server.js

import express from "express";
import axios from "axios";
import cors from "cors";

const app = express();

// Enable CORS for all routes
app.use(cors());

// Parse JSON bodies
app.use(express.json());

// Health check
app.get("/", (req, res) => res.send("🔥 Advanced Proxy Server Live"));

// Main proxy endpoint with aggressive spoofing
app.get("/proxy", async (req, res) => {
  const { url, matchId, home, away, referer } = req.query;
  
  if (!url) return res.status(400).send("❌ Missing ?url param");

  const targetUrl = decodeURIComponent(url);
  
  // Dynamic referer generation
  const customReferer = referer || 
    (matchId && home && away 
      ? `https://www.808ball6.com/football/${matchId}-${home}-vs-${away}.html` 
      : "https://www.808ball6.com/");

  // Extract domain from target URL for origin spoofing
  const urlObj = new URL(targetUrl);
  const targetOrigin = `${urlObj.protocol}//${urlObj.hostname}`;

  try {
    const response = await axios.get(targetUrl, {
      headers: {
        // Browser identification
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
        
        // Accept headers
        "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
        "Accept-Language": "en-US,en;q=0.9,es;q=0.8,fr;q=0.7",
        "Accept-Encoding": "gzip, deflate, br, zstd",
        
        // Referer and Origin
        "Referer": customReferer,
        "Origin": targetOrigin,
        
        // Connection
        "Connection": "keep-alive",
        
        // Security/Fetch metadata
        "Sec-Fetch-Dest": "iframe",
        "Sec-Fetch-Mode": "navigate",
        "Sec-Fetch-Site": "cross-site",
        "Sec-Fetch-User": "?1",
        
        // Chrome-specific headers
        "Sec-Ch-Ua": '"Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"',
        "Sec-Ch-Ua-Mobile": "?0",
        "Sec-Ch-Ua-Platform": '"Windows"',
        "Sec-Ch-Ua-Arch": '"x86"',
        "Sec-Ch-Ua-Bitness": '"64"',
        "Sec-Ch-Ua-Full-Version-List": '"Google Chrome";v="131.0.6778.86", "Chromium";v="131.0.6778.86", "Not_A Brand";v="24.0.0.0"',
        
        // Additional realistic headers
        "Upgrade-Insecure-Requests": "1",
        "DNT": "1",
        "Cache-Control": "max-age=0",
        "Priority": "u=0, i",
        
        // Cookie forwarding (if provided)
        ...(req.headers.cookie && { "Cookie": req.headers.cookie }),
        
        // Cloudflare bypass headers
        "CF-Connecting-IP": "8.8.8.8",
        "X-Forwarded-For": "8.8.8.8",
        "X-Real-IP": "8.8.8.8",
        "X-Forwarded-Host": urlObj.hostname,
        "X-Forwarded-Proto": "https",
        
        // Additional anti-detection
        "Device-Memory": "8",
        "Viewport-Width": "1920",
        "DPR": "1"
      },
      responseType: "arraybuffer",
      maxRedirects: 10,
      validateStatus: () => true,
      timeout: 30000,
      decompress: true,
      
      // Proxy configuration (if needed)
      // proxy: false, // Disable if you don't have a proxy
      
      // HTTP/2 support
      httpAgent: false,
      httpsAgent: false
    });

    // Set response headers
    const contentType = response.headers["content-type"] || "text/html; charset=utf-8";
    
    // Remove anti-iframe headers
    const headersToRemove = [
      "x-frame-options",
      "content-security-policy",
      "content-security-policy-report-only",
      "x-content-security-policy",
      "x-webkit-csp",
      "strict-transport-security"
    ];
    
    // Copy safe headers
    Object.keys(response.headers).forEach(key => {
      if (!headersToRemove.includes(key.toLowerCase())) {
        res.setHeader(key, response.headers[key]);
      }
    });
    
    res.setHeader("Content-Type", contentType);
    res.setHeader("Access-Control-Allow-Origin", "*");
    res.setHeader("Access-Control-Allow-Methods", "*");
    res.setHeader("Access-Control-Allow-Headers", "*");
    res.setHeader("X-Frame-Options", "ALLOWALL");
    res.setHeader("X-Content-Type-Options", "nosniff");

    // Handle HTML responses with frame-busting prevention
    if (contentType.includes("text/html")) {
      let html = response.data.toString("utf-8");
      
