Unfinished soundcloud authorization

soundcloud_auth.py

from requests import Session
import re
import json
from base64 import b64encode
from urllib.parse import quote, urlparse


session = Session()
session.headers = {
    'Accept': '*/*',
    'Accept-Encoding': 'gzip, deflate, br, zstd',
    'Accept-Language': 'en-US;q=0.5,en;q=0.3',
    'DNT': '1',
    'Origin': 'https://soundcloud.com/',
    'Referer': 'https://soundcloud.com/',
    'Sec-Fetch-Dest': 'empty',
    'Sec-Fetch-Mode': 'cors',
    'Sec-Fetch-Site': 'same-site',
    'TE': 'trailers',
    'Sec-GPC': '1',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0',
}

login = ''
password = ''

client_id = '6ZQ2Vr6GmERVhpEmkZmcNAuDQ3l9qaZe'
signin_version = '8'
signin_secret = '0763ed7314c69015fd4a0dc16bbf4b90'
captcha_site_key = '6Lf_t_wUAAAAACyAReaZlQzxI0fxbxhNCwrngjp6'

# pkce random stuff - should be randomized
random_nonce = 'l1240Ek_hG0CsXfpfnlY5xOZa8W8L80jaAwqIE20frc0oU3okVY1Jz6GeA055vZF'
random_code_challenge = 'ctCwd7B8ntvMv2mVffhrvg1qht_VFxXWbq-p97TSZXo'

state = b64encode(json.dumps({
    "client_id": client_id,
    "nonce": random_nonce
}).encode())

content = session.get('https://soundcloud.com/').text
hydration_data = json.loads(re.search(r'window.__sc_hydration = (.*?)<\/script>', content).group(1)[:-1])

anonymous_id = None
for x in hydration_data:
    val = x.get('hydratable')
    if val != 'anonymousId':
        continue

    anonymous_id = x['data']
    break

assert anonymous_id


# todo: datadome stuff here
# https://dwt.soundcloud.com/tags.js
# POST to https://dwt.soundcloud.com/js/


def hash_data(string: str) -> int:
    d = 8011470
    f = 0
    
    while f < len(string):
        d = (d >> 1) + ((1 & d) << 23)
        d += ord(string[f])
        d &= 16777215
        f += 1
    
    return d


# https://secure.sndcdn.com/web_auth-b2df66a32514f6d4f70e.js
def sign() -> str:
    e = login
    t = client_id
    n = signin_secret
    o = session.headers['User-Agent']

    i = 1  # 1 if legit webdriver
    a = 3  # firefox
    s = 20 * 1000 * 1000  # 20 sec in msec
    u = 1920 * 1080  # resolution
    l = 1283  # plugins enumeration
    
    move_count = 83
    keydown_count = 21
    keyup_count = keydown_count
    
    u = '-'.join(map(str, [
        a,
        i,
        s,
        move_count,
        u,
        l,
        keydown_count,
        keyup_count,
    ]))
    
    n = n + signin_version + u + o + e + t + u + n
    c = n  # window.unescape(window.encodeURIComponent(n))
    d = hash_data(c)

    r = a
    return signin_version + ':' + u + ':' + hex(d)[2:] + ':' + str(r)



rj = session.post('https://api-auth.soundcloud.com/sign-in', params={'client_id': client_id}, json={
    'credentials': {
        'body': {
            'identifier': login,
            'password': password
        },
        'kind': 'password'
    },
    'vk': {
        'ag': session.headers['User-Agent'],
        'cd': client_id,
        'cp': captcha_site_key,  # captchaPubKey or site key
        'cr': None,  # captcha or None
        'dd': anonymous_id,
        'kd': 'password',
        'sg': sign(),
    }
})

print(rj.status_code)
rj.raise_for_error()

rj2 = session.post('https://api-auth.soundcloud.com/oauth/authorize', params={'client_id': client_id}, json={
    'client_id': client_id,
    'code_challenge': random_code_challenge,
    'code_challenge_method': 'S256',
    'redirect_uri': 'https://soundcloud.com/signin/callback',
    'response_type': 'code',
    'state': state,
})
print(rj2.status_code)
rj2.raise_for_error()

redirect_url = rj2.json()['redirect_url']

params = urlparse(redirect_url).query.split('&')
code = None

for x in params:
    if not x.startswith('code='):
        continue
    code = x.split('=', maxsplit=1)[1]
    break

assert code

# todo: pkce stuff to calculate the code_verifier then POST
# https://secure.soundcloud.com/oauth/token?grant_type=authorization_code&client_id=

