 @@ function CConfirmation(community, data) {
 CConfirmation.prototype.getOfferID = function(time, key, callback) {
 	if (this.type && this.creator) {
 		if (this.type != SteamCommunity.ConfirmationType.Trade) {
-			callback(new Error("Not a trade confirmation"));
+			callback(new Error('Not a trade confirmation'));
 			return;
 		}
 

components/confirmations.js

@@ -4,63 +4,55 @@ var SteamTotp = require('steam-totp');
 var Async = require('async');
 
 var CConfirmation = require('../classes/CConfirmation.js');
+var EConfirmationType = require('../resources/EConfirmationType.js');
 
 /**
  * Get a list of your account's currently outstanding confirmations.
  * @param {int} time - The unix timestamp with which the following key was generated
- * @param {string} key - The confirmation key that was generated using the preceeding time and the tag "conf" (this key can be reused)
+ * @param {string} key - The confirmation key that was generated using the preceeding time and the tag 'conf' (this key can be reused)
  * @param {SteamCommunity~getConfirmations} callback - Called when the list of confirmations is received
  */
 SteamCommunity.prototype.getConfirmations = function(time, key, callback) {
 	var self = this;
 
-	request(this, "conf", key, time, "conf", null, false, function(err, body) {
-		if(err) {
-			if (err.message == "Invalid protocol: steammobile:") {
-				err.message = "Not Logged In";
-				self._notifySessionExpired(err);
-			}
+	// Ugly hack to maintain backward compatibility
+	var tag = 'conf';
+	if (typeof key == 'object') {
+		tag = key.tag;
+		key = key.key;
+	}
 
+	// The official Steam app uses the tag 'list', but 'conf' still works so let's use that for backward compatibility.
+	request(this, 'getlist', key, time, tag, null, true, function(err, body) {
+		if (err) {
 			callback(err);
 			return;
 		}
 
-		var $ = Cheerio.load(body);
-		var empty = $('#mobileconf_empty');
-		if(empty.length > 0) {
-			if(!$(empty).hasClass('mobileconf_done')) {
-				// An error occurred
-				callback(new Error(empty.find('div:nth-of-type(2)').text()));
-			} else {
-				callback(null, []);
+		if (!body.success) {
+			if (body.needauth) {
+				var err = new Error('Not Logged In');
+				self._notifySessionExpired(err);
+				callback(err);
+				return;
 			}
 
+			callback(new Error('Failed to get confirmation list'));
 			return;
 		}
 
-		// We have something to confirm
-		var confirmations = $('#mobileconf_list');
-		if(!confirmations) {
-			callback(new Error("Malformed response"));
-			return;
-		}
-
-		var confs = [];
-		Array.prototype.forEach.call(confirmations.find('.mobileconf_list_entry'), function(conf) {
-			conf = $(conf);
-
-			var img = conf.find('.mobileconf_list_entry_icon img');
-			confs.push(new CConfirmation(self, {
-				"id": conf.data('confid'),
-				"type": conf.data('type'),
-				"creator": conf.data('creator'),
-				"key": conf.data('key'),
-				"title": conf.find('.mobileconf_list_entry_description>div:nth-of-type(1)').text().trim(),
-				"receiving": conf.find('.mobileconf_list_entry_description>div:nth-of-type(2)').text().trim(),
-				"time": conf.find('.mobileconf_list_entry_description>div:nth-of-type(3)').text().trim(),
-				"icon": img.length < 1 ? '' : $(img).attr('src')
-			}));
-		});
+		var confs = (body.conf || []).map(conf => new CConfirmation(self, {
+			id: conf.id,
+			type: conf.type,
+			creator: conf.creator_id,
+			key: conf.nonce,
+			title: `${conf.type_name || 'Confirm'} - ${conf.headline || ''}`,
+			receiving: conf.type == EConfirmationType.Trade ? ((conf.summary || [])[1] || '') : '',
+			sending: (conf.summary || [])[0] || '',
+			time: (new Date(conf.creation_time * 1000)).toISOString(), // for backward compatibility
+			timestamp: new Date(conf.creation_time * 1000),
+			icon: conf.icon || ''
+		}));
 
 		callback(null, confs);
 	});
@@ -76,22 +68,23 @@ SteamCommunity.prototype.getConfirmations = function(time, key, callback) {
  * Get the trade offer ID associated with a particular confirmation
  * @param {int} confID - The ID of the confirmation in question
  * @param {int} time - The unix timestamp with which the following key was generated
- * @param {string} key - The confirmation key that was generated using the preceeding time and the tag "details" (this key can be reused)
+ * @param {string} key - The confirmation key that was generated using the preceeding time and the tag "detail" (this key can be reused)
  * @param {SteamCommunity~getConfirmationOfferID} callback
  */
 SteamCommunity.prototype.getConfirmationOfferID = function(confID, time, key, callback) {
-	request(this, "details/" + confID, key, time, "details", null, true, function(err, body) {
-		if(err) {
+	// The official Steam app uses the tag 'detail', but 'details' still works so let's use that for backward compatibility
+	request(this, 'detailspage/' + confID, key, time, 'details', null, false, function(err, body) {
+		if (err) {
 			callback(err);
 			return;
 		}
 
