#!/bin/sh

if test $# -ne 1; then
  printf "Resolves a wetransfer.com link to a direct download one\n"
  printf "Usage: %s URL\n" "$0"
  exit 1
fi

download_url=$1
main_url=https://wetransfer.com/
api_url=https://wetransfer.com/api/v4/transfers

# resolve short URL
case $download_url in
  https://we.tl/*) download_url=$(curl -I "$download_url" | sed -n 's/Location: \(.*\)/\1/p')
esac

# grab a CSRF token
token=$(curl -s "$main_url" | sed -n 's/.*name="csrf-token" content="\([^"]\+\)".*/\1/p' )

# unpack the URL components
set -- $(echo "$download_url" | sed 's@.*downloads@@; s@/@ @g')
if test $# -eq 3; then
  transfer_id=$1; recipient_id=$2; security_hash=$3
elif test $# -eq 2; then
  transfer_id=$1; security_hash=$2
else
  echo "unknown URL format"
  exit 1
fi

# build the request payload
data=$(cat <<EOF
{ "intent": "entire_transfer",
  "security_hash": "${security_hash}",
  "recipient_id": "${recipient_id}"
}
EOF
)

# do a fake AJAX and extract the direct link
curl -s "${api_url}/${transfer_id}/download"         \
  -X POST                                            \
  -H "Content-Type: application/json; charset=utf-8" \
  -H "x-requested-with: XMLHttpRequest"              \
  -H "x-csrf-token: ${token}"                        \
  -d "$data"                                         \
  | sed -n 's/.*"direct_link": "\([^"]\+\)".*/\1/p'