Alright!
So first you need an X-CSRF-TOKEN, you can just make a request with your .ROBLOSECUIRTY to PATCH https://apis.roblox.com/assets/user-auth/v1/assets/ + rootPlaceId
So after that you need to assemble a body to upload data to the roblox servers
Here is the code for this:
var buf = Buffer.from(xmlCode).toString('hex')
var isPublish = (req.query.publish == 'true') ? (Buffer.from('true').toString('hex')) : Buffer.from('false').toString('hex')
var bodySend = Buffer.from('2d2d2d2d2d2d2d2d2d5075626c6973685365727669636543726561746541737365740d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2272657175657374220d0a0d0a7b22617373657454797065223a22506c616365222c2261737365744964223a' + Buffer.from(req.body.split('!!')[0]).toString('hex') + '2c227075626c6973686564223a' + isTrue + '2c226372656174696f6e436f6e74657874223a7b7d7d0d0a2d2d2d2d2d2d2d2d2d5075626c6973685365727669636543726561746541737365740d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2266696c65436f6e74656e74223b2066696c656e616d653d22636f6e74656e74546f55706c6f6164220d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a0d0a' + buf +'0d0a2d2d2d2d2d2d2d2d2d5075626c6973685365727669636543726561746541737365742d2d0d0a', 'hex')
So first, what
var buf = Buffer.from(xmlCode).toString('hex')
does is that it converts the xml file to hex code so i can integrate it with the other hex code
Then, (req.query.publish == 'true') ? (Buffer.from('true').toString('hex'))
means that it converts if you want to save it to the place or publish it in hex.
After this what
var bodySend = Buffer.from('2d2d2d2d2d2d2d2d2d5075626c6973685365727669636543726561746541737365740d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2272657175657374220d0a0d0a7b22617373657454797065223a22506c616365222c2261737365744964223a' + Buffer.from(req.body.split('!!')[0]).toString('hex') + '2c227075626c6973686564223a' + isTrue + '2c226372656174696f6e436f6e74657874223a7b7d7d0d0a2d2d2d2d2d2d2d2d2d5075626c6973685365727669636543726561746541737365740d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2266696c65436f6e74656e74223b2066696c656e616d653d22636f6e74656e74546f55706c6f6164220d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a0d0a' + buf +'0d0a2d2d2d2d2d2d2d2d2d5075626c6973685365727669636543726561746541737365742d2d0d0a', 'hex')
means is that, this large hex buffer is literaly just this
---------PublishServiceCreateAsset
Content-Disposition: form-data; name="request"
{"assetType":"Place","assetId": (placeId),"published":true,"creationContext":{}}
---------PublishServiceCreateAsset
Content-Disposition: form-data; name="fileContent"; filename="contentToUpload"
Content-Type: application/octet-stream
but as a buffer, the reason for all of this is roblox servers do not like it as text, it wants it as bytes, so use a buffer I convert the whole body to bytes.
Then, I just send then with a PATCH request and, with the headers of the cookie and then roblox place and universe id with these headers:
'Roblox-Place-Id': placeId,
'Roblox-Universe-Id': gameId
I get it that you may not understand it because roblox makes it more complicated then it needs to but idk