snapcap — Web API recon

┌─────────────────┐
│ Node bridge     │  fetch + ws — pure Node, no browser at runtime
│ (snapcap server)│
└────────┬────────┘
         │ HTTPS / gRPC-Web (HTTP/2 or HTTP/3)
         │ WebSocket (real-time push, deferred for v1)
         │
         ├─→ accounts.snapchat.com    (login, sets __Host-sc-a-auth-session cookie)
         ├─→ session.snapchat.com     (WebAttestationService — once per session)
         ├─→ web.snapchat.com         (gRPC-Web API surface — main API host)
         ├─→ cf-st.sc-cdn.net         (CDN PUT for media uploads, AWS-signed URLs)
         └─→ aws.duplex.snapchat.com  (WebSocket for real-time push, deferred)

1.  GET  https://accounts.snapchat.com/accounts/sso?client_id=web-calling-corp--prod
        → 303 redirect, Set-Cookie: __Host-sc-a-auth-session=<value>; HttpOnly; Secure
        (the actual login form submission lives upstream of this; the cookie carries the session)

2.  POST https://session.snapchat.com/snap.security.WebAttestationService/BootstrapAttestationSession
        body: 352 bytes protobuf (gRPC-Web framing)
        → establishes session attestation

3.  POST https://web.snapchat.com/snapchat.fidelius.FideliusIdentityService/InitializeWebKey
        body: 162 bytes protobuf
        → exchanges public keys; sets up Fidelius E2E identity material in localStorage

4.  POST https://web.snapchat.com/web-chat-session/refresh?client_id=web-calling-corp--prod
        body: 0 bytes (heartbeat)
        Authorization: Bearer <token>
        cookie: __Host-sc-a-auth-session=<value>
        → keeps the Bearer fresh; can be polled periodically

URL:                wss://aws.duplex.snapchat.com/snapchat.gateway.Gateway/WebSocketConnect
Origin:             https://www.snapchat.com
Sec-WebSocket-Protocol: snap-ws-auth, <Bearer token>

byte 0:           compression flag (always 0x00 in observed traffic)
bytes 1-4:        big-endian uint32 = length of protobuf payload
bytes 5..N+5:     the protobuf payload itself

message CreateContentMessageRequest {
  Uuid          conversation_id    = 1;  // Uuid wraps a 16-byte UUID
  uint64        client_message_id  = 2;  // unique per send (snowflake-ish)
  Recipients    recipients         = 3;
  Content       content            = 4;
  // 5 reserved
  Sender        sender             = 6;
  // 7 reserved
  ContextId     context            = 8;  // 16-byte UUID identifying client/session
}

message Uuid {
  bytes uuid = 1;  // exactly 16 bytes
}

message Recipients {
  // field 2 (or sometimes 1) wraps each recipient
  Recipient r = 2;  // (multiple = multi-recipient broadcast)
}

message Recipient {
  Uuid          target_id          = 1;  // ← critical:
                                          //   Stories:   01010101010101010101010101010101 (all 0x01)
                                          //   DMs:       <friend's conversation UUID>
                                          //   Groups:    <group conversation UUID>
  RecipientMeta meta               = 2;  // optional
}

message Content {
  // text-only DM:  field 4 is empty, separate text field used (TBD — need to capture text-only DM)
  // media DM/story: field 4 contains MediaContent
  MediaContent  media              = 4;
  UploadRef     upload             = 5;
  // 6 reserved (empty bytes)
  uint32        type               = 7;  // 2 = media DM, 3 = story (observed values)
  // 9 reserved
}

message MediaContent {
  MediaItem item = 11;  // wrapper
}

message MediaItem {
  uint32          content_type     = 8;   // 2 = image (other types: video, audio TBD)
  QualityHint     quality          = 4;
  MediaDescriptor descriptor       = 5;
  Attribution     attribution      = 13;  // referrer URL, render hints
  Timestamp       timestamp        = 17;  // unix ms
  // 22: { 1: varint 7 } — purpose unclear
}

message MediaDescriptor {
  MediaInfo info = 1;
}

message MediaInfo {
  Dimensions       dims              = 5;  // { width: int, height: int }
  // 18: bytes (empty observed)
  EncryptionKeys   keys              = 4;
  ExtraCrypto      extra             = 19;
  uint32           version           = 20; // observed: 3
  uint32           flag              = 22; // observed: 1
}

message Dimensions {
  uint32 width  = 1;
  uint32 height = 2;
}

message EncryptionKeys {
  string aes_key_b64 = 1;  // 32 bytes (AES-256), base64 — 44 chars
  string iv_b64      = 2;  // 16 bytes (AES IV),   base64 — 24 chars
}

