Upload 8 files

.gitattributes

@@ -33,3 +33,4 @@ saved_model/**/* filter=lfs diff=lfs merge=lfs -text
 *.zip filter=lfs diff=lfs merge=lfs -text
 *.zst filter=lfs diff=lfs merge=lfs -text
 *tfevents* filter=lfs diff=lfs merge=lfs -text
+public/icon.webp filter=lfs diff=lfs merge=lfs -text

Dockerfile

@@ -0,0 +1,38 @@
+FROM node:20
+
+RUN apt-get update && apt-get install -y \
+    wget \
+    gnupg \
+    ca-certificates \
+    fonts-liberation \
+    libappindicator3-1 \
+    libasound2 \
+    libatk-bridge2.0-0 \
+    libatk1.0-0 \
+    libcups2 \
+    libdbus-1-3 \
+    libdrm2 \
+    libgbm1 \
+    libgtk-3-0 \
+    libnspr4 \
+    libnss3 \
+    libx11-xcb1 \
+    libxcomposite1 \
+    libxdamage1 \
+    libxrandr2 \
+    xdg-utils \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+
+COPY package*.json ./
+
+RUN npm install
+
+RUN npx puppeteer browsers install chrome
+
+COPY . .
+
+EXPOSE 7860
+
+CMD ["npm", "start"]

README.md

@@ -1,7 +1,7 @@
 ---
-title: DashX
-emoji: 📈
-colorFrom: indigo
+title: DashX API
+emoji: 🌖
+colorFrom: pink
 colorTo: indigo
 sdk: docker
 pinned: false

index.js

@@ -0,0 +1,2132 @@
+const express = require('express');
+const mongoose = require('mongoose');
+const bcrypt = require('bcryptjs');
+const jwt = require('jsonwebtoken');
+const nodemailer = require('nodemailer');
+const rateLimit = require('express-rate-limit');
+const path = require('path');
+const fs = require('fs');
+const { Resend } = require('resend');
+const crypto = require('crypto');
+const syntaxError = require('syntax-error');
+const tmpRouter = require('./tmp');
+
+
+const app = express();
+app.use(express.json());
+
+app.set('trust proxy', true);
+
+const getRealIP = (req, res, next) => {
+    let ip;
+
+    if (req.headers['cf-connecting-ip']) {
+        ip = req.headers['cf-connecting-ip'];
+    } else if (req.headers['x-real-ip']) {
+        ip = req.headers['x-real-ip'];
+    } else if (req.headers['x-forwarded-for']) {
+        ip = req.headers['x-forwarded-for'].split(',')[0].trim();
+    } else {
+        ip = req.socket.remoteAddress || req.connection.remoteAddress || '0.0.0.0';
+    }
+
+    if (ip.startsWith('::ffff:')) {
+        ip = ip.substring(7);
+    }
+
+    req.realIP = ip;
+    next();
+};
+
+app.use(getRealIP);
+app.use(express.static('public'));
+
+const JWT_SECRET = process.env.JWT;
+const MONGODB_URI = process.env.MONGODB;
+
+mongoose.connect(MONGODB_URI)
+    .then(() => console.log('Connected to MongoDB'))
+    .catch(err => console.error('MongoDB connection error:', err));
+
+const activitySchema = new mongoose.Schema({
+    userId: { type: String, required: true },
+    username: String,
+    type: { 
+        type: String, 
+        enum: ['api_key_generated', 'limit_updated', 'profile_updated', 'redeem_code_used', 'premium_activated', 'api_request', 'temp_banned', 'ban_removed', 'limit_reset', 'role_expired', 'role_assigned', 'api_key_updated'], 
+        required: true 
+    },
+    description: String,
+    metadata: Object,
+    timestamp: { type: Date, default: Date.now }
+});
+
+const userSchema = new mongoose.Schema({
+    username: { type: String, required: true, unique: true },
+    email: { type: String, required: true, unique: true },
+    password: { type: String, required: true },
+    apikey: { type: String, required: true, unique: true },
+    profileUrl: { type: String, default: 'https://files.catbox.moe/8l6hhm' },
+    verified: { type: Boolean, default: true },
+    role: { type: String, enum: ['user', 'admin'], default: 'user' },
+    userRole: { type: String, enum: ['cheap', 'premium', 'vip', 'supreme'], default: null },
+    userRoleExpiresAt: { type: Date, default: null },
+    premium: { type: Boolean, default: false },
+    premiumExpiredAt: { type: Date, default: null },
+    limit: { type: Number, default: 30 },
+    requests: { type: Number, default: 0 },
+    requestsToday: { type: Number, default: 0 },
+    lastReset: { type: Date, default: Date.now },
+    banned: { type: Boolean, default: false },
+    tempBanned: { type: Boolean, default: false },
+    tempBanUntil: { type: Date, default: null },
+    tempBanReason: { type: String, default: null },
+    ipAddress: String,
+    createdAt: { type: Date, default: Date.now }
+});
+
+const pendingVerificationSchema = new mongoose.Schema({
+    email: { type: String, required: true, unique: true },
+    username: { type: String, required: true },
+    password: { type: String, required: true },
+    verificationCode: { type: String, required: true },
+    ipAddress: String,
+    ispInfo: Object,
+    expiresAt: { type: Date, default: () => new Date(Date.now() + 15 * 60 * 1000) },
+    createdAt: { type: Date, default: Date.now }
+});
+
+pendingVerificationSchema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 });
+
+const redeemCodeSchema = new mongoose.Schema({
+    code: { type: String, required: true, unique: true },
+    type: { type: String, enum: ['limit', 'premium', 'both'], required: true },
+    limitValue: { type: Number, default: 0 },
+    codeExpired: { type: Date, required: true },
+    premiumExpired: { type: Date, default: null },
+    used: { type: Boolean, default: false },
+    usedBy: String,
+    createdBy: { type: String, required: true },
+    createdAt: { type: Date, default: Date.now }
+});
+
+redeemCodeSchema.index({ codeExpired: 1 }, { expireAfterSeconds: 0 });
+
+const requestLogSchema = new mongoose.Schema({
+    userId: String,
+    username: String,
+    apikey: String,
+    endpoint: String,
+    ipAddress: String,
+    userAgent: String,
+    timestamp: { type: Date, default: Date.now },
+    success: Boolean,
+    responseTime: Number,
+    limitDeducted: { type: Number, default: 1 }
+});
+
+const banListSchema = new mongoose.Schema({
+    ipAddress: String,
+    bannedUntil: Date,
+    reason: String,
+    createdAt: { type: Date, default: Date.now }
+});
+
+banListSchema.index({ bannedUntil: 1 }, { expireAfterSeconds: 0 });
+
+const roleSchema = new mongoose.Schema({
+    userId: { type: String, required: true },
+    roleName: { type: String, enum: ['cheap', 'premium', 'vip', 'supreme'], required: true },
+    customApiKey: { type: String, unique: true, sparse: true },
+    expiresAt: { type: Date, required: true },
+    createdAt: { type: Date, default: Date.now },
+    createdBy: String
+});
+
+const UserRole = mongoose.model('UserRole', roleSchema);
+const Activity = mongoose.model('Activity', activitySchema);
+const User = mongoose.model('User', userSchema);
+const PendingVerification = mongoose.model('PendingVerification', pendingVerificationSchema);
+const RedeemCode = mongoose.model('RedeemCode', redeemCodeSchema);
+const RequestLog = mongoose.model('RequestLog', requestLogSchema);
+const BanList = mongoose.model('BanList', banListSchema);
+
+/*const transporter = nodemailer.createTransport({
+    host: 'smtp-relay.brevo.com',
+    port: 587,
+    secure: false,
+    auth: {
+        user: '998a64001@smtp-brevo.com', // Login dari Brevo (BUKAN email kamu!)
