martbost
1aab52ca90
- Profile pane: avatar upload + bio, with a link to your public page - Wall becomes a bio page: avatar, bio, scannable join QR, line ladder, join CTA - qrcode npm dep; /api/qr renders SVG QR server-side (CSP-clean img) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
943 lines
52 KiB
JavaScript
943 lines
52 KiB
JavaScript
// InstantAdPay — membership advertising with immutable on-chain settlement.
|
|
// Zero-dependency Node server (RM Circle pattern): static pages + JSON API,
|
|
// wallet sign-in (SIWE), live contract ledger, sponsor join links.
|
|
//
|
|
// Chain selection (Amoy rehearsal vs mainnet) lives in data/config.json —
|
|
// see chain.js. Wipe the volume's accounts/sessions + flip config = launch.
|
|
const http = require('http');
|
|
const https = require('https');
|
|
const dns = require('dns');
|
|
const fs = require('fs');
|
|
const path = require('path');
|
|
const crypto = require('crypto');
|
|
const { URL } = require('url');
|
|
const chain = require('./chain');
|
|
const auth = require('./auth');
|
|
const accounts = require('./accounts');
|
|
const ads = require('./ads');
|
|
const mailer = require('./mailer');
|
|
const messages = require('./messages');
|
|
let QR = null; try { QR = require('qrcode'); } catch (e) { /* optional */ }
|
|
const chatbot = require('./chatbot');
|
|
|
|
const PORT = Number(process.env.PORT || 3000);
|
|
const ROOT = __dirname;
|
|
const PUBLIC_DIR = path.join(ROOT, 'public');
|
|
const DATA_DIR = process.env.DATA_DIR || path.join(ROOT, 'data');
|
|
const ADMIN_PASSWORD = process.env.ADMIN_PASSWORD || 'changeme';
|
|
const IS_PROD = process.env.NODE_ENV === 'production';
|
|
const SITE_FILE = path.join(DATA_DIR, 'site.json');
|
|
|
|
const db = require('./db');
|
|
fs.mkdirSync(DATA_DIR, { recursive: true });
|
|
const UPLOADS_DIR = path.join(DATA_DIR, 'uploads'); // solo-ad media lives on the volume
|
|
fs.mkdirSync(UPLOADS_DIR, { recursive: true });
|
|
const uploadCounts = new Map(); // email:day -> uploads today
|
|
const gauntletTokens = new Map(); // email -> welcome-tour token (server-clock dwell floor)
|
|
const videoTokens = new Map(); // email -> watch-to-earn video token (server-clock watch floor)
|
|
// walk the referral chain upward via sponsorRef (code/username/member id)
|
|
async function uplineSlides(email, depth = 3) {
|
|
const out = [];
|
|
let cur = await accounts.byEmail(email);
|
|
for (let i = 0; i < depth && cur; i++) {
|
|
const ref = String(cur.sponsorRef || '').trim().toLowerCase();
|
|
if (!ref) break;
|
|
let s = null;
|
|
if (/^\d+$/.test(ref)) s = await accounts.byMemberId(Number(ref));
|
|
if (!s) s = await accounts.byCode(ref);
|
|
if (!s) s = await accounts.byUsername(ref);
|
|
if (!s || s.email === cur.email) break;
|
|
out.push(s);
|
|
cur = s;
|
|
}
|
|
return out;
|
|
}
|
|
const chatHits = new Map();
|
|
function chatLimited(ip) {
|
|
const now = Date.now(), rec = chatHits.get(ip);
|
|
if (!rec || now > rec.reset) { chatHits.set(ip, { count: 1, reset: now + 60000 }); return false; }
|
|
rec.count += 1;
|
|
return rec.count > 10;
|
|
}
|
|
// magic-code sign-in: emailLower -> {code, exp, tries}
|
|
const emailCodes = new Map();
|
|
// earn-view tokens: emailLower -> {token, ts} (one live token per member)
|
|
const earnTokens = new Map();
|
|
// human-check pairs for the view verifier: [emoji shown, word named in the prompt]
|
|
const CAPTCHA = [['🚀', 'rocket'], ['⚡', 'lightning bolt'], ['🔑', 'key'], ['🎯', 'target'],
|
|
['🌊', 'wave'], ['🔥', 'flame'], ['💎', 'diamond'], ['🧲', 'magnet'], ['🔔', 'bell'], ['🌙', 'moon']];
|
|
|
|
// ── frame-breaking check ─────────────────────────────────
|
|
// Surf views frame the advertiser's URL full screen, so a target that refuses
|
|
// framing (X-Frame-Options / CSP frame-ancestors) would burn members' views on
|
|
// a blank frame. Catch it the moment the campaign is submitted. The lookup
|
|
// also refuses private/internal addresses so member URLs can't probe our LAN.