"""
// https://secure.sndcdn.com/web_auth-b2df66a32514f6d4f70e.js
h.initialize = function () {
  function e(e) {
    try {
      if (false === e.isTrusted) {
        return
      }
    } catch (e) {}
    move_count += 1
  }
  start_time = window.Date.now()
  window.addEventListener('mousemove', e)
  window.addEventListener('touchmove', e)
  window.addEventListener('keydown', function () {
    keydown_count += 1
  })
  window.addEventListener('keyup', function () {
    keyup_count += 1
  })
  window.addEventListener('click', function () {
    click_count += 1
  })
}

// e = input email, t = clientId, n = __SIGN_IN_SIGNATURE_SECRET__
h.sign = function (e, t, n, r) {
  var o = window.navigator.userAgent,
    i = 1 // 1 if legit webdriver
  window.document.$cdc_asdjflasutopfhvcZLmcfl_ && (i += 2)
  window.document.documentElement.getAttribute('webdriver') && (i += 4)
  window.navigator.webdriver && (i += 16)
  window.location.protocol !== 'https:' && (i += 32)
  window.eval('typeof process') !== 'undefined' && (i += 64)
  window.eval('typeof global') !== 'undefined' && (i += 128)
  window.eval('typeof readFully') !== 'undefined' && (i += +'256')
  window['_Selenium_IDE_Recorder'] && (i += +'512')
  window.document['__webdriver_script_fn'] && (i += 1024)
  var a = 1
  window.mozInnerScreenY && (a += 2) // firefox
  null === window.onoperacustomcontrol && (a += 4) // opera
  window.msLaunchUri && (a += 8) // idk, maybe edge?
  window.safari && (a += 16) // safari
  window.chrome && (a += 32) // chrome
  var s = window.Date.now() - start_time,
    u = 0
  try {
    u = window.screen.width * window.screen.height
  } catch (e) {}
  var l = +'1024'
  try {
    ;[].forEach.call(window.navigator.plugins, function (e) {
      e = e.name
      e === 'Chromium PDF Viewer' && (l += 1)
      e === 'Chrome PDF Viewer' && (l += 2)
      'Native Client' === e && (l += 4)
      'Widevine Content Decryption Module' === e && (l += 8)
      'Chrome PDF Plugin' === e && (l += 16)
      e === 'Java Applet Plug-in' && (l += 32)
      e === 'Shockwave Flash' && (l += 64)
      e === 'Edge PDF Viewer' && (l += +'128')
      e === 'WebKit built-in PDF' && (l += +'256')
    })
  } catch (e) {}
  r && (o = 'TestUA')
  r && (i = +'4096')
  r && (move_count = 42)
  r && (s = +'424242')
  r && (u = 420 * +'420')
  r && (l = +'1024')
  r && (click_count = 0)
  for (
    var u = [
        (a = r ? 4096 : a),
        i,
        s,
        move_count,
        u,
        l,
        (keydown_count = r ? 7 : keydown_count),
        (keyup_count = r ? 9 : keyup_count),
      ].join('-'),
      r = click_count,
      n = n + h['__SIGNIN_SIGNATURE_VERSION__'] + u + o + e + t + u + n,
      c = window.unescape(window.encodeURIComponent(n)),
      d = 8011470,
      f = 0;
    f < c.length;
    f += 1
  ) {
    d = (d >> 1) + ((1 & d) << 23)
    d += c.charCodeAt(f)
    d &= 16777215
  }
  return (
    h['__SIGNIN_SIGNATURE_VERSION__'] + ':' + u + ':' + d.toString(16) + ':' + r
  )
}
"""