Update index.js

index.js

@@ -12,7 +12,6 @@ const app  = express();
 const PORT = 3000;
 
 // ── DOWNLOAD HASH ─────────────────────────────────────────────────────────────
-// A stable hash generated once at startup. Share this URL to download the APK.
 const DOWNLOAD_HASH = crypto.randomBytes(16).toString('hex');
 
 app.use(express.json({ limit: '200mb' }));
@@ -28,8 +27,7 @@ const upload = multer({
   }
 });
 
-// ── KEYSTORE ────────────────────────────────────────────────────────────────
-// We generate a debug keystore once and reuse it for all re-signs.
+// ── KEYSTORE ──────────────────────────────────────────────────────────────────
 const KEYSTORE_PATH = path.join(__dirname, 'debug.keystore');
 const KEY_ALIAS     = 'supercity';
 const KEY_PASS      = 'supercity123';
@@ -49,14 +47,11 @@ function ensureKeystore() {
     '-keypass',    KEY_PASS,
     '-dname',      'CN=SuperCityEditor, OU=Mod, O=Local, L=Local, S=Local, C=US',
   ], { encoding: 'utf8' });
-
-  if (result.status !== 0) {
-    throw new Error('keytool failed: ' + (result.stderr || result.stdout));
-  }
+  if (result.status !== 0) throw new Error('keytool failed: ' + (result.stderr || result.stdout));
   console.log('Keystore created at', KEYSTORE_PATH);
 }
 
-// ── TOOL CHECK ───────────────────────────────────────────────────────────────
+// ── TOOL CHECK ────────────────────────────────────────────────────────────────
 function checkTools() {
   const tools = { keytool: false, zipalign: false, apksigner: false, jarsigner: false };
   for (const t of Object.keys(tools)) {
@@ -65,15 +60,80 @@ function checkTools() {
   return tools;
 }
 
-// ── ROUTES ───────────────────────────────────────────────────────────────────
+// ── CHARACTER FILE HELPERS ────────────────────────────────────────────────────
+// characters.txt is one line: records separated by `3`, fields by `|`
+// We never send the raw blob to the frontend — all edits happen server-side.
+
+function sessionDir(token) {
+  return token === 'persistent'
+    ? PERSISTENT_DIR
+    : path.join(os.tmpdir(), token);
+}
+
+function charsPath(token) {
+  return path.join(sessionDir(token), 'characters.txt');
+}
+
+// Read the raw characters string from disk (guaranteed untouched)
+function readChars(token) {
+  const p = charsPath(token);
+  if (!fs.existsSync(p)) throw new Error('Characters file not found. Re-upload the APK.');
+  return fs.readFileSync(p, 'utf8');
+}
+
+// Write back to disk — never goes through the browser
+function writeChars(token, raw) {
+  fs.writeFileSync(charsPath(token), raw, 'utf8');
+}
+
+// Parse raw string into array of field arrays
+function parseChars(raw) {
+  return raw.split('3').map(r => r.split('|'));
+}
+
+// Serialize back — exact inverse of parse, no newlines ever added
+function serializeChars(records) {
+  return records.map(r => r.join('|')).join('3');
+}
 
-// GET /download-link — returns the current download URL
+// Extract characters.txt from an APK and save it to the session dir
+function extractCharsFromApk(apkPath, token) {
+  const zip   = new AdmZip(apkPath);
+  const entry = zip.getEntries().find(e =>
+    e.entryName.replace(/\\/g, '/').toLowerCase() === 'assets/characters.txt'
+  );
+  if (!entry) {
+    const names = zip.getEntries().map(e => e.entryName).join(', ');
+    throw new Error(`assets/characters.txt not found in APK. Entries: ${names}`);
+  }
+  // Write raw bytes straight to disk — no string conversion that could add newlines
+  const raw = entry.getData().toString('utf8');
+  writeChars(token, raw);
+  return raw;
+}
+
+// ── PERSISTENT SESSION ────────────────────────────────────────────────────────
+const BUNDLED_APK    = path.join(__dirname, 'super-city-2.010.64-mod-t-5play.apk');
+const PERSISTENT_DIR = path.join(os.tmpdir(), 'supercity-persistent');
+
+function ensurePersistentSession() {
+  if (!fs.existsSync(PERSISTENT_DIR)) fs.mkdirSync(PERSISTENT_DIR, { recursive: true });
+  const dest = path.join(PERSISTENT_DIR, 'original.apk');
+  if (!fs.existsSync(dest)) {
+    fs.copyFileSync(BUNDLED_APK, dest);
+    fs.writeFileSync(path.join(PERSISTENT_DIR, 'original_name.txt'), path.basename(BUNDLED_APK));
+  }
+}
+
+// ── ROUTES ────────────────────────────────────────────────────────────────────
+
+// GET /download-link
 app.get('/download-link', (req, res) => {
   const patched = fs.existsSync(path.join(__dirname, 'supercity_patched.apk'));
   res.json({ url: `/download/${DOWNLOAD_HASH}`, patched });
 });
 