|
|
const PRIVATE_IP = /^(127\.|10\.|192\.168\.|169\.254\.|0\.|172\.(1[6-9]|2\d|3[01])\.|::1$|::$|f[cd])/i;
|
|
function frameFetch(url, depth) {
|
|
return new Promise(resolve => {
|
|
let u;
|
|
try { u = new URL(String(url || '')); } catch (e) { return resolve({ error: 'that is not a valid URL' }); }
|
|
if (!/^https?:$/.test(u.protocol)) return resolve({ error: 'only http(s) URLs work' });
|
|
if (u.port && u.port !== '80' && u.port !== '443') return resolve({ error: 'custom ports are not allowed' });
|
|
if (u.hostname === 'localhost' || u.hostname.endsWith('.local')) return resolve({ error: 'that address is not reachable from here' });
|
|
dns.lookup(u.hostname, (de, addr) => {
|
|
if (de) return resolve({ error: 'that domain does not resolve' });
|
|
if (PRIVATE_IP.test(addr)) return resolve({ error: 'that address is not reachable from here' });
|
|
const mod = u.protocol === 'https:' ? https : http;
|
|
const rq = mod.get(u.href, { timeout: 8000,
|
|
headers: { 'User-Agent': 'Mozilla/5.0 (compatible; InstantAdPay-FrameCheck/1.0)', Accept: 'text/html' } }, r => {
|
|
const loc = r.headers.location;
|
|
r.resume(); // headers are all we need
|
|
if ([301, 302, 303, 307, 308].includes(r.statusCode) && loc && depth < 4) {
|
|
rq.destroy();
|
|
let next; try { next = new URL(loc, u.href).href; } catch (e2) { return resolve({ error: 'it redirects somewhere invalid' }); }
|
|
return resolve(frameFetch(next, depth + 1)); // every hop re-runs the private-IP guard
|
|
}
|
|
resolve({ status: r.statusCode, xfo: r.headers['x-frame-options'] || '', csp: r.headers['content-security-policy'] || '' });
|
|
rq.destroy();
|
|
});
|
|
rq.on('timeout', () => { rq.destroy(); resolve({ error: 'it did not answer within 8 seconds' }); });
|
|
rq.on('error', e2 => resolve({ error: 'it did not answer (' + (e2.code || 'connection failed') + ')' }));
|
|
});
|
|
});
|
|
}
|
|
async function frameCheck(url) {
|
|
const h = await frameFetch(url, 0);
|
|
if (h.error) return { ok: false, reason: 'We checked your URL and ' + h.error + '. Fix the URL and try again.' };
|
|
if (h.status >= 400) return { ok: false, reason: 'Your URL answers with HTTP ' + h.status + '. Point the campaign at a working page.' };
|
|
if (/deny|sameorigin/i.test(String(h.xfo)))
|
|
return { ok: false, reason: 'That site blocks framing (X-Frame-Options), so it would show members a blank page in the ad viewer. Use a landing page that allows framing.' };
|
|
const fa = /frame-ancestors\s+([^;]+)/i.exec(String(h.csp));
|
|
if (fa && !fa[1].split(/\s+/).some(x => {
|
|
const v = x.replace(/['"]/g, '').toLowerCase();
|
|
return v === '*' || v === 'https:' || v.includes('instantadpay.com');
|
|
}))
|
|
return { ok: false, reason: 'That site blocks framing (CSP frame-ancestors), so it would show members a blank page in the ad viewer. Use a landing page that allows framing.' };
|
|
return { ok: true };
|
|
}
|
|
async function boot() {
|
|
await db.init({ dataDir: DATA_DIR }); // no-op without DATABASE_URL (JSON mode)
|
|
chain.init({ onEvent: ev => attachNames([ev]).then(a => pushFeed(a[0])).catch(() => pushFeed(ev)) });
|
|
auth.init({ dataDir: DATA_DIR, chain, isProd: IS_PROD, site: 'instantadpay.com' });
|
|
accounts.init({ dataDir: DATA_DIR });
|
|
ads.init({ dataDir: DATA_DIR, chain });
|
|
mailer.init({ dataDir: DATA_DIR });
|
|
messages.init({ dataDir: DATA_DIR });
|
|
chatbot.init({ dataDir: DATA_DIR, chain });
|
|
setTimeout(() => ads.dailySweep().catch(e => console.error('sweep', e.message)), 60 * 1000);
|
|
setInterval(() => ads.dailySweep().catch(e => console.error('sweep', e.message)), 60 * 60 * 1000);
|
|
// NAS reconcile: pull syndicated delivery into the unified credit pool
|
|
// (inert unless NAS_DB_* is set). Every 5 min after a short warm-up.
