3.48.6

Fixes cache_expiration restore for CS2 Items

README.md

@@ -4,9 +4,8 @@
 [![license](https://img.shields.io/npm/l/steamcommunity.svg)](https://github.com/DoctorMcKay/node-steamcommunity/blob/master/LICENSE)
 [![paypal](https://img.shields.io/badge/paypal-donate-yellow.svg)](https://www.paypal.com/cgi-bin/webscr?cmd=_donations&business=N36YVAT42CZ4G&item_name=node%2dsteamcommunity&currency_code=USD)
 
-This module provides an easy interface for the Steam Community website. This module can be used to simply login to steamcommunity.com for use with other libraries, or to interact with steamcommunity.com.
-
-It supports Steam Guard and CAPTCHAs.
+This module provides an easy interface for the Steam Community website. This module can be used to simply login to
+steamcommunity.com for use with other libraries, or to interact with steamcommunity.com.
 
 **Have a question about the module or coding in general? *Do not create a GitHub issue.* GitHub issues are for feature
 requests and bug reports. Instead, post in the [dedicated forum](https://dev.doctormckay.com/forum/8-node-steamcommunity/).

classes/CEconItem.js

@@ -68,9 +68,9 @@ function CEconItem(item, description, contextID) {
 
 	// Restore cache_expiration, if we can (for CS:GO items)
 	if (this.appid == 730 && this.contextid == 2 && this.owner_descriptions) {
-		let description = this.owner_descriptions.find(d => d.value && d.value.indexOf('Tradable After ') == 0);
+		let description = this.owner_descriptions.find(d => d.value && d.value.indexOf('Tradable/Marketable After ') == 0);
 		if (description) {
-			let date = new Date(description.value.substring(15).replace(/[,()]/g, ''));
+			let date = new Date(description.value.substring(26).replace(/[,()]/g, ''));
 			if (date) {
 				this.cache_expiration = date.toISOString();
 			}

classes/CSteamUser.js

@@ -13,7 +13,7 @@ SteamCommunity.prototype.getSteamUser = function(id, callback) {
 	}
 
 	var self = this;
-	this.httpRequest("http://steamcommunity.com/" + (typeof id === 'string' ? "id/" + id : "profiles/" + id.toString()) + "/?xml=1", function(err, response, body) {
+	this.httpRequest("https://steamcommunity.com/" + (typeof id === 'string' ? "id/" + id : "profiles/" + id.toString()) + "/?xml=1", function(err, response, body) {
 		if (err) {
 			callback(err);
 			return;

components/groups.js

@@ -11,17 +11,17 @@ SteamCommunity.prototype.getGroupMembers = function(gid, callback, members, link
 	if (!link) {
 		if (typeof gid !== 'string') {
 			// It's a SteamID object
-			link = "http://steamcommunity.com/gid/" + gid.toString() + "/memberslistxml/?xml=1";
+			link = "https://steamcommunity.com/gid/" + gid.toString() + "/memberslistxml/?xml=1";
 		} else {
 			try {
 				var sid = new SteamID(gid);
 				if (sid.type == SteamID.Type.CLAN && sid.isValid()) {
-					link = "http://steamcommunity.com/gid/" + sid.getSteamID64() + "/memberslistxml/?xml=1";
+					link = "https://steamcommunity.com/gid/" + sid.getSteamID64() + "/memberslistxml/?xml=1";
 				} else {
 					throw new Error("Doesn't particularly matter what this message is");
 				}
 			} catch (e) {
-				link = "http://steamcommunity.com/groups/" + gid + "/memberslistxml/?xml=1";
+				link = "https://steamcommunity.com/groups/" + gid + "/memberslistxml/?xml=1";
 			}
 		}
 	}

components/http.js

@@ -1,3 +1,5 @@
+var URL = require('url');
+
 var SteamCommunity = require('../index.js');
 
