Spaces:
Sleeping
Sleeping
| const express = require('express'); | |
| const crypto = require('crypto'); | |
| const path = require('path'); | |
| const User = require('./models/User'); | |
| const { editMsg, editInlineMsg } = require('./utils/editMsg'); | |
| const app = express(); | |
| app.use(express.json()); | |
| // ── CORS ── | |
| app.use((req, res, next) => { | |
| res.setHeader('Access-Control-Allow-Origin', process.env.WEBAPP_ORIGIN || '*'); | |
| res.setHeader('Access-Control-Allow-Headers', 'Content-Type, X-Init-Data'); | |
| res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS'); | |
| if (req.method === 'OPTIONS') return res.sendStatus(204); | |
| next(); | |
| }); | |
| // ── Static files ── | |
| app.use(express.static(path.join(__dirname, 'webapp'))); | |
| app.get('/carrom', (req, res) => res.sendFile(path.join(__dirname, 'webapp', 'carrom.html'))); | |
| app.get('/cards', (req, res) => res.sendFile(path.join(__dirname, 'webapp', 'cards.html'))); | |
| app.get('/omi', (req, res) => res.sendFile(path.join(__dirname, 'webapp', 'omi.html'))); | |
| app.get('/deck-demo', (req, res) => res.sendFile(path.join(__dirname, 'webapp', 'deck-demo.html'))); | |
| // ── Auth ── | |
| function verifyInitData(raw) { | |
| try { | |
| const params = new URLSearchParams(raw); | |
| const hash = params.get('hash'); if (!hash) return null; | |
| params.delete('hash'); | |
| const cs = [...params.entries()].sort(([a],[b])=>a.localeCompare(b)).map(([k,v])=>`${k}=${v}`).join('\n'); | |
| const secret = crypto.createHmac('sha256','WebAppData').update(process.env.BOT_TOKEN).digest(); | |
| if (crypto.createHmac('sha256',secret).update(cs).digest('hex') !== hash) return null; | |
| return JSON.parse(params.get('user') || 'null'); | |
| } catch { return null; } | |
| } | |
| function auth(req, res, next) { | |
| const raw = req.headers['x-init-data'] || req.query.initData; | |
| if (!raw) return res.status(401).json({ ok: false, error: 'Missing auth' }); | |
| const user = verifyInitData(raw); | |
| if (!user) return res.status(403).json({ ok: false, error: 'Invalid auth' }); | |
| req.tgUser = user; next(); | |
| } | |
| // ── Helper: DB query with timeout ── | |
| async function dbFind(query, timeout = 5000) { | |
| return Promise.race([ | |
| User.findOne(query).lean(), | |
| new Promise((_, reject) => setTimeout(() => reject(new Error('DB timeout')), timeout)) | |
| ]); | |
| } | |
| // ── Helper: getName with timeout (won't hang server) ── | |
| async function safeGetName(userId) { | |
| try { | |
| const user = await User.findOne({ userId }).select('username').lean().maxTimeMS(3000); | |
| if (user?.username) return user.username; | |
| if (global._tgClient) { | |
| const ent = await Promise.race([ | |
| global._tgClient.getEntity(userId), | |
| new Promise((_, r) => setTimeout(() => r(new Error('timeout')), 3000)) | |
| ]); | |
| const name = ent.firstName || ent.username || `User${userId.slice(-4)}`; | |
| // Save for future use | |
| await User.updateOne({ userId }, { $set: { username: name } }).catch(() => {}); | |
| return name; | |
| } | |
| } catch {} | |
| return `User${userId.toString().slice(-4)}`; | |
| } | |
| // ── GET /status ── | |
| app.get('/status', auth, async (req, res) => { | |
| try { | |
| const userId = req.tgUser.id.toString(); | |
| const user = await User.findOne({ userId }).select('lastDaily lastAdWatchDate dailyAdsCount').lean().maxTimeMS(5000); | |
| const today = new Date().toISOString().split('T')[0]; | |
| if (!user) return res.json({ canClaim: true, hoursLeft: null, adsLeft: 50 }); | |
| if (req.query.type === 'mission_inpage') { | |
| const ld = user.lastAdWatchDate?.toISOString().split('T')[0]; | |
| const cnt = ld !== today ? 0 : (user.dailyAdsCount || 0); | |
| return res.json({ canClaim: 50 - cnt > 0, adsLeft: Math.max(0, 50 - cnt) }); | |
| } | |
| const ld = user.lastDaily?.toISOString().split('T')[0]; | |
| res.json({ canClaim: ld !== today, hoursLeft: ld === today ? 24 : null }); | |
| } catch (err) { res.status(500).json({ error: 'Error' }); } | |
| }); | |
| // ── POST /claim ── | |
