Create app.py

app.py

@@ -0,0 +1,310 @@
+import os, io, json, subprocess, tempfile, secrets, shutil
+from datetime import datetime, timedelta
+from typing import Optional
+from pathlib import Path
+
+from fastapi import FastAPI, UploadFile, File, HTTPException, Depends, Form, Request
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse, HTMLResponse, PlainTextResponse
+from pydantic import BaseModel
+from passlib.context import CryptContext
+from jose import JWTError, jwt
+
+# ── Config ────────────────────────────────────────────────────────────────────
+SECRET_KEY        = os.environ.get("SECRET_KEY", "php-hosting-secret-key-change-me")
+ALGORITHM         = "HS256"
+TOKEN_EXPIRE_MINS = 60 * 24 * 7   # 7 days
+
+MAX_FILE_BYTES    = 25 * 1024 * 1024        # 25 MB per file
+MAX_USER_BYTES    = 500 * 1024 * 1024       # 500 MB per user
+MAX_TOTAL_BYTES   = 15 * 1024 * 1024 * 1024 # 15 GB total
+
+# ── Storage paths (HF persistent storage) ─────────────────────────────────────
+DATA_DIR  = Path("/data")
+USERS_DIR = DATA_DIR / "users"   # /data/users/<username>/<repo>/<files>
+DB_FILE   = DATA_DIR / "db" / "users.json"
+
+USERS_DIR.mkdir(parents=True, exist_ok=True)
+DB_FILE.parent.mkdir(parents=True, exist_ok=True)
+
+# ── Simple JSON database ───────────────────────────────────────────────────────
+def load_db() -> dict:
+    if DB_FILE.exists():
+        try:
+            return json.loads(DB_FILE.read_text())
+        except:
+            return {}
+    return {}
+
+def save_db(db: dict):
+    DB_FILE.write_text(json.dumps(db, indent=2))
+
+# ── Security ───────────────────────────────────────────────────────────────────
+pwd_ctx = CryptContext(schemes=["bcrypt"], deprecated="auto")
+
+def hash_password(p: str) -> str:
+    return pwd_ctx.hash(p)
+
+def verify_password(plain: str, hashed: str) -> bool:
+    return pwd_ctx.verify(plain, hashed)
+
+def create_jwt(data: dict):
+    to_encode = data.copy()
+    expire = datetime.utcnow() + timedelta(minutes=TOKEN_EXPIRE_MINS)
+    to_encode.update({"exp": expire})
+    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
+
+def decode_jwt(token: str):
+    try:
+        return jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
+    except JWTError:
+        return None
+
+# ── Storage helpers ────────────────────────────────────────────────────────────
+def user_dir(username: str) -> Path:
+    p = USERS_DIR / username
+    p.mkdir(parents=True, exist_ok=True)
+    return p
+
+def repo_dir(username: str, repo: str) -> Path:
+    p = user_dir(username) / repo
+    p.mkdir(parents=True, exist_ok=True)
+    return p
+
+def get_dir_size(path: Path) -> int:
+    return sum(f.stat().st_size for f in path.rglob("*") if f.is_file())
+
+def get_total_storage() -> int:
+    if USERS_DIR.exists():
+        return get_dir_size(USERS_DIR)
+    return 0
+
+# ── Auth dependency ────────────────────────────────────────────────────────────
+def get_current_user(request: Request) -> dict:
+    auth = request.headers.get("Authorization", "")
+    if not auth.startswith("Bearer "):
+        raise HTTPException(401, "Missing token")
+    payload = decode_jwt(auth.split(" ")[1])
+    if not payload:
+        raise HTTPException(401, "Invalid or expired token")
+    username = payload.get("sub")
+    db = load_db()
+    if username not in db:
+        raise HTTPException(401, "User not found")
+    return db[username]
+
+# ── App ────────────────────────────────────────────────────────────────────────
+app = FastAPI(title="PHP Hosting Backend")
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=["*"],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
+# ── Routes ─────────────────────────────────────────────────────────────────────
+
+@app.get("/")
+def root():
+    return {"status": "PHP Hosting Backend is running"}
+
+# ── Register ─────────────────────────────────────────────────────────────────��─
+class RegisterBody(BaseModel):
+    username: str
+    password: str
+
+@app.post("/auth/register")
+def register(body: RegisterBody):
+    if len(body.username) < 3:
+        raise HTTPException(400, "Username must be at least 3 characters")
+    if not body.username.isalnum():
+        raise HTTPException(400, "Username must be letters and numbers only")
+    if len(body.password) < 8:
+        raise HTTPException(400, "Password must be at least 8 characters")
+
+    db = load_db()
+    if body.username in db:
+        raise HTTPException(400, "Username already taken")
+
+    db[body.username] = {
+        "username":      body.username,
+        "password_hash": hash_password(body.password),
+        "created_at":    datetime.utcnow().isoformat(),
+    }
+    save_db(db)
+
+    # Create user folder immediately
+    user_dir(body.username)
+
+    token = create_jwt({"sub": body.username})
+    return {
+        "access_token": token,
+        "token_type":   "bearer",
+        "username":     body.username,
+        "message":      "Account created successfully!"
+    }
+
+# ── Login ──────────────────────────────────────────────────────────────────────
+class LoginBody(BaseModel):
+    username: str
+    password: str
+
+@app.post("/auth/login")
+def login(body: LoginBody):
+    db = load_db()
+    user = db.get(body.username)
+    if not user or not verify_password(body.password, user["password_hash"]):
+        raise HTTPException(401, "Invalid username or password")
+    token = create_jwt({"sub": body.username})
+    return {
+        "access_token": token,
+        "token_type":   "bearer",
+        "username":     body.username,
+    }
+
+# ── Upload files ───────────────────────────────────────────────────────────────
+@app.post("/upload")
+async def upload_files(
+    repo: str = Form(...),
+    files: list[UploadFile] = File(...),
+    user: dict = Depends(get_current_user)
+):
+    if not repo.isalnum():
+        raise HTTPException(400, "Repo name must be letters and numbers only")
+
+    # Check total storage
+    total = get_total_storage()
+    if total >= MAX_TOTAL_BYTES:
+        raise HTTPException(507, "Platform storage full. Contact admin.")
