https://fuckstation.eu/scripts/synocredential.js/synocredential.min.js?v=1773131207

1var synocredential=function(e){"use strict";e=e&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e;var t=null;function o(){return new Promise(e=>{synowebapi.promises.request({api:"SYNO.Remote.Credential.Challenge",method:"get",version:1}).then(t=>t&&t.challenge?e([void 0,t.challenge]):e([t]))})}class i{constructor(e={}){this.opt=e}makeid(e){for(var t="",o="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",i=o.length,s=0;s<e;s++)t+=o.charAt(Math.floor(Math.random()*i));return t}async execute(e){return this.login(Object.assign({challenge_getter:o},e))}async login(e={}){Object.assign(this.opt,e);let o=e=>{this.opt.callback(e,this.opt)},i="width=600,height=800,toolbar=no,menubar=no";if(!this.opt.url||""===this.opt.url)return o({message:"no request url."}),this.cancel();if(null==t||t.closed){if(!(t=window.open("about:blank","childWindow",i))){let e=this.opt.appWin;return new Promise((t,o)=>{const i=_T("login","popup_blocked_desc"),s=_T("acl_editor","allow"),n=_T("common","cancel");e&&e._isVue?(async()=>{"confirm"===await e.getMsgBox().confirm(null,i,{confirm:{text:s},cancel:{text:n}},{useHtml:!0})?t():o()})():e?e.getMsgBox().confirm("",i,e=>{"yes"===e?t():o()},this,{yes:{text:s},no:{text:n}}):o()}).then(()=>{(t=window.open("about:blank","childWindow",i))?this.doChallenge(t,o):o({message:"open child window failed."})},()=>{o({message:"open child window failed."})})}this.doChallenge(t,o)}else t.focus()}async doChallenge(e,t){let o=this.opt.url,i=this.opt.client_id||"webui",s=this.opt.scope,n=this.opt.audience,r=this.opt.redirect_uri||window.origin,a=this.opt.session||"webui",c=this.opt.forceLogin,l={capture:!1};const[h,u]=await this.opt.challenge_getter();if(h||!u||""===u)return t({message:"challenge_getter execute failed."}),this.cancel();var d,g;g=e=>{let i,s,n;try{i=new URL(o),s=new URL(r),n=new URL(e.origin)}catch{return void t({code:1002,mssage:"some of url, redirect_uri, event.origin\tis invali

1d URL."})}n.hostname===s.hostname||n.hostname===i.hostname?e.target.origin.toUpperCase()===window.origin.toUpperCase()&&(clearInterval(d),window.removeEventListener("message",g,l),e.data&&e.data.code?e.data.rs?t({code:e.data.code,challenge:u,rs:e.data.rs}):t({code:e.data.code,challenge:u}):t({message:"request code failed."})):SYNO.Debug("PKCEClient","hostname not match",i.hostname,s.hostname,originUrl.hostname)},o+="?forceDesktop=1",o+="&client_id="+i,o+="&code_challenge="+u,o+="&code_challenge_method=S256",o+="&response_type=code",o+="&opener="+encodeURIComponent(window.origin),o+="&redirect_uri="+encodeURIComponent(r),o+="&state="+this.makeid(10),s&&(o+="&scope="+encodeURIComponent(s)),n&&(o+="&audience="+encodeURIComponent(n)),a&&(o+="&session="+a),c&&(o+="&force_login="+c),window.addEventListener("message",g,l),e.location=o,d=setInterval(()=>{e&&e.closed&&(clearInterval(d),window.removeEventListener("message",g,l),t({closed:!0}))},500)}logout(e){let t=this.opt.end_session_url+"?post_logout_redirect_uri="+this.opt.logout_redirect_uri+"&id_token_hint="+e;window.open(t,"childWindow","width=600,height=800,toolbar=no,menubar=no")}cancel(){t&&!t.closed&&t.close()}}const{createHash:s,randomBytes:n}=e;function r(e){return function(e,t){let o="";const i=n(e),s=Math.pow(2,8),r=s/Math.min(t.length,s);for(let s=0;s<e;s++){o+=t[Math.floor(i[s]/r)]}return o}(e,"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~")}function a(e){const t=s("sha256").update(e).digest("base64");return t.replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}var c=function(e){if(e||(e=43),e<43||e>128)throw`Expected a length between 43 and 128. Received ${e}.