|
|
if (ads.nasEnabled()) {
|
|
console.log('NAS syndication enabled');
|
|
setTimeout(() => ads.reconcileNas().catch(e => console.error('nas reconcile', e.message)), 90 * 1000);
|
|
setInterval(() => ads.reconcileNas().catch(e => console.error('nas reconcile', e.message)), 5 * 60 * 1000);
|
|
}
|
|
}
|
|
|
|
function siteConfig() {
|
|
let saved = {};
|
|
try { saved = JSON.parse(fs.readFileSync(SITE_FILE, 'utf8')); } catch (e) {}
|
|
return Object.assign({
|
|
siteName: 'InstantAdPay',
|
|
tagline: 'Advertise and earn. Locked in code, not promises.',
|
|
rehearsal: true // shows the testnet banner; flipped off at mainnet launch
|
|
}, saved);
|
|
}
|
|
|
|
// ---- helpers ----
|
|
const MIME = { '.html': 'text/html; charset=utf-8', '.css': 'text/css', '.js': 'text/javascript',
|
|
'.png': 'image/png', '.jpg': 'image/jpeg', '.svg': 'image/svg+xml', '.webp': 'image/webp',
|
|
'.ico': 'image/x-icon', '.json': 'application/json', '.mp4': 'video/mp4', '.woff2': 'font/woff2',
|
|
'.gif': 'image/gif', '.webm': 'video/webm' };
|
|
const CSP = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: https:; media-src 'self' https: blob:; connect-src 'self'; font-src 'self' data: https://fonts.gstatic.com; form-action 'self'; frame-src https: http:";
|
|
function baseHeaders(extra) {
|
|
return Object.assign({ 'Content-Security-Policy': CSP, 'X-Content-Type-Options': 'nosniff',
|
|
'Referrer-Policy': 'strict-origin-when-cross-origin' }, extra || {});
|
|
}
|
|
function json(res, code, obj, extra) {
|
|
const body = JSON.stringify(obj);
|
|
res.writeHead(code, baseHeaders(Object.assign({ 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }, extra)));
|
|
res.end(body);
|
|
}
|
|
function sendFile(res, file) {
|
|
fs.readFile(file, (err, data) => {
|
|
if (err) { res.writeHead(404, baseHeaders({ 'Content-Type': 'text/plain' })); return res.end('Not found'); }
|
|
const ext = path.extname(file).toLowerCase();
|
|
res.writeHead(200, baseHeaders({ 'Content-Type': MIME[ext] || 'application/octet-stream',
|
|
'Cache-Control': ext === '.html' ? 'no-cache' : 'public, max-age=3600' }));
|
|
res.end(data);
|
|
});
|
|
}
|
|
function readRaw(req, maxBytes) {
|
|
return new Promise((resolve, reject) => {
|
|
const chunks = [];
|
|
let n = 0;
|
|
req.on('data', c => {
|
|
n += c.length;
|
|
if (n > maxBytes) { req.destroy(); reject(new Error('too big')); return; }
|
|
chunks.push(c);
|
|
});
|
|
req.on('end', () => resolve(Buffer.concat(chunks)));
|
|
req.on('error', reject);
|
|
});
|
|
}
|
|
function readBody(req) {
|
|
return new Promise((resolve, reject) => {
|
|
let d = ''; let n = 0;
|
|
req.on('data', c => { n += c.length; if (n > 64 * 1024) { req.destroy(); reject(new Error('too big')); } d += c; });
|
|
req.on('end', () => { try { resolve(d ? JSON.parse(d) : {}); } catch (e) { reject(e); } });
|
|
req.on('error', reject);
|
|
});
|
|
}
|
|
function parseCookies(req) {
|
|
const out = {};
|
|
for (const p of (req.headers.cookie || '').split(';')) {
|