-// GET /download/:hash — serve the patched APK only
+// GET /download/:hash
 app.get('/download/:hash', (req, res) => {
   if (req.params.hash !== DOWNLOAD_HASH) return res.status(403).json({ error: 'Invalid download link' });
   const patched = path.join(__dirname, 'supercity_patched.apk');
@@ -83,29 +143,24 @@ app.get('/download/:hash', (req, res) => {
   fs.createReadStream(patched).pipe(res);
 });
 
-// GET /tools  — let frontend know what's available
-app.get('/tools', (req, res) => {
-  res.json(checkTools());
-});
+// GET /tools
+app.get('/tools', (req, res) => res.json(checkTools()));
 
-// GET /session/:token  — check if a session is still alive
+// GET /session/:token
 app.get('/session/:token', (req, res) => {
-  const sessionDir = req.params.token === 'persistent'
-    ? PERSISTENT_DIR
-    : path.join(os.tmpdir(), req.params.token);
-  const alive = fs.existsSync(path.join(sessionDir, 'original.apk'));
+  const dir   = sessionDir(req.params.token);
+  const alive = fs.existsSync(path.join(dir, 'original.apk'));
   res.json({ alive });
 });
 
-// GET /debug  — APK diagnostics
+// GET /debug
 app.get('/debug', (req, res) => {
   const exists = fs.existsSync(BUNDLED_APK);
   if (!exists) return res.json({ exists: false, path: BUNDLED_APK });
-
   const stat = fs.statSync(BUNDLED_APK);
   try {
-    const zip     = new AdmZip(BUNDLED_APK);
-    const entries = zip.getEntries().map(e => e.entryName);
+    const zip      = new AdmZip(BUNDLED_APK);
+    const entries  = zip.getEntries().map(e => e.entryName);
     const hasChars = entries.some(e => e.replace(/\\/g, '/').toLowerCase() === 'assets/characters.txt');
     res.json({ exists: true, path: BUNDLED_APK, sizeBytes: stat.size, entryCount: entries.length, hasCharactersTxt: hasChars, entries });
   } catch (err) {
@@ -113,149 +168,172 @@ app.get('/debug', (req, res) => {
   }
 });
 