`;const t=r(e);return{code_challenge:a(t),code_verifier:t}};var l=function(e,t){return a(e)===t};c.verifyChallenge=l;const h="function"==typeof atob,u="function"==typeof btoa,d="function"==typeof Buffer,g=("function"==typeof TextDecoder&&new TextDecoder,"function"==typeof TextEncoder?new TextEncoder:void 0),_=[..."ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="],p=(e=>{let t={};return e.forEach((e,o)=>t[e]=o),t})(_),f=/^(?:[A-Za-z\d+\/]{4})*?(?:[A-Za-z\d+\/]{2}(?:==)?|[A-Za-z\d+\/]{3}=?)?$/,m=String.fromCharCode.bind(String),k="function"==typeof Uint8Array.from?Uint8Array.from.bind(Uint8Array):(e,t=(e=>e))=>new Uint8Array(Array.prototype.slice.call(e,0).map(t)),w=e=>e.replace(/[+\/]/g,e=>"+"==e?"-":"_").replace(/=+$/m,""),b=e=>e.replace(/[^A-Za-z0-9\+\/]/g,""),y=e=>{let t,o,i,s,n="";const r=e.length%3;for(let r=0;r<e.length;){if((o=e.charCodeAt(r++))>255||(i=e.charCodeAt(r++))>255||(s=e.charCodeAt(r++))>255)throw new TypeError("invalid character found");t=o<<16|i<<8|s,n+=_[t>>18&63]+_[t>>12&63]+_[t>>6&63]+_[63&t]}return r?n.slice(0,r-3)+"===".substring(r):n},S=u?e=>btoa(e):d?e=>Buffer.from(e,"binary").toString("base64"):y,v=d?e=>Buffer.from(e).toString("base64"):e=>{let t=[];for(let o=0,i=e.length;o<i;o+=4096)t.push(m.apply(null,e.subarray(o,o+4096)));return S(t.join(""))},O=(e,t=!1)=>t?w(v(e)):v(e),A=e=>{if(e.length<2)return(t=e.charCodeAt(0))<128?e:t<2048?m(192|t>>>6)+m(128|63&t):m(224|t>>>12&15)+m(128|t>>>6&63)+m(128|63&t);var t=65536+1024*(e.charCodeAt(0)-55296)+(e.charCodeAt(1)-56320);return m(240|t>>>18&7)+m(128|t>>>12&63)+m(128|t>>>6&63)+m(128|63&t)},R=/[\uD800-\uDBFF][\uDC00-\uDFFFF]|[^\x00-\x7F]/g,x=e=>e.replace(R,A),C=d?e=>Buffer.from(e,"utf8").toString("base64"):g?e=>v(g.encode(e)):e=>S(x(e)),T=(e,t=!1)=>t?w(C(e)):C(e),N=e=>{if(e=e.replace(/\s+/g,""),!f.test(e))throw new TypeError("malformed base64.");e+="==".slice(2-(3&e.length));let t,o,i,s="";for(let n=0;n<e.length;)t=p[e.charAt(n++)]<<18|p[e.charAt(n++)]<<12|(o=p[e.charAt(n++)])<<6|(i=p[e.charAt(n++)]),s+=64===o?m(t>>16&255):64===i?m(t>>16&255,t>>8&255):m(t>>16&255,t>>8&255,255&t);return s},P=h?e=>atob(b(e)):d?e=>Buffer.from(e,"base64").toString("binary"):N,I=d?e=>k(Buffer.from(e,"base64")):e=>k(P(e),e=>e.charCodeAt(0)),E=e=>I(U(e)),U=e=>b(e.replace(/[-_]/g,e=>"-"==e?"+":"/")),M=T,L=O,D=E;class H{constructor(e){return this.__noise_c=e,this}init(e,t,o,i){var s=Array();if("initiator"===t&&!o)return this.key_pair=s,!1;let n=this.__noise_c;if(i)s.push(i);else{let t;if("Noise_IK_25519_ChaChaPoly_BLAKE2b"===e&&(t=n.CreateKeyPair(n.constants.NOISE_DH_CURVE25519)),!t)return!1;s=t}return t="initiator"===t?n.constants.NOISE_ROLE_INITIATOR:n.constants.NOISE_ROLE_RESPONDER,this._handshake_state=n.HandshakeState(e,t),this._handshake_state.Initialize(null,s[0],o,null),this.key_pair=s,!0}writeMessage(e=""){var t=this._handshake_state;if(t)return t.WriteMessage(e)}readMessage(e){var t=this._handshake_state;if(t)return t.ReadMessage(e,!0),t.GetRemotePublicKey()}split(){var e=this._handshake_state;if(e){var t=e.Split();return t[0].n=0,t[1].n=0,this.