Update app.js

app.js

@@ -1,37 +1,74 @@
-Const express = require('express');
+const express = require('express');
 const admin = require('firebase-admin');
 const crypto = require('crypto');
 const cluster = require('cluster');
 const os = require('os');
 
-// সার্ভারের মোট সিপিইউ কোর সংখ্যা স্বয়ংক্রিয়ভাবে ডিটেক্ট করা (১২ কোর হলে ১২টি প্রসেস তৈরি হবে)
 const numCPUs = os.cpus().length;
 
 if (cluster.isMaster) {
-    console.log(`Master Server Process ${process.pid} is running. Detecting ${numCPUs} CPU cores...`);
-
-    // প্রতিটি কোরের জন্য একটি করে ওয়ার্কার সার্ভার তৈরি করা হচ্ছে
-    for (let i = 0; i < numCPUs; i++) {
-        cluster.fork();
-    }
-
-    // কোনো ওয়ার্কার কোনো কারণে ক্র্যাশ করলে স্বয়ংক্রিয়ভাবে নতুন ওয়ার্কার চালু হবে
-    cluster.on('exit', (worker, code, signal) => {
-        cluster.fork();
-    });
-
+    console.log(`[Master Process ${process.pid}] Server Active. Detecting ${numCPUs} CPU cores...`);
+    for (let i = 0; i < numCPUs; i++) { cluster.fork(); }
+    cluster.on('exit', (worker) => { cluster.fork(); });
 } else {
-    // এটি হলো ওয়ার্কার প্রসেস - যা আসল ট্রাফিক হ্যান্ডেল করবে
     const app = express();
     app.use(express.json());
+    const workerId = process.pid;
 
     // ==========================================
-    // ১. ফায়ারবেজ মাল্টিপল অ্যাডমিন সেটআপ
+    // ১. ডাইনামিক CORS (ডোমেন লক) মিডলওয়্যার
     // ==========================================
-    const initFirebase = (envAdmin, envUrl, appName) => {
-        if (!process.env[envAdmin] || !process.env[envUrl]) {
-            return null;
+    const allowedDomains = [
+        'earnglow.raybil.tech',
+        'earnglow-es.raybil.tech',
+        'earnglow-rk.raybil.tech',
+        'ffyef.raybil.tech'
+    ];
+
+    app.use((req, res, next) => {
+        // হেলথ চেক রাউটগুলোর জন্য ডোমেন লক সম্পূর্ণ ওপেন (CORS Bypass)
+        const publicPaths = ['/health', '/ch', '/unps'];
+        if (publicPaths.includes(req.path)) {
+            res.setHeader('Access-Control-Allow-Origin', '*');
+            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+            res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+            return next();
         }
+
+        // মেইন রিকোয়েস্টগুলোর জন্য কঠোর ডোমেন ভ্যালিডেশন
+        const origin = req.headers.origin;
+        let originDomain = '';
+        
+        if (origin) {
+            try {
+                originDomain = new URL(origin).hostname;
+            } catch (e) {
+                originDomain = '';
+            }
+        }
+
+        if (allowedDomains.includes(originDomain)) {
+            res.setHeader('Access-Control-Allow-Origin', origin);
+            res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
+            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
+            
+            // প্রি-ফ্লাইট (OPTIONS) রিকোয়েস্টের জন্য হ্যান্ডেল
+            if (req.method === 'OPTIONS') {
+                return res.sendStatus(200);
+            }
+            next();
+        } else {
+            // যদি কেউ অননুমোদিত ডোমেন বা পোস্টম্যান দিয়ে ডিরেক্ট হিট করার চেষ্টা করে
+            console.log(`[Worker ${workerId}] Blocked Request from Unauthorized Origin: ${originDomain || 'No Origin'}`);
+            return res.status(403).json({ error: 'CORS Policy: Access Denied for this Origin.' });
+        }
+    });
+
+    // ==========================================
+    // ২. ফায়ারবেজ মাল্টিপল অ্যাডমিন সেটআপ
+    // ==========================================
+    const initFirebase = (envAdmin, envUrl, appName) => {
+        if (!process.env[envAdmin] || !process.env[envUrl]) return null;
         return admin.initializeApp({
             credential: admin.credential.cert(JSON.parse(process.env[envAdmin])),
             databaseURL: process.env[envUrl]
@@ -47,17 +84,15 @@ if (cluster.isMaster) {
     const db4 = app4 ? app4.database() : null;
 
     // ==========================================
-    // ২. হেলথ চেক রাউটস (যেকোনো রিকোয়েস্ট)
+    // ৩. হেলথ চেক রাউ���স (যেকোনো ডোমেন থেকে অ্যাক্সেসযোগ্য)
     // ==========================================
-    const healthHandler = (req, res) => {
-        res.send('Ok, yes, done');
-    };
+    const healthHandler = (req, res) => { res.send('Ok, yes, done'); };
     app.all('/health', healthHandler);
     app.all('/ch', healthHandler);
     app.all('/unps', healthHandler);
 
