Site fixes

/**

 * Copyright 2022 Jacob K

 * Copyright 2022 Wojtek Kosior <koszko@koszko.org>

 *

 * This program is free software: you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation, either version 3 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * As additional permission under GNU GPL version 3 section 7, you

 * may distribute forms of that code without the copy of the GNU

 * GPL normally required by section 4, provided you include this

 * license notice and, in case of non-source distribution, a URL

 * through which recipients can access the Corresponding Source.

 * If you modify file(s) with this exception, you may extend this

 * exception to your version of the file(s), but you are not

 * obligated to do so. If you do not wish to do so, delete this

 * exception statement from your version.

 *

 * As a special exception to the GPL, any HTML file which merely

 * makes function calls to this code, and for that purpose

 * includes it by reference shall be deemed a separate work for

 * copyright law purposes. If you modify this code, you may extend

 * this exception to your version of the code, but you are not

 * obligated to do so. If you do not wish to do so, delete this

 * exception statement from your version.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>.

 *

 * I, Wojtek Kosior, thereby promise not to sue for violation of this file's

 * license. Although I request that you do not make use of this code in a

 * proprietary program, I am not going to enforce this in court.

 */

// meta: match should be https://***.app.box.com/s/* (*** instead of * for the first section because otherwise plain app.box.com URLs won't work)

// meta: some test cases (mostly found at https://old.reddit.com/search?q="box.com"&include_over_18=on&sort=new)

	// https://uwmadison.app.box.com/s/ydht2incbdmw1lhpjg5t40adguc0fm14

		// umadison's enrollment report

		// pdf

	// https://app.box.com/s/gc4ygloi4qtimeh98dq9mmydyuydawcn

		// password-protected 7z file (nsfw)

	// https://app.box.com/shared/static/su6xx6zx50cd68zdtbm3wfxhh9kwke8x.zip

		// a soundtrack in a zip file

		// This is a static download, so it works without this script.

	// https://app.box.com/s/vysdh2u78yih3c8leetgq82il954a3g3

		// some gambling ad

		// pptx

	// https://app.box.com/s/nnlplkmjhimau404qohh9my10pwmo8es

		// a list of books(?)

		// txt

	// https://ucla.app.box.com/s/mv32q624ojihohzh8d0mhhj0b3xluzbz

		// "COVID-19 Pivot Plan Decision Matrix"

		// If you load the proprietary scripts on this page, you'll see that there is no download button

	// TODO: find a public folder link (the private links I have seem to work)

	// TODO: find a (preferably public) link with a folder inside a folder, as these may need to be handled differently

/* Extract data from a script that sets multiple variables. */ // from here: https://api-demo.hachette-hydrilla.org/content/sgoogle_sheets_download/google_sheets_download.js

let prefetchedData = null; // This variable isn't actually used.

for (const script of document.scripts) {

    const match = /Box.prefetchedData = ({([^;]|[^}];)+})/.exec(script.textContent); // looks for "Box.prefetchedData = " in the script files and then grabs the json text after that.

    if (!match)

	continue;

    prefetchedData = JSON.parse(match[1]);

}

let config = null;

for (const script of document.scripts) {

    const match = /Box.config = ({([^;]|[^}];)+})/.exec(script.textContent); // looks for "Box.config = " in the script files and then grabs the json text after that.

    if (!match)

	continue;

    config = JSON.parse(match[1]);

}

let postStreamData = null;

for (const script of document.scripts) {

    const match = /Box.postStreamData = ({([^;]|[^}];)+})/.exec(script.textContent); // looks for "Box.postStreamData = " in the script files and then grabs the json text after that.

    if (!match)

	continue;

    postStreamData = JSON.parse(match[1]);

}

// empty the initial document body

[...document.body.childNodes].forEach(n => n.remove());

// create div container

const divContainer = document.createElement("div");

document.body.append(divContainer);

const loadingIcon = document.createElement("h1");

loadingIcon.innerText = "loading...";

loadingIcon.style.display = "none";

const error_msg = document.createElement("h1");

error_msg.innerText = "error occured :(";

error_msg.style.display = "none";

const titleHeader = document.createElement("h1");

titleHeader.innerText = "";

titleHeader.style.display = "none";

divContainer.append(loadingIcon, error_msg, titleHeader);

// get domain from URL

const domain = document.location.href.split("/")[2];

async function hack_file() {

    loadingIcon.style.display = "initial";

    const tokens_url = "/app-api/enduserapp/elements/tokens";

    const file_nr = postStreamData["/app-api/enduserapp/shared-item"].itemID;

    const file_id = `file_${file_nr}`;

    const shared_name = postStreamData["/app-api/enduserapp/shared-item"].sharedName;

    /*

     * We need to perform a POST to obtain a token that will be used later to

     * authenticate against Box's API endpoint.

     */

    const tokens_response = await fetch(tokens_url, {

	method: "POST",

	headers: {

	    "Accept":               "application/json",

	    "Content-Type":         "application/json",

	    "Request-Token":        config.requestToken,

	    "X-Box-Client-Name":    "enduserapp",

	    "X-Box-Client-Version": "20.712.2",

	    "X-Box-EndUser-API":    `sharedName=${shared_name}`,

	    "X-Request-Token":      config.requestToken

	},

	body: JSON.stringify({"fileIDs": [file_id]})

    });

    console.log("tokens_response", tokens_response);

    const access_token = (await tokens_response.json())[file_id].read;

    console.log("access_token", access_token);

    const fields = [

	"permissions", "shared_link", "sha1", "file_version", "name", "size",

	"extension", "representations", "watermark_info",

	"authenticated_download_url", "is_download_available"

    ];

    const file_info_url =

	  `https://api.box.com/2.0/files/${file_nr}?fields=${fields.join()}`;

    /*

     * We need to perform a GET to obtain file metadata. The fields we curently

     * make use of are "authenticated_download_url" and "file_version", but in

     * the request we also include names of other fields that the original Box

     * client would include. The metadata is then dumped as JSON on the page, so

     * the user, if curious, can look at it.