__cipher_states=t,t}}encrypt(e,t){var o=this.__cipher_states;if(o)return o[0].EncryptWithAd(e,t)}getNonceNum(){var e=this.__cipher_states;if(e)return e[0].n++}}class Y{constructor(e,t={}){return Y._instance||(this.__noise_c=e,this.running=!1,this.opt={},this.info=Object.assign({headers:{},hsh:"",account:"",lhstime:Date.now(),authtok:""},t),Y._instance=this),Y._instance}issue(e={}){var t=e.callback;if("function"!=typeof t)return t({code:1e3,message:"no callback"});var o=e.url;return"string"!=typeof o?t({code:1e3,message:"no url"}):this.running?t({code:1e3,message:"already running."}):(this.running=!0,Object.assign(this.opt,e),this.runner=new i,void this.runner.login({url:o,challenge_getter:e.challenge_getter,forceLogin:"yes",callback:this.onLoginCallback.bind(this),appWin:e.appWin}))}onLoginCallback(e,t){let o=this.opt.callback;this.running=!1,e&&e.challenge&&e.code&&e.rs?o({url:t.url,challenge:e.challenge,code:e.code,rs:e.rs}):e&&e.message?o({code:1002,mssage:e.message}):e&&e.closed?o({code:1001}):o({code:1002,message:"Unknow"})}

1CreateChallenge(){return this._challenge=c(),this._challenge.code_challenge}GetLoginParams(e,t){var o=Object.assign({api:"SYNO.API.Auth",version:6,method:"login",session:"webui"},e);if(!this.__noise_c)return o;if(this.noise=new H(this.__noise_c),!this.info.authtok)try{this.info.authtok=JSON.parse(localStorage.getItem("lastHS")).authtok}catch{}let i=""!==this.info.authtok?D(this.info.authtok):void 0,s=D(t);if(!this.noise.init("Noise_IK_25519_ChaChaPoly_BLAKE2b","initiator",s,i))return o;let n=JSON.stringify({time:Math.floor(Date.now()/1e3)});return o.ik_message=L(this.noise.writeMessage(n),!0),o.version=7,e.code&&(o=Object.assign({type:"code",grant_type:"authorzation_code",code_verifier:this._challenge?this._challenge.code_verifier:"",client_id:""},o)),o}SetLoginResult(e){return this.info.cookie&&(e.sid&&(this.info.cookie.id=e.sid),e.device_id&&(this.info.cookie.did=e.device_id)),e.synotoken&&this.UpdateToken(e.synotoken),this.noise&&e.account&&e.ik_message&&this.noise.readMessage(D(e.ik_message))&&(this.info.hsh=L(this.noise._handshake_state.GetHandshakeHash(),!0),this.noise.split(),localStorage.setItem("lastHS",JSON.stringify({authtok:this.info.authtok=L(this.noise.key_pair[0],!0),account:this.info.account=e.account,lhstime:this.info.lhstime}))),this.info}GetLogoutParams(e){return Object.assign({api:"SYNO.API.Auth",method:"logout",version:7},e)}SetLogoutResult(){return delete this.noise,this.info.cookie&&delete this.info.cookie.id,delete this.info.headers["X-SYNO-TOKEN"],this.info.account="",this.info.authtok="",this.info}GetSuspendParams(e){return Object.assign({api:"SYNO.API.Auth",method:"suspend",version:7},e)}SetSuspendResult(){return delete this.noise,this.info.cookie&&delete this.info.cookie.id,delete this.info.headers["X-SYNO-TOKEN"],this.info}GetResumeParams(e,t){if(!this.__noise_c||!t)return;if(!this.info.account||!this.info.authtok)return;var o=localStorage.getItem("lastHS");if(o){var i=JSON.parse(o);i.account===this.info.account&&i.authtok!==this.info.authtok&&i.lhstime>this.info.lhstime&&(this.info.authtok=i.authtok,this.info.lhstime=i.lhstime)}let s=D(this.info.authtok),n=D(t);if(this.noise=new H(this.