-		if(!body.success) {
+		if (typeof body != 'string') {
 			callback(new Error("Cannot load confirmation details"));
 			return;
 		}
 
-		var $ = Cheerio.load(body.html);
+		var $ = Cheerio.load(body);
 		var offer = $('.tradeoffer');
 		if(offer.length < 1) {
 			callback(null, null);
@@ -118,31 +111,39 @@ SteamCommunity.prototype.getConfirmationOfferID = function(confID, time, key, ca
  * @param {SteamCommunity~genericErrorCallback} callback - Called when the request is complete
  */
 SteamCommunity.prototype.respondToConfirmation = function(confID, confKey, time, key, accept, callback) {
-	request(this, (confID instanceof Array) ? "multiajaxop" : "ajaxop", key, time, accept ? "allow" : "cancel", {
-		"op": accept ? "allow" : "cancel",
-		"cid": confID,
-		"ck": confKey
+	// Ugly hack to maintain backward compatibility
+	var tag = accept ? 'allow' : 'cancel';
+	if (typeof key == 'object') {
+		tag = key.tag;
+		key = key.key;
+	}
+
+	// The official app uses tags reject/accept, but cancel/allow still works so use these for backward compatibility
+	request(this, (confID instanceof Array) ? 'multiajaxop' : 'ajaxop', key, time, tag, {
+		op: accept ? 'allow' : 'cancel',
+		cid: confID,
+		ck: confKey
 	}, true, function(err, body) {
-		if(!callback) {
+		if (!callback) {
 			return;
 		}
 
-		if(err) {
+		if (err) {
 			callback(err);
 			return;
 		}
 
-		if(body.success) {
+		if (body.success) {
 			callback(null);
 			return;
 		}
 
-		if(body.message) {
+		if (body.message) {
 			callback(new Error(body.message));
 			return;
 		}
 
-		callback(new Error("Could not act on confirmation"));
+		callback(new Error('Could not act on confirmation'));
 	});
 };
 
@@ -179,7 +180,8 @@ SteamCommunity.prototype.acceptConfirmationForObject = function(identitySecret,
 	function doConfirmation() {
 		var offset = self._timeOffset;
 		var time = SteamTotp.time(offset);
-		self.getConfirmations(time, SteamTotp.getConfirmationKey(identitySecret, time, "conf"), function(err, confs) {
+		var confKey = SteamTotp.getConfirmationKey(identitySecret, time, 'list');
+		self.getConfirmations(time, {tag: 'list', key: confKey}, function(err, confs) {
 			if (err) {
 				callback(err);
 				return;
@@ -187,7 +189,7 @@ SteamCommunity.prototype.acceptConfirmationForObject = function(identitySecret,
 
 			var conf = confs.filter(function(conf) { return conf.creator == objectID; });
 			if (conf.length == 0) {
-				callback(new Error("Could not find confirmation for object " + objectID));
+				callback(new Error('Could not find confirmation for object ' + objectID));
 				return;
 			}
 
@@ -204,7 +206,8 @@ SteamCommunity.prototype.acceptConfirmationForObject = function(identitySecret,
 				self._usedConfTimes.splice(0, self._usedConfTimes.length - 60); // we don't need to save more than 60 entries
 			}
 
-			conf.respond(time, SteamTotp.getConfirmationKey(identitySecret, time, "allow"), true, callback);
+			confKey = SteamTotp.getConfirmationKey(identitySecret, time, 'accept');
+			conf.respond(time, {tag: 'accept', key: confKey}, true, callback);
 		});
 	}
 };
@@ -244,7 +247,7 @@ SteamCommunity.prototype.acceptAllConfirmations = function(time, confKey, allowK
 
 function request(community, url, key, time, tag, params, json, callback) {
 	if (!community.steamID) {
-		throw new Error("Must be logged in before trying to do anything with confirmations");
+		throw new Error('Must be logged in before trying to do anything with confirmations');
 	}
 
 	params = params || {};
@@ -252,16 +255,16 @@ function request(community, url, key, time, tag, params, json, callback) {
 	params.a = community.steamID.getSteamID64();
 	params.k = key;
 	params.t = time;
-	params.m = "android";
+	params.m = 'react';
 	params.tag = tag;
 
 	var req = {
-		"method": url == 'multiajaxop' ? 'POST' : 'GET',
-		"uri": "https://steamcommunity.com/mobileconf/" + url,
-		"json": !!json
+		method: url == 'multiajaxop' ? 'POST' : 'GET',
+		uri: 'https://steamcommunity.com/mobileconf/' + url,
+		json: !!json
 	};
 
