fix(mobile): support HTTP proxy after SMS registration

src/auth/__tests__/credentials-flow.test.ts

@@ -192,6 +192,35 @@ test('buildCommsConfig maps ws proxy agent when provided', async () => {
     wsAgent.destroy()
 })
 
+test('buildCommsConfig forwards the ws proxy agent to a mobile TCP session', async () => {
+    const wsAgent = Object.assign(new http.Agent({ keepAlive: true }), {
+        proxy: new URL('http://127.0.0.1:3128')
+    })
+    const config = await buildCommsConfig(
+        createNoopLogger(),
+        {
+            ...createCredentials(),
+            deviceInfo: {
+                manufacturer: 'Google',
+                device: 'panther',
+                osVersion: '14',
+                osBuildNumber: 'AP3A',
+                appVersion: '2.26.15.11'
+            }
+        },
+        {
+            proxy: {
+                ws: wsAgent
+            }
+        },
+        { requireFullSync: false }
+    )
+
+    assert.equal(config.agent, wsAgent)
+    assert.ok(config.rawWebSocketConstructor)
+    wsAgent.destroy()
+})
+
 test('buildCommsConfig falls back to credentials.deviceInfo when mobileTransport option is absent', async () => {
     const credentials: WaAuthCredentials = {
         ...createCredentials(),

src/auth/credentials-flow.ts

@@ -180,11 +180,6 @@ export async function buildCommsConfig(
     }
 
     if (effectiveMobileTransport) {
-        if (wsProxy) {
-            throw new Error(
-                'mobileTransport does not support socketOptions.proxy.ws – remove the proxy option or open an issue to add TCP proxy support'
-            )
-        }
         if (!loginIdentity) {
             throw new Error(
                 'mobileTransport requires registered credentials (meJid) – run the mobile bridge flow first'
@@ -209,6 +204,7 @@ export async function buildCommsConfig(
         return {
             url: effectiveMobileTransport.tcpUrl ?? 'tcp://g.whatsapp.net:443',
             rawWebSocketConstructor: WaMobileTcpSocketCtor,
+            agent: toProxyAgent(wsProxy),
             connectTimeoutMs: socketOptions.connectTimeoutMs,
             reconnectIntervalMs: socketOptions.reconnectIntervalMs,
             timeoutIntervalMs: socketOptions.timeoutIntervalMs,

src/transport/node/WaMobileTcpSocket.ts

@@ -7,7 +7,7 @@ import type {
     WaRawWebSocketInit,
     WebSocketEventLike
 } from '@transport/types'
-import { TEXT_ENCODER } from '@util/bytes'
+import { bytesToBase64, concatBytes, TEXT_DECODER, TEXT_ENCODER } from '@util/bytes'
 
 /**
  * `RawWebSocket`-shaped adapter over a raw Node TCP socket. Used by the
@@ -28,21 +28,61 @@ export class WaMobileTcpSocket implements RawWebSocket {
     private closedClean = true
     private forceCloseTimer: NodeJS.Timeout | null = null
 
-    public constructor(url: string, _protocols?: unknown, _options?: WaRawWebSocketInit) {
+    public constructor(url: string, _protocols?: unknown, options?: WaRawWebSocketInit) {
         const { host, port } = parseTcpUrl(url)
-        this.socket = netConnect({ host, port })
+        const proxy = resolveHttpProxy(options?.agent)
+        this.socket = proxy
+            ? netConnect({ host: proxy.hostname, port: proxy.port })
+            : netConnect({ host, port })
+
+        let tunnelReady = proxy === null
+        let proxyResponse: Uint8Array = new Uint8Array(0)
 
         this.socket.on('connect', () => {
             if (this.readyState !== WA_READY_STATES.CONNECTING) return
-            this.readyState = WA_READY_STATES.OPEN
-            this.onopen?.({})
+            if (proxy) {
+                const authority = `${host}:${port}`
+                const lines = [
+                    `CONNECT ${authority} HTTP/1.1`,
+                    `Host: ${authority}`,
+                    'Proxy-Connection: Keep-Alive'
+                ]
+                if (proxy.authorization) lines.push(`Proxy-Authorization: ${proxy.authorization}`)
+                this.socket.write(TEXT_ENCODER.encode(`${lines.join('\r\n')}\r\n\r\n`))
+                return
+            }
+            this.markOpen()
         })
 
         this.socket.on('data', (chunk: Uint8Array) => {
-            if (!this.onmessage || this.readyState !== WA_READY_STATES.OPEN) return
-            const copy = new Uint8Array(chunk.byteLength)
-            copy.set(chunk)
-            this.onmessage({ data: copy })
+            if (!tunnelReady && proxy) {
+                proxyResponse = concatBytes([proxyResponse, chunk])
+                const headerEnd = findHttpHeaderEnd(proxyResponse)
+                if (headerEnd === -1) {
+                    if (proxyResponse.byteLength > 65_536) {
+                        this.socket.destroy(
+                            new Error('WaMobileTcpSocket: proxy response headers too large')
+                        )
+                    }
+                    return
+                }
+                const statusLine = TEXT_DECODER.decode(proxyResponse.subarray(0, headerEnd)).split(
+                    '\r\n'
+                )[0]
+                if (!/^HTTP\/1\.[01] 2\d\d(?:\s|$)/.test(statusLine)) {
+                    this.socket.destroy(
+                        new Error(`WaMobileTcpSocket: proxy CONNECT failed (${statusLine})`)
+                    )
+                    return
+                }
+                const remaining = proxyResponse.subarray(headerEnd + 4)
+                proxyResponse = new Uint8Array(0)
+                tunnelReady = true
+                this.markOpen()
+                if (remaining.byteLength > 0) this.emitMessage(remaining)
+                return
+            }
+            this.emitMessage(chunk)
         })
 
         this.socket.on('error', (err: Error) => {
@@ -66,6 +106,19 @@ export class WaMobileTcpSocket implements RawWebSocket {
         })
     }
 
