Update webui/run_app.py

webui/run_app.py

@@ -113,7 +113,42 @@ async def get_system_status(key: str = "", request: Request = None):
             }
     except Exception:
         return { "thread_string": "0/6", "key_info": { "status": "failed", "type": "free", "show_test_panel": False } }
-
+# --- API CHUYÊN TRÁCH XỬ LÝ NÚT BẤM VALIDATE TOKEN (THÊM MỚI ĐỂ VÁ LỖI) ---
+@app.post("/api/validate-key")
+async def validate_user_key(request: Request):
+    try:
+        data = await request.json()
+        token = data.get("key", "").strip()
+    except Exception:
+        return JSONResponse(status_code=400, content={"status": "error", "message": "Invalid raw payload structure."})
+        
+    device_id = request.client.host if request else "MOBILE_DEFAULT_NODE"
+    
+    # Nếu để trống key, chặn ngay từ vòng gửi xe
+    if not token:
+        return JSONResponse(status_code=400, content={"status": "error", "message": "Access token cannot be empty!"})
+        
+    # Gọi licensing_client để kiểm tra tính hợp lệ thực tế
+    is_valid, key_info = licensing_client.verify_and_get_license_info(token, device_id)
+    
+    # NẾU KEY SAI/LỤI: Trả về trạng thái lỗi 401 Unauthorized để chặn đứng Frontend
+    if not is_valid:
+        return JSONResponse(
+            status_code=401, 
+            content={
+                "status": "error", 
+                "message": "Authentication Failed: Invalid or expired security token."
+            }
+        )
+        
+    # NẾU KEY ĐÚNG: Trả về thành công và đồng bộ dữ liệu VIP
+    return {
+        "status": "success",
+        "message": "Credentials verification payload synchronized.",
+        "tier": key_info.get("tier", "FREE").lower(),
+        "days_left": key_info.get("days_left", 0)
+    }
+    
 # --- API TRÍCH XUẤT LOG DIAGNOSTICS ĐỂ ĐẨY LÊN TERMINAL UI TỪNG GIÂY ---
 @app.get("/api/logs/{task_id}")
 async def get_task_logs(task_id: str):
@@ -483,6 +518,39 @@ async def index_page():
                 const keyDetails = document.getElementById("keyDetails");
                 const adminPanel = document.getElementById("adminTestPanel");
                 
+                if(data.key_info.status === "success") {{
+                    if(data.key_info.type === "admin") {{
+                        keyDetails.innerHTML = '<div class="text-emerald-600"><i class="fa-solid fa-crown text-base mr-1"></i> Core System Status: ACCESS GRANTED (ADMIN MASTER CONTROL)</div>';
+                        adminPanel.classList.remove("hidden");
+                        
+    <script>
+        let currentTaskId = null;
+        let logPollingTimer = null;
+        let runningStateActive = false;
+
+        const txtInput = document.getElementById("video_script");
+        const lblCounter = document.getElementById("charCounter");
+        
+        function enforceInputConstraints() {{
+            if(txtInput.value.length > 1500) {{
+                txtInput.value = txtInput.value.substring(0, 1500);
+            }}
+            lblCounter.innerText = txtInput.value.length + " / 1500 Chars";
+        }}
+        txtInput.addEventListener("input", enforceInputConstraints);
+        txtInput.addEventListener("paste", () => {{ setTimeout(enforceInputConstraints, 10); }});
+
+        async function runSystemStatusSync() {{
+            const currentToken = document.getElementById("licenseKey").value.trim();
+            try {{
+                const response = await fetch("/api/system-status?key=" + encodeURIComponent(currentToken));
+                const data = await response.json();
+                
+                document.getElementById("liveThreadMonitor").innerText = data.thread_string + " Running Threads";
+                
+                const keyDetails = document.getElementById("keyDetails");
+                const adminPanel = document.getElementById("adminTestPanel");
+                
                 if(data.key_info.status === "success") {{
                     if(data.key_info.type === "admin") {{
                         keyDetails.innerHTML = '<div class="text-emerald-600"><i class="fa-solid fa-crown text-base mr-1"></i> Core System Status: ACCESS GRANTED (ADMIN MASTER CONTROL)</div>';
@@ -495,10 +563,10 @@ async def index_page():
                         keyDetails.innerHTML = `
                             <div class="text-emerald-600 font-extrabold grid grid-cols-1 sm:grid-cols-2 gap-1 text-xs">
                                 <div><i class="fa-solid fa-check-circle"></i> SECURE TOKEN AUTHENTICATED</div>
-                                <div>🆔 TxID: \${{data.key_info.tx_id}}</div>
-                                <div>💰 Paid Metric: \${{data.key_info.amount}}</div>
-                                <div>📅 Registration: \${{data.key_info.issued_date}}</div>
-                                <div>⏳ Termination: \${{data.key_info.expiry_date}} (\${{data.key_info.days_left}} days remaining)</div>
+                                <div>🆔 TxID: $${{data.key_info.tx_id}}</div>
+                                <div>💰 Paid Metric: $${{data.key_info.amount}}</div>
+                                <div>📅 Registration: $${{data.key_info.issued_date}}</div>
+                                <div>⏳ Termination: $${{data.key_info.expiry_date}} ($${{data.key_info.days_left}} days remaining)</div>
                             </div>
                         `;
                     }}
@@ -510,6 +578,42 @@ async def index_page():
         }}
         setInterval(runSystemStatusSync, 1000);
 