 SteamCommunity.prototype.httpRequest = function(uri, options, callback, source) {
@@ -19,6 +21,16 @@ SteamCommunity.prototype.httpRequest = function(uri, options, callback, source)
 		delete this._httpRequestConvenienceMethod;
 	}
 
+	// Add origin header if necessary
+	// https://github.com/DoctorMcKay/node-steamcommunity/issues/351
+	if ((options.method || 'GET').toUpperCase() != 'GET') {
+		options.headers = options.headers || {};
+		if (!options.headers.origin) {
+			var parsedUrl = URL.parse(options.url);
+			options.headers.origin = parsedUrl.protocol + '//' + parsedUrl.host;
+		}
+	}
+
 	var requestID = ++this._httpRequestID;
 	source = source || "";
 

components/login.js

@@ -54,7 +54,7 @@ SteamCommunity.prototype._modernLogin = function(logOnDetails) {
 				let webCookies = await session.getWebCookies();
 				let sessionIdCookie = webCookies.find(c => c.startsWith('sessionid='));
 				resolve({
-					sessionID: sessionIdCookie.split('=')[1],
+					sessionID: sessionIdCookie.split('=')[1].split(';')[0].trim(),
 					cookies: webCookies,
 					steamguard: session.steamGuardMachineToken,
 					mobileAccessToken: logOnDetails.disableMobile ? null : session.accessToken

components/twofactor.js

@@ -20,10 +20,10 @@ SteamCommunity.prototype.enableTwoFactor = function(callback) {
 		// TODO: Send this as protobuf to more closely mimic official app behavior
 		form: {
 			steamid: this.steamID.getSteamID64(),
-			authenticator_time: Math.floor(Date.now() / 1000),
 			authenticator_type: ETwoFactorTokenType.ValveMobileApp,
 			device_identifier: SteamTotp.getDeviceID(this.steamID),
-			sms_phone_id: '1'
+			sms_phone_id: '1',
+			version: 2
 		},
 		json: true
 	}, (err, response, body) => {

components/users.js

@@ -590,7 +590,7 @@ SteamCommunity.prototype.getUserInventoryContents = function(userID, appID, cont
 			},
 			"qs": {
 				"l": language, // Default language
-				"count": 2000, // Max items per 'page'
+				"count": 5000, // Max items per 'page'
 				"start_assetid": start
 			},
 			"json": true
@@ -629,6 +629,13 @@ SteamCommunity.prototype.getUserInventoryContents = function(userID, appID, cont
 				return;
 			}
 
+			if (appID == 730 && body && body.success && !body.assets) {
+				// CS inventory has no visible items. We need a special case for this because Valve is incapable of
+				// doing anything not dumb.
+				callback(null, [], [], body.total_inventory_count);
+				return;
+			}
+
 			if (!body || !body.success || !body.assets || !body.descriptions) {
 				if (body) {
 					// Dunno if the error/Error property even exists on this new endpoint

components/webapi.js

@@ -1,49 +1,152 @@
-var SteamCommunity = require('../index.js');
+const SteamCommunity = require('../index.js');
 
 const Helpers = require('./helpers.js');
 
-SteamCommunity.prototype.getWebApiKey = function(domain, callback) {
-	var self = this;
+/**
+ * Retrieves your account's Steam Web API key, if you already have one. If you don't yet have one, this will fail.
+ * To create a Web API key, use `createWebApiKey()`.
+ *
+ * @param {null|function} unused - No longer used, kept for backward compatibility. You can omit this parameter and pass
+ *    your callback directly as the first parameter if you want.
+ * @param {function} callback
+ */
+SteamCommunity.prototype.getWebApiKey = function(unused, callback) {
+	if (typeof unused == 'function') {
+		callback = unused;
+	}
+
 	this.httpRequest({
-		"uri": "https://steamcommunity.com/dev/apikey?l=english",
-		"followRedirect": false
-	}, function(err, response, body) {
+		uri: 'https://steamcommunity.com/dev/apikey?l=english',
+		followRedirect: false
+	}, (err, response, body) => {
 		if (err) {
 			callback(err);
 			return;
 		}
 