| app.post('/claim', auth, async (req, res) => { | |
| try { | |
| const { type } = req.body; | |
| const userId = req.tgUser.id.toString(); | |
| let user = await User.findOne({ userId }) || await User.create({ userId, username: req.tgUser.username }); | |
| const today = new Date().toISOString().split('T')[0]; | |
| if (type === 'daily') { | |
| if (user.lastDaily?.toISOString().split('T')[0] === today) return res.json({ ok: false, error: 'Already claimed' }); | |
| user.wallet += 3000; user.xp += 100; user.lastDaily = new Date(); await user.save(); | |
| if (global._tgClient) try { await global._tgClient.sendMessage(userId, { message: `🎉 <b>+$3000</b> daily reward!` }); } catch {} | |
| return res.json({ ok: true, reward: 3000, wallet: user.wallet }); | |
| } else if (type === 'mission') { | |
| const ld = user.lastAdWatchDate?.toISOString().split('T')[0]; | |
| if (ld !== today) user.dailyAdsCount = 0; | |
| if (user.dailyAdsCount >= 50) return res.json({ ok: false, error: 'Limit reached' }); | |
| user.wallet += 200; user.dailyAdsCount++; user.lastAdWatchDate = new Date(); user.lastMissionClaim = new Date(); | |
| await user.save(); | |
| return res.json({ ok: true, reward: 200, adsLeft: 50 - user.dailyAdsCount, wallet: user.wallet }); | |
| } | |
| res.status(400).json({ ok: false, error: 'Invalid type' }); | |
| } catch (err) { res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| // ── GET /leaderboard — getEntity with timeout ── | |
| app.get('/leaderboard', auth, async (req, res) => { | |
| try { | |
| const { type = 'wallet', period = 'all' } = req.query; | |
| const sorts = { bank:{bank:-1}, wallet:{wallet:-1}, xp:{xp:-1}, kills:{kills:-1}, robs:{robs:-1} }; | |
| let df = {}; | |
| const now = new Date(); | |
| if (period === 'daily') df = { lastDaily: { $gte: new Date(now.toISOString().split('T')[0]) } }; | |
| else if (period === 'weekly') df = { lastDaily: { $gte: new Date(now - 7*86400000) } }; | |
| else if (period === 'monthly') df = { lastDaily: { $gte: new Date(now - 30*86400000) } }; | |
| const users = await User.find(df).sort(sorts[type]||{wallet:-1}).limit(50) | |
| .select('userId username wallet bank xp level kills robs').lean().maxTimeMS(5000); | |
| // Resolve names with timeout — won't hang | |
| for (const u of users) { | |
| if (!u.username) u.username = await safeGetName(u.userId); | |
| } | |
| res.json({ ok: true, leaderboard: users, type, period }); | |
| } catch (err) { console.error('[API] leaderboard:', err.message); res.status(500).json({ error: 'Error' }); } | |
| }); | |
| // ── GET /me ── | |
| app.get('/me', auth, async (req, res) => { | |
| try { | |
| const userId = req.tgUser.id.toString(); | |
| let user = await User.findOne({ userId }).lean().maxTimeMS(5000); | |
| if (!user) { user = (await User.create({ userId, username: req.tgUser.username })).toObject(); } | |
| res.json({ ok: true, user }); | |
| } catch (err) { res.status(500).json({ error: 'Error' }); } | |
| }); | |
| async function editGameChatResult(game, text) { | |
| if (!global._tgClient) return; | |
| try { | |
| if (game?.inlineMsgId) { | |
| await editInlineMsg(global._tgClient, game.inlineMsgId, text, null); | |
| return; | |
| } | |
| if (game?.chatId && game?.chatMsgId) { | |
| await editMsg(global._tgClient, game.chatId, game.chatMsgId, text, null); | |
| } | |
| } catch (e) { | |
| console.error('[API] editGameChatResult:', e.message); | |
| } | |
| } | |
| // ── Carrom API ── | |
| app.post('/carrom/mode', auth, (req, res) => { | |
| try { | |
| const { gameId, modeKey } = req.body; | |
| const sessions = require('./games/sessions'); | |
| const game = sessions.get(gameId); | |
| if (!game?.selectMode) return res.json({ ok: false, error: 'Not found' }); | |
| const r = game.selectMode(req.tgUser.id.toString(), modeKey); | |
| if (r.error) return res.json({ ok: false, error: r.error }); | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { | |
| console.error('[API] carrom/mode:', err.message); | |
| res.status(500).json({ ok: false, error: 'Error' }); | |
| } | |
| }); | |
| app.post('/carrom/start', auth, async (req, res) => { | |
| try { | |