-	if (req.method == "GET") {
+	if (req.method == 'GET') {
 		req.qs = params;
 	} else {
 		req.form = params;
@@ -274,7 +277,7 @@ function request(community, url, key, time, tag, params, json, callback) {
 		}
 
 		callback(null, body);
-	}, "steamcommunity");
+	}, 'steamcommunity');
 }
 
 // Confirmation checker

components/help.js

@@ -2,6 +2,8 @@ const SteamCommunity = require('../index.js');
 
 const Helpers = require('./helpers.js');
 
+const HELP_SITE_DOMAIN = 'https://help.steampowered.com';
+
 /**
  * Restore a previously removed steam package from your steam account.
  * @param {int|string} packageID
@@ -9,26 +11,14 @@ const Helpers = require('./helpers.js');
  */
 SteamCommunity.prototype.restorePackage = function(packageID, callback) {
 	this.httpRequestPost({
-		"uri": "https://help.steampowered.com/wizard/AjaxDoPackageRestore",
-		"form": {
-			"packageid": packageID,
-			"sessionid": this.getSessionID('https://help.steampowered.com'),
-			"wizard_ajax": 1
+		uri: HELP_SITE_DOMAIN + '/wizard/AjaxDoPackageRestore',
+		form: {
+			packageid: packageID,
+			sessionid: this.getSessionID(HELP_SITE_DOMAIN),
+			wizard_ajax: 1
 		},
-		"json": true
-	}, (err, res, body) => {
-		if (err) {
-			callback(err);
-			return;
-		}
-
-		if (!body.success) {
-			callback(body.errorMsg ? new Error(body.errorMsg) : Helpers.eresultError(body.success));
-			return;
-		}
-
-		callback(null);
-	});
+		json: true
+	}, wizardAjaxHandler(callback));
 };
 
 /**
@@ -38,14 +28,27 @@ SteamCommunity.prototype.restorePackage = function(packageID, callback) {
  */
 SteamCommunity.prototype.removePackage = function(packageID, callback) {
 	this.httpRequestPost({
-		"uri": "https://help.steampowered.com/wizard/AjaxDoPackageRemove",
-		"form": {
-			"packageid": packageID,
-			"sessionid": this.getSessionID('https://help.steampowered.com'),
-			"wizard_ajax": 1
+		uri: HELP_SITE_DOMAIN + '/wizard/AjaxDoPackageRemove',
+		form: {
+			packageid: packageID,
+			sessionid: this.getSessionID(HELP_SITE_DOMAIN),
+			wizard_ajax: 1
 		},
-		"json": true
-	}, (err, res, body) => {
+		json: true
+	}, wizardAjaxHandler(callback));
+};
+
+/**
+ * Returns a handler for wizard ajax HTTP requests.
+ * @param {function} callback
+ * @returns {(function(*=, *, *): void)|*}
+ */
+function wizardAjaxHandler(callback) {
+	return (err, res, body) => {
+		if (!callback) {
+			return;
+		}
+
 		if (err) {
 			callback(err);
 			return;
@@ -57,5 +60,5 @@ SteamCommunity.prototype.removePackage = function(packageID, callback) {
 		}
 
 		callback(null);
-	});
-};
+	};
+}

components/helpers.js

@@ -54,3 +54,15 @@ exports.eresultError = function(eresult) {
 	err.eresult = eresult;
 	return err;
 };
+
+exports.decodeJwt = function(jwt) {
+	let parts = jwt.split('.');
+	if (parts.length != 3) {
+		throw new Error('Invalid JWT');
+	}
+
+	let standardBase64 = parts[1].replace(/-/g, '+')
+		.replace(/_/g, '/');
+
+	return JSON.parse(Buffer.from(standardBase64, 'base64').toString('utf8'));
+}

components/http.js

@@ -124,7 +124,7 @@ SteamCommunity.prototype._checkCommunityError = function(html, callback) {
 		return err;
 	}
 
-	if (typeof html === 'string' && html.match(/g_steamID = false;/) && html.match(/<h1>Sign In<\/h1>/)) {
+	if (typeof html === 'string' && html.indexOf('g_steamID = false;') > -1 && html.indexOf('<title>Sign In</title>') > -1) {
 		err = new Error("Not Logged In");
 		callback(err);
 		this._notifySessionExpired(err);

components/market.js

@@ -148,6 +148,124 @@ SteamCommunity.prototype.openBoosterPack = function(appid, assetid, callback) {
 	})
 };
 