+        // --- HÀM XỬ LÝ CHECK SỰ KIỆN VALIDATE TOKEN KHI BẤM NÚT (SỬA LỖI NHẬP LỤI) ---
+        async function triggerVerificationHandshake() {{
+            const currentToken = document.getElementById("licenseKey").value.trim();
+            const keyDetails = document.getElementById("keyDetails");
+            
+            if (!currentToken) {{
+                alert("❌ Please enter a token before validation!");
+                return;
+            }}
+            
+            try {{
+                // Gọi trực tiếp đến API POST kiểm tra key chuyên dụng ở Backend
+                const response = await fetch("/api/validate-key", {{
+                    method: "POST",
+                    headers: {{ "Content-Type": "application/json" }},
+                    body: JSON.stringify({{ key: currentToken }})
+                }});
+                
+                const data = await response.json();
+                
+                if (!response.ok) {{
+                    // Nếu backend trả về 401 hoặc lỗi chặn, quăng lỗi xuống block catch bên dưới
+                    throw new Error(data.message || "Invalid or expired security token.");
+                }}
+                
+                // CHỈ BẮN THÔNG BÁO KHI KEY THỰC SỰ CHUẨN
+                alert("💚 " + data.message);
+                await runSystemStatusSync(); // Đồng bộ lại giao diện VIP/ADMIN ngay lập tức
+                
+            }} catch (error) {{
+                // NẾU KEY SAI HOẶC BẤM LỤI: Báo lỗi đỏ và khóa quyền
+                alert("❌ " + error.message);
+                keyDetails.innerHTML = '<div><i class="fa-solid fa-circle-exclamation mr-1"></i> License Status: Authentication Failed (Token Rejected)</div>';
+            }}
+        }}
+
         function fetchLiveTerminalOutput() {{
             if (!currentTaskId) return;
             fetch("/api/logs/" + currentTaskId)
@@ -539,7 +643,7 @@ async def index_page():
             const targetBtn = document.getElementById("mainSubmitBtn");
             const iconObj = document.getElementById("btnIcon");
             const textObj = document.getElementById("btnText");
-            const currentToken = document.getElementById("licenseKey").value;
+            const currentToken = document.getElementById("licenseKey").value.trim();
             
             if(runningStateActive) {{
                 if(confirm("Do you want to terminate the active rendering cycle immediately?")) {{
@@ -604,15 +708,10 @@ async def index_page():
             textObj.innerText = "GENERATE PRODUCTION VIDEO";
             iconObj.className = "fa-solid fa-play";
         }}
-
-        function triggerVerificationHandshake() {{
-            runSystemStatusSync();
-            alert("Credentials verification payload synchronized.");
-        }}
     </script>
 </body>
 </html>
-    """
+
     return HTMLResponse(content=html_content)
 
 if __name__ == "__main__":