| const { gameId, modeKey } = req.body; | |
| const sessions = require('./games/sessions'); | |
| const game = sessions.get(gameId); | |
| if (!game) return res.json({ ok: false, error: 'Not found' }); | |
| if (game.status !== 'lobby') return res.json({ ok: false, error: 'Already started' }); | |
| if (game.hostId !== req.tgUser.id.toString()) return res.json({ ok: false, error: 'Only host' }); | |
| if (game.players.length < 2) return res.json({ ok: false, error: 'Need 2+' }); | |
| const started = game.start(modeKey); | |
| if (started.error) return res.json({ ok: false, error: started.error }); | |
| if (game._timer) clearTimeout(game._timer); | |
| if (game._autoStart) clearTimeout(game._autoStart); | |
| for (const p of game.players) { | |
| let u = await User.findOne({ userId: p.userId }) || await User.create({ userId: p.userId }); | |
| u.wallet -= game.bet; | |
| await u.save(); | |
| } | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { | |
| console.error('[API] carrom/start:', err.message); | |
| res.status(500).json({ ok: false, error: 'Error' }); | |
| } | |
| }); | |
| app.get('/carrom/state', auth, (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const game = sessions.get(req.query.gameId); | |
| if (!game?.getState) return res.json({ ok: false, error: 'Not found' }); | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { | |
| res.status(500).json({ ok: false, error: 'Error' }); | |
| } | |
| }); | |
| app.post('/carrom/move', auth, (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const game = sessions.get(req.body.gameId); | |
| if (!game?.moveStriker) return res.json({ ok: false, error: 'Not found' }); | |
| const r = game.moveStriker(req.tgUser.id.toString(), req.body); | |
| res.json(r.error ? { ok: false, error: r.error } : { ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { | |
| res.status(500).json({ ok: false, error: 'Error' }); | |
| } | |
| }); | |
| app.post('/carrom/shoot', auth, async (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const leveling = require('./utils/leveling'); | |
| const game = sessions.get(req.body.gameId); | |
| if (!game?.shoot) return res.json({ ok: false, error: 'Not found' }); | |
| const r = game.shoot(req.tgUser.id.toString(), req.body); | |
| if (r.error) return res.json({ ok: false, error: r.error }); | |
| if (game.status === 'ended') { | |
| const winners = game.getWinnerPlayers(); | |
| const pot = game.bet * game.players.length; | |
| const share = winners.length ? Math.floor(pot / winners.length) : 0; | |
| for (const w of winners) { | |
| let u = await User.findOne({ userId: w.userId }) || await User.create({ userId: w.userId }); | |
| u.wallet += share; | |
| await leveling.addXP(w.userId, 200); | |
| await u.save(); | |
| } | |
| await editGameChatResult(game, `🏆 <b>CARROM OVER!</b>\n${winners.map(w => w.name).join(' & ')} win <b>$${pot}</b>!`); | |
| setTimeout(() => sessions.delete(req.body.gameId), 5000); | |
| } | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { | |
| console.error('[API] carrom/shoot:', err.message); | |
| res.status(500).json({ ok: false, error: 'Error' }); | |
| } | |
| }); | |
| app.post('/carrom/forfeit', auth, async (req, res) => { | |
| try { | |
| const { gameId } = req.body; | |
| const sessions = require('./games/sessions'); | |
| const leveling = require('./utils/leveling'); | |
| const game = sessions.get(gameId); | |
| if (!game?.forfeit) return res.json({ ok: false, error: 'Not found' }); | |
| const userId = req.tgUser.id.toString(); | |
| const wasPlaying = game.status === 'playing' || game.status === 'board_over'; | |
| const r = game.forfeit(userId); | |
| if (r.error) return res.json({ ok: false, error: r.error }); | |
| const quitter = game.forfeitedBy; | |
| if (wasPlaying) { | |
| const winners = game.getWinnerPlayers(); | |
| const pot = game.bet * game.players.length; | |
| const share = winners.length ? Math.floor(pot / winners.length) : 0; | |
| for (const w of winners) { | |
| let u = await User.findOne({ userId: w.userId }) || await User.create({ userId: w.userId }); | |
| u.wallet += share; | |
| await leveling.addXP(w.userId, 100); | |