+/**
+ * Get the booster pack catalog to see what booster packs you can create
+ * @param {function} callback
+ */
+SteamCommunity.prototype.getBoosterPackCatalog = function(callback) {
+	this.httpRequestGet('https://steamcommunity.com/tradingcards/boostercreator/', (err, res, body) => {
+		if (err) {
+			callback(err);
+			return;
+		}
+
+		let idx = body.indexOf('CBoosterCreatorPage.Init(');
+		if (idx == -1) {
+			callback(new Error('Malformed response'));
+			return;
+		}
+
+		let lines = body.slice(idx).split('\n').map(l => l.trim());
+
+		for (let i = 1; i <= 4; i++) {
+			if (typeof lines[i] != 'string' || !lines[i].match(/,$/)) {
+				let err = new Error('Malformed response');
+				err.line = i;
+				callback(err);
+				return;
+			}
+
+			lines[i] = lines[i].replace(/,$/, '');
+		}
+
+		let boosterPackCatalog, totalGems, tradableGems, untradableGems;
+		try {
+			boosterPackCatalog = JSON.parse(lines[1]);
+			totalGems = parseInt(lines[2].match(/\d+/)[0], 10);
+			tradableGems = parseInt(lines[3].match(/\d+/)[0], 10);
+			untradableGems = parseInt(lines[4].match(/\d+/)[0], 10);
+		} catch (ex) {
+			let err = new Error('Malformed response');
+			err.inner = ex;
+			callback(err);
+			return;
+		}
+
+		let keyedCatalog = {};
+		boosterPackCatalog.forEach((app) => {
+			app.price = parseInt(app.price, 10);
+			app.unavailable = app.unavailable || false;
+			app.availableAtTime = app.available_at_time || null;
+
+			if (typeof app.availableAtTime == 'string') {
+				app.availableAtTime = Helpers.decodeSteamTime(app.availableAtTime);
+			}
+
+			delete app.available_at_time;
+
+			keyedCatalog[app.appid] = app;
+		});
+
+		callback(null, {
+			totalGems,
+			tradableGems,
+			untradableGems,
+			catalog: keyedCatalog
+		});
+	});
+};
+
+/**
+ * Create a booster pack using gems.
+ * @param {int} appid
+ * @param {boolean} [useUntradableGems=false]
+ * @param callback
+ */
+SteamCommunity.prototype.createBoosterPack = function(appid, useUntradableGems, callback) {
+	if (typeof useUntradableGems == 'function') {
+		callback = useUntradableGems;
+		useUntradableGems = false;
+	}
+
+	this.httpRequestPost({
+		uri: 'https://steamcommunity.com/tradingcards/ajaxcreatebooster/',
+		form: {
+			sessionid: this.getSessionID(),
+			appid,
+			series: 1,
+			// tradability_preference can be a value 1-3
+			// 1: Prefer using tradable gems, but use untradable if necessary
+			// 2: Only use tradable gems
+			// 3: Prefer using untradable gems, but use tradable if necessary
+			tradability_preference: useUntradableGems ? 3 : 2
+		},
+		json: true,
+		checkHttpError: false
+	}, (err, res, body) => {
+		if (err) {
+			callback(err);
+			return;
+		}
+
+		if (body.purchase_eresult && body.purchase_eresult != 1) {
+			callback(Helpers.eresultError(body.purchase_eresult));
+			return;
+		}
+
+		// We can now check HTTP status codes
+		if (this._checkHttpError(err, res, callback, body)) {
+			return;
+		}
+
+		callback(null, {
+			totalGems: parseInt(body.goo_amount, 10),
+			tradableGems: parseInt(body.tradable_goo_amount, 10),
+			untradableGems: parseInt(body.untradable_goo_amount, 10),
+			resultItem: body.purchase_result
+		});
+	});
+};
+
 /**
  * Get details about a gift in your inventory.
  * @param {string} giftID

components/twofactor.js

@@ -2,158 +2,151 @@ var SteamTotp = require('steam-totp');
 var SteamCommunity = require('../index.js');
 
 var ETwoFactorTokenType = {
-	"None": 0,                  // No token-based two-factor authentication
-	"ValveMobileApp": 1,        // Tokens generated using Valve's special charset (5 digits, alphanumeric)
-	"ThirdParty": 2             // Tokens generated using literally everyone else's standard charset (6 digits, numeric). This is disabled.
+	None: 0,                  // No token-based two-factor authentication
+	ValveMobileApp: 1,        // Tokens generated using Valve's special charset (5 digits, alphanumeric)
+	ThirdParty: 2             // Tokens generated using literally everyone else's standard charset (6 digits, numeric). This is disabled.
 };
 