|
const i = p.indexOf('='); if (i > 0) out[p.slice(0, i).trim()] = decodeURIComponent(p.slice(i + 1).trim());
|
|
}
|
|
return out;
|
|
}
|
|
function isAdmin(req) {
|
|
const h = req.headers.authorization || '';
|
|
return h === 'Bearer ' + ADMIN_PASSWORD;
|
|
}
|
|
// attach a memberId->username map to events so activity shows real people
|
|
async function attachNames(evts) {
|
|
try {
|
|
const ids = [];
|
|
for (const ev of evts)
|
|
for (const k of ['id', 'buyerId', 'recipientId', 'skippedId', 'sponsorId', 'newBuyerId', 'toId', 'memberId'])
|
|
if (ev[k]) ids.push(ev[k]);
|
|
const names = await accounts.namesForMembers(ids);
|
|
if (!Object.keys(names).length) return evts;
|
|
return evts.map(ev => Object.assign({}, ev, { names }));
|
|
} catch (e) { return evts; }
|
|
}
|
|
// A sponsor token is a numeric chain id or a site share code. Codes resolve
|
|
// to the referrer's CURRENT chain id, so activation any time before the
|
|
// referral's first purchase still locks the line to them.
|
|
async function resolveSponsorToken(tok) {
|
|
const t = String(tok || '').trim().toLowerCase();
|
|
if (!t) return 0;
|
|
if (/^\d+$/.test(t)) return Number(t);
|
|
let acct = await accounts.byCode(t);
|
|
if (!acct) acct = await accounts.byUsername(t); // vanity links: /join/<username>
|
|
if (!acct || !acct.address) return 0;
|
|
try { return await chain.memberIdByAccount(acct.address); } catch (e) { return 0; }
|
|
}
|
|
// The moment someone joins through a code, nudge its owner to activate.
|
|
async function nudgeReferrer(ref) {
|
|
try {
|
|
const t = String(ref || '').trim().toLowerCase();
|
|
if (!t || /^\d+$/.test(t) || !mailer.hasKey()) return;
|
|
const owner = await accounts.byCode(t);
|
|
if (!owner || !owner.email || owner.address) return; // already activated-ready
|
|
mailer.send(owner.email, 'Someone just joined through your InstantAdPay link',
|
|
'Good news: a new member just signed up through your share link.\n\n'
|
|
+ 'One thing to do so you never miss a payment: sign in and switch on payouts '
|
|
+ '(one free wallet step). The contract locks each buyer to their sponsor at their '
|
|
+ 'first purchase, so have payouts on before your people start buying.\n\n'
|
|
+ 'https://instantadpay.com/my\n\nInstantAdPay').catch(e => console.error('nudge failed', e.message));
|
|
} catch (e) {}
|
|
}
|
|
|
|
// ---- live feed (SSE) ----
|
|
const feedClients = new Set();
|
|
function pushFeed(ev) {
|
|
const line = 'data: ' + JSON.stringify(ev) + '\n\n';
|
|
for (const res of feedClients) { try { res.write(line); } catch (e) { feedClients.delete(res); } }
|
|
}
|
|
|
|
// ---- server ----
|
|
const server = http.createServer(async (req, res) => {
|
|
try {
|
|
const u = new URL(req.url, 'http://x');
|
|
const p = u.pathname;
|
|
|
|
// -- join links: /join/<memberId or share code> — first-touch cookie.
|
|
// Codes resolve LATE (at buy time) to whatever chain id the referrer
|
|
// has by then, so free members refer from day one.