-		if(body.match(/<h2>Access Denied<\/h2>/)) {
-			return callback(new Error("Access Denied"));
+		if (body.match(/You must have a validated email address to create a Steam Web API key./)) {
+			return callback(new Error('You must have a validated email address to create a Steam Web API key.'));
 		}
 
-		if(body.match(/You must have a validated email address to create a Steam Web API key./)) {
-			return callback(new Error("You must have a validated email address to create a Steam Web API key."));
+		if (body.match(/Your account requires (<a [^>]+>)?Steam Guard Mobile Authenticator/)) {
+			return callback(new Error('Steam Guard Mobile Authenticator required to create a Steam Web API key'));
 		}
 
-		var match = body.match(/<p>Key: ([0-9A-F]+)<\/p>/);
-		if(match) {
+		if (body.match(/<h2>Access Denied<\/h2>/)) {
+			return callback(new Error('Access Denied'));
+		}
+
+		let match = body.match(/<p>Key: ([0-9A-F]+)<\/p>/);
+		if (match) {
 			// We already have an API key registered
 			callback(null, match[1]);
 		} else {
-			// We need to register a new API key
-			self.httpRequestPost('https://steamcommunity.com/dev/registerkey?l=english', {
-				"form": {
-					"domain": domain,
-					"agreeToTerms": "agreed",
-					"sessionid": self.getSessionID(),
-					"Submit": "Register"
-				}
-			}, function(err, response, body) {
-				if (err) {
-					callback(err);
+			callback(new Error('No API key created for this account'));
+		}
+	}, "steamcommunity");
+};
+
+/**
+ * @typedef CreateApiKeyOptions
+ * @property {string} domain - The domain to associate with your API key
+ * @property {string} [requestID] - If finalizing an existing create request, include the request ID
+ * @property {string|Buffer} [identitySecret] - If you pass your identity_secret here, then steamcommunity will
+ *   internally handle accepting any confirmations.
+ */
+
+/**
+ * @typedef CreateApiKeyResponse
+ * @property {boolean} confirmationRequired
+ * @property {string} [apiKey] - If creating your API key succeeded, this is the new key
+ * @property {CreateApiKeyOptions} [finalizeOptions] - If confirmation is required to create a key, then accept the
+ *   confirmation, then call createWebApiKey again and pass this whole object for the `options` parameter.
+ */
+
+/**
+ * @callback createWebApiKeyCallback
+ * @param {Error|null} err
+ * @param {CreateApiKeyResponse} [result]
+ */
+
+/**
+ * Starts the process to create a Steam Web API key. When the callback is fired, you will need to approve a mobile
+ * confirmation in your app or using getConfirmations().
+ *
+ * @param {CreateApiKeyOptions} options
+ * @param {createWebApiKeyCallback} callback
+ */
+SteamCommunity.prototype.createWebApiKey = function(options, callback) {
+	if (!options.domain) {
+		callback(new Error('Passing a domain is required to register an API key'));
+		return;
+	}
+
+	this.httpRequestPost({
+		uri: 'https://steamcommunity.com/dev/requestkey',
+		form: {
+			domain: options.domain,
+			request_id: options.requestID || '0',
+			sessionid: this.getSessionID(),
+			agreeToTerms: 'true'
+		},
+		json: true
+	}, (err, res, body) => {
+		if (err) {
+			callback(err);
+			return;
+		}
+
+		// body.requires_confirmation is 1/0, but the Steam website doesn't check this value and instead only checks the
+		// value of `success`. So let's just do that.
+
+		// This is a mess. I'm glad we have promises and await now.
+
+		switch (body.success) {
+			case SteamCommunity.EResult.OK:
+				if (body.api_key) {
+					callback(null, {confirmationRequired: false, apiKey: body.api_key});
 					return;
 				}
 