 SteamCommunity.prototype.enableTwoFactor = function(callback) {
-	var self = this;
+	this._verifyMobileAccessToken();
 
-	this.getWebApiOauthToken(function(err, token) {
-		if(err) {
+	if (!this.mobileAccessToken) {
+		callback(new Error('No mobile access token available. Provide one by calling setMobileAppAccessToken()'));
+		return;
+	}
+
+	this.httpRequestPost({
+		uri: "https://api.steampowered.com/ITwoFactorService/AddAuthenticator/v1/?access_token=" + this.mobileAccessToken,
+		// TODO: Send this as protobuf to more closely mimic official app behavior
+		form: {
+			steamid: this.steamID.getSteamID64(),
+			authenticator_time: Math.floor(Date.now() / 1000),
+			authenticator_type: ETwoFactorTokenType.ValveMobileApp,
+			device_identifier: SteamTotp.getDeviceID(this.steamID),
+			sms_phone_id: '1'
+		},
+		json: true
+	}, (err, response, body) => {
+		if (err) {
 			callback(err);
 			return;
 		}
 
-		self.httpRequestPost({
-			"uri": "https://api.steampowered.com/ITwoFactorService/AddAuthenticator/v1/",
-			"form": {
-				"steamid": self.steamID.getSteamID64(),
-				"access_token": token,
-				"authenticator_time": Math.floor(Date.now() / 1000),
-				"authenticator_type": ETwoFactorTokenType.ValveMobileApp,
-				"device_identifier": SteamTotp.getDeviceID(self.steamID),
-				"sms_phone_id": "1"
-			},
-			"json": true
-		}, function(err, response, body) {
-			if (err) {
-				callback(err);
-				return;
-			}
+		if (!body.response) {
+			callback(new Error('Malformed response'));
+			return;
+		}
 
-			if(!body.response) {
-				callback(new Error("Malformed response"));
-				return;
-			}
+		if (body.response.status != 1) {
+			var error = new Error('Error ' + body.response.status);
+			error.eresult = body.response.status;
+			callback(error);
+			return;
+		}
 
-			if(body.response.status != 1) {
-				var error = new Error("Error " + body.response.status);
-				error.eresult = body.response.status;
-				callback(error);
-				return;
-			}
-
-			callback(null, body.response);
-		}, "steamcommunity");
-	});
+		callback(null, body.response);
+	}, 'steamcommunity');
 };
 
 SteamCommunity.prototype.finalizeTwoFactor = function(secret, activationCode, callback) {
-	var attemptsLeft = 30;
-	var diff = 0;
+	this._verifyMobileAccessToken();
 
-	var self = this;
-	this.getWebApiOauthToken(function(err, token) {
-		if(err) {
-			callback(err);
-			return;
-		}
+	if (!this.mobileAccessToken) {
+		callback(new Error('No mobile access token available. Provide one by calling setMobileAppAccessToken()'));
+		return;
+	}
 
-		SteamTotp.getTimeOffset(function(err, offset, latency) {
-			if (err) {
-				callback(err);
-				return;
-			}
+	let attemptsLeft = 30;
+	let diff = 0;
 
-			diff = offset;
-			finalize(token);
-		});
-	});
+	let finalize = () => {
+		let code = SteamTotp.generateAuthCode(secret, diff);
 
-	function finalize(token) {
-		var code = SteamTotp.generateAuthCode(secret, diff);
-
-		self.httpRequestPost({
-			"uri": "https://api.steampowered.com/ITwoFactorService/FinalizeAddAuthenticator/v1/",
-			"form": {
-				"steamid": self.steamID.getSteamID64(),
-				"access_token": token,
-				"authenticator_code": code,
-				"authenticator_time": Math.floor(Date.now() / 1000),
-				"activation_code": activationCode
+		this.httpRequestPost({
+			uri: 'https://api.steampowered.com/ITwoFactorService/FinalizeAddAuthenticator/v1/?access_token=' + this.mobileAccessToken,
+			form: {
+				steamid: this.steamID.getSteamID64(),
+				authenticator_code: code,
+				authenticator_time: Math.floor(Date.now() / 1000),
+				activation_code: activationCode
 			},
-			"json": true
+			json: true
 		}, function(err, response, body) {
 			if (err) {
 				callback(err);
 				return;
 			}
 
-			if(!body.response) {
-				callback(new Error("Malformed response"));
+			if (!body.response) {
+				callback(new Error('Malformed response'));
 				return;
 			}
 
 			body = body.response;
 
-			if(body.server_time) {
+			if (body.server_time) {
 				diff = body.server_time - Math.floor(Date.now() / 1000);
 			}
 