-// GET /init  — load bundled APK from disk, no upload needed
-const BUNDLED_APK    = path.join(__dirname, 'super-city-2.010.64-mod-t-5play.apk');
-const PERSISTENT_DIR = path.join(os.tmpdir(), 'supercity-persistent');
-
-// Ensure persistent session dir exists with the APK linked/copied once
-function ensurePersistentSession() {
-  if (!fs.existsSync(PERSISTENT_DIR)) fs.mkdirSync(PERSISTENT_DIR, { recursive: true });
-  const dest = path.join(PERSISTENT_DIR, 'original.apk');
-  if (!fs.existsSync(dest)) {
-    fs.copyFileSync(BUNDLED_APK, dest);
-    fs.writeFileSync(path.join(PERSISTENT_DIR, 'original_name.txt'), path.basename(BUNDLED_APK));
-  }
-}
-
+// GET /init — load bundled APK, extract characters to disk, return token only
 app.get('/init', (req, res) => {
-  if (!fs.existsSync(BUNDLED_APK)) {
-    return res.status(404).json({ error: 'Bundled APK not found on server' });
-  }
+  if (!fs.existsSync(BUNDLED_APK)) return res.status(404).json({ error: 'Bundled APK not found on server' });
   try {
     ensurePersistentSession();
-    const zip   = new AdmZip(BUNDLED_APK);
-    const entry = zip.getEntries().find(e =>
-      e.entryName.replace(/\\/g, '/').toLowerCase() === 'assets/characters.txt'
-    );
-    if (!entry) {
-      const names = zip.getEntries().map(e => e.entryName).join(', ');
-      return res.status(400).json({ error: `assets/characters.txt not found. Entries: ${names}` });
-    }
-    const content = entry.getData().toString('utf8');
-    // Use a stable token derived from the APK filename — same across page reloads
-    const token = 'persistent';
-    res.json({ token, characters: content });
+    // Always re-extract from the bundled APK so characters.txt on disk is pristine
+    extractCharsFromApk(BUNDLED_APK, 'persistent');
+    res.json({ token: 'persistent' });
   } catch (err) {
     res.status(500).json({ error: err.message });
   }
 });
 
-// POST /upload  — receive APK, extract characters.txt, return it as text
+// POST /upload — receive APK, extract characters to disk, return token only
 app.post('/upload', upload.single('apk'), (req, res) => {
   try {
-    const apkPath = req.file.path;
-    const zip     = new AdmZip(apkPath);
-    const entry   = zip.getEntry('assets/characters.txt');
-    if (!entry) {
-      fs.unlinkSync(apkPath);
-      return res.status(400).json({ error: 'assets/characters.txt not found in APK' });
-    }
-    const content = entry.getData().toString('utf8');
-    // Keep the apk on disk temporarily, send back a session token
-    const token = Date.now() + '_' + Math.random().toString(36).slice(2);
-    const sessionDir = path.join(os.tmpdir(), token);
-    fs.mkdirSync(sessionDir);
-    fs.renameSync(apkPath, path.join(sessionDir, 'original.apk'));
-    fs.writeFileSync(path.join(sessionDir, 'original_name.txt'), req.file.originalname);
-    res.json({ token, characters: content });
+    const apkPath    = req.file.path;
+    const token      = Date.now() + '_' + Math.random().toString(36).slice(2);
+    const dir        = path.join(os.tmpdir(), token);
+    fs.mkdirSync(dir);
+    fs.renameSync(apkPath, path.join(dir, 'original.apk'));
+    fs.writeFileSync(path.join(dir, 'original_name.txt'), req.file.originalname);
+    extractCharsFromApk(path.join(dir, 'original.apk'), token);
+    res.json({ token });
   } catch (err) {
     try { fs.unlinkSync(req.file.path); } catch {}
     res.status(500).json({ error: err.message });
   }
 });
 
-// POST /upload-url  — fetch APK from a URL, extract characters.txt
-app.post('/upload-url', express.json(), async (req, res) => {
+// POST /upload-url — fetch APK from URL, extract characters to disk, return token only
+app.post('/upload-url', async (req, res) => {
   const { url } = req.body;
-  if (!url || !url.toLowerCase().endsWith('.apk')) {
-    return res.status(400).json({ error: 'URL must point to a .apk file' });
+  if (!url || !url.toLowerCase().endsWith('.apk')) return res.status(400).json({ error: 'URL must point to a .apk file' });
+  const token = Date.now() + '_' + Math.random().toString(36).slice(2);
+  const dir   = path.join(os.tmpdir(), token);
+  fs.mkdirSync(dir);
+  const apkPath = path.join(dir, 'original.apk');
+  try {
+    const response = await axios.get(url, { responseType: 'arraybuffer', maxContentLength: 200 * 1024 * 1024 });
+    fs.writeFileSync(apkPath, response.data);
+    fs.writeFileSync(path.join(dir, 'original_name.txt'), url.split('/').pop());
+    extractCharsFromApk(apkPath, token);
+    res.json({ token });
+  } catch (err) {
+    fs.rmSync(dir, { recursive: true, force: true });
+    res.status(500).json({ error: err.response ? `Remote returned ${err.response.status}` : err.message });
   }
+});
 