-				self.getWebApiKey(domain, callback);
-			}, "steamcommunity");
+				// It's not been observed that we get result OK without api_key included, but the Steam website doesn't
+				// use this value so let's be safe just in case it disappears in the future.
+				this.getWebApiKey((err, key) => {
+					if (err) {
+						callback(err);
+						return;
+					}
+
+					callback(null, {confirmationRequired: false, apiKey: key});
+				});
+				return;
+
+			case SteamCommunity.EResult.Pending:
+				let finalizeOptions = {
+					domain: options.domain,
+					requestID: body.request_id || options.requestID
+				}
+
+				if (options.identitySecret) {
+					this.acceptConfirmationForObject(options.identitySecret, finalizeOptions.requestID, (err) => {
+						if (err) {
+							callback(err);
+						} else {
+							this.createWebApiKey(finalizeOptions, callback);
+						}
+					});
+					return;
+				}
+
+				callback(null, {
+					confirmationRequired: true,
+					finalizeOptions: finalizeOptions
+				});
+				return;
+
+			default:
+				callback(Helpers.eresultError(body.success));
 		}
-	}, "steamcommunity");
+	});
 };
 
 /**

examples/.gitignore

@@ -0,0 +1 @@
+twofactor_*.json

examples/disable_twofactor.js

@@ -1,7 +1,7 @@
 // If you aren't running this script inside of the repository, replace the following line with:
 // const SteamCommunity = require('steamcommunity');
 const SteamCommunity = require('../index.js');
-const SteamSession = require('steam-session');
+const SteamTotp = require('steam-totp');
 const ReadLine = require('readline');
 
 let g_AbortPromptFunc = null;
@@ -13,69 +13,32 @@ async function main() {
 	let accountName = await promptAsync('Username: ');
 	let password = await promptAsync('Password (hidden): ', true);
 
-	// Create a LoginSession for us to use to attempt to log into steam
-	let session = new SteamSession.LoginSession(SteamSession.EAuthTokenPlatformType.MobileApp);
+	attemptLogin(accountName, password);
+}
 
-	// Go ahead and attach our event handlers before we do anything else.
-	session.on('authenticated', async () => {
-		abortPrompt();
+function attemptLogin(accountName, password, twoFactorCode) {
+	community.login({
+		accountName,
+		password,
+		twoFactorCode,
+		disableMobile: false
+	}, async (err) => {
+		if (err && err.message == 'SteamGuardMobile') {
+			let code = await promptAsync('Steam Guard App Code OR Shared Secret: ');
+			if (code.length > 5) {
+				// If we were provided a shared secret, turn it into a code.
+				code = SteamTotp.getAuthCode(code);
+			}
+			attemptLogin(accountName, password, code);
+			return;
+		}
 
-		let accessToken = session.accessToken;
-		let cookies = await session.getWebCookies();
-
-		community.setCookies(cookies);
-		community.setMobileAppAccessToken(accessToken);
-
-		// Enabling or disabling 2FA is presently the only action in node-steamcommunity which requires an access token.
-		// In all other cases, using `community.setCookies(cookies)` is all you need to do in order to be logged in,
-		// although there's never any harm in setting a mobile app access token.
+		if (err) {
+			throw err;
+		}
 