|
|
let m = /^\/join\/([A-Za-z0-9_]{1,20})$/.exec(p);
|
|
if (m && req.method === 'GET') {
|
|
const tok = m[1].toLowerCase();
|
|
const cookies = parseCookies(req);
|
|
const headers = { Location: '/' };
|
|
if (!cookies['iap.sponsor']) {
|
|
headers['Set-Cookie'] = `iap.sponsor=${tok}; Path=/; SameSite=Lax; Max-Age=${180 * 24 * 3600}${IS_PROD ? '; Secure' : ''}`;
|
|
}
|
|
res.writeHead(302, baseHeaders(headers));
|
|
return res.end();
|
|
}
|
|
|
|
// -- public API
|
|
if (p === '/api/config' && req.method === 'GET') {
|
|
const c = chain.getConfig();
|
|
return json(res, 200, Object.assign({ contract: c.contract, chainId: c.chainId,
|
|
chainName: c.chainName, explorer: c.explorer, rpc: c.rpcs[0],
|
|
emailAuth: mailer.hasKey() || !IS_PROD }, siteConfig()));
|
|
}
|
|
if (p === '/api/catalog' && req.method === 'GET') {
|
|
return json(res, 200, { products: await chain.catalog() });
|
|
}
|
|
if (p === '/api/feed' && req.method === 'GET') {
|
|
return json(res, 200, { events: await attachNames(chain.recentEvents(Number(u.searchParams.get('n')) || 100)) });
|
|
}
|
|
if (p === '/api/feed/live' && req.method === 'GET') {
|
|
res.writeHead(200, baseHeaders({ 'Content-Type': 'text/event-stream', 'Cache-Control': 'no-store', Connection: 'keep-alive' }));
|
|
res.write(': connected\n\n');
|
|
feedClients.add(res);
|
|
req.on('close', () => feedClients.delete(res));
|
|
return;
|
|
}
|
|
m = /^\/api\/tx\/(0x[0-9a-fA-F]{64})$/.exec(p);
|
|
if (m && req.method === 'GET') {
|
|
// tx relay so the browser never talks to the RPC directly (CSP stays 'self').
|
|
// Serves both the wallet's waitTx poll (found/status) and the built-in
|
|
// /tx/<hash> viewer (full details + decoded events).
|
|
try {
|
|
const r = await chain.rpc('eth_getTransactionReceipt', [m[1]]);
|
|
if (!r) return json(res, 200, { found: false });
|
|
const out = { found: true, status: r.status, blockNumber: r.blockNumber, gasUsed: r.gasUsed };
|
|
try {
|
|
const t = await chain.rpc('eth_getTransactionByHash', [m[1]]);
|
|
if (t) { out.from = t.from; out.to = t.to; out.valueWei = BigInt(t.value || '0x0').toString(); }
|
|
} catch (e) {}
|
|
try {
|
|
const blk = await chain.rpc('eth_getBlockByNumber', [r.blockNumber, false]);
|
|
if (blk) out.ts = blk.timestamp;
|
|
} catch (e) {}
|
|
try {
|
|
out.events = await attachNames((r.logs || []).map(chain.decodeLog).filter(Boolean)
|
|
.map(ev => Object.assign(ev, { tx: m[1] })));
|
|
} catch (e) { out.events = []; }
|
|
return json(res, 200, out);
|
|
} catch (e) { return json(res, 200, { found: false, rpcError: true }); }
|
|
}
|
|
if (p === '/api/sponsor' && req.method === 'GET') {
|
|
const tok = parseCookies(req)['iap.sponsor'] || '';
|
|
const sponsorId = await resolveSponsorToken(tok);
|
|
return json(res, 200, { ref: tok, sponsorId, invited: !!tok });
|
|
}
|
|
if (p === '/api/stats' && req.method === 'GET') {
|
|
let members = 0; try { members = await chain.memberCount(); } catch (e) {}
|
|
return json(res, 200, Object.assign({ onchainMembers: members, siteAccounts: await accounts.count() }, chain.totals()));
|
|
}
|
|
|
|
// -- 24/7 assistant
|
|
if (p === '/api/chat' && req.method === 'POST') {
|
|
const ip = req.socket.remoteAddress || 'x';
|
|
if (chatLimited(ip)) return json(res, 429, { error: 'Give it a minute, then ask again.' });
|
|
const b = await readBody(req);
|
|
const r = await chatbot.answer(b.message, b.history);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
|
|
// -- accounts: email + password is the normal join path (wallet comes
|
|
// out only at purchase / payout-activation time and gets linked then)
|
|
if (p === '/api/signup' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const ref = parseCookies(req)['iap.sponsor'] || ''; // first-touch attribution
