Akamai SBSD interstitial cookies

// akamai-sbsd-playwright.js - solve Akamai SBSD and open the protected page with the returned
// cookie jar.
// Install: npm install playwright && npx playwright install chromium
// Run: node akamai-sbsd-playwright.js

const { chromium } = require('playwright');
const { setTimeout: sleep } = require('node:timers/promises');

// Your SurSolver API key.
const CLIENT_KEY = 'YOUR_API_KEY';
// The protected page that answers with the SBSD interstitial.
const TARGET_URL = 'https://example.com/page';
// The proxy for the solve and the replay: http://user:pass@host:port or socks5://host:port.
const PROXY_URL = 'http://username:password@proxy.example.com:8080';
// Optional, read from the page when empty: every script URL the interstitial loads, in order,
// with query strings.
const SCRIPT_URLS = undefined;
// A protected same-origin path that must answer 200 after the solve, such as /account.
const VERIFY_PATH = '';
// A selector that matches only after the site accepted the result.
const SUCCESS_SELECTOR = '.PASTE_ACCEPTED_SELECTOR';

const API = 'https://api.sursolver.com';
const POLL_ATTEMPTS = 60;

// API errors are HTTP 200 with errorId 1; anything else is a transport failure.
async function call(path, body) {
  const res = await fetch(`${API}${path}`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(body),
  });
  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  const data = await res.json();
  if (data.errorId !== 0) throw new Error(`${data.errorCode}: ${data.errorDescription}`);
  return data;
}

async function solve(task) {
  const created = await call('/createTask', { clientKey: CLIENT_KEY, task });

  for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt += 1) {
    const result = await call('/getTaskResult', {
      clientKey: CLIENT_KEY,
      taskId: created.taskId,
    });
    if (result.status === 'ready') return result.solution;
    await sleep(3000);
  }
  throw new Error(`task ${created.taskId} was not ready in ${POLL_ATTEMPTS} polls`);
}

// Optional task fields are sent only when they have a value.
function withoutEmpty(fields) {
  return Object.fromEntries(
    Object.entries(fields).filter(([, value]) => value !== undefined && value !== ''),
  );
}

// A value the page did not show must be pasted into its constant at the top.
function need(name, value) {
  if (value === undefined || value === null || value === '') {
    throw new Error(`Could not read ${name} from the page; fill in the ${name} constant.`);
  }
  return value;
}

// Chromium takes the proxy as a server plus credentials rather than one URL.
// It cannot send credentials to a SOCKS5 proxy; use an http:// proxy for browser runs.
function proxyOption(proxyUrl) {
  const url = new URL(proxyUrl);
  return {
    server: `${url.protocol}//${url.host}`,
    ...(url.username
      ? { username: decodeURIComponent(url.username), password: decodeURIComponent(url.password) }
      : {}),
  };
}

// The jar holds one JSON cookie per line; Playwright needs a domain and a path on each.
function jarToCookies(jar) {
  return jar
    .split('\n')
    .filter(Boolean)
    .map((line) => JSON.parse(line))
    .map((cookie) => ({
      name: cookie.name,
      value: cookie.value,
      domain: cookie.host_only ? cookie.host : `.${cookie.host.replace(/^\./, '')}`,
      path: cookie.path,
      secure: cookie.secure,
      httpOnly: cookie.http_only,
      ...(cookie.persistent && cookie.expires_ms ? { expires: cookie.expires_ms / 1000 } : {}),
    }));
}

// Opens the interstitial through the proxy and reads its scripts, HTML and cookies.
async function readPage(browser) {
  const context = await browser.newContext();
  const page = await context.newPage();
  try {
    const response = await page.goto(TARGET_URL);
    const scriptUrls = await page.evaluate(
      () => [...document.scripts]
        .map((script) => script.src)
        .filter(Boolean),
    );
    const cookies = (await context.cookies())
      .map((cookie) => `${cookie.name}=${cookie.value}`)
      .join('; ');
    return { pageUrl: page.url(), scriptUrls, pageData: await response.text(), cookies };
  } finally {
    await context.close();
  }
}

async function main() {
  const browser = await chromium.launch({ proxy: proxyOption(PROXY_URL) });
  try {
    const found = await readPage(browser);
    const solution = await solve({
      type: 'AkamaiSbsdCookie',
      websiteURL: found.pageUrl,
      scriptUrls: need('scriptUrls', SCRIPT_URLS || found.scriptUrls),
      pageData: found.pageData,
      ...withoutEmpty({ cookies: found.cookies }),
      ...withoutEmpty({
        verify: VERIFY_PATH,
      }),
      proxy: PROXY_URL,
    });
    if (!solution.cookies) throw new Error('The solve returned no cookie jar.');

    // Replay with the user agent the solve presented, through the same proxy.
    const context = await browser.newContext(
      solution.userAgent ? { userAgent: solution.userAgent } : {},
    );
    await context.addCookies(jarToCookies(solution.cookies));
    const page = await context.newPage();
    await page.goto(found.pageUrl, { waitUntil: 'domcontentloaded' });
    await page.locator(SUCCESS_SELECTOR).first().waitFor({ timeout: 15000 });
    console.log('The site served the protected page.');
  } finally {
    await browser.close();
  }
}

main().catch((error) => {
  console.error(error);
  process.exitCode = 1;
});