 		doRevoke();
 	});
-
-	session.on('timeout', () => {
-		abortPrompt();
-		console.log('This login attempt has timed out.');
-	});
-
-	session.on('error', (err) => {
-		abortPrompt();
-
-		// This should ordinarily not happen. This only happens in case there's some kind of unexpected error while
-		// polling, e.g. the network connection goes down or Steam chokes on something.
-
-		console.log(`ERROR: This login attempt has failed! ${err.message}`);
-	});
-
-	// Start our login attempt
-	let startResult = await session.startWithCredentials({accountName, password});
-	if (startResult.actionRequired) {
-		// Some Steam Guard action is required. We only care about email and device codes; in theory an
-		// EmailConfirmation and/or DeviceConfirmation action could be possible, but we're just going to ignore those.
-		// If the user does receive a confirmation and accepts it, LoginSession will detect and handle that automatically.
-		// The only consequence of ignoring it here is that we don't print a message to the user indicating that they
-		// could accept an email or device confirmation.
-
-		let codeActionTypes = [SteamSession.EAuthSessionGuardType.EmailCode, SteamSession.EAuthSessionGuardType.DeviceCode];
-		let codeAction = startResult.validActions.find(action => codeActionTypes.includes(action.type));
-		if (codeAction) {
-			if (codeAction.type == SteamSession.EAuthSessionGuardType.EmailCode) {
-				// We wouldn't expect this to happen since we're trying to disable 2FA, but just in case...
-				console.log(`A code has been sent to your email address at ${codeAction.detail}.`);
-			} else {
-				console.log('You need to provide a Steam Guard Mobile Authenticator code.');
-			}
-
-			let code = await promptAsync('Code: ');
-			if (code) {
-				await session.submitSteamGuardCode(code);
-			}
-
-			// If we fall through here without submitting a Steam Guard code, that means one of two things:
-			//   1. The user pressed enter without providing a code, in which case the script will simply exit
-			//   2. The user approved a device/email confirmation, in which case 'authenticated' was emitted and the prompt was canceled
-		}
-	}
 }
 
 async function doRevoke() {

examples/enable_twofactor.js

@@ -1,7 +1,6 @@
 // If you aren't running this script inside of the repository, replace the following line with:
 // const SteamCommunity = require('steamcommunity');
 const SteamCommunity = require('../index.js');
-const SteamSession = require('steam-session');
 const ReadLine = require('readline');
 const FS = require('fs');
 
@@ -16,69 +15,28 @@ async function main() {
 	let accountName = await promptAsync('Username: ');
 	let password = await promptAsync('Password (hidden): ', true);
 
-	// Create a LoginSession for us to use to attempt to log into steam
-	let session = new SteamSession.LoginSession(SteamSession.EAuthTokenPlatformType.MobileApp);
+	attemptLogin(accountName, password);
+}
 
-	// Go ahead and attach our event handlers before we do anything else.
-	session.on('authenticated', async () => {
-		abortPrompt();
+function attemptLogin(accountName, password, authCode) {
+	community.login({
+		accountName,
+		password,
+		authCode,
+		disableMobile: false
+	}, async (err) => {
+		if (err && err.message == 'SteamGuard') {
+			let code = await promptAsync('Steam Guard Email Code: ');
+			attemptLogin(accountName, password, code);
+			return;
+		}
 
-		let accessToken = session.accessToken;
-		let cookies = await session.getWebCookies();
-
-		community.setCookies(cookies);
-		community.setMobileAppAccessToken(accessToken);
-
-		// Enabling or disabling 2FA is presently the only action in node-steamcommunity which requires an access token.
-		// In all other cases, using `community.setCookies(cookies)` is all you need to do in order to be logged in,
-		// although there's never any harm in setting a mobile app access token.
+		if (err) {
+			throw err;
+		}
 
 		doSetup();
 	});
-
-	session.on('timeout', () => {
-		abortPrompt();
-		console.log('This login attempt has timed out.');
-	});
-
-	session.on('error', (err) => {
-		abortPrompt();
-
-		// This should ordinarily not happen. This only happens in case there's some kind of unexpected error while
-		// polling, e.g. the network connection goes down or Steam chokes on something.
-
-		console.log(`ERROR: This login attempt has failed! ${err.message}`);
-	});
-
-	// Start our login attempt
-	let startResult = await session.startWithCredentials({accountName, password});
-	if (startResult.actionRequired) {
-		// Some Steam Guard action is required. We only care about email and device codes; in theory an
-		// EmailConfirmation and/or DeviceConfirmation action could be possible, but we're just going to ignore those.
-		// If the user does receive a confirmation and accepts it, LoginSession will detect and handle that automatically.
-		// The only consequence of ignoring it here is that we don't print a message to the user indicating that they
-		// could accept an email or device confirmation.
-
-		let codeActionTypes = [SteamSession.EAuthSessionGuardType.EmailCode, SteamSession.EAuthSessionGuardType.DeviceCode];
-		let codeAction = startResult.validActions.find(action => codeActionTypes.includes(action.type));
-		if (codeAction) {
-			if (codeAction.type == SteamSession.EAuthSessionGuardType.EmailCode) {
-				console.log(`A code has been sent to your email address at ${codeAction.detail}.`);
-			} else {
-				// We wouldn't expect this to happen since we're trying to enable 2FA, but just in case...
-				console.log('You need to provide a Steam Guard Mobile Authenticator code.');
-			}
-
-			let code = await promptAsync('Code: ');
-			if (code) {
-				await session.submitSteamGuardCode(code);
-			}
-
-			// If we fall through here without submitting a Steam Guard code, that means one of two things:
-			//   1. The user pressed enter without providing a code, in which case the script will simply exit
-			//   2. The user approved a device/email confirmation, in which case 'authenticated' was emitted and the prompt was canceled
-		}
-	}
 }
 