|
|
const r = await accounts.signup(b.email, b.password, ref);
|
|
if (r.error) return json(res, 400, r);
|
|
nudgeReferrer(ref).catch(() => {});
|
|
const token = await auth.mintSession({ email: r.account.email });
|
|
return json(res, 200, { ok: true, account: r.account }, { 'Set-Cookie': auth.sessionCookie(token) });
|
|
}
|
|
if (p === '/api/login' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const r = await accounts.login(b.email, b.password);
|
|
if (r.error) return json(res, 400, r);
|
|
let memberId = 0;
|
|
if (r.account.address) { try { memberId = await chain.memberIdByAccount(r.account.address); } catch (e) {} }
|
|
const token = await auth.mintSession({ email: r.account.email, address: r.account.address, memberId });
|
|
return json(res, 200, { ok: true, account: r.account }, { 'Set-Cookie': auth.sessionCookie(token) });
|
|
}
|
|
|
|
// -- passwordless: email code sign-in (signup and login are the same act)
|
|
if (p === '/api/auth/email/start' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const e = String(b.email || '').trim().toLowerCase();
|
|
if (!/^[^\s@]+@[^\s@]+\.[^\s@]{2,}$/.test(e)) return json(res, 400, { error: 'That email address does not look right.' });
|
|
const prev = emailCodes.get(e);
|
|
if (prev && Date.now() < prev.nextAt) return json(res, 429, { error: 'Code already sent. Give it a minute, then try again.' });
|
|
const code = String(Math.floor(100000 + Math.random() * 900000));
|
|
emailCodes.set(e, { code, exp: Date.now() + 15 * 60 * 1000, tries: 0, nextAt: Date.now() + 60 * 1000 });
|
|
if (mailer.hasKey()) {
|
|
try { await mailer.sendCode(e, code); } catch (err) {
|
|
console.error('sendCode failed', err.message);
|
|
return json(res, 502, { error: 'Could not send the email. Try again in a minute.' });
|
|
}
|
|
return json(res, 200, { ok: true, sent: true });
|
|
}
|
|
if (!IS_PROD) return json(res, 200, { ok: true, sent: false, devCode: code });
|
|
return json(res, 503, { error: 'Email sign-in is not configured yet.' });
|
|
}
|
|
if (p === '/api/auth/email/verify' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const e = String(b.email || '').trim().toLowerCase();
|
|
const rec = emailCodes.get(e);
|
|
if (!rec || rec.exp < Date.now()) return json(res, 400, { error: 'Code expired. Request a fresh one.' });
|
|
rec.tries += 1;
|
|
if (rec.tries > 6) { emailCodes.delete(e); return json(res, 400, { error: 'Too many tries. Request a fresh code.' }); }
|
|
if (String(b.code || '').trim() !== rec.code) return json(res, 400, { error: 'That code does not match.' });
|
|
emailCodes.delete(e);
|
|
const ref = parseCookies(req)['iap.sponsor'] || '';
|
|
const r = await accounts.ensure(e, ref); // first touch wins; existing accounts unchanged
|
|
if (r.error) return json(res, 400, r);
|
|
if (r.created) nudgeReferrer(ref).catch(() => {});
|
|
let memberId = 0;
|
|
if (r.account.address) { try { memberId = await chain.memberIdByAccount(r.account.address); } catch (err) {} }
|
|
const token = await auth.mintSession({ email: r.account.email, address: r.account.address, memberId });
|
|
return json(res, 200, { ok: true, account: r.account }, { 'Set-Cookie': auth.sessionCookie(token) });
|
|
}
|
|
|
|
// -- wallet auth: link-to-account when an email session exists, or
|
|
// wallet-first sign-in for crypto-native users
|
|
if (p === '/api/auth/challenge' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const r = auth.makeChallenge(b.address);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
if (p === '/api/auth/verify' && req.method === 'POST') {
|
|
const b = await readBody(req);
|
|
const r = await auth.verifyChallenge(b.address, b.signature);
|
|
if (r.error) return json(res, 400, r);
|
|
let memberId = 0;
|
|