+        pass: 'xsmtpsib-c8f574e4088a014fc3859e8dc887afdf65a95bd21e1e3edd7ae32825ac6a44d5-A8ms8qx31RuVgZnc' // SMTP Key
+    },
+    tls: {
+        rejectUnauthorized: false
+    }
+});*/
+
+const generateApiKey = () => {
+    return 'DHX-' + crypto.randomBytes(3).toString('hex').toUpperCase();
+};
+
+const generateVerificationCode = () => {
+    return Math.random().toString(36).substring(2, 8).toUpperCase();
+};
+
+const logActivity = async (userId, username, type, description, metadata = {}) => {
+    try {
+        await Activity.create({
+            userId,
+            username,
+            type,
+            description,
+            metadata,
+            timestamp: new Date()
+        });
+    } catch (error) {
+        console.error('Activity logging error:', error);
+    }
+};
+
+const getTimeAgo = (date) => {
+    const now = new Date();
+    const diff = now - new Date(date);
+    const minutes = Math.floor(diff / 60000);
+    const hours = Math.floor(diff / 3600000);
+    const days = Math.floor(diff / 86400000);
+
+    if (minutes < 1) return 'Just now';
+    if (minutes < 60) return `${minutes} minutes ago`;
+    if (hours < 24) return `${hours} hours ago`;
+    return `${days} days ago`;
+};
+
+const getNextMidnight = () => {
+    const now = new Date();
+    const midnight = new Date(now);
+    midnight.setHours(24, 0, 0, 0);
+    return midnight;
+};
+
+const getTimeUntilMidnight = () => {
+    const now = new Date();
+    const midnight = getNextMidnight();
+    const diff = midnight - now;
+
+    const hours = Math.floor(diff / (1000 * 60 * 60));
+    const minutes = Math.floor((diff % (1000 * 60 * 60)) / (1000 * 60));
+    const seconds = Math.floor((diff % (1000 * 60)) / 1000);
+
+    return { hours, minutes, seconds, totalMs: diff };
+};
+
+const apiRateLimit = rateLimit({
+    windowMs: 10 * 1000,
+    max: 3,
+    message: { success: false, error: 'Too many requests, please try again later' },
+    standardHeaders: true,
+    legacyHeaders: false,
+    keyGenerator: (req) => req.realIP,
+    handler: async (req, res) => {
+        const ip = req.realIP;
+        const bannedUntil = new Date(Date.now() + 10 * 60 * 1000);
+        try {
+            await BanList.create({ ipAddress: ip, bannedUntil, reason: 'Rate limit exceeded' });
+        } catch (error) {
+            console.error('Ban list creation error:', error);
+        }
+
+        const randomStatus = Math.random() > 0.5 ? 429 : 403;
+        res.status(randomStatus).json({
+            success: false,
+            error: randomStatus === 429 ? 'Too many requests' : 'Forbidden - IP temporarily banned'
+        });
+    }
+});
+
+const authRateLimit = rateLimit({
+    windowMs: 5 * 60 * 1000,
+    max: 10,
+    message: { success: false, error: '429 Forbidden Request flood detected' },
+    standardHeaders: true,
+    legacyHeaders: false,
+    keyGenerator: (req) => req.realIP,
+    handler: async (req, res) => {
+        const ip = req.realIP;
+        const bannedUntil = new Date(Date.now() + 30 * 60 * 1000);
+
+        try {
+            const existingBan = await BanList.findOne({ ipAddress: ip });
+
+            if (!existingBan) {
+                await BanList.create({ 
+                    ipAddress: ip, 
+                    bannedUntil, 
+                    reason: 'Authentication flood detected' 
+                });
+                console.log(`IP ${ip} banned for 30 minutes due to auth flood`);
+            }
+        } catch (error) {
+            console.error('Auth ban list creation error:', error);
+        }
+
+        res.status(429).json({
+            success: false,
+            error: '429 Forbidden Request flood detected',
+            bannedUntil: bannedUntil.toISOString(),
+            message: 'Your IP has been temporarily blocked for 30 minutes'
+        });
+    }
+});
+
+const checkBanned = async (req, res, next) => {
+    const ip = req.realIP;
+    try {
+        const banned = await BanList.findOne({
+            ipAddress: ip,
+            bannedUntil: { $gt: new Date() }
+        });
+
+        if (banned) {
+            return res.status(403).json({
+                success: false,
+                error: 'IP is temporarily banned',
+                bannedUntil: banned.bannedUntil,
+                reason: banned.reason
+            });
+        }
+    } catch (error) {
+        console.error('Check banned error:', error);
+    }
+    next();
+};
+
+const checkTempBan = async (user) => {
+    if (user.tempBanned && user.tempBanUntil) {
+        if (new Date() > user.tempBanUntil) {
+            user.tempBanned = false;
+            user.tempBanUntil = null;
+            user.tempBanReason = null;
+            await user.save();
+
+            await logActivity(user._id, user.username, 'ban_removed', 'Temporary ban expired automatically');
+            return false;
+        }
+        return true;
+    }
+    return false;
+};
+
+const checkPremiumExpiry = async (user) => {
+    if (user.premium && user.premiumExpiredAt) {
+        if (new Date() > user.premiumExpiredAt) {
+            user.premium = false;
+            user.premiumExpiredAt = null;
+            await user.save();
+            return true;
+        }
+    }
+    return false;
+};
+
+const checkRoleExpiry = async (user) => {
+    if (user.userRoleExpiresAt && new Date() > user.userRoleExpiresAt) {
+        const oldRole = user.userRole;
+        const oldLimit = user.limit;
+
+        user.userRole = null;
+        user.userRoleExpiresAt = null;
+        user.premium = false;
+        user.premiumExpiredAt = null;
+
+        if (user.limit <= 30) {
+            user.limit = 30;
+        }
+
+        await user.save();
+        await UserRole.deleteOne({ userId: user._id });
+
+        await logActivity(user._id, user.username, 'role_expired', `Role ${oldRole} expired, limit ${oldLimit} → ${user.limit}`);
+        return true;
+    }
+    return false;
+};
+
+const resetUserLimitIfNeeded = async (user) => {
+    const now = new Date();
+    const lastReset = new Date(user.lastReset);
+
+    now.setHours(0, 0, 0, 0);
+    lastReset.setHours(0, 0, 0, 0);
+
+    const needsReset = now.getTime() !== lastReset.getTime();
+
+    if (needsReset) {
+        if (user.userRole) {
+            const roleConfig = {
+                cheap: 500,
+                premium: 1500,
+                vip: 2500,
+                supreme: 3000
+            };
+
+            const oldLimit = user.limit;
+            user.limit = roleConfig[user.userRole] || 30;
+            user.requestsToday = 0;
+            user.lastReset = new Date();
+
+            await user.save();
+
+            await logActivity(user._id, user.username, 'limit_reset', `Daily limit reset from ${oldLimit} to ${user.limit} (Role: ${user.userRole})`);
+
+            return true;
+        } else {
+            if (user.limit <= 30) {
+                user.limit = 30;
+                user.requestsToday = 0;
+                user.lastReset = new Date();
+
+                await user.save();
+
+                await logActivity(user._id, user.username, 'limit_reset', 'Daily limit reset to 30 (No role)');
+
+                return true;
+            } else {
+                user.requestsToday = 0;
+                user.lastReset = new Date();
+
+                await user.save();
+
+                await logActivity(user._id, user.username, 'limit_reset', `Requests reset, limit remains ${user.limit} (waiting to reach 30)`);
+
+                return true;
+            }
+        }
+    }
+
+    return false;
+};
+
+const authenticate = async (req, res, next) => {
+    const token = req.headers.authorization?.replace('Bearer ', '');
+    if (!token) {
+        return res.status(401).json({ success: false, error: 'No token provided' });
+    }
+
+    try {
+        const decoded = jwt.verify(token, JWT_SECRET);
+        req.user = await User.findById(decoded.userId);
+        if (!req.user) {
+            return res.status(401).json({ success: false, error: 'User not found' });
+        }
+
+        await checkPremiumExpiry(req.user);
+        await checkRoleExpiry(req.user);
+        await resetUserLimitIfNeeded(req.user);
+
+        next();
+    } catch (error) {
+        return res.status(401).json({ success: false, error: 'Invalid token' });
+    }
+};
+
+const validateApiKey = async (req, res, next) => {
+    const { key } = req.query;
+    if (!key) {
+        return res.status(400).json({ success: false, error: 'API key required' });
+    }
+
+    try {
+        const user = await User.findOne({ apikey: key });
+        if (!user || user.banned) {
+            return res.status(401).json({ success: false, error: 'Invalid or banned API key' });
+        }
+
+        await checkPremiumExpiry(user);
+        await checkRoleExpiry(user);
+        await resetUserLimitIfNeeded(user);
+
+        const isTempBanned = await checkTempBan(user);
+        if (isTempBanned) {
+            const banUntil = new Date(user.tempBanUntil);
+            return res.status(403).json({ 
+                success: false, 
+                error: `Account temporarily banned until ${banUntil.toLocaleString()}. Reason: ${user.tempBanReason || 'No reason provided'}` 
+            });
+        }
+
+        const limitDeduction = req.limitDeduction || 1;
+
+        if (user.role !== 'admin' && user.requestsToday >= user.limit) {
+            return res.status(429).json({ success: false, error: 'Daily limit exceeded' });
+        }
+
+        user.requests++;
+        user.requestsToday += limitDeduction;
+        await user.save();
+
+        await logActivity(user._id, user.username, 'api_request', 'API request made', {
+            endpoint: req.path,
+            method: req.method,
+            ip: req.realIP,
+            limitDeducted: limitDeduction
+        });
+
+        req.apiUser = user;
+        req.limitDeducted = limitDeduction;
+        next();
+    } catch (error) {
+        console.error('API key validation error:', error);
+        return res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+};
+
+const BLOCKED_ISP_KEYWORDS = [
+    'digitalocean', 'linode', 'vultr', 'ovh', 'hetzner',
+    'contabo', 'amazon', 'aws', 'google cloud', 'microsoft azure',
+    'scaleway', 'ramnode', 'buyvm', 'hostinger', 'namecheap',
+    'godaddy', 'hostgator', 'bluehost', 'siteground',
+    'cloudflare', 'fastly', 'maxcdn', 'keycdn', 'bunnycdn',
+    'rackspace', 'packet', 'equinix', 'servermania',
+    'quadranet', 'psychz', 'choopa', 'fdcservers', 'nobistech',