-			if(body.status == 89) {
-				callback(new Error("Invalid activation code"));
+			if (body.status == 89) {
+				callback(new Error('Invalid activation code'));
 			} else if(body.want_more) {
 				attemptsLeft--;
 				diff += 30;
 
-				finalize(token);
+				finalize();
 			} else if(!body.success) {
-				callback(new Error("Error " + body.status));
+				callback(new Error('Error ' + body.status));
 			} else {
 				callback(null);
 			}
-		}, "steamcommunity");
+		}, 'steamcommunity');
 	}
-};
 
-SteamCommunity.prototype.disableTwoFactor = function(revocationCode, callback) {
-	var self = this;
-
-	this.getWebApiOauthToken(function(err, token) {
-		if(err) {
+	SteamTotp.getTimeOffset(function(err, offset, latency) {
+		if (err) {
 			callback(err);
 			return;
 		}
 
-		self.httpRequestPost({
-			"uri": "https://api.steampowered.com/ITwoFactorService/RemoveAuthenticator/v1/",
-			"form": {
-				"steamid": self.steamID.getSteamID64(),
-				"access_token": token,
-				"revocation_code": revocationCode,
-				"steamguard_scheme": 1
-			},
-			"json": true
-		}, function(err, response, body) {
-			if (err) {
-				callback(err);
-				return;
-			}
-
-			if(!body.response) {
-				callback(new Error("Malformed response"));
-				return;
-			}
-
-			if(!body.response.success) {
-				callback(new Error("Request failed"));
-				return;
-			}
-
-			// success = true means it worked
-			callback(null);
-		}, "steamcommunity");
+		diff = offset;
+		finalize();
 	});
 };
+
+SteamCommunity.prototype.disableTwoFactor = function(revocationCode, callback) {
+	this._verifyMobileAccessToken();
+
+	if (!this.mobileAccessToken) {
+		callback(new Error('No mobile access token available. Provide one by calling setMobileAppAccessToken()'));
+		return;
+	}
+
+	this.httpRequestPost({
+		uri: 'https://api.steampowered.com/ITwoFactorService/RemoveAuthenticator/v1/?access_token=' + this.mobileAccessToken,
+		form: {
+			steamid: this.steamID.getSteamID64(),
+			revocation_code: revocationCode,
+			steamguard_scheme: 1
+		},
+		json: true
+	}, function(err, response, body) {
+		if (err) {
+			callback(err);
+			return;
+		}
+
+		if (!body.response) {
+			callback(new Error('Malformed response'));
+			return;
+		}
+
+		if (!body.response.success) {
+			callback(new Error('Request failed'));
+			return;
+		}
+
+		// success = true means it worked
+		callback(null);
+	}, 'steamcommunity');
+};

components/users.js

@@ -526,7 +526,7 @@ SteamCommunity.prototype.getUserInventoryContents = function(userID, appID, cont
 			},
 			"qs": {
 				"l": language, // Default language
-				"count": 5000, // Max items per 'page'
+				"count": 2000, // Max items per 'page'
 				"start_assetid": start
 			},
 			"json": true

components/webapi.js

@@ -1,5 +1,7 @@
 var SteamCommunity = require('../index.js');
 
+const Helpers = require('./helpers.js');
+
 SteamCommunity.prototype.getWebApiKey = function(domain, callback) {
 	var self = this;
 	this.httpRequest({
@@ -45,7 +47,7 @@ SteamCommunity.prototype.getWebApiKey = function(domain, callback) {
 };
 
 /**
- * @deprecated No longer works if not logged in via mobile login. Will be removed in a future release.
+ * @deprecated No longer works. Will be removed in a future release.
  * @param {function} callback
  */
 SteamCommunity.prototype.getWebApiOauthToken = function(callback) {
@@ -53,5 +55,64 @@ SteamCommunity.prototype.getWebApiOauthToken = function(callback) {
 		return callback(null, this.oAuthToken);
 	}
 