try { memberId = await chain.memberIdByAccount(r.address); } catch (e) {}
|
|
const s = await auth.fromRequest(req);
|
|
if (s && s.email) {
|
|
const lr = await accounts.linkWallet(s.email, r.address);
|
|
if (lr.error) return json(res, 400, lr);
|
|
await auth.updateSession(s.token, { address: r.address, memberId });
|
|
return json(res, 200, { ok: true, linked: true, address: r.address, memberId });
|
|
}
|
|
const acct = await accounts.byAddress(r.address);
|
|
const token = await auth.mintSession({ email: acct ? acct.email : null, address: r.address, memberId });
|
|
return json(res, 200, { ok: true, address: r.address, memberId },
|
|
{ 'Set-Cookie': auth.sessionCookie(token) });
|
|
}
|
|
if (p === '/api/auth/logout' && req.method === 'POST') {
|
|
await auth.logout(req);
|
|
return json(res, 200, { ok: true }, { 'Set-Cookie': auth.clearCookie() });
|
|
}
|
|
if (p === '/api/me' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s) return json(res, 200, { signedIn: false });
|
|
const memberId = await auth.refreshMemberId(s);
|
|
const acct = (s.email && await accounts.byEmail(s.email)) || (s.address && await accounts.byAddress(s.address)) || null;
|
|
const sponsorId = await resolveSponsorToken((acct && acct.sponsorRef) || parseCookies(req)['iap.sponsor']);
|
|
if (memberId && acct && acct.memberId !== memberId) accounts.setMemberId(acct.email, memberId).catch(() => {});
|
|
const out = { signedIn: true, email: s.email || (acct && acct.email) || null,
|
|
address: s.address || (acct && acct.address) || null, memberId,
|
|
username: (acct && acct.username) || null,
|
|
refCode: (acct && acct.code) || null, sponsorId };
|
|
if (memberId) {
|
|
try {
|
|
const mm = await chain.member(memberId);
|
|
out.buyerCount = mm.buyerCount;
|
|
out.onchainSponsorId = mm.sponsorId;
|
|
out.credits = await chain.creditBalance(memberId, 0);
|
|
} catch (e) { out.chainReadError = true; }
|
|
}
|
|
return json(res, 200, out);
|
|
}
|
|
|
|
if (p === '/api/my/dashboard' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s) return json(res, 401, { error: 'Sign in first.' });
|
|
const memberId = await auth.refreshMemberId(s);
|
|
const acct = (s.email && await accounts.byEmail(s.email)) || (s.address && await accounts.byAddress(s.address)) || null;
|
|
if (memberId && acct && acct.memberId !== memberId) accounts.setMemberId(acct.email, memberId).catch(() => {});
|
|
const out = { memberId, email: s.email || (acct && acct.email) || null,
|
|
address: s.address || (acct && acct.address) || null,
|
|
username: (acct && acct.username) || null,
|
|
refCode: (acct && acct.code) || null, credits: 0, buyerCount: 0,
|
|
earnedWei: '0', earnCount: 0, referrals: [], welcomeCredits: 0 };
|
|
if (out.email) {
|
|
// welcome credits unlock via the welcome tour when an upline with a
|
|
// line banner exists; members with no tour to walk get them instantly
|
|
const welcomed = await ads.welcomeGranted(out.email);
|
|
const tour = welcomed ? [] : (await uplineSlides(out.email)).filter(a => a.lineTargetUrl);
|
|
if (welcomed || !tour.length) out.welcomeCredits = await ads.grantWelcome(out.email);
|
|
else { out.welcomeCredits = 0; out.gauntletPending = true; }
|
|
}
|
|
if (out.email) out.inboxUnread = await ads.unreadCount(out.email); // delivers pending solos too
|
|
// achievement milestones (same ladder as the Overview stepper) + one-time credit bonuses
|
|
{
|
|
const bc = out.buyerCount || 0;
|
|
const reached = [];
|
|
if (out.memberId) reached.push('payouts');
|
|
if (bc >= 1) reached.push('firstBuyer');
|
|
if (bc >= 2) reached.push('level2');
|
|
if (bc >= 5) reached.push('level3');
|
|
out.milestonesReached = reached;
|
|
if (out.email && reached.length) out.milestonesGranted = await ads.grantMilestones(out.email, reached);