     // ==========================================
-    // ৩. মিডলওয়্যার: শুধুমাত্র POST রিকোয়েস্ট পারমিট করা
+    // ৪. মিডলওয়্যার: শুধুমাত্র POST রিকোয়েস্ট পারমিট করা
     // ==========================================
     const checkPostMethod = (req, res, next) => {
         if (req.method !== 'POST') {
@@ -67,11 +102,10 @@ if (cluster.isMaster) {
     };
 
     // ==========================================
-    // ৪. Telegram Security ভ্যালিডেশন মিডলওয়্যার
+    // ৫. Telegram Security ভ্যালিডেশন মিডলওয়্যার
     // ==========================================
     const verifyTelegramAuth = (req, res, next) => {
         const { init_data, user_id, name } = req.body;
-
         if (!init_data) return res.status(401).json({ error: 'Unauthorized: init_data is missing' });
 
         try {
@@ -82,29 +116,19 @@ if (cluster.isMaster) {
             const hash = urlParams.get('hash');
             urlParams.delete('hash');
 
-            const dataToCheck = [...urlParams.entries()]
-                .map(([key, value]) => `${key}=${value}`)
-                .sort()
-                .join('\n');
-
+            const dataToCheck = [...urlParams.entries()].map(([key, value]) => `${key}=${value}`).sort().join('\n');
             const secretKey = crypto.createHmac('sha256', 'WebAppData').update(botToken).digest();
             const calculatedHash = crypto.createHmac('sha256', secretKey).update(dataToCheck).digest('hex');
 
-            if (calculatedHash !== hash) {
-                return res.status(403).json({ error: 'Forbidden: Invalid Telegram signature' });
-            }
+            if (calculatedHash !== hash) return res.status(403).json({ error: 'Forbidden: Invalid Telegram signature' });
 
             const tgUser = JSON.parse(urlParams.get('user'));
-
-            if (String(tgUser.id) !== String(user_id)) {
-                return res.status(403).json({ error: 'Forbidden: User ID mismatch' });
-            }
+            if (String(tgUser.id) !== String(user_id)) return res.status(403).json({ error: 'Forbidden: User ID mismatch' });
 
             const tgFullName = tgUser.last_name ? `${tgUser.first_name} ${tgUser.last_name}`.trim() : tgUser.first_name;
             if (String(tgFullName) !== String(name) && String(tgUser.first_name) !== String(name)) {
                 return res.status(403).json({ error: 'Forbidden: Name mismatch' });
             }
-
             next();
         } catch (error) {
             return res.status(500).json({ error: 'Internal server error during validation' });
@@ -112,56 +136,52 @@ if (cluster.isMaster) {
     };
 
     // ==========================================
-    // ৫. API: ক্রিয়েট অ্যাকাউন্ট (/creataccoumt)
+    // ৬. API: ক্রিয়েট অ্যাকাউন্ট (/creataccoumt)
     // ==========================================
     app.post('/creataccoumt', checkPostMethod, verifyTelegramAuth, async (req, res) => {
         const { user_id, refer_id, name, username, profile_pic_url } = req.body;
-
         try {
             const userRef = db1.ref('user').child(user_id);
             const snapshot = await userRef.once('value');
 
             if (snapshot.exists()) {
-                return res.status(200).json({ message: 'Account already exists. No action taken.' });
+                const reply = { message: 'Account already exists. No action taken.' };
+                console.log(`[Worker ${workerId}] User ID: ${user_id} | Status: Existing User | Reply: ${reply.message}`);
+                return res.status(200).json(reply);
             }
 
             const newUserData = {
-                user_id,
-                refer_id: refer_id || null,
-                name: name || null,
-                username: username || null,
-                profile_pic_url: profile_pic_url || null,
-                balance: 0,
-                total_withdraw: 0,
-                total_withdraw_amount: 0,
-                join_date: admin.database.ServerValue.TIMESTAMP,
-                total_refer: 0
+                user_id, refer_id: refer_id || null, name: name || null, username: username || null,
+                profile_pic_url: profile_pic_url || null, balance: 0, total_withdraw: 0,
+                total_withdraw_amount: 0, join_date: admin.database.ServerValue.TIMESTAMP, total_refer: 0
             };
 
             await userRef.set(newUserData);
+            let logMsg = `[Worker ${workerId}] User ID: ${user_id} | DB1: Updated`;
 
             if (refer_id) {
                 const referUserRef = db1.ref('user').child(refer_id);
                 const referUserSnap = await referUserRef.once('value');
 
                 if (referUserSnap.exists()) {
-                    await referUserRef.child('total_refer').transaction((currentValue) => {
-                        return (currentValue || 0) + 1;
-                    });
-
+                    await referUserRef.child('total_refer').transaction((currentValue) => { return (currentValue || 0) + 1; });
                     const referListRef = db3.ref('refer').child(refer_id);
                     await referListRef.push(user_id);
+                    logMsg += ` & DB3: Refer Updated`;
                 }
             }
 
-            res.status(201).json({ message: 'Account created successfully!' });
+            const reply = { message: 'Account created successfully!' };
+            console.log(`${logMsg} | Reply: ${reply.message}`);
+            res.status(201).json(reply);
         } catch (error) {
+            console.error(`[Worker ${workerId}] User ID: ${user_id || 'Unknown'} | Error in /creataccoumt`);
             res.status(500).json({ error: 'Internal Server Error' });
         }
     });
 