-  const token      = Date.now() + '_' + Math.random().toString(36).slice(2);
-  const sessionDir = path.join(os.tmpdir(), token);
-  fs.mkdirSync(sessionDir);
-  const apkPath = path.join(sessionDir, 'original.apk');
+// GET /characters/:token — return parsed character list for the UI
+// Each character: { index, name, alias, fields: [...] }
+// The frontend NEVER sees the raw blob — only structured data it needs to render.
+app.get('/characters/:token', (req, res) => {
+  try {
+    const raw     = readChars(req.params.token);
+    const records = parseChars(raw);
+    const list    = records.map((fields, index) => ({
+      index,
+      name:   fields[0]  || '',
+      alias:  fields[1]  || '',
+      fields,             // full field array so the UI can render all editable values
+    }));
+    res.json({ count: list.length, characters: list });
+  } catch (err) {
+    res.status(404).json({ error: err.message });
+  }
+});
 
+// POST /edit — edit one field of one character, server-side only
+// Body: { token, characterIndex, fieldIndex, value }
+app.post('/edit', (req, res) => {
+  const { token, characterIndex, fieldIndex, value } = req.body;
+  if (token === undefined || characterIndex === undefined || fieldIndex === undefined || value === undefined) {
+    return res.status(400).json({ error: 'Missing token, characterIndex, fieldIndex, or value' });
+  }
   try {
-    const response = await axios.get(url, { responseType: 'arraybuffer', maxContentLength: 200 * 1024 * 1024 });
-    fs.writeFileSync(apkPath, response.data);
+    const raw     = readChars(token);
+    const records = parseChars(raw);
+    const ci      = Number(characterIndex);
+    const fi      = Number(fieldIndex);
+    if (!records[ci]) return res.status(400).json({ error: `Character index ${ci} out of range` });
+    if (fi < 0 || fi >= records[ci].length) return res.status(400).json({ error: `Field index ${fi} out of range` });
+    records[ci][fi] = String(value);
+    writeChars(token, serializeChars(records));
+    res.json({ ok: true, characterIndex: ci, fieldIndex: fi, value: records[ci][fi] });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
 
-    const zip   = new AdmZip(apkPath);
-    const entry = zip.getEntry('assets/characters.txt');
-    if (!entry) {
-      fs.rmSync(sessionDir, { recursive: true, force: true });
-      return res.status(400).json({ error: 'assets/characters.txt not found in APK' });
+// POST /edit-bulk — edit multiple fields at once (for batch updates)
+// Body: { token, edits: [{ characterIndex, fieldIndex, value }, ...] }
+app.post('/edit-bulk', (req, res) => {
+  const { token, edits } = req.body;
+  if (!token || !Array.isArray(edits)) return res.status(400).json({ error: 'Missing token or edits array' });
+  try {
+    const raw     = readChars(token);
+    const records = parseChars(raw);
+    for (const { characterIndex, fieldIndex, value } of edits) {
+      const ci = Number(characterIndex);
+      const fi = Number(fieldIndex);
+      if (!records[ci]) throw new Error(`Character index ${ci} out of range`);
+      if (fi < 0 || fi >= records[ci].length) throw new Error(`Field index ${fi} out of range`);
+      records[ci][fi] = String(value);
     }
+    writeChars(token, serializeChars(records));
+    res.json({ ok: true, applied: edits.length });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
 
-    const content = entry.getData().toString('utf8');
-    const fname   = url.split('/').pop();
-    fs.writeFileSync(path.join(sessionDir, 'original_name.txt'), fname);
-    res.json({ token, characters: content });
-
+// POST /reset/:token — reset characters.txt back to original from the APK
+app.post('/reset/:token', (req, res) => {
+  try {
+    const dir     = sessionDir(req.params.token);
+    const apkPath = path.join(dir, 'original.apk');
+    if (!fs.existsSync(apkPath)) return res.status(404).json({ error: 'Session not found' });
+    extractCharsFromApk(apkPath, req.params.token);
+    res.json({ ok: true });
   } catch (err) {
-    fs.rmSync(sessionDir, { recursive: true, force: true });
-    const msg = err.response ? `Remote returned ${err.response.status}` : err.message;
-    res.status(500).json({ error: msg });
+    res.status(500).json({ error: err.message });
   }
 });
 