+    'colocrossing', 'hostus', 'reliablesite', 'serverpronto',
+    'wholesaleinternet', 'online.net', 'nforce', 'leaseweb',
+    'expressvpn', 'nordvpn', 'surfshark', 'cyberghost', 'purevpn',
+    'ipvanish', 'tunnelbear', 'protonvpn', 'mullvad',
+    'tor exit', 'proxy', 'vpn', 'anonymous'
+];
+
+const detectSuspiciousISP = async (ip) => {
+    try {
+        const response = await fetch(`https://ipinfo.io/${ip}?token=790c300f1388ce`);
+        const data = await response.json();
+
+        const isp = (data.org || '').toLowerCase();
+        const company = (data.company?.name || '').toLowerCase();
+        const asn = (data.asn?.name || '').toLowerCase();
+
+        const suspiciousKeywords = BLOCKED_ISP_KEYWORDS.some(keyword => 
+            isp.includes(keyword) || company.includes(keyword) || asn.includes(keyword)
+        );
+
+        return {
+            isSuspicious: suspiciousKeywords,
+            isp: data.org,
+            country: data.country,
+            region: data.region,
+            city: data.city
+        };
+    } catch (error) {
+        console.error('ISP detection error:', error);
+        return { isSuspicious: false };
+    }
+};
+
+async function hashPassword() {
+  const password = process.env.DEFAULT_PASSWORD;
+  const hashedPassword = await bcrypt.hash(password, 12);
+  console.log(hashedPassword);
+  return hashedPassword;
+}
+let herxaj = process.env.APIKEY
+
+const initializeAdmin = async () => {
+    try {
+      const hashedPassword = await bcrypt.hash(process.env.DEFAULT_PASSWORD, 12);
+        let admin = await User.findOne({ username: 'HERXA' });
+        if (!admin) {
+            admin = new User({
+                username: 'HERXA',
+                email: 'admin@dashx.com',
+                password: hashedPassword,
+                apikey: herxaj,
+                profileUrl: 'https://files.catbox.moe/8l6hhm',
+                verified: true,
+                role: 'admin',
+                premium: true,
+                limit: 9999,
+                ipAddress: '127.0.0.1'
+            });
+            await admin.save();
+        } else {
+            admin.apikey = 'DHX-M3SA';
+            admin.limit = 9999;
+            admin.role = 'admin';
+            admin.premium = true;
+            await admin.save();
+        }
+    } catch (error) {
+        console.error('Admin initialization error:', error);
+    }
+};
+
+app.get('/', (req, res) => {
+    res.sendFile(path.join(__dirname, 'public', 'index.html'));
+});
+
+app.get('/auth', (req, res) => {
+    res.sendFile(path.join(__dirname, 'public', 'auth.html'));
+});
+
+app.get('/denied', (req, res) => {
+    res.sendFile(path.join(__dirname, 'public', 'denied.html'));
+});
+
+app.get('/dashboard', (req, res) => {
+    res.sendFile(path.join(__dirname, 'public', 'dashboard.html'));
+});
+
+app.get('/profile', (req, res) => {
+    res.sendFile(path.join(__dirname, 'public', 'profile.html'));
+});
+
+app.get('/check-ip', (req, res) => {
+    res.json({
+        realIP: req.realIP,
+        headers: {
+            'x-forwarded-for': req.headers['x-forwarded-for'],
+            'x-real-ip': req.headers['x-real-ip'],
+            'cf-connecting-ip': req.headers['cf-connecting-ip']
+        },
+        socket: req.socket.remoteAddress
+    });
+});
+
+app.get('/api/stats', async (req, res) => {
+    try {
+        const totalUsers = await User.countDocuments();
+        const totalRequests = await RequestLog.countDocuments();
+
+        const todayStart = new Date();
+        todayStart.setHours(0, 0, 0, 0);
+
+        const todayRequests = await RequestLog.countDocuments({
+            timestamp: { $gte: todayStart }
+        });
+
+        res.json({
+            success: true,
+            stats: {
+                totalUsers,
+                totalRequests,
+                todayRequests
+            }
+        });
+    } catch (error) {
+        console.error('Stats error:', error);
+        res.status(500).json({ 
+            success: false, 
+            error: 'Failed to load statistics' 
+        });
+    }
+});
+
+app.get('/api/plugins', (req, res) => {
+    const plugins = [];
+
+    try {
+        Object.keys(global.plugins).forEach(file => {
+            try {
+                const plugin = global.plugins[file];
+                if (plugin && plugin.enabled) {
+                    plugins.push({
+                        name: plugin.name || 'Unknown Plugin',
+                        description: plugin.description || 'No description',
+                        type: plugin.type || 'GET',
+                        routes: plugin.routes || [],
+                        main: plugin.main || [],
+                        tags: plugin.tags || [],
+                        parameters: plugin.parameters || {},
+                        limit: plugin.limit || 1
+                    });
+                }
+            } catch (error) {
+                console.error(`Error loading plugin info ${file}:`, error.message);
+            }
+        });
+    } catch (error) {
+        console.error('Error reading plugins:', error);
+    }
+
+    res.json({ success: true, plugins });
+});
+
+app.get('/DB/delete', validateApiKey, async (req, res) => {
+    try {
+        if (req.apiUser.role !== 'admin') {
+            return res.status(403).json({ success: false, error: 'Admin access required' });
+        }
+
+        const deleteResults = {};
+
+        const userResult = await User.deleteMany({ 
+            _id: { $ne: req.apiUser._id } 
+        });
+        deleteResults.users = userResult.deletedCount;
+
+        const pendingResult = await PendingVerification.deleteMany({});
+        deleteResults.pendingVerifications = pendingResult.deletedCount;
+
+        const redeemResult = await RedeemCode.deleteMany({});
+        deleteResults.redeemCodes = redeemResult.deletedCount;
+
+        const logResult = await RequestLog.deleteMany({});
+        deleteResults.requestLogs = logResult.deletedCount;
+
+        const banResult = await BanList.deleteMany({});
+        deleteResults.banList = banResult.deletedCount;
+
+        const activityResult = await Activity.deleteMany({});
+        deleteResults.activities = activityResult.deletedCount;
+
+        res.json({
+            success: true,
+            message: 'Database cleared successfully',
+            deletedCounts: deleteResults,
+            timestamp: new Date().toISOString()
+        });
+
+    } catch (error) {
+        console.error('Database deletion error:', error);
+        res.status(500).json({ 
+            success: false, 
+            error: 'Failed to delete database data',
+            details: error.message 
+        });
+    }
+});
+
+app.post('/api/auth/register', checkBanned, authRateLimit, async (req, res) => {
+    try {
+        const { username, email, password } = req.body;
+        const ipAddress = req.realIP;
+
+        if (!username || !email || !password) {
+            return res.status(400).json({
+                success: false,
+                error: 'Username, email, and password are required'
+            });
+        }
+
+        if (password.length < 6) {
+            return res.status(400).json({
+                success: false,
+                error: 'Password must be at least 6 characters long'
+            });
+        }
+
+        const ispCheck = await detectSuspiciousISP(ipAddress);
+        if (ispCheck.isSuspicious) {
+            return res.status(403).json({
+                success: false,
+                error: 'Registration not allowed from this network. Please use a different connection.',
+                blocked_reason: 'suspicious_isp'
+            });
+        }
+
+        const existingUser = await User.findOne({
+            $or: [{ email }, { username }, { ipAddress }]
+        });
+
+        if (existingUser) {
+            return res.status(400).json({
+                success: false,
+                error: 'User already exists with this email, username, or IP address'
+            });
+        }
+
+        const existingPending = await PendingVerification.findOne({ email });
+        if (existingPending) {
+            await PendingVerification.deleteOne({ _id: existingPending._id });
+        }
+
+        const verificationCode = generateVerificationCode();
+        const hashedPassword = await bcrypt.hash(password, 12);
+
+        const pendingVerification = new PendingVerification({
+            email,
+            username,
+            password: hashedPassword,
+            verificationCode,
+            ipAddress,
+            ispInfo: {
+                isp: ispCheck.isp,
+                country: ispCheck.country,
+                region: ispCheck.region,
+                city: ispCheck.city,
+                registeredAt: new Date()
+            }
+        });
+
+        await pendingVerification.save();
+const resend = new Resend(process.env.RESEND_API_KEY);
+        const emailTemplate = `
+            <!DOCTYPE html>
+            <html lang="en">
+            <head>
+                <meta charset="UTF-8">
+                <meta name="viewport" content="width=device-width, initial-scale=1.0">
+                <title>DashX Verification</title>
+            </head>
+            <body style="margin: 0; padding: 0; font-family: 'Arial', sans-serif; background: linear-gradient(135deg, #853030 0%, #292727 100%); min-height: 100vh;">
+                <div style="max-width: 600px; margin: 0 auto; padding: 20px;">
+                    <div style="background: #ffffff; border-radius: 20px; box-shadow: 0 20px 40px rgba(0,0,0,0.1); overflow: hidden;">
+                        <div style="background: linear-gradient(135deg, #853030 0%, #292727 100%); padding: 40px 30px; text-align: center;">
+                            <h1 style="color: #ffffff; margin: 0; font-size: 32px; font-weight: 700; text-shadow: 0 2px 4px rgba(0,0,0,0.1);">
+                                🚀 DashX
+                            </h1>
+                            <p style="color: #e8eaf6; margin: 10px 0 0 0; font-size: 16px; opacity: 0.9;">
+                                API Dashboard Platform
+                            </p>
+                        </div>
+                        <div style="padding: 40px 30px;">
+                            <div style="text-align: center; margin-bottom: 30px;">
+                                <h2 style="color: #2c3e50; margin: 0 0 15px 0; font-size: 28px; font-weight: 600;">
+                                    Welcome to DashX!