 function doSetup() {
@@ -118,10 +76,13 @@ function doSetup() {
 
 async function promptActivationCode(response) {
 	if (response.phone_number_hint) {
-		console.log(`A code has been sent to your phone ending in ${response.phone_number_hint}.`);
+		console.log(`An activation code has been sent to your phone ending in ${response.phone_number_hint}.`);
+	} else if (response.confirm_type == 3) {
+		// Exact meaning of confirm_type is unknown, but 3 appears to be email code
+		console.log('An activation code has been sent to your email.');
 	}
 
-	let smsCode = await promptAsync('SMS Code: ');
+	let smsCode = await promptAsync('Activation Code: ');
 	community.finalizeTwoFactor(response.shared_secret, smsCode, (err) => {
 		if (err) {
 			if (err.message == 'Invalid activation code') {

index.js

@@ -154,16 +154,20 @@ SteamCommunity.prototype._setCookie = function(cookie, secure) {
 	var protocol = secure ? "https" : "http";
 	cookie.secure = !!secure;
 
-	this._jar.setCookie(cookie.clone(), protocol + "://steamcommunity.com");
-	this._jar.setCookie(cookie.clone(), protocol + "://store.steampowered.com");
-	this._jar.setCookie(cookie.clone(), protocol + "://help.steampowered.com");
+	if (cookie.domain) {
+		this._jar.setCookie(cookie.clone(), protocol + '://' + cookie.domain);
+	} else {
+		this._jar.setCookie(cookie.clone(), protocol + "://steamcommunity.com");
+		this._jar.setCookie(cookie.clone(), protocol + "://store.steampowered.com");
+		this._jar.setCookie(cookie.clone(), protocol + "://help.steampowered.com");
+	}
 };
 
 SteamCommunity.prototype.setCookies = function(cookies) {
 	cookies.forEach((cookie) => {
-		var cookieName = cookie.match(/(.+)=/)[1];
+		var cookieName = cookie.trim().split('=')[0];
 		if (cookieName == 'steamLogin' || cookieName == 'steamLoginSecure') {
-			this.steamID = new SteamID(cookie.match(/=(\d+)/)[1]);
+			this.steamID = new SteamID(cookie.match(/steamLogin(Secure)?=(\d+)/)[2]);
 		}
 
 		this._setCookie(Request.cookie(cookie), !!(cookieName.match(/^steamMachineAuth/) || cookieName.match(/Secure$/)));

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "steamcommunity",
-	"version": "3.47.1",
+	"version": "3.48.6",
 	"description": "Provides an interface for logging into and interacting with the Steam Community website",
 	"files": [
 		"/classes",
@@ -33,7 +33,7 @@
 		"cheerio": "0.22.0",
 		"image-size": "^0.8.2",
 		"request": "^2.88.0",
-		"steam-session": "^1.6.0",
+		"steam-session": "^1.9.1",
 		"steam-totp": "^1.5.0",
 		"steamid": "^1.1.3",
 		"xml2js": "^0.6.2"