__noise_c),!this.noise.init("Noise_KK_25519_ChaChaPoly_BLAKE2b","initiator",n,s))return;let r=JSON.stringify({time:Math.floor(Date.now()/1e3)});return Object.assign({api:"SYNO.API.Auth",version:7,method:"resume",session:"webui",account:this.info.account,kk_message:L(this.noise.writeMessage(r),!0)},e)}SetResumeResult(e){return this.info.cookie&&e.sid&&(this.info.cookie.id=e.sid),e.synotoken&&this.UpdateToken(e.synotoken),this.noise&&e.kk_message&&this.noise.readMessage(D(e.kk_message))&&(this.info.hsh=L(this.noise._handshake_state.GetHandshakeHash(),!0),this.noise.split(),this.info.authtok=L(this.noise.key_pair[0],!0)),this.info}UpdateToken(e){const t=encodeURIComponent(e);this.info.headers["X-SYNO-TOKEN"]=t,SYNO.SDS.Session.SynoToken=t,synowebapi&&synowebapi.env.setSynoToken(SYNO.SDS.Session.SynoToken)}

1GetRequestParams(){return{}}GetRequestHeaders(e={}){if(e=Object.assign(e,this.info.headers),this.info.cookie){let t=this.info.cookie;e.Cookie=Object.keys(t).map(e=>e+"="+t[e]).join("; ")}let t=this.GetRequestHash();if(t&&(e["X-SYNO-HASH"]=t),window){window.self!==window.top&&(e["X-SYNO-FROM-IFRAME"]=!0)}return e}SetAccount(e){this.info.account=e}GetAccount(){return this.inf.account}SetAuthtok(e){this.info.authtok=e}GetAuthtok(){return this.info.authtok}GetRequestHash(){if(this.noise){var e=this.noise.encrypt(new Uint8Array,new Uint8Array),t=this.noise.getNonceNum(),o=this.info.hsh.slice(0,8);return e&&void 0!==t&&o?o+L(e,!0)+"."+M(""+t,!0):""}return""}WaitForReady(){return new Promise(e=>{this.resumePromise?this.resumePromise.then(e).catch(e):e()})}GetRemoteKey(){let e=document.cookie.match(/_SSID=[^;]+/);if(e)return e[0].split("=")[1]}Resume(){return this.resumePromise?this.resumePromise:(this.resumePromise=new Promise((e,t)=>{let o=this.GetRemoteKey();if(!o)return void t({code:119,message:"make resume parameters failed."});let i=this.GetResumeParams({enable_syno_token:"yes"},o);if(!o||!i)return void t({code:119,message:"make resume parameters failed."});let s=this;synowebapi.create().request({url:"webapi/entry.cgi?api=SYNO.API.Auth",requestFormat:"raw",responseFormat:"raw",method:"POST",params:i,callback:function(o,i){o&&i.data&&i.data.kk_message?(s.SetResumeResult(i.data),e()):t({code:119,message:"resume noise failed."})}})}),this.resumePromise.finally(()=>this.resumePromise=void 0))}}class B{async check(e){let t=e.forceLegacyMode||!1,o=e.url,i=e.appWin;return!0===t||!await this.isRemoteSupport(o)||!await this.isRemoteVisible(o,i)}issue(e){let t=e.appWin,o=e.callback,i=!1;SYNO.SDS.JSLoad("SYNO.SDS.Utils.AccountPasswordDialog",()=>{let e=SYNO.SDS.Utils.AccountPasswordDialog.openDialog(t,(e,t)=>{if(t&&e&&(""===e.account||""===e.passwd))return void t(!1,{text:_T("login","error_cantlogin"),clear:!0});let s;t||e||(i=!0),t&&(s=(e,o)=>{e&&(i=!0),t(e,o)}),o(e,s)});e.mon(e,"beforeclose",()=>{i||o()})},this)}isRemoteSupport(e){return new Promise((t,o)=>{synowebapi.request({api:"SYNO.Remote.Credential.Info",method:"get",version:1,params:{url:e},callback:(e,i)=>{e&&i?t(i.support_code_login):o(1002)}})})}isRemoteVisible(e,t){return new Promise((function(o,i){var s=new XMLHttpRequest;s.open("GET",e+"/webman/pingpong.cgi?action=cors"),s.onload=()=>{200==s.status?o(!0):o(!1,1002)},s.timeout=2e3,s.onerror=()=>{if(e.startsWith("https")){var i=String.format(_T("login","remote_network_error"),e),s=_T("login","btn_use_weblogin"),n=_T("login","btn_use_passwd");t&&t._isVue?