+                                </h2>
+                                <p style="color: #7f8c8d; margin: 0; font-size: 16px; line-height: 1.6;">
+                                    Please verify your email address to complete registration.
+                                </p>
+                            </div>
+                            <div style="background: linear-gradient(135deg, #f8f9ff 0%, #e8eaf6 100%); border-radius: 15px; padding: 30px; text-align: center; margin: 30px 0; border: 2px solid #e3f2fd;">
+                                <p style="color: #853030; margin: 0 0 15px 0; font-size: 18px; font-weight: 600;">
+                                    Your Verification Code
+                                </p>
+                                <div style="background: #ffffff; border-radius: 10px; padding: 20px; margin: 15px 0; box-shadow: 0 4px 12px rgba(0,0,0,0.1);">
+                                    <span style="font-size: 36px; font-weight: 700; color: #853030; letter-spacing: 8px; font-family: 'Courier New', monospace;">
+                                        ${verificationCode}
+                                    </span>
+                                </div>
+                                <p style="color: #7986cb; margin: 15px 0 0 0; font-size: 14px;">
+                                    This code will expire in 15 minutes
+                                </p>
+                            </div>
+                        </div>
+                        <div style="background: #f8f9fa; padding: 25px 30px; text-align: center; border-top: 1px solid #e9ecef;">
+                            <p style="color: #6c757d; margin: 0 0 10px 0; font-size: 14px;">
+                                Need help? Contact our support team
+                            </p>
+                            <p style="color: #adb5bd; margin: 0; font-size: 12px;">
+                                © 2025 DashX. All rights reserved.
+                            </p>
+                        </div>
+                    </div>
+                </div>
+            </body>
+            </html>
+        `;
+    const EMAIL_API_URL = process.env.API_URL
+const EMAIL_API_KEY = process.env.EMAIL_API_KEY;
+
+
+        const response = await fetch('https://mail-sooty-gamma.vercel.app/api/send-email', {
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'x-api-key': EMAIL_API_KEY
+  },
+  body: JSON.stringify({
+    target: email,
+    subject: 'DashX - Email Verification',
+    html: emailTemplate
+  })
+});
+
+        res.json({ 
+            success: true, 
+            message: 'Verification code sent to your email. Please verify within 15 minutes.',
+            expiresIn: '15 minutes'
+        });
+
+    } catch (error) {
+        console.error('Registration error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.post('/api/auth/verify', checkBanned, authRateLimit, async (req, res) => {
+    try {
+        const { email, code } = req.body;
+
+        if (!email || !code) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'Email and verification code are required' 
+            });
+        }
+
+        const pendingVerification = await PendingVerification.findOne({ 
+            email, 
+            verificationCode: code 
+        });
+
+        if (!pendingVerification) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'Invalid verification code or code has expired' 
+            });
+        }
+
+        const existingUser = await User.findOne({
+            $or: [{ email: pendingVerification.email }, { username: pendingVerification.username }]
+        });
+
+        if (existingUser) {
+            await PendingVerification.deleteOne({ _id: pendingVerification._id });
+            return res.status(400).json({ 
+                success: false, 
+                error: 'User already exists in database' 
+            });
+        }
+
+        const apikey = generateApiKey();
+
+        const user = new User({
+            username: pendingVerification.username,
+            email: pendingVerification.email,
+            password: pendingVerification.password,
+            apikey: apikey,
+            profileUrl: 'https://files.catbox.moe/8l6hhm',
+            verified: true,
+            ipAddress: pendingVerification.ipAddress,
+            role: 'user',
+            premium: false,
+            limit: 30,
+            requests: 0,
+            requestsToday: 0,
+            lastReset: new Date(),
+            banned: false
+        });
+
+        await user.save();
+        await PendingVerification.deleteOne({ _id: pendingVerification._id });
+
+        await logActivity(user._id, user.username, 'api_key_generated', 'Account created and verified successfully', {
+            apikey: user.apikey,
+            registrationIP: pendingVerification.ipAddress
+        });
+
+        const token = jwt.sign({ userId: user._id }, JWT_SECRET, { expiresIn: '30d' });
+
+        res.json({ 
+            success: true, 
+            token, 
+            user: { 
+                id: user._id,
+                username: user.username, 
+                email: user.email, 
+                apikey: user.apikey,
+                profileUrl: user.profileUrl,
+                premium: user.premium,
+                limit: user.limit
+            },
+            message: 'Account created and verified successfully!'
+        });
+
+    } catch (error) {
+        console.error('Verification error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.get('/api/admin/search-users', authenticate, async (req, res) => {
+    try {
+        if (req.user.role !== 'admin') {
+            return res.status(403).json({ success: false, error: 'Admin access required' });
+        }
+
+        const { query } = req.query;
+        if (!query) {
+            return res.json({ success: true, users: [] });
+        }
+
+        const users = await User.find({
+            $or: [
+                { username: { $regex: query, $options: 'i' } },
+                { email: { $regex: query, $options: 'i' } }
+            ],
+            role: { $ne: 'admin' }
+        }).limit(10).select('username email limit premium role');
+
+        res.json({ success: true, users });
+    } catch (error) {
+        console.error('Search users error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.get('/api/admin/user-role/:userId', authenticate, async (req, res) => {
+    try {
+        if (req.user.role !== 'admin') {
+            return res.status(403).json({ success: false, error: 'Admin access required' });
+        }
+
+        const userRole = await UserRole.findOne({ userId: req.params.userId });
+        res.json({ success: true, role: userRole });
+    } catch (error) {
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.post('/api/auth/login', checkBanned, authRateLimit, async (req, res) => {
+    try {
+        const { email, password } = req.body;
+
+        if (!email || !password) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'Email and password are required'
+            });
+        }
+
+        const user = await User.findOne({ email });
+        if (!user) {
+            return res.status(400).json({ success: false, error: 'Invalid credentials' });
+        }
+
+        const isValidPassword = await bcrypt.compare(password, user.password);
+        if (!isValidPassword) {
+            return res.status(400).json({ success: false, error: 'Invalid credentials' });
+        }
+
+        if (user.banned) {
+            return res.status(403).json({ success: false, error: 'Account is permanently banned' });
+        }
+
+        await checkPremiumExpiry(user);
+        await checkRoleExpiry(user);
+        await resetUserLimitIfNeeded(user);
+
+        const isTempBanned = await checkTempBan(user);
+        if (isTempBanned) {
+            const banUntil = new Date(user.tempBanUntil);
+            return res.status(403).json({ 
+                success: false, 
+                error: `Account temporarily banned until ${banUntil.toLocaleString()}. Reason: ${user.tempBanReason || 'No reason provided'}` 
+            });
+        }
+
+        const token = jwt.sign({ userId: user._id }, JWT_SECRET, { expiresIn: '30d' });
+
+        res.json({ 
+            success: true, 
+            token, 
+            user: { 
+                id: user._id,
+                username: user.username, 
+                email: user.email, 
+                apikey: user.apikey,
+                profileUrl: user.profileUrl,
+                premium: user.premium,
+                premiumExpiredAt: user.premiumExpiredAt,
+                limit: user.limit,
+                role: user.role
+            } 
+        });
+    } catch (error) {
+        console.error('Login error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.post('/api/auth/admin-login', checkBanned, authRateLimit, async (req, res) => {
+    try {
+        const { username, password } = req.body;
+
+        if (username === 'HERXA' && password === 'BTXHZ') {
+            let admin = await User.findOne({ username: 'HERXA' });
+            if (!admin) {
+                admin = new User({
+                    username: 'HERXA',
+                    email: 'admin@dashx.com',
+                    password: await bcrypt.hash('BTXHZ', 12),
+                    apikey: 'DHX-M3SA',
+                    profileUrl: 'https://files.catbox.moe/8l6hhm',
+                    verified: true,
+                    role: 'admin',
+                    premium: true,
+                    limit: 9999,
+                    ipAddress: req.realIP
+                });