-	callback(new Error('This operation requires an OAuth token, which can only be obtained from node-steamcommunity\'s `login` method.'));
+	callback(new Error('This operation requires an OAuth token, which is no longer issued by Steam.'));
+};
+
+/**
+ * Sets an access_token generated by steam-session using EAuthTokenPlatformType.MobileApp.
+ * Required for some operations such as 2FA enabling and disabling.
+ * This will throw an Error if the provided token is not valid, was not generated for the MobileApp platform, is expired,
+ * or does not belong to the logged-in user account.
+ *
+ * @param {string} token
+ */
+SteamCommunity.prototype.setMobileAppAccessToken = function(token) {
+	if (!this.steamID) {
+		throw new Error('Log on to steamcommunity before setting a mobile app access token');
+	}
+
+	let decodedToken = Helpers.decodeJwt(token);
+
+	if (!decodedToken.iss || !decodedToken.sub || !decodedToken.aud || !decodedToken.exp) {
+		throw new Error('Provided value is not a valid Steam access token');
+	}
+
+	if (decodedToken.iss == 'steam') {
+		throw new Error('Provided token is a refresh token, not an access token');
+	}
+
+	if (decodedToken.sub != this.steamID.getSteamID64()) {
+		throw new Error(`Provided token belongs to account ${decodedToken.sub}, but we are logged into ${this.steamID.getSteamID64()}`);
+	}
+
+	if (decodedToken.exp < Math.floor(Date.now() / 1000)) {
+		throw new Error('Provided token is expired');
+	}
+
+	if ((decodedToken.aud || []).indexOf('mobile') == -1) {
+		throw new Error('Provided token is not valid for MobileApp platform type');
+	}
+
+	this.mobileAccessToken = token;
+};
+
+/**
+ * Verifies that the mobile access token we already have set is still valid for current login.
+ *
+ * @private
+ */
+SteamCommunity.prototype._verifyMobileAccessToken = function() {
+	if (!this.mobileAccessToken) {
+		// No access token, so nothing to do here.
+		return;
+	}
+
+	let decodedToken = Helpers.decodeJwt(this.mobileAccessToken);
+
+	let isTokenInvalid = decodedToken.sub != this.steamID.getSteamID64()    // SteamID doesn't match
+		|| decodedToken.exp < Math.floor(Date.now() / 1000);                      // Token is expired
+
+	if (isTokenInvalid) {
+		delete this.mobileAccessToken;
+	}
 };

examples/disable_twofactor.js

@@ -48,15 +48,34 @@ function doLogin(accountName, password, authCode, captcha, rCode) {
 		}
 
 		console.log('Logged on!');
-		community.disableTwoFactor('R' + rCode, (err) => {
-			if (err) {
-				console.log(err);
-				process.exit();
-				return;
-			}
 
-			console.log('Two-factor authentication disabled!');
-			process.exit();
+		if (community.mobileAccessToken) {
+			// If we already have a mobile access token, we don't need to prompt for one.
+			doRevoke(rCode);
+			return;
+		}
+
+		console.log('You need to provide a mobile app access token to continue.');
+		console.log('You can generate one using steam-session (https://www.npmjs.com/package/steam-session).');
+		console.log('The access token needs to be generated using EAuthTokenPlatformType.MobileApp.');
+		console.log('Make sure you provide an *ACCESS* token, not a refresh token.');
+
+		rl.question('Access Token: ', (accessToken) => {
+			community.setMobileAppAccessToken(accessToken);
+			doRevoke(rCode);
 		});
 	});
 }
+
+function doRevoke(rCode) {
+	community.disableTwoFactor('R' + rCode, (err) => {
+		if (err) {
+			console.log(err);
+			process.exit();
+			return;
+		}
+
+		console.log('Two-factor authentication disabled!');
+		process.exit();
+	});
+}

examples/enable_twofactor.js

@@ -56,41 +56,60 @@ function doLogin(accountName, password, authCode, captcha) {
 		}
 
 		console.log('Logged on!');
-		community.enableTwoFactor((err, response) => {
-			if (err) {
-				if (err.eresult == EResult.Fail) {
-					console.log('Error: Failed to enable two-factor authentication. Do you have a phone number attached to your account?');
-					process.exit();
-					return;
-				}
 
-				if (err.eresult == EResult.RateLimitExceeded) {
-					console.log('Error: RateLimitExceeded. Try again later.');
-					process.exit();
-					return;
-				}
+		if (community.mobileAccessToken) {
+			// If we already have a mobile access token, we don't need to prompt for one.
+			doSetup();
+			return;
+		}
 
-				console.log(err);
-				process.exit();
-				return;
-			}
+		console.log('You need to provide a mobile app access token to continue.');
+		console.log('You can generate one using steam-session (https://www.npmjs.com/package/steam-session).');
+		console.log('The access token needs to be generated using EAuthTokenPlatformType.MobileApp.');
+		console.log('Make sure you provide an *ACCESS* token, not a refresh token.');
 
-			if (response.status != EResult.OK) {
-				console.log(`Error: Status ${response.status}`);
-				process.exit();
-				return;
-			}
-
-			let filename = `twofactor_${community.steamID.getSteamID64()}.json`;
-			console.log(`Writing secrets to ${filename}`);
-			console.log(`Revocation code: ${response.revocation_code}`);
-			FS.writeFileSync(filename, JSON.stringify(response, null, '\t'));
-
-			promptActivationCode(response);
+		rl.question('Access Token: ', (accessToken) => {
+			community.setMobileAppAccessToken(accessToken);
+			doSetup();
 		});
 	});
 }
 