+    private markOpen(): void {
+        if (this.readyState !== WA_READY_STATES.CONNECTING) return
+        this.readyState = WA_READY_STATES.OPEN
+        this.onopen?.({})
+    }
+
+    private emitMessage(chunk: Uint8Array): void {
+        if (!this.onmessage || this.readyState !== WA_READY_STATES.OPEN) return
+        const copy = new Uint8Array(chunk.byteLength)
+        copy.set(chunk)
+        this.onmessage({ data: copy })
+    }
+
     public send(data: string | ArrayBuffer | Uint8Array): void {
         if (this.readyState !== WA_READY_STATES.OPEN) {
             throw new Error('WaMobileTcpSocket: send() called on non-OPEN socket')
@@ -97,6 +150,41 @@ export class WaMobileTcpSocket implements RawWebSocket {
     }
 }
 
+interface ResolvedHttpProxy {
+    readonly hostname: string
+    readonly port: number
+    readonly authorization?: string
+}
+
+function resolveHttpProxy(agent: WaRawWebSocketInit['agent']): ResolvedHttpProxy | null {
+    const value = (agent as unknown as { readonly proxy?: URL | string } | undefined)?.proxy
+    if (value === undefined) return null
+    const proxy = value instanceof URL ? value : new URL(value)
+    if (proxy.protocol !== 'http:') {
+        throw new Error(`WaMobileTcpSocket: unsupported proxy protocol ${proxy.protocol}`)
+    }
+    const username = decodeURIComponent(proxy.username)
+    const password = decodeURIComponent(proxy.password)
+    const authorization =
+        username || password
+            ? `Basic ${bytesToBase64(TEXT_ENCODER.encode(`${username}:${password}`))}`
+            : undefined
+    return {
+        hostname: proxy.hostname,
+        port: proxy.port ? Number(proxy.port) : 80,
+        authorization
+    }
+}
+
+function findHttpHeaderEnd(bytes: Uint8Array): number {
+    for (let i = 3; i < bytes.byteLength; i += 1) {
+        if (bytes[i - 3] === 13 && bytes[i - 2] === 10 && bytes[i - 1] === 13 && bytes[i] === 10) {
+            return i - 3
+        }
+    }
+    return -1
+}
+
 function parseTcpUrl(url: string): { host: string; port: number } {
     let work = url
     if (work.startsWith('tcp://')) {

src/transport/node/__tests__/WaMobileTcpSocket.test.ts

@@ -1,4 +1,6 @@
 import assert from 'node:assert/strict'
+import type { Agent } from 'node:http'
+import { createServer } from 'node:net'
 import test from 'node:test'
 
 import { WA_READY_STATES } from '@protocol/constants'
@@ -57,3 +59,58 @@ test('WaMobileTcpSocket.close is idempotent when already CLOSED', () => {
             socket.readyState === WA_READY_STATES.CLOSED
     )
 })
+
+test('WaMobileTcpSocket tunnels mobile TCP through an authenticated HTTP CONNECT proxy', async (t) => {
+    let request = ''
+    const server = createServer((peer) => {
+        let pending = Buffer.alloc(0)
+        peer.on('data', (chunk) => {
+            if (request) {
+                peer.write(chunk)
+                return
+            }
+            pending = Buffer.concat([pending, chunk])
+            const end = pending.indexOf('\r\n\r\n')
+            if (end === -1) return
+            request = pending.subarray(0, end).toString('latin1')
+            const remaining = pending.subarray(end + 4)
+            peer.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+            if (remaining.byteLength > 0) peer.write(remaining)
+        })
+    })
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve))
+    const address = server.address()
+    assert.ok(address && typeof address === 'object')
+    const agent = {
+        proxy: new URL(`http://proxy-user:proxy-pass@127.0.0.1:${address.port}`)
+    } as unknown as Agent
+    const socket = new WaMobileTcpSocket('tcp://g.whatsapp.net:443', undefined, { agent })
+    t.after(() => {
+        socket.close()
+        server.close()
+    })
+    socket.onerror = (event) => assert.fail(`unexpected proxy socket error: ${event.reason}`)
+
+    await new Promise<void>((resolve, reject) => {
+        const timer = setTimeout(() => {
+            socket.close()
+            reject(new Error(`proxy open timeout; request=${request}`))
+        }, 2_000)
+        socket.onopen = () => {
+            clearTimeout(timer)
+            resolve()
+        }
+    })
+    assert.match(request, /^CONNECT g\.whatsapp\.net:443 HTTP\/1\.1/m)
+    assert.match(request, /Proxy-Authorization: Basic cHJveHktdXNlcjpwcm94eS1wYXNz/i)
+
+    const received = new Promise<Uint8Array>((resolve, reject) => {
+        const timer = setTimeout(() => reject(new Error('proxy echo timeout')), 2_000)
+        socket.onmessage = (event) => {
+            clearTimeout(timer)
+            resolve(event.data as Uint8Array)
+        }
+    })
+    socket.send(new Uint8Array([1, 2, 3]))
+    assert.deepEqual(await received, new Uint8Array([1, 2, 3]))
+})