+                await admin.save();
+            } else {
+                admin.apikey = 'DHX-M3SA';
+                admin.limit = 9999;
+                admin.role = 'admin';
+                admin.premium = true;
+                await admin.save();
+            }
+
+            const token = jwt.sign({ userId: admin._id }, JWT_SECRET, { expiresIn: '30d' });
+            return res.json({ 
+                success: true, 
+                token, 
+                user: { 
+                    id: admin._id,
+                    username: admin.username, 
+                    role: admin.role, 
+                    apikey: admin.apikey,
+                    profileUrl: admin.profileUrl,
+                    limit: admin.limit
+                } 
+            });
+        }
+
+        const admin = await User.findOne({ username, role: 'admin' });
+        if (!admin || !await bcrypt.compare(password, admin.password)) {
+            return res.status(400).json({ success: false, error: 'Invalid admin credentials' });
+        }
+
+        const token = jwt.sign({ userId: admin._id }, JWT_SECRET, { expiresIn: '30d' });
+        res.json({ 
+            success: true, 
+            token, 
+            user: { 
+                id: admin._id,
+                username: admin.username, 
+                role: admin.role, 
+                apikey: admin.apikey,
+                profileUrl: admin.profileUrl,
+                limit: admin.limit
+            } 
+        });
+    } catch (error) {
+        console.error('Admin login error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.get('/api/user/profile', authenticate, async (req, res) => {
+    try {
+        const personalTodayStart = new Date();
+        personalTodayStart.setHours(0, 0, 0, 0);
+
+        const userTodayRequestCount = await RequestLog.countDocuments({
+            $or: [
+                { userId: req.user._id.toString() },
+                { userId: req.user._id }
+            ],
+            timestamp: { $gte: personalTodayStart }
+        });
+
+        const userTotalRequestCount = await RequestLog.countDocuments({
+            $or: [
+                { userId: req.user._id.toString() },
+                { userId: req.user._id }
+            ]
+        });
+
+        const timeUntilReset = getTimeUntilMidnight();
+
+        res.json({
+            success: true,
+            user: {
+                id: req.user._id,
+                username: req.user.username,
+                email: req.user.email,
+                apikey: req.user.apikey,
+                profileUrl: req.user.profileUrl,
+                premium: req.user.premium,
+                premiumExpiredAt: req.user.premiumExpiredAt,
+                limit: req.user.limit,
+                requests: userTotalRequestCount,
+                requestsToday: userTodayRequestCount,
+                lastReset: req.user.lastReset,
+                nextResetTime: getNextMidnight(),
+                hoursUntilReset: timeUntilReset.hours,
+                minutesUntilReset: timeUntilReset.minutes,
+                secondsUntilReset: timeUntilReset.seconds,
+                role: req.user.role,
+                userRole: req.user.userRole,
+                roleExpiresAt: req.user.userRoleExpiresAt,
+                createdAt: req.user.createdAt,
+                tempBanned: req.user.tempBanned,
+                tempBanUntil: req.user.tempBanUntil,
+                tempBanReason: req.user.tempBanReason
+            }
+        });
+    } catch (error) {
+        console.error('Profile fetch error:', error);
+        res.status(500).json({ 
+            success: false, 
+            error: 'Failed to load profile' 
+        });
+    }
+});
+
+app.get('/api/user/activities', authenticate, async (req, res) => {
+    try {
+        const activities = await Activity.find({ userId: req.user._id })
+            .sort({ timestamp: -1 })
+            .limit(50);
+
+        const requestLogs = await RequestLog.find({ userId: req.user._id })
+            .sort({ timestamp: -1 })
+            .limit(20);
+
+        res.json({
+            success: true,
+            activities: activities.map(activity => ({
+                type: activity.type,
+                description: activity.description,
+                timestamp: activity.timestamp,
+                timeAgo: getTimeAgo(activity.timestamp),
+                metadata: activity.metadata
+            })),
+            requestLogs: requestLogs.map(log => ({
+                endpoint: log.endpoint,
+                timestamp: log.timestamp,
+                timeAgo: getTimeAgo(log.timestamp),
+                success: log.success,
+                ipAddress: log.ipAddress,
+                limitDeducted: log.limitDeducted
+            }))
+        });
+    } catch (error) {
+        console.error('Activities fetch error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.get('/api/user/usage-stats', authenticate, async (req, res) => {
+    try {
+        const userId = req.user._id.toString();
+
+        const todayStart = new Date();
+        todayStart.setHours(0, 0, 0, 0);
+
+        const userTodayRequests = await RequestLog.countDocuments({
+            userId,
+            timestamp: { $gte: todayStart }
+        });
+
+        const userTotalRequests = await RequestLog.countDocuments({
+            userId
+        });
+
+        const topEndpoints = await RequestLog.aggregate([
+            { $match: { userId } },
+            { $group: { _id: '$endpoint', count: { $sum: 1 } } },
+            { $sort: { count: -1 } },
+            { $limit: 10 }
+        ]);
+
+        const recentIPs = await RequestLog.aggregate([
+            { $match: { userId } },
+            { $group: { 
+                _id: '$ipAddress', 
+                count: { $sum: 1 },
+                lastUsed: { $max: '$timestamp' }
+            }},
+            { $sort: { lastUsed: -1 } },
+            { $limit: 10 }
+        ]);
+
+        const dailyUsage = await RequestLog.aggregate([
+            { $match: { 
+                userId,
+                timestamp: { $gte: new Date(Date.now() - 7 * 24 * 60 * 60 * 1000) }
+            }},
+            { $group: {
+                _id: { $dateToString: { format: '%Y-%m-%d', date: '$timestamp' } },
+                requests: { $sum: 1 },
+                limitUsed: { $sum: '$limitDeducted' }
+            }},
+            { $sort: { _id: 1 } }
+        ]);
+
+        res.json({
+            success: true,
+            stats: {
+                totalRequests: userTotalRequests,
+                todayRequests: userTodayRequests,
+                topEndpoints: topEndpoints.map(ep => ({
+                    endpoint: ep._id,
+                    count: ep.count
+                })),
+                recentIPs: recentIPs.map(ip => ({
+                    address: ip._id,
+                    count: ip.count,
+                    lastUsed: ip.lastUsed,
+                    timeAgo: getTimeAgo(ip.lastUsed)
+                })),
+                dailyUsage: dailyUsage.map(day => ({
+                    date: day._id,
+                    requests: day.requests,
+                    limitUsed: day.limitUsed
+                }))
+            }
+        });
+    } catch (error) {
+        console.error('Usage stats error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.put('/api/user/profile', authenticate, async (req, res) => {
+    try {
+        const { username, profileUrl, customApiKey } = req.body;
+        let updated = false;
+
+        if (username && username !== req.user.username) {
+            const existing = await User.findOne({ username });
+            if (existing) {
+                return res.status(400).json({ success: false, error: 'Username already taken' });
+            }
+
+            const oldUsername = req.user.username;
+            req.user.username = username;
+            updated = true;
+
+            await logActivity(req.user._id, req.user.username, 'profile_updated', `Username changed from ${oldUsername} to ${username}`, {
+                oldUsername,
+                newUsername: username
+            });
+        }
+
+        if (profileUrl !== undefined && profileUrl !== req.user.profileUrl) {
+            req.user.profileUrl = profileUrl;
+            updated = true;
+
+            await logActivity(req.user._id, req.user.username, 'profile_updated', 'Profile URL updated', {
+                newProfileUrl: profileUrl
+            });
+        }
+
+        if (customApiKey && (req.user.premium || req.user.role === 'admin')) {
+            const existing = await User.findOne({ apikey: customApiKey });
+            if (existing && existing._id.toString() !== req.user._id.toString()) {
+                return res.status(400).json({ success: false, error: 'API key already in use' });
+            }
+
+            const oldApiKey = req.user.apikey;
+            req.user.apikey = customApiKey;
+            updated = true;
+
+            await logActivity(req.user._id, req.user.username, 'api_key_updated', 'Custom API key set', {
+                oldApiKey,
+                newApiKey: customApiKey
+            });
+        }
+
+        if (updated) {
+            await req.user.save();
+        }
+
+        res.json({ success: true, message: 'Profile updated successfully' });
+    } catch (error) {
+        console.error('Profile update error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.delete('/api/user/account', authenticate, async (req, res) => {
+    try {
+        if (req.user.role === 'admin') {
+            return res.status(403).json({ success: false, error: 'Cannot delete admin account' });