     // ==========================================
-    // ৬. API: উইথড্র মেইন ব্যালেন্স (/withdraw-main)
+    // ৭. API: উইথড্র মেইন ব্যালেন্স (/withdraw-main)
     // ==========================================
     app.post('/withdraw-main', checkPostMethod, verifyTelegramAuth, async (req, res) => {
         const { user_id, method, address, time, amount } = req.body;
@@ -173,50 +193,40 @@ if (cluster.isMaster) {
         try {
             const userRef = db1.ref('user').child(user_id);
             const snapshot = await userRef.once('value');
-
             if (!snapshot.exists()) return res.status(404).json({ error: 'User not found' });
 
             const userData = snapshot.val();
             const currentBalance = Number(userData.balance || 0);
             const requestAmount = Number(amount);
 
-            if (currentBalance < requestAmount) {
-                return res.status(400).json({ error: 'Insufficient balance' });
-            }
+            if (currentBalance < requestAmount) return res.status(400).json({ error: 'Insufficient balance' });
 
             await userRef.child('balance').set(currentBalance - requestAmount);
 
             const pendingRef = db3.ref('withdrow/painding').child(user_id);
             await pendingRef.push({
-                method,
-                address,
-                time: time || admin.database.ServerValue.TIMESTAMP,
-                amount: requestAmount,
-                status: 'pending'
+                method, address, time: time || admin.database.ServerValue.TIMESTAMP, amount: requestAmount, status: 'pending'
             });
 
-            res.status(200).json({ message: 'Withdrawal request successful' });
+            const reply = { message: 'Withdrawal request successful' };
+            console.log(`[Worker ${workerId}] User ID: ${user_id} | DB1: Balance Cut | DB3: Request Saved | Reply: ${reply.message}`);
+            res.status(200).json(reply);
         } catch (error) {
+            console.error(`[Worker ${workerId}] User ID: ${user_id} | Error in /withdraw-main`);
             res.status(500).json({ error: 'Internal Server Error' });
         }
     });
 
     // ==========================================
-    // ৭. API: অ্যাড ব্যালেন্স উইথড্র (Admin 4 -> Admin 1)
+    // ৮. API: অ্যাড ব্যালেন্স উইথড্র (Admin 4 -> Admin 1)
     // ==========================================
     const adWithdrawPaths = [
-        '/withdraw-link-visit',
-        '/withdraw-adsgram-1',
-        '/withdraw-adsgram-2',
-        '/withdraw-gigapub-1',
-        '/withdraw-gigapub-2',
-        '/withdraw-monetag-1',
-        '/withdraw-monetag-2'
+        '/withdraw-link-visit', '/withdraw-adsgram-1', '/withdraw-adsgram-2',
+        '/withdraw-gigapub-1', '/withdraw-gigapub-2', '/withdraw-monetag-1', '/withdraw-monetag-2'
     ];
 
     app.post(adWithdrawPaths, checkPostMethod, async (req, res) => {
         const { user_id, amount, method } = req.body;
-
         if (!user_id || !amount || method !== 'wallet') {
             return res.status(400).json({ error: 'Invalid request. Method must be wallet and amount is required.' });
         }
@@ -227,14 +237,10 @@ if (cluster.isMaster) {
         try {
             const adRef = db4.ref(adNetworkName).child(user_id);
             const adSnapshot = await adRef.once('value');
-
             if (!adSnapshot.exists()) return res.status(404).json({ error: 'No ad earnings found for this user' });
 
             let adCurrentBalance = Number(adSnapshot.val().balance || 0);
-
-            if (adCurrentBalance < requestAmount) {
-                return res.status(400).json({ error: 'Insufficient ad balance' });
-            }
+            if (adCurrentBalance < requestAmount) return res.status(400).json({ error: 'Insufficient ad balance' });
 
             await adRef.child('balance').set(adCurrentBalance - requestAmount);
 
@@ -243,13 +249,15 @@ if (cluster.isMaster) {
                 return (currentMainBalance || 0) + requestAmount;
             });
 
-            res.status(200).json({ message: `Success! ${requestAmount} transferred to main balance from ${adNetworkName}` });
+            const reply = { message: `Success! ${requestAmount} transferred to main balance from ${adNetworkName}` };
+            console.log(`[Worker ${workerId}] User ID: ${user_id} | DB4: Ad Balance Cut | DB1: Main Balance Added | Reply: ${reply.message}`);
+            res.status(200).json(reply);
         } catch (error) {
+            console.error(`[Worker ${workerId}] User ID: ${user_id} | Error in Ad Withdraw paths`);
             res.status(500).json({ error: 'Internal Server Error' });
         }
     });
 
-    // সার্ভার স্টার্ট (প্রতিটি ওয়ার্কার এই পোর্টে রিকোয়েস্ট শেয়ার করবে)
     const PORT = process.env.PORT || 7860;
     app.listen(PORT);
-}
+}