      // Aggressive frame-busting prevention
      const antiFrameBust = `
        <script>
          (function() {
            // Freeze top and parent
            try {
              Object.defineProperty(window, 'top', { 
                get: function() { return window.self; },
                set: function() {},
                configurable: false
              });
              Object.defineProperty(window, 'parent', { 
                get: function() { return window.self; },
                set: function() {},
                configurable: false
              });
              Object.defineProperty(window, 'frameElement', {
                get: function() { return null; },
                set: function() {},
                configurable: false
              });
              
              // Override location checks
              var originalLocation = window.location;
              Object.defineProperty(window, 'location', {
                get: function() { return originalLocation; },
                set: function(val) {
                  if (window.self === window.top) {
                    originalLocation = val;
                  }
                }
              });
              
              // Disable common frame-busting patterns
              window.onbeforeunload = null;
              
              // Intercept and block certain navigation attempts
              var _confirm = window.confirm;
              window.confirm = function() { return true; };
              
              var _alert = window.alert;
              window.alert = function() {};
              
            } catch(e) {
              console.log('Frame protection applied');
            }
          })();
        </script>
      `;
      
      // Inject at multiple points for maximum coverage
      html = html.replace(/<!DOCTYPE/i, antiFrameBust + '<!DOCTYPE');
      html = html.replace(/<head>/i, `<head>${antiFrameBust}`);
      html = html.replace(/<head\s/i, `<head>${antiFrameBust} `);
      
      // If no head tag, inject at start
      if (!/<head/i.test(html)) {
        html = antiFrameBust + html;
      }
      
      // Rewrite absolute URLs to go through proxy
      html = html.replace(
        /(src|href)=["'](https?:\/\/[^"']+)["']/gi,
        (match, attr, url) => {
          if (url.includes(urlObj.hostname)) {
            return `${attr}="/proxy?url=${encodeURIComponent(url)}"`;
          }
          return match;
        }
      );
      
      return res.send(html);
    }

    // For non-HTML content, send as-is
    res.send(response.data);

  } catch (err) {
    console.error("❌ Proxy error:", err.message);
    console.error("   URL:", targetUrl);
    console.error("   Status:", err.response?.status);
    
    res.status(err.response?.status || 500).send({
      error: "Proxy failed",
      message: err.message,
      url: targetUrl,
      status: err.response?.status
    });
  }
});

// Catch-all proxy for any resource
app.use("/fetch/*", async (req, res) => {
  const targetUrl = req.params[0];
  
  if (!targetUrl) return res.status(400).send("❌ No URL provided");
  
  try {
    const response = await axios.get(targetUrl, {
      headers: {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
        "Accept": "*/*",
        "Accept-Language": "en-US,en;q=0.9",
        "Accept-Encoding": "gzip, deflate, br",
        "Referer": "https://www.808ball6.com/",
        "Origin": "https://www.808ball6.com",
        "Sec-Fetch-Dest": "empty",
        "Sec-Fetch-Mode": "cors",
        "Sec-Fetch-Site": "cross-site"
      },
      responseType: "arraybuffer",
      timeout: 30000,
      validateStatus: () => true
    });
    
    res.setHeader("Content-Type", response.headers["content-type"] || "application/octet-stream");
    res.setHeader("Access-Control-Allow-Origin", "*");
    res.send(response.data);
    
  } catch (err) {
    console.error("❌ Fetch error:", err.message);
    res.status(500).send({ error: "Fetch failed", message: err.message });
  }
});

// POST proxy for form submissions or API calls
app.post("/proxy", async (req, res) => {
  const { url } = req.query;
  const body = req.body;
  
  if (!url) return res.status(400).send("❌ Missing ?url param");
  
  const targetUrl = decodeURIComponent(url);
  
  try {
    const response = await axios.post(targetUrl, body, {
      headers: {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
        "Content-Type": "application/json",
        "Accept": "*/*",
        "Referer": "https://www.808ball6.com/",
        "Origin": "https://www.808ball6.com"
      },
      validateStatus: () => true
    });
    
    res.status(response.status).json(response.data);
  } catch (err) {
    res.status(500).send({ error: "POST proxy failed", message: err.message });
  }
});

const PORT = process.env.PORT || 7860;
app.listen(PORT, () => {
  console.log(`\n🚀 Proxy Server Running`);
  console.log(`📡 Port: ${PORT}`);
  console.log(`🌐 Endpoints:`);
  console.log(`   • GET  / (health check)`);
  console.log(`   • GET  /proxy?url=<target>`);
  console.log(`   • GET  /fetch/<target>`);
  console.log(`   • POST /proxy?url=<target>`);
});