+        }
+
+        await User.deleteOne({ _id: req.user._id });
+        await Activity.deleteMany({ userId: req.user._id });
+        res.json({ success: true, message: 'Account deleted successfully' });
+    } catch (error) {
+        console.error('Account deletion error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.get('/api/stats/all', async (req, res) => {
+    try {
+        const totalUsers = await User.countDocuments();
+        const totalRequests = await RequestLog.countDocuments();
+
+        const todayStart = new Date();
+        todayStart.setHours(0, 0, 0, 0);
+
+        const todayRequests = await RequestLog.countDocuments({
+            timestamp: { $gte: todayStart }
+        });
+
+        const topEndpoints = await RequestLog.aggregate([
+            { $group: { 
+                _id: '$endpoint', 
+                count: { $sum: 1 },
+                successCount: { 
+                    $sum: { $cond: ['$success', 1, 0] }
+                },
+                failCount: { 
+                    $sum: { $cond: ['$success', 0, 1] }
+                }
+            }},
+            { $sort: { count: -1 } },
+            { $limit: 10 }
+        ]);
+
+        const successCount = await RequestLog.countDocuments({ success: true });
+        const failCount = await RequestLog.countDocuments({ success: false });
+        const successRate = totalRequests > 0 ? ((successCount / totalRequests) * 100).toFixed(2) : 0;
+        const failRate = totalRequests > 0 ? ((failCount / totalRequests) * 100).toFixed(2) : 0;
+
+        const sevenDaysAgo = new Date();
+        sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);
+
+        const dailyRequests = await RequestLog.aggregate([
+            { 
+                $match: { 
+                    timestamp: { $gte: sevenDaysAgo }
+                }
+            },
+            { 
+                $group: {
+                    _id: { $dateToString: { format: '%Y-%m-%d', date: '$timestamp' } },
+                    count: { $sum: 1 },
+                    success: { $sum: { $cond: ['$success', 1, 0] } },
+                    fail: { $sum: { $cond: ['$success', 0, 1] } }
+                }
+            },
+            { $sort: { _id: 1 } }
+        ]);
+
+        const yesterday = new Date();
+        yesterday.setHours(yesterday.getHours() - 24);
+
+        const hourlyRequests = await RequestLog.aggregate([
+            { 
+                $match: { 
+                    timestamp: { $gte: yesterday }
+                }
+            },
+            { 
+                $group: {
+                    _id: { $dateToString: { format: '%Y-%m-%d %H:00', date: '$timestamp' } },
+                    count: { $sum: 1 }
+                }
+            },
+            { $sort: { _id: 1 } }
+        ]);
+
+        res.json({
+            success: true,
+            stats: {
+                totalUsers,
+                totalRequests,
+                todayRequests,
+                topEndpoints: topEndpoints.map(ep => ({
+                    endpoint: ep._id,
+                    count: ep.count,
+                    successCount: ep.successCount,
+                    failCount: ep.failCount
+                })),
+                successRate: parseFloat(successRate),
+                failRate: parseFloat(failRate),
+                successCount,
+                failCount,
+                dailyRequests: dailyRequests.map(day => ({
+                    date: day._id,
+                    count: day.count,
+                    success: day.success,
+                    fail: day.fail
+                })),
+                hourlyRequests: hourlyRequests.map(hour => ({
+                    hour: hour._id,
+                    count: hour.count
+                }))
+            }
+        });
+    } catch (error) {
+        console.error('All stats error:', error);
+        res.status(500).json({ 
+            success: false, 
+            error: 'Failed to load statistics' 
+        });
+    }
+});
+
+app.post('/api/user/regenerate-key', authenticate, async (req, res) => {
+    try {
+        if (!req.user.premium && req.user.role !== 'admin') {
+            return res.status(403).json({ success: false, error: 'Premium feature only' });
+        }
+
+        const oldApikey = req.user.apikey;
+
+        if (req.user.role === 'admin') {
+            req.user.apikey = 'DHX-M3SA';
+        } else {
+            req.user.apikey = generateApiKey();
+        }
+
+        await req.user.save();
+
+        await logActivity(req.user._id, req.user.username, 'api_key_generated', 'API key regenerated', {
+            oldApikey,
+            newApikey: req.user.apikey
+        });
+
+        res.json({ success: true, apikey: req.user.apikey });
+    } catch (error) {
+        console.error('API key regeneration error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.post('/api/user/redeem', authenticate, async (req, res) => {
+    try {
+        const { code } = req.body;
+
+        if (!code) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'Redeem code is required' 
+            });
+        }
+
+        const redeemCode = await RedeemCode.findOne({ code });
+
+        if (!redeemCode) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'This redeem code is not available anymore or never exist' 
+            });
+        }
+
+        if (redeemCode.used) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'This redeem code has already been used' 
+            });
+        }
+
+        if (new Date() > redeemCode.codeExpired) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'This redeem code is not available anymore or never exist' 
+            });
+        }
+
+        let benefits = [];
+
+        if (redeemCode.type === 'limit' || redeemCode.type === 'both') {
+            req.user.limit += redeemCode.limitValue;
+            benefits.push(`+${redeemCode.limitValue} API requests`);
+        }
+
+        if (redeemCode.type === 'premium' || redeemCode.type === 'both') {
+            req.user.premium = true;
+            req.user.premiumExpiredAt = redeemCode.premiumExpired;
+            benefits.push(`Premium activated until ${redeemCode.premiumExpired.toLocaleString()}`);
+        }
+
+        if (redeemCode.type === 'premium' && redeemCode.limitValue > 0) {
+            req.user.limit += redeemCode.limitValue;
+            benefits.push(`+${redeemCode.limitValue} API requests (bonus)`);
+        }
+
+        redeemCode.used = true;
+        redeemCode.usedBy = req.user.username;
+
+        await req.user.save();
+        await redeemCode.save();
+
+        await logActivity(req.user._id, req.user.username, 'redeem_code_used', `Redeem code used: ${benefits.join(', ')}`, {
+            code: code,
+            type: redeemCode.type,
+            benefits
+        });
+
+        res.json({ 
+            success: true, 
+            message: 'Redeem code used successfully',
+            benefits 
+        });
+    } catch (error) {
+        console.error('Redeem code error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.get('/api/admin/stats', authenticate, async (req, res) => {
+    try {
+        if (req.user.role !== 'admin') {
+            return res.status(403).json({ success: false, error: 'Admin access required' });
+        }
+
+        const totalUsers = await User.countDocuments();
+        const pendingUsers = await PendingVerification.countDocuments();
+        const totalRequests = await RequestLog.countDocuments();
+
+        const todayStart = new Date();
+        todayStart.setHours(0, 0, 0, 0);
+
+        const todayRequests = await RequestLog.countDocuments({
+            timestamp: { $gte: todayStart }
+        });
+
+        res.json({
+            success: true,
+            stats: { 
+                totalUsers, 
+                pendingUsers, 
+                totalRequests, 
+                todayRequests 
+            }
+        });
+    } catch (error) {
+        console.error('Admin stats error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.get('/api/server-stats', async (req, res) => {
+    try {
+        const totalUsers = await User.countDocuments();
+        const regularUsers = await User.countDocuments({ 
+            $and: [
+                { premium: false },
+                { $or: [{ userRole: null }, { userRole: { $exists: false } }] }
+            ]
+        });
+        const premiumUsers = await User.countDocuments({ premium: true });
+
+        const cheapCount = await User.countDocuments({ userRole: 'cheap' });
+        const premiumRoleCount = await User.countDocuments({ userRole: 'premium' });
+        const vipCount = await User.countDocuments({ userRole: 'vip' });
+        const supremeCount = await User.countDocuments({ userRole: 'supreme' });
+
+        let dbSize = '0 MB';
+        let storageSize = '0 GB';
+
+        try {
+            const dbStats = await mongoose.connection.db.stats();
+            dbSize = (dbStats.dataSize / 1024 / 1024).toFixed(2) + ' MB';
+            storageSize = (dbStats.storageSize / 1024 / 1024 / 1024).toFixed(2) + ' GB';
+        } catch (dbError) {
+            console.log('DB stats not available:', dbError.message);
+        }
+
+        const memUsage = process.memoryUsage();
+        const ramUsage = (memUsage.heapUsed / 1024 / 1024).toFixed(2) + ' MB';
+
+        const cpuUsage = process.cpuUsage();
+        const cpuPercent = ((cpuUsage.user + cpuUsage.system) / 1000000).toFixed(2);
+
+        res.json({
+            success: true,
+            stats: {
+                totalUsers,