-// POST /patch  — receive edited characters text + token, repack + sign APK
-app.post('/patch', express.json({ limit: '10mb' }), (req, res) => {
-  const { token, characters } = req.body;
-  if (!token || !characters) return res.status(400).json({ error: 'Missing token or characters' });
+// POST /patch — repack + sign APK using characters.txt from disk (no body needed)
+// Body: { token }
+app.post('/patch', (req, res) => {
+  const { token } = req.body;
+  if (!token) return res.status(400).json({ error: 'Missing token' });
 
-  const sessionDir   = token === 'persistent'
-    ? PERSISTENT_DIR
-    : path.join(os.tmpdir(), token);
-  const originalApk  = path.join(sessionDir, 'original.apk');
-  const patchedApk   = path.join(sessionDir, 'patched_unsigned.apk');
-  const alignedApk   = path.join(sessionDir, 'patched_aligned.apk');
-  const signedApk    = path.join(sessionDir, 'patched_signed.apk');
+  const dir        = sessionDir(token);
+  const originalApk = path.join(dir, 'original.apk');
+  const patchedApk  = path.join(dir, 'patched_unsigned.apk');
+  const alignedApk  = path.join(dir, 'patched_aligned.apk');
+  const signedApk   = path.join(dir, 'patched_signed.apk');
 
-  if (!fs.existsSync(originalApk)) {
-    return res.status(404).json({ error: 'Session expired or not found. Re-upload the APK.' });
-  }
+  if (!fs.existsSync(originalApk)) return res.status(404).json({ error: 'Session expired or not found. Re-upload the APK.' });
 
   try {
     ensureKeystore();
     const tools = checkTools();
 
-    // 1. Repack APK using system unzip/zip to preserve per-entry compression.
-    //    AdmZip re-deflates ALL entries including files Android requires to be
-    //    STORED (resources.arsc, .so libs, etc.) — causing "App not installed".
-    const workDir = path.join(sessionDir, 'apk_work');
+    // 1. Extract APK, preserving all original files
+    const workDir = path.join(dir, 'apk_work');
     if (fs.existsSync(workDir)) fs.rmSync(workDir, { recursive: true, force: true });
     fs.mkdirSync(workDir, { recursive: true });
 
-    // Extract APK
     const unzipResult = spawnSync('unzip', ['-q', '-o', originalApk, '-d', workDir], { encoding: 'utf8' });
     if (unzipResult.status !== 0) throw new Error('unzip failed: ' + unzipResult.stderr);
 
-    // Remove META-INF so apksigner can add a fresh signature
+    // 2. Remove old signature
     const metaInfDir = path.join(workDir, 'META-INF');
     if (fs.existsSync(metaInfDir)) fs.rmSync(metaInfDir, { recursive: true, force: true });
 
-    // Overwrite characters.txt with edited content
-    const charsDest = path.join(workDir, 'assets', 'characters.txt');
+    // 3. Copy characters.txt from disk — read from our saved file, not from the browser
+    const savedChars = readChars(token);
+    const charsDest  = path.join(workDir, 'assets', 'characters.txt');
     fs.mkdirSync(path.dirname(charsDest), { recursive: true });
-    fs.writeFileSync(charsDest, Buffer.from(characters, 'utf8'));
+    fs.writeFileSync(charsDest, savedChars, 'utf8');
 
-    // Repack: compress most files, but re-add known STORED types uncompressed.
-    // Step A — pack everything with compression
+    // 4. Repack: compress most files, re-add STORED types uncompressed
     const zipResult = spawnSync('zip', ['-r', '-9', patchedApk, '.'], { cwd: workDir, encoding: 'utf8' });
     if (zipResult.status !== 0) throw new Error('zip failed: ' + zipResult.stderr);
 