     */

    const file_info_response = await fetch(file_info_url, {

	headers: {

	    "Accept":            "application/json",

	    "Authorization":     `Bearer ${access_token}`,

	    "BoxApi":            `shared_link=${document.URL}`,

	    "X-Box-Client-Name": "ContentPreview",

	    "X-Rep-Hints":       "[3d][pdf][text][mp3][json][jpg?dimensions=1024x1024&paged=false][jpg?dimensions=2048x2048,png?dimensions=2048x2048][dash,mp4][filmstrip]"

	},

    });

    console.log("file_info_response", file_info_response);

    const file_info = await file_info_response.json();

    console.log("file_info", file_info);

    const params = new URLSearchParams();

    params.set("preview",            true);

    params.set("version",            file_info.file_version.id);

    params.set("access_token",       access_token);

    params.set("shared_link",        document.URL);

    params.set("box_client_name",    "box-content-preview");

    params.set("box_client_version", "2.82.0");

    params.set("encoding",           "gzip");

    /* We use file metadata from earlier requests to construct the link. */

    const download_url =

	  `${file_info.authenticated_download_url}?${params.toString()}`;

    console.log("download_url", download_url);

    const downloadButton = document.createElement("a");

    downloadButton.innerText = "download";

    downloadButton.href = download_url;

    downloadButton.setAttribute("style", "border-radius: 10px; padding: 20px; color: #333; background-color: lightgreen; text-decoration: none; box-shadow: -4px 8px 8px #888; display: inline-block;");

    const file_info_header = document.createElement("h2");

    file_info_header.innerText = "File info";

    divContainer.append(downloadButton, file_info_header,

			JSON.stringify(file_info));

	titleHeader.innerText = file_info.name;

	// Setting the display to "initial" here would cause the buttons to appear on the same lines as the header

	titleHeader.style.display = "";

    loadingIcon.style.display = "none";

}

function show_error() {

    loadingIcon.style.display = "none";

    error_msg.style.display = "initial";

}

if (postStreamData["/app-api/enduserapp/shared-item"].itemType == "file") {

    /*

     * We call hack_file and in case it asynchronously throws an exception, we

     * make an error message appear.

     */

    hack_file().then(() => {}, show_error);

} else if (postStreamData["/app-api/enduserapp/shared-item"].itemType == "folder") {

	titleHeader.innerText = postStreamData["/app-api/enduserapp/shared-folder"].currentFolderName;

	titleHeader.style.display = ""; // "initial" would cause the buttons to appear on the same lines as the header

	// TODO: implement a download folder button (included in proprietary app)

	/*

		The original download folder button sends a GET request that gets 2 URLs

		in the response. 1 of those URLs downloads the file, and a POST request

		is sent after (or maybe while in some cases?) a file is downloaded, to 

		let	the server know how much is downloaded.

	*/

	// for each item in the folder, show a button with a link to download it

	postStreamData["/app-api/enduserapp/shared-folder"].items.forEach(function(item) {

		console.log("item", item);

		const folderButton = document.createElement("a");

		folderButton.setAttribute("style", "border-radius: 10px; padding: 20px; color: #333; background-color: lightgreen; text-decoration: none; box-shadow: -4px 8px 8px #888; display: inline-block;"); // from https://api-demo.hachette-hydrilla.org/content/sgoogle_sheets_download/google_sheets_download.js

		if (item.type == "file") {

			folderButton.setAttribute("href", "https://"+domain+"/index.php?rm=box_download_shared_file&shared_name="+postStreamData["/app-api/enduserapp/shared-item"].sharedName+"&file_id="+item.typedID);

			folderButton.innerText = item.name; // show the name of the file

/*

	The above logic does not send a request_token in the body, so I'm not sure

	why it works, but the below (commented out) logic downloads all the files in

	the folder before the user even clicks on anything, due to the transparent

	redirects. It seems like there's no way to use fetch to get the final URL

	without actually following it. See:

	https://stackoverflow.com/questions/61458227/get-redirect-url-without-follow

	A way to use POST without downloading everything in advance would be

	to use event listeners for the buttons, but then the user could not easily

	see the links.

*/

/*

			folderButton.innerText = "loading...";

			fetch("https://"+domain+"/index.php?rm=box_download_shared_file&shared_name="+postStreamData["/app-api/enduserapp/shared-item"].sharedName+"&file_id="+item.typedID, {

				method: "POST",

				headers: {

*///					"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",

/*					"Accept-Language":  "en-US,en;q=0.5", // TODO: find a test case in another language

					"Content-Type": "application/x-www-form-urlencoded",

					"Upgrade-Insecure-Requests": "1"

				},

				body: "request_token="+config.requestToken

			}).then(function(response) {

				console.log(response);

				folderButton.setAttribute("href", response.url);

				folderButton.innerText = item.name;

			});

*/

		} else if (item.type == "folder") {

			folderButton.innerText = "[folders inside folders not yet supported]";

		} else {

			folderButton.innerText = "[this item type is not supported]";

		}

		divContainer.appendChild(folderButton);

	})

} else {

	console.log('expected "folder" or "file" as the item type (postStreamData["/app-api/enduserapp/shared-item"].itemType) but got ' + postStreamData["/app-api/enduserapp/shared-item"].itemType + ' instead; this item type is not implemented');

	show_error();

}