+                regularUsers,
+                premiumUsers,
+                roleDistribution: {
+                    regular: regularUsers,
+                    cheap: cheapCount,
+                    premium: premiumRoleCount,
+                    vip: vipCount,
+                    supreme: supremeCount
+                },
+                database: {
+                    size: dbSize
+                },
+                system: {
+                    ramUsage: ramUsage,
+                    cpuUsage: cpuPercent,
+                    storageUsed: storageSize
+                }
+            }
+        });
+    } catch (error) {
+        console.error('Server stats error:', error);
+        res.status(500).json({ 
+            success: false, 
+            error: 'Internal server error',
+            details: error.message 
+        });
+    }
+});
+
+app.post('/api/admin/set-role', authenticate, async (req, res) => {
+    try {
+        if (req.user.role !== 'admin') {
+            return res.status(403).json({ success: false, error: 'Admin access required' });
+        }
+
+        const { userId, roleName, customApiKey } = req.body;
+
+        if (!userId || !roleName) {
+            return res.status(400).json({ success: false, error: 'User ID and role name required' });
+        }
+
+        const user = await User.findById(userId);
+        if (!user) {
+            return res.status(404).json({ success: false, error: 'User not found' });
+        }
+
+        if (user.role === 'admin') {
+            return res.status(403).json({ success: false, error: 'Cannot modify admin users' });
+        }
+
+        const roleConfig = {
+            cheap: { limit: 500, premium: true },
+            premium: { limit: 1500, premium: true },
+            vip: { limit: 2500, premium: true },
+            supreme: { limit: 3000, premium: true }
+        };
+
+        if (!roleConfig[roleName]) {
+            return res.status(400).json({ success: false, error: 'Invalid role name' });
+        }
+
+        const expiresAt = new Date();
+        expiresAt.setMonth(expiresAt.getMonth() + 1);
+
+        let finalApiKey = user.apikey;
+        if (customApiKey && customApiKey.trim()) {
+            const existing = await User.findOne({ apikey: customApiKey });
+            if (existing && existing._id.toString() !== userId) {
+                return res.status(400).json({ success: false, error: 'API key already in use' });
+            }
+            user.apikey = customApiKey;
+            finalApiKey = customApiKey;
+        }
+
+        user.userRole = roleName;
+        user.userRoleExpiresAt = expiresAt;
+        user.limit = roleConfig[roleName].limit;
+        user.premium = roleConfig[roleName].premium;
+        user.premiumExpiredAt = expiresAt;
+
+        await user.save();
+
+        const userRole = await UserRole.findOne({ userId: user._id });
+        if (userRole) {
+            userRole.roleName = roleName;
+            userRole.customApiKey = customApiKey || null;
+            userRole.expiresAt = expiresAt;
+            userRole.createdBy = req.user.username;
+            await userRole.save();
+        } else {
+            await UserRole.create({
+                userId: user._id,
+                roleName,
+                customApiKey: customApiKey || null,
+                expiresAt,
+                createdBy: req.user.username
+            });
+        }
+
+        await logActivity(user._id, user.username, 'role_assigned', `Role ${roleName} assigned by admin`, {
+            roleName,
+            limit: user.limit,
+            expiresAt,
+            customApiKey: customApiKey || 'none',
+            assignedBy: req.user.username
+        });
+
+        res.json({ 
+            success: true, 
+            message: `Role ${roleName} assigned successfully`,
+            expiresAt,
+            newLimit: user.limit,
+            apiKey: user.apikey
+        });
+    } catch (error) {
+        console.error('Set role error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.get('/api/admin/users', authenticate, async (req, res) => {
+    try {
+        if (req.user.role !== 'admin') {
+            return res.status(403).json({ success: false, error: 'Admin access required' });
+        }
+
+        const users = await User.find({}, {
+            password: 0
+        }).sort({ createdAt: -1 });
+
+        res.json({
+            success: true,
+            users: users.map(user => ({
+                id: user._id,
+                username: user.username,
+                email: user.email,
+                role: user.role,
+                userRole: user.userRole,
+                userRoleExpiresAt: user.userRoleExpiresAt,
+                premium: user.premium,
+                premiumExpiredAt: user.premiumExpiredAt,
+                banned: user.banned,
+                tempBanned: user.tempBanned,
+                tempBanUntil: user.tempBanUntil,
+                tempBanReason: user.tempBanReason,
+                limit: user.limit,
+                requests: user.requests,
+                requestsToday: user.requestsToday,
+                createdAt: user.createdAt,
+                ipAddress: user.ipAddress
+            }))
+        });
+    } catch (error) {
+        console.error('Admin users fetch error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.post('/api/admin/temp-ban', authenticate, async (req, res) => {
+    try {
+        if (req.user.role !== 'admin') {
+            return res.status(403).json({ success: false, error: 'Admin access required' });
+        }
+
+        const { userId, banUntil, reason } = req.body;
+
+        if (!userId || !banUntil) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'User ID and ban until date are required' 
+            });
+        }
+
+        const user = await User.findById(userId);
+        if (!user) {
+            return res.status(404).json({ success: false, error: 'User not found' });
+        }
+
+        if (user.role === 'admin') {
+            return res.status(403).json({ success: false, error: 'Cannot ban admin users' });
+        }
+
+        const banUntilDate = new Date(banUntil);
+        if (banUntilDate <= new Date()) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'Ban until date must be in the future' 
+            });
+        }
+
+        user.tempBanned = true;
+        user.tempBanUntil = banUntilDate;
+        user.tempBanReason = reason || 'No reason provided';
+
+        await user.save();
+
+        await logActivity(user._id, user.username, 'temp_banned', `User temporarily banned until ${banUntilDate.toLocaleString()}`, {
+            bannedBy: req.user.username,
+            banUntil: banUntilDate,
+            reason: user.tempBanReason
+        });
+
+        res.json({ 
+            success: true, 
+            message: `User ${user.username} temporarily banned until ${banUntilDate.toLocaleString()}` 
+        });
+    } catch (error) {
+        console.error('Temp ban error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.post('/api/admin/remove-temp-ban', authenticate, async (req, res) => {
+    try {
+        if (req.user.role !== 'admin') {
+            return res.status(403).json({ success: false, error: 'Admin access required' });
+        }
+
+        const { userId } = req.body;
+
+        if (!userId) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'User ID is required' 
+            });
+        }
+
+        const user = await User.findById(userId);
+        if (!user) {
+            return res.status(404).json({ success: false, error: 'User not found' });
+        }
+
+        user.tempBanned = false;
+        user.tempBanUntil = null;
+        user.tempBanReason = null;
+
+        await user.save();
+
+        await logActivity(user._id, user.username, 'ban_removed', 'Temporary ban removed by admin', {
+            removedBy: req.user.username
+        });
+
+        res.json({ 
+            success: true, 
+            message: `Temporary ban removed for user ${user.username}` 
+        });
+    } catch (error) {
+        console.error('Remove temp ban error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.post('/api/admin/redeem-code', authenticate, async (req, res) => {
+    try {
+        if (req.user.role !== 'admin') {
+            return res.status(403).json({ success: false, error: 'Admin access required' });
+        }
+
+        const { type, limitValue, codeExpired, premiumExpired } = req.body;
+
+        if (!type || !codeExpired) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'Type and code expiration date are required' 
+            });
+        }
+
+        const codeExpiredDate = new Date(codeExpired);
+        if (codeExpiredDate <= new Date()) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'Code expiration date must be in the future' 
+            });
+        }
+
+        if (type === 'limit' && (!limitValue || limitValue <= 0)) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'Limit value must be greater than 0 for Limit Only type' 
+            });
+        }
+
+        if (type === 'premium' && !premiumExpired) {
+            return res.status(400).json({ 
+                success: false, 
+                error: 'Premium expiration date is required for Premium Only type' 
+            });
+        }
+
+        if (type === 'both') {
+            if (!limitValue || limitValue <= 0) {
+                return res.status(400).json({ 
+                    success: false, 
+                    error: 'Limit value must be greater than 0 for Both type' 
+                });
+            }
+            if (!premiumExpired) {