+
+    # Check user storage
+    udir = user_dir(user["username"])
+    user_used = get_dir_size(udir)
+    if user_used >= MAX_USER_BYTES:
+        raise HTTPException(507, "Your storage limit (500 MB) reached.")
+
+    rdir = repo_dir(user["username"], repo)
+    uploaded = []
+
+    for f in files:
+        content = await f.read()
+        if len(content) > MAX_FILE_BYTES:
+            raise HTTPException(413, f"{f.filename} exceeds 25 MB limit")
+
+        safe_name = Path(f.filename).name
+        file_path = rdir / safe_name
+        file_path.write_bytes(content)
+
+        uploaded.append({
+            "filename": safe_name,
+            "size":     len(content),
+            "url":      f"https://php-hosting.emalawi.workers.dev/{user['username']}/{repo}/{safe_name}"
+        })
+
+    return {
+        "uploaded": uploaded,
+        "repo":     repo,
+        "repo_url": f"https://php-hosting.emalawi.workers.dev/{user['username']}/{repo}"
+    }
+
+# ── List repos and files ───────────────────────────────────────────────────────
+@app.get("/files")
+def list_files(user: dict = Depends(get_current_user)):
+    udir = user_dir(user["username"])
+    repos = []
+    for repo_path in sorted(udir.iterdir()):
+        if repo_path.is_dir():
+            files = []
+            for fp in sorted(repo_path.iterdir()):
+                if fp.is_file():
+                    files.append({
+                        "filename":  fp.name,
+                        "size":      fp.stat().st_size,
+                        "url":       f"https://php-hosting.emalawi.workers.dev/{user['username']}/{repo_path.name}/{fp.name}"
+                    })
+            repos.append({
+                "repo":     repo_path.name,
+                "repo_url": f"https://php-hosting.emalawi.workers.dev/{user['username']}/{repo_path.name}",
+                "files":    files
+            })
+    used = get_dir_size(udir)
+    return {
+        "username": user["username"],
+        "repos":    repos,
+        "used_mb":  round(used / (1024 * 1024), 2),
+        "limit_mb": 500
+    }
+
+# ── Delete file ────────────────────────────────────────────────────────────────
+@app.delete("/files/{repo}/{filename}")
+def delete_file(repo: str, filename: str, user: dict = Depends(get_current_user)):
+    fp = USERS_DIR / user["username"] / repo / filename
+    if not fp.exists():
+        raise HTTPException(404, "File not found")
+    fp.unlink()
+    return {"message": f"{filename} deleted"}
+
+# ── Delete repo ────────────────────────────────────────────────────────────────
+@app.delete("/repo/{repo}")
+def delete_repo(repo: str, user: dict = Depends(get_current_user)):
+    rdir = USERS_DIR / user["username"] / repo
+    if not rdir.exists():
+        raise HTTPException(404, "Repo not found")
+    shutil.rmtree(rdir)
+    return {"message": f"Repo {repo} deleted"}
+
+# ── Serve PHP / static files (called by Cloudflare Worker) ────────────────────
+@app.get("/serve/{username}/{repo}/{filename:path}")
+def serve_file(username: str, repo: str, filename: str):
+    file_path = USERS_DIR / username / repo / filename
+    if not file_path.exists():
+        raise HTTPException(404, "File not found")
+
+    content = file_path.read_bytes()
+
+    if filename.endswith(".php"):
+        with tempfile.NamedTemporaryFile(suffix=".php", delete=False) as tmp:
+            tmp.write(content)
+            tmp_path = tmp.name
+        try:
+            result = subprocess.run(
+                ["php", tmp_path],
+                capture_output=True, text=True, timeout=30
+            )
+            output = result.stdout
+            if result.returncode != 0:
+                output = f"<pre style='color:red'>PHP Error:\n{result.stderr}</pre>"
+        except subprocess.TimeoutExpired:
+            output = "<pre style='color:red'>Error: Script timed out (30s limit)</pre>"
+        finally:
+            os.unlink(tmp_path)
+        return HTMLResponse(content=output)
+
+    # Serve static files
+    ext = filename.split(".")[-1].lower()
+    mime_map = {
+        "html": "text/html", "css": "text/css",
+        "js":   "application/javascript", "json": "application/json",
+        "png":  "image/png", "jpg": "image/jpeg",
+        "gif":  "image/gif", "svg": "image/svg+xml",
+        "txt":  "text/plain"
+    }
+    mime = mime_map.get(ext, "application/octet-stream")
+    from fastapi.responses import Response
+    return Response(content=content, media_type=mime)
+
+# ── Storage stats (admin) ──────────────────────────────────────────────────────
+@app.get("/storage")
+def storage_stats(user: dict = Depends(get_current_user)):
+    udir = user_dir(user["username"])
+    user_used = get_dir_size(udir)
+    total_used = get_total_storage()
+    return {
+        "user_used_mb":   round(user_used / (1024 * 1024), 2),
+        "user_limit_mb":  500,
+        "total_used_gb":  round(total_used / (1024 ** 3), 3),
+        "total_limit_gb": 15,
+        "percent_used":   round((user_used / MAX_USER_BYTES) * 100, 2)
+    }