(async()=>{o("confirm"===await t.getMsgBox().confirm(null,i,{confirm:{text:s},cancel:{text:n}},{useHtml:!0}))})():t?t.getMsgBox().confirm("",i,e=>{o("yes"===e)},this,{yes:{text:s},no:{text:n}}):o(!0)}else o(!1)},s.ontimeout=s.onerror,s.send()}))}}return Y.PKCEClient=i,Y.Issue=async function(e){let t=new B,i=e.callback,s=e.url,n={};if(s)try{n=new URL(s)}catch{return void i({code:1002,mssage:"url is invalid."})}else if(!e.mustHaveCredential)return void i({code:1002,mssage:"url is empty"});this.options=Object.assign({},e,{callback:((o,s)=>{if(o&&(o.challenge&&o.code&&o.rs||o.account&&o.passwd)){let r={protocol:"http:"===n.protocol?"http":"https",host:n.hostname||"",port:n.port||("http:"===n.protocol?"80":"443"),application:e.session};o.code?(r.code=o.code,r.rs=o.rs,r.challenge=o.challenge):(r.account=o.account,r.passwd=o.passwd,r.otp=o.otp),synowebapi.request({api:"SYNO.Remote.Credential",method:"set",version:1,params:r,callback:(e,o)=>{if(e&&o&&o.credential)s&&s(!0),i(o.credential);else if(1004===o.code&&s){if(!o.errors)return void s(!1,{text:_T("login","error_cantlogin"),clear:!0});switch(o.errors.code){case 401:s(!1,{text:_T("login","error_expired"),clear:!0});break;case 402:s(!1,{text:_T("login","error_noprivilege"),clear:!0});break;case 403:s(!1,{status:"need_otp"});break;case 404:s(!1,{text:_T("login","error_otp_failed"),clear:!0});break;case 406:s(!1,{text:_T("login","error_otp_enforced"),clear:!0});break;case 407:s(!1,{text:_T("login","error_max_tries"),clear:!0});break;case 408:s(!1,{text:_T("login","error_pwd_expired"),clear:!0});break;case 409:s(!1,{text:_T("login","error_remote_password_expired"),clear:!0});break;case 410:s(!1,{text:_T("login","error_auth_password_must_change"),clear:!0});break;case 412:s(!1,{text:_T("login","error_guest"),clear:!0});break;case 413:s(!1,{text:SYNO.SDS.formatString(_T("login","error_corrupted_otp_system_files"),'<a href="https://sy.to/reset2fa" target="_blank">',"</a>",'<a href="https://sy.to/resetnas" target="_blank">',"</a>"),clear:!0});break;case 414:case 416:s(!1,{text:_T("login","error_cantlogin"),clear:!0});break;case 417:s(!1,{text:_T("login","warn_otp_systemfull"),clear:!0});break;case 498:s(!1,{text:_T("login","error_upgrading"),clear:!0});break;case 499:s(!1,{text:_T("login","error_system_not_ready"),clear:!0});break;default:s(!1,{text:_T("login","error_cantlogin"),clear:!0})}}else if(1004===o.code){r.code&&o&&o.errors&&o.errors.code&&400===o.errors.code&&this.options.appWin||i({code:1004,auth_error:o.errors});let e=this,s=this.options.appWin;new Promise((e,t)=>

1{let o=_T("login","is_weblogin_failback_password");s._isVue?(async()=>{"confirm"===await s.getMsgBox().confirm(null,o)?e():t()})():s.getMsgBox().confirm("",o,o=>{"yes"===o?e():t()})}).then(()=>{e.running=!0,t.issue(e.options)},()=>{i({code:1004,auth_error:o.errors})})}else s?s(!1,{text:_T("login","error_cantlogin"),clear:!0}):i({code:1003,success:e,data:o})}})}else o&&o.message?(s&&s(!0),i({code:1002,mssage:o.message})):(s&&s(!0),i({code:1001}))}).bind(this)});let r=!0;try{r=await t.check(this.options)}catch(t){if(s="",n={},1002===t&&!e.mustHaveCredential)return void i({code:1002,mssage:"server connect failed."})}if(r)this.running=!0,t.issue(this.options);else{let e=new Y;this.options.challenge_getter=o,e.issue(this.options)}},Y}(crypto);