| await u.save(); | |
| } | |
| await editGameChatResult(game, `🏳️ <b>${quitter}</b> gave up!\n${winners.map(w => w.name).join(' & ')} win <b>$${pot}</b>!`); | |
| } | |
| setTimeout(() => sessions.delete(gameId), 5000); | |
| res.json({ ok: true, state: game.getState(userId) }); | |
| } catch (err) { | |
| console.error('[API] carrom/forfeit:', err.message); | |
| res.status(500).json({ ok: false, error: 'Error' }); | |
| } | |
| }); | |
| // ── Card Web Game API ── | |
| app.get('/wcards/state', auth, (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const game = sessions.get(req.query.gameId); | |
| if (!game?.getState) return res.json({ ok: false, error: 'Not found' }); | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| app.post('/wcards/start', auth, async (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const game = sessions.get(req.body.gameId); | |
| if (!game) return res.json({ ok: false, error: 'Not found' }); | |
| if (game.hostId !== req.tgUser.id.toString()) return res.json({ ok: false, error: 'Only host' }); | |
| if (!game.start()) return res.json({ ok: false, error: 'Need 2+' }); | |
| if (game._timer) clearTimeout(game._timer); | |
| if (game._autoStart) clearTimeout(game._autoStart); | |
| for (const p of game.players) { let u = await User.findOne({userId:p.userId})||await User.create({userId:p.userId}); u.wallet-=game.bet; await u.save(); } | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| app.post('/wcards/play', auth, async (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const leveling = require('./utils/leveling'); | |
| const game = sessions.get(req.body.gameId); | |
| if (!game) return res.json({ ok: false, error: 'Not found' }); | |
| const r = game.playCard(req.tgUser.id.toString(), req.body.cardIndex); | |
| if (r.error) return res.json({ ok: false, error: r.error }); | |
| if (game.status === 'ended') { | |
| const winners = game.getWinners(); | |
| const pot = game.bet * game.players.length; | |
| const share = Math.floor(pot / winners.length); | |
| for (const w of winners) { let u = await User.findOne({userId:w.userId})||await User.create({userId:w.userId}); u.wallet+=share; await leveling.addXP(w.userId,150); await u.save(); } | |
| await editGameChatResult(game, `🃏 <b>CARDS OVER!</b>\n${winners.map(w=>w.name).join(' & ')} win <b>$${pot}</b>!`); | |
| setTimeout(() => sessions.delete(req.body.gameId), 5000); | |
| } | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| app.post('/wcards/next', auth, (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const game = sessions.get(req.body.gameId); | |
| if (!game) return res.json({ ok: false, error: 'Not found' }); | |
| game.nextRound(); | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| app.post('/wcards/forfeit', auth, async (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const leveling = require('./utils/leveling'); | |
| const game = sessions.get(req.body.gameId); | |
| if (!game?.forfeit) return res.json({ ok: false, error: 'Not found' }); | |
| const userId = req.tgUser.id.toString(); | |
| const wasPlaying = game.status === 'playing' || game.status === 'reveal'; | |
| const r = game.forfeit(userId); | |
| if (r.error) return res.json({ ok: false, error: r.error }); | |
| const quitter = game.forfeitedBy; | |
| if (wasPlaying) { | |
| const winners = game.getWinners(); | |
| const pot = game.bet * game.players.length; | |
| const share = winners.length ? Math.floor(pot / winners.length) : 0; | |
| for (const w of winners) { let u = await User.findOne({userId:w.userId})||await User.create({userId:w.userId}); u.wallet+=share; await leveling.addXP(w.userId,75); await u.save(); } | |
| await editGameChatResult(game, `🏳️ <b>${quitter}</b> gave up!\n${winners.map(w=>w.name).join(' & ')} win <b>$${pot}</b>!`); | |
| } | |
| setTimeout(() => sessions.delete(req.body.gameId), 4000); | |
| res.json({ ok: true, state: game.getState(userId) }); | |
| } catch (err) { console.error('[API] wcards/forfeit:', err.message); res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| // ── Omi API ── | |