+                return res.status(400).json({ 
+                    success: false, 
+                    error: 'Premium expiration date is required for Both type' 
+                });
+            }
+        }
+
+        let premiumExpiredDate = null;
+        if (premiumExpired) {
+            premiumExpiredDate = new Date(premiumExpired);
+            if (premiumExpiredDate <= new Date()) {
+                return res.status(400).json({ 
+                    success: false, 
+                    error: 'Premium expiration date must be in the future' 
+                });
+            }
+        }
+
+        const code = crypto.randomBytes(4).toString('hex').toUpperCase();
+
+        const redeemCode = new RedeemCode({
+            code,
+            type,
+            limitValue: parseInt(limitValue) || 0,
+            codeExpired: codeExpiredDate,
+            premiumExpired: premiumExpiredDate,
+            createdBy: req.user.username
+        });
+
+        await redeemCode.save();
+
+        await logActivity(req.user._id, req.user.username, 'redeem_code_created', `Created redeem code: ${code}`, {
+            code,
+            type,
+            limitValue,
+            codeExpired: codeExpiredDate,
+            premiumExpired: premiumExpiredDate
+        });
+
+        res.json({ success: true, code });
+    } catch (error) {
+        console.error('Redeem code creation error:', error);
+        res.status(500).json({ success: false, error: 'Internal server error' });
+    }
+});
+
+app.use('/api', checkBanned);
+app.use('/api', apiRateLimit);
+
+let pluginsDir = path.join(__dirname, "plugins");
+let isJavaScriptFile = (fileName) => /\.js$/.test(fileName);
+global.plugins = {};
+
+const loadPlugins = () => {
+    if (!fs.existsSync(pluginsDir)) {
+        console.log('Plugins directory not found, creating...');
+        try {
+            fs.mkdirSync(pluginsDir, { recursive: true });
+        } catch (error) {
+            console.error('Error creating plugins directory:', error);
+        }
+        return;
+    }
+
+    for (let pluginFile of fs.readdirSync(pluginsDir).filter(isJavaScriptFile)) {
+        try {
+            delete require.cache[require.resolve(path.join(pluginsDir, pluginFile))];
+            global.plugins[pluginFile] = require(path.join(pluginsDir, pluginFile));
+        } catch (error) {
+            console.error(`Error loading plugin ${pluginFile}:`, error.message);
+            delete global.plugins[pluginFile];
+        }
+    }
+
+    console.log('Loaded plugins:', Object.keys(global.plugins));
+};
+
+global.reload = (event, filename) => {
+    if (/\.js$/.test(filename)) {
+        let fullFilePath = path.join(pluginsDir, filename);
+        if (fullFilePath in require.cache) {
+            delete require.cache[fullFilePath];
+            if (fs.existsSync(fullFilePath)) {
+                console.log(`♻️ Re-requiring plugin '${filename}'`);
+            } else {
+                console.log(`🗑️ Deleted plugin '${filename}'`);
+                return delete global.plugins[filename];
+            }
+        } else {
+            console.log(`🔁 Requiring new plugin '${filename}'`);
+        }
+
+        let errorCheck = syntaxError(fs.readFileSync(fullFilePath), filename);
+        if (errorCheck) {
+            console.error(`❌ Syntax error while loading '${filename}':\n${errorCheck}`);
+        } else {
+            try {
+                global.plugins[filename] = require(fullFilePath);
+                reloadHandler();
+            } catch (error) {
+                console.error(`Error loading plugin ${filename}:`, error);
+            } finally {
+                global.plugins = Object.fromEntries(Object.entries(global.plugins).sort(([a], [b]) => a.localeCompare(b)));
+            }
+        }
+    }
+};
+
+const reloadHandler = () => {
+    const routes = [];
+
+    Object.keys(global.plugins).forEach(file => {
+        const plugin = global.plugins[file];
+        if (plugin && plugin.enabled && plugin.routes && plugin.handler) {
+            plugin.routes.forEach(route => {
+                routes.push({ route, plugin, file });
+            });
+        }
+    });
+
+    routes.forEach(({ route, plugin, file }) => {
+        const method = (plugin.type || 'get').toLowerCase();
+        if (app[method] && typeof app[method] === 'function') {
+            app[method](`/${route}`, (req, res, next) => {
+                req.limitDeduction = plugin.limit || 1;
+                next();
+            }, validateApiKey, async (req, res) => {
+                const startTime = Date.now();
+                try {
+                    await plugin.handler(req, res);
+
+                    await RequestLog.create({
+                        userId: req.apiUser._id,
+                        username: req.apiUser.username,
+                        apikey: req.apiUser.apikey,
+                        endpoint: route,
+                        ipAddress: req.realIP,
+                        userAgent: req.get('User-Agent'),
+                        success: true,
+                        responseTime: Date.now() - startTime,
+                        limitDeducted: req.limitDeducted || 1
+                    });
+                } catch (error) {
+                    console.error(`Plugin ${plugin.name} error:`, error);
+
+                    await RequestLog.create({
+                        userId: req.apiUser._id,
+                        username: req.apiUser.username,
+                        apikey: req.apiUser.apikey,
+                        endpoint: route,
+                        ipAddress: req.realIP,
+                        userAgent: req.get('User-Agent'),
+                        success: false,
+                        responseTime: Date.now() - startTime,
+                        limitDeducted: req.limitDeducted || 1
+                    });
+
+                    if (!res.headersSent) {
+                        res.status(500).json({ 
+                            success: false, 
+                            error: 'Plugin execution failed' 
+                        });
+                    }
+                }
+            });
+            console.log(`✅ Registered route: ${method.toUpperCase()} /${route} from ${file}`);
+        }
+    });
+};
+
+Object.freeze(global.reload);
+fs.watch(pluginsDir, global.reload);
+
+setInterval(async () => {
+    const now = new Date();
+
+    if (now.getHours() === 0 && now.getMinutes() === 0) {
+        console.log('Running daily limit reset at midnight...');
+
+        try {
+            const users = await User.find({});
+
+            for (const user of users) {
+                await resetUserLimitIfNeeded(user);
+            }
+
+            console.log('Daily limit reset completed for all users');
+        } catch (error) {
+            console.error('Daily reset error:', error);
+        }
+    }
+}, 60000);
+
+initializeAdmin();
+loadPlugins();
+reloadHandler();
+app.use('/', tmpRouter);
+
+
+app.use((err, req, res, next) => {
+    console.error('Unhandled error:', err);
+    res.status(500).json({ 
+        success: false, 
+        error: 'Internal server error' 
+    });
+});
+
+const PORT = process.env.PORT || 7860;
+app.listen(PORT, () => {
+    console.log(`DashX API Server running on port ${PORT}`);
+    console.log('=== ADMIN ACCOUNT INFO ===');
+    console.log('Username: HERXA');
+    console.log('Password: #HIDDEN#');
+    console.log('API Key: #HIDDEN#');
+    console.log('Limit: 9999');
+    console.log('=========================');
+    console.log('Database connected successfully');
+    console.log('Plugin auto-reload enabled');
+    console.log('Daily reset cron job started');
+});

package.json

@@ -0,0 +1,33 @@
+{
+  "name": "nodejs",
+  "version": "1.0.0",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "start": "node index.js",
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "dependencies": {
+    "@types/node": "^22.13.11",
+    "axios": "^1.12.2",
+    "bcryptjs": "^3.0.2",
+    "resend": "^3.0.0",
+    "bycf": "^1.0.1",
+    "puppeteer": "^23.10.4",
+    "express": "^5.1.0",
+    "playwright": "*",
+    "express-rate-limit": "^8.1.0",
+    "groq-sdk": "^0.33.0",
+    "jimp": "^1.6.0",
+    "jsonwebtoken": "^9.0.2",
+    "jsqr": "^1.4.0",
+    "mongoose": "^8.18.1",
+    "multer": "^2.0.2",
+    "nodemailer": "^7.0.6",
+    "notmebotz-tools": "^2.0.29",
+    "syntax-error": "^1.4.0"
+  }
+}

tmp.js

@@ -0,0 +1,44 @@
+const express = require('express');
+const fs = require('fs');
+const path = require('path');
+
+const router = express.Router();
+
+router.get('/tmp/:filename', (req, res) => {
+  try {
+    const filename = req.params.filename;
+
+    if (!filename) {
+      return res.status(400).send('Missing filename');
+    }
+
+    const tmpDir = path.join(process.cwd(), 'tmp');
+    const filePath = path.join(tmpDir, filename);
+
+    if (!fs.existsSync(filePath)) {
+      return res.status(404).send('File not found or expired');
+    }
+
+    const ext = path.extname(filename).toLowerCase();
+    const contentTypes = {
+      '.webp': 'image/webp',
+      '.jpg': 'image/jpeg',
+      '.jpeg': 'image/jpeg',
+      '.png': 'image/png',
+      '.gif': 'image/gif'
+    };
+
+    const contentType = contentTypes[ext] || 'application/octet-stream';
+
+    res.setHeader('Content-Type', contentType);
+    res.setHeader('Cache-Control', 'public, max-age=60');
+    
+    const fileStream = fs.createReadStream(filePath);
+    fileStream.pipe(res);
+
+  } catch (error) {
+    res.status(500).send(error.message);
+  }
+});
+
+module.exports = router;