+function doSetup() {
+	community.enableTwoFactor((err, response) => {
+		if (err) {
+			if (err.eresult == EResult.Fail) {
+				console.log('Error: Failed to enable two-factor authentication. Do you have a phone number attached to your account?');
+				process.exit();
+				return;
+			}
+
+			if (err.eresult == EResult.RateLimitExceeded) {
+				console.log('Error: RateLimitExceeded. Try again later.');
+				process.exit();
+				return;
+			}
+
+			console.log(err);
+			process.exit();
+			return;
+		}
+
+		if (response.status != EResult.OK) {
+			console.log(`Error: Status ${response.status}`);
+			process.exit();
+			return;
+		}
+
+		let filename = `twofactor_${community.steamID.getSteamID64()}.json`;
+		console.log(`Writing secrets to ${filename}`);
+		console.log(`Revocation code: ${response.revocation_code}`);
+		FS.writeFileSync(filename, JSON.stringify(response, null, '\t'));
+
+		promptActivationCode(response);
+	});
+}
+
 function promptActivationCode(response) {
 	rl.question('SMS Code: ', (smsCode) => {
 		community.finalizeTwoFactor(response.shared_secret, smsCode, (err) => {

index.js

@@ -65,7 +65,7 @@ SteamCommunity.prototype.login = function(details, callback) {
 		this._setCookie(Request.cookie('steamMachineAuth' + parts[0] + '=' + encodeURIComponent(parts[1])), true);
 	}
 
-	var disableMobile = details.disableMobile;
+	var disableMobile = typeof details.disableMobile == 'undefined' ? true : details.disableMobile;
 
 	var self = this;
 
@@ -123,7 +123,7 @@ SteamCommunity.prototype.login = function(details, callback) {
 			"donotcache": Date.now()
 		};
 
-		if(!disableMobile){
+		if (!disableMobile) {
 			formObj.oauth_client_id = "DE45CD61";
 			formObj.oauth_scope = "read_profile write_profile read_client write_client";
 			formObj.loginfriendlyname = "#login_emailauth_friendlyname_mobile";
@@ -161,22 +161,20 @@ SteamCommunity.prototype.login = function(details, callback) {
 				callback(error);
 			} else if (!body.success) {
 				callback(new Error(body.message || "Unknown error"));
-			} else if (!disableMobile && !body.oauth) {
-				callback(new Error("Malformed response"));
 			} else {
 				var sessionID = generateSessionID();
-				var oAuth;
+				var oAuth = {};
 				self._setCookie(Request.cookie('sessionid=' + sessionID));
 
 				var cookies = self._jar.getCookieString("https://steamcommunity.com").split(';').map(function(cookie) {
 					return cookie.trim();
 				});
 
-				if (!disableMobile){
+				if (!disableMobile && body.oauth) {
 					oAuth = JSON.parse(body.oauth);
 					self.steamID = new SteamID(oAuth.steamid);
 					self.oAuthToken = oAuth.oauth_token;
-				}else{
+				} else {
 					for(var i = 0; i < cookies.length; i++) {
 						var parts = cookies[i].split('=');
 						if(parts[0] == 'steamLogin') {
@@ -190,7 +188,7 @@ SteamCommunity.prototype.login = function(details, callback) {
 
 				// Find the Steam Guard cookie
 				var steamguard = null;
-				for(var i = 0; i < cookies.length; i++) {
+				for (var i = 0; i < cookies.length; i++) {
 					var parts = cookies[i].split('=');
 					if(parts[0] == 'steamMachineAuth' + self.steamID) {
 						steamguard = self.steamID.toString() + '||' + decodeURIComponent(parts[1]);
@@ -216,6 +214,12 @@ SteamCommunity.prototype.login = function(details, callback) {
 	}
 };
 
+/**
+ * @deprecated
+ * @param {string} steamguard
+ * @param {string} token
+ * @param {function} callback
+ */
 SteamCommunity.prototype.oAuthLogin = function(steamguard, token, callback) {
 	steamguard = steamguard.split('||');
 	var steamID = new SteamID(steamguard[0]);
@@ -302,6 +306,10 @@ SteamCommunity.prototype.setCookies = function(cookies) {
 
 		this._setCookie(Request.cookie(cookie), !!(cookieName.match(/^steamMachineAuth/) || cookieName.match(/Secure$/)));
 	});
+
+	// The account we're logged in as might have changed, so verify that our mobile access token (if any) is still valid
+	// for this account.
+	this._verifyMobileAccessToken();
 };
 
 SteamCommunity.prototype.getSessionID = function(host = "http://steamcommunity.com") {

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "steamcommunity",
-	"version": "3.43.1",
+	"version": "3.45.2",
 	"description": "Provides an interface for logging into and interacting with the Steam Community website",
 	"keywords": [
 		"steam",