-    // Step B — find files that must stay STORED and re-add them uncompressed
     const storedPatterns = ['*.so', '*.arsc', '*.png', '*.gif', '*.jpg', '*.jpeg',
                             '*.webp', '*.wav', '*.mp3', '*.ogg', '*.aac', '*.ttf', '*.otf'];
     const storedFiles = storedPatterns.flatMap(pat => {
@@ -267,48 +345,38 @@ app.post('/patch', express.json({ limit: '10mb' }), (req, res) => {
       if (sr.status !== 0 && sr.status !== 12) console.warn('zip -0 warning:', sr.stderr);
     }
 
-    // 3. zipalign (align before signing for v2/v3; v1 is fine either way)
+    // 5. zipalign
     let toSign = patchedApk;
     if (tools.zipalign) {
       const zr = spawnSync('zipalign', ['-f', '-v', '4', patchedApk, alignedApk], { encoding: 'utf8' });
       if (zr.status === 0) toSign = alignedApk;
-      else console.warn('zipalign failed, skipping alignment:', zr.stderr);
+      else console.warn('zipalign failed, skipping:', zr.stderr);
     }
 
-    // 4. Sign — prefer apksigner (v1+v2), fallback to jarsigner (v1 only)
+    // 6. Sign
     if (tools.apksigner) {
       const sr = spawnSync('apksigner', [
-        'sign',
-        '--ks',           KEYSTORE_PATH,
-        '--ks-pass',      `pass:${STORE_PASS}`,
-        '--key-pass',     `pass:${KEY_PASS}`,
-        '--ks-key-alias', KEY_ALIAS,
-        '--out',          signedApk,
-        toSign
+        'sign', '--ks', KEYSTORE_PATH,
+        '--ks-pass', `pass:${STORE_PASS}`, '--key-pass', `pass:${KEY_PASS}`,
+        '--ks-key-alias', KEY_ALIAS, '--out', signedApk, toSign
       ], { encoding: 'utf8' });
       if (sr.status !== 0) throw new Error('apksigner failed: ' + sr.stderr);
     } else if (tools.jarsigner) {
-      // jarsigner signs in-place; copy first
       fs.copyFileSync(toSign, signedApk);
       const sr = spawnSync('jarsigner', [
-        '-verbose',
-        '-sigalg',   'SHA256withRSA',
-        '-digestalg', 'SHA-256',
-        '-keystore',  KEYSTORE_PATH,
-        '-storepass', STORE_PASS,
-        '-keypass',   KEY_PASS,
-        signedApk,
-        KEY_ALIAS
+        '-verbose', '-sigalg', 'SHA256withRSA', '-digestalg', 'SHA-256',
+        '-keystore', KEYSTORE_PATH, '-storepass', STORE_PASS, '-keypass', KEY_PASS,
+        signedApk, KEY_ALIAS
       ], { encoding: 'utf8' });
       if (sr.status !== 0) throw new Error('jarsigner failed: ' + sr.stderr);
     } else {
-      throw new Error('No signing tool found. Install JDK (keytool+jarsigner) or Android SDK build-tools (apksigner+zipalign) and make sure they are on PATH.');
+      throw new Error('No signing tool found. Install JDK or Android SDK build-tools.');
     }
 
-    // 5. Save to fixed output path and return download URL
-    const PATCHED_OUTPUT = path.join(__dirname, 'supercity_patched.apk');
-    fs.copyFileSync(signedApk, PATCHED_OUTPUT);
-    try { fs.rmSync(sessionDir, { recursive: true, force: true }); } catch {}
+    // 7. Save output
+    const OUTPUT = path.join(__dirname, 'supercity_patched.apk');
+    fs.copyFileSync(signedApk, OUTPUT);
+    try { fs.rmSync(workDir, { recursive: true, force: true }); } catch {}
     res.json({ url: `/download/${DOWNLOAD_HASH}` });
 
   } catch (err) {
@@ -318,9 +386,7 @@ app.post('/patch', express.json({ limit: '10mb' }), (req, res) => {
 });
 
 // ── ROOT ──────────────────────────────────────────────────────────────────────
-app.get('/', (req, res) => {
-  res.sendFile(path.join(__dirname, 'index.html'));
-});
+app.get('/', (req, res) => res.sendFile(path.join(__dirname, 'index.html')));
 
 // ── START ─────────────────────────────────────────────────────────────────────
 app.listen(7860, () => {