| app.get('/omi/state', auth, (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const game = sessions.get(req.query.gameId); | |
| if (!game?.getState) return res.json({ ok: false, error: 'Not found' }); | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch { res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| app.post('/omi/start', auth, async (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const game = sessions.get(req.body.gameId); | |
| if (!game) return res.json({ ok: false, error: 'Not found' }); | |
| if (game.hostId !== req.tgUser.id.toString()) return res.json({ ok: false, error: 'Only host' }); | |
| if (!game.start()) return res.json({ ok: false, error: 'Need 2+' }); | |
| if (game._timer) clearTimeout(game._timer); | |
| if (game._autoStart) clearTimeout(game._autoStart); | |
| for (const p of game.players) { let u = await User.findOne({userId:p.userId})||await User.create({userId:p.userId}); u.wallet-=game.bet; await u.save(); } | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| app.post('/omi/trump', auth, (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const game = sessions.get(req.body.gameId); | |
| if (!game) return res.json({ ok: false, error: 'Not found' }); | |
| const r = game.chooseTrump(req.tgUser.id.toString(), req.body.suit); | |
| if (r.error) return res.json({ ok: false, error: r.error }); | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch { res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| app.post('/omi/play', auth, async (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const leveling = require('./utils/leveling'); | |
| const game = sessions.get(req.body.gameId); | |
| if (!game) return res.json({ ok: false, error: 'Not found' }); | |
| const r = game.playCard(req.tgUser.id.toString(), req.body.cardIndex); | |
| if (r.error) return res.json({ ok: false, error: r.error }); | |
| if (game.status === 'ended') { | |
| const winners = game.getWinners(); | |
| const pot = game.bet * game.players.length; | |
| const share = Math.floor(pot / winners.length); | |
| for (const w of winners) { let u = await User.findOne({userId:w.userId})||await User.create({userId:w.userId}); u.wallet+=share; await leveling.addXP(w.userId,150); await u.save(); } | |
| await editGameChatResult(game, `🃏 <b>OMI OVER!</b>\n${winners.map(w=>w.name).join(' & ')} win <b>$${pot}</b>!`); | |
| setTimeout(() => sessions.delete(req.body.gameId), 5000); | |
| } | |
| res.json({ ok: true, state: game.getState(req.tgUser.id.toString()) }); | |
| } catch (err) { res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| app.post('/omi/forfeit', auth, async (req, res) => { | |
| try { | |
| const sessions = require('./games/sessions'); | |
| const leveling = require('./utils/leveling'); | |
| const game = sessions.get(req.body.gameId); | |
| if (!game?.forfeit) return res.json({ ok: false, error: 'Not found' }); | |
| const userId = req.tgUser.id.toString(); | |
| const wasPlaying = game.status === 'playing' || game.status === 'chooseTrump'; | |
| const r = game.forfeit(userId); | |
| if (r.error) return res.json({ ok: false, error: r.error }); | |
| const quitter = game.forfeitedBy; | |
| if (wasPlaying) { | |
| const winners = game.getWinners(); | |
| const pot = game.bet * game.players.length; | |
| const share = winners.length ? Math.floor(pot / winners.length) : 0; | |
| for (const w of winners) { let u = await User.findOne({userId:w.userId})||await User.create({userId:w.userId}); u.wallet+=share; await leveling.addXP(w.userId,75); await u.save(); } | |
| await editGameChatResult(game, `🏳️ <b>${quitter}</b> gave up!\n${winners.map(w=>w.name).join(' & ')} win <b>$${pot}</b>!`); | |
| } | |
| setTimeout(() => sessions.delete(req.body.gameId), 4000); | |
| res.json({ ok: true, state: game.getState(userId) }); | |
| } catch (err) { console.error('[API] omi/forfeit:', err.message); res.status(500).json({ ok: false, error: 'Error' }); } | |
| }); | |
| // ── Start ── | |
| const PORT = parseInt(process.env.PORT || '7860'); | |
| function startApi() { app.listen(PORT, () => console.log(`[API] Port ${PORT}`)); } | |
| module.exports = { startApi }; | |