message ExtraCrypto {
  bytes hash_or_key = 1;  // 32 bytes
  bytes nonce       = 2;  // 16 bytes
}

message UploadRef {
  // wraps reference to the CDN PUT we just did
  message Inner {
    string upload_id_full   = 1;  // e.g. "CX1poQxotdvVfv2Cthh7z_1"
    UploadMeta meta         = 2;
  }
  Inner inner = 1;  // (nesting omitted in protobuf wire — use same shape)
}

message UploadMeta {
  string upload_id_base   = 2;  // matches CDN URL path: cf-st.sc-cdn.net/d/<base>
  bytes flag              = 6;  // observed: 0x04
  uint32 a                = 9;
  uint32 b                = 10;
  uint32 c                = 12;
}

message Sender {
  SenderInfo info = 1;
}

message SenderInfo {
  string username_session = 1;  // "<username>~<session-uuid>", e.g. "perdyjamie~d03d8e41-68c7-..."
  // field 12 has a fixed32 — purpose TBD
}

message ContextId {
  Uuid id = 1;  // 16-byte UUID
}

message CreateContentMessageResponse {
  uint64    client_message_id_echo = 1;  // matches request field 2
  Result    result                 = 2;
}

message Result {
  Uuid    target_id_echo = 1;  // echoes request recipient
  uint32  status         = 2;  // 1 = success
  PublishedRef published = 13;
}

message PublishedRef {
  Uuid    target_id_echo = 1;
  string  published_id   = 2;  // server-issued story/message ID, e.g. "Unvi_6rsRiKcaH..."
}

MY_STORY recipient UUID = 0x01010101010101010101010101010101 (16 bytes of 0x01)

1. POST  web.snapchat.com/snapchat.content.v2.MediaDeliveryService/getUploadLocations
   body: ~15 bytes protobuf (probably {content_type: image, size_estimate: ...})
   → returns:  pre-signed AWS URL to PUT to + upload_id

2. PUT   cf-st.sc-cdn.net/d/<upload_id>?x-amz-acl=public-read
                                       &X-Amz-Algorithm=AWS4-HMAC-SHA256
                                       &X-Amz-Date=<date>
                                       &<more aws sig v4 params>
   body: AES-256-CBC-encrypted media bytes
   → 200 OK (no Authorization header needed; URL is pre-signed)

3. POST  web.snapchat.com/messagingcoreservice.MessagingCoreService/CreateContentMessage
   Authorization: Bearer <token>
   body: protobuf with
         - recipient = MY_STORY UUID for stories, friend conv UUID for DMs
         - encryption_keys = {AES key, IV} we used in step 2 (PLAINTEXT in body — server has them)
         - upload_ref = upload_id from step 1
         - dimensions = (width, height)
         - timestamp_ms
   → response: { client_msg_id_echo, status, published_id }

// Pseudocode for the bridge
import { randomBytes, createCipheriv } from 'crypto';
const aesKey = randomBytes(32);                       // AES-256
const iv     = randomBytes(16);                       // CBC IV
const cipher = createCipheriv('aes-256-cbc', aesKey, iv);
const encryptedMedia = Buffer.concat([cipher.update(mediaBytes), cipher.final()]);
// → PUT encryptedMedia to CDN URL
// → Send aesKey.toString('base64') + iv.toString('base64') in the protobuf body

content-type: application/grpc-web+proto
x-grpc-web: 1
authorization: Bearer <bearer>
referer: https://www.snapchat.com/
x-snap-client-user-agent: SnapchatWeb/13.79.0 PROD (linux 0.0.0; chromium 147.0.7727.15)
sec-ch-ua: "Chromium";v="147", "Not.A/Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

1: msg                                            # recipient
  1: bytes(16) <recipient snap_user_id>
2: varint <message timestamp/snowflake>
3: msg                                            # sender + saved-message-references
  1: msg
    1: msg
      1: bytes(16) <sender snap_user_id>
    2: varint 30
  99: msg                                         # ~looks like saved-message refs
    5: msg
      1: msg(43) {1: bytes(5) … 2: varint 10 3: bytes(32) …}
      …(repeats per saved entry)
4: msg                                            # ENCRYPTED CONTENT
  2: varint 1
  3: msg                                          # crypto envelope (ECIES-ish)
    5: msg
      1: bytes(12) <AES-GCM nonce / IV>
      2: bytes(16) <wrapping or auth tag>
      3: bytes(33) <compressed-EC public key>
      4: varint 10
  4: bytes(64) <encrypted message body>           # the text, not in plaintext
  7: varint 2
8: msg
  1: msg
    1: bytes(16) <message UUID>