|
|
}
|
|
if (out.email) { // unmissable login modal when the upline sent a message
|
|
const un = await messages.newestUnread(out.email);
|
|
if (un) {
|
|
const nm = un.fromMember ? await accounts.namesForMembers([un.fromMember]) : {};
|
|
out.sponsorMsg = { id: un.id, subject: un.subject, body: un.body,
|
|
fromName: (un.fromMember && nm[un.fromMember]) ? '@' + nm[un.fromMember] : (un.fromMember ? 'member #' + un.fromMember : 'your sponsor') };
|
|
}
|
|
}
|
|
if (memberId) {
|
|
try {
|
|
const mm = await chain.member(memberId);
|
|
out.buyerCount = mm.buyerCount;
|
|
out.credits = await ads.availableCredits(memberId);
|
|
} catch (e) { out.chainReadError = true; }
|
|
let earned = 0n, n = 0;
|
|
for (const ev of chain.recentEvents(600)) {
|
|
if ((ev.type === 'TierPaid' && ev.recipientId === memberId) || (ev.type === 'AwardPaid' && ev.toId === memberId)) {
|
|
earned += BigInt(ev.amountWei); n += 1;
|
|
}
|
|
}
|
|
out.earnedWei = earned.toString();
|
|
out.earnCount = n;
|
|
}
|
|
// who joined through this member (code and, once on-chain, numeric id)
|
|
const refs = [];
|
|
if (acct && acct.code) refs.push(acct.code);
|
|
if (memberId) refs.push(String(memberId));
|
|
const joined = await accounts.listByReferrer(refs);
|
|
out.referrals = joined.map(r => ({
|
|
name: r.username || r.email.replace(/^(.).*(@.*)$/, '$1***$2'), // username, else privacy mask
|
|
joined: r.created,
|
|
status: r.address ? 'wallet linked' : 'joined free'
|
|
}));
|
|
return json(res, 200, out);
|
|
}
|
|
if (p === '/api/my/profile' && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const b = await readBody(req);
|
|
const r = await accounts.setUsername(s.email, b.username);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
// -- earn credits by viewing ads (attention-gated daily claim)
|
|
if (p === '/api/my/earn' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
return json(res, 200, await ads.viewStatus(s.email));
|
|
}
|
|
// fraud-guarded view flow: the server issues a single-use token when it
|
|
// serves the ad, and only counts the view if the dwell elapsed on the
|
|
// SERVER clock. Client-side focus tracking pauses the countdown; this is
|
|
// the floor a script cannot cheat past.
|
|
if (p === '/api/my/earnview' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const status = await ads.viewStatus(s.email);
|
|
if (status.views >= status.target || status.claimed) return json(res, 200, { ad: null, status });
|
|
const type = String(u.searchParams.get('type') || 'banner');
|
|
// members never see (or earn from) their own campaigns in the viewer
|
|
const ad = await ads.serve(type === 'text' ? 'text' : 'banner', { excludeEmail: s.email });
|
|
if (!ad) return json(res, 200, { ad: null, status });
|
|
const token = crypto.randomBytes(16).toString('hex');
|
|
// the viewer tab frames the advertiser's REAL url (no click counted for a paid view)
|
|
earnTokens.set(s.email, { token, ts: Date.now(), adId: ad.id,
|
|
targetUrl: await ads.targetOf(ad.id), adName: ad.title || ad.name || null });
|
|
return json(res, 200, { ad, token, viewUrl: '/view/' + token, status });
|
|
}
|
|
// the viewer tab asks where to point the frame (does not consume the token)
|
|
if (p === '/api/my/viewinfo' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const t = earnTokens.get(s.email);
|
|
if (!t || t.token !== String(u.searchParams.get('token') || ''))
|
|
return json(res, 400, { error: 'That view is no longer open. Head back to the dashboard and load the next ad.' });
|
|
return json(res, 200, { targetUrl: t.targetUrl, adName: t.adName || null,
|
|
dwell: ads.rates().viewDwellSeconds || 5 });
|
|
}
|
|
// human check: handed out only once the dwell has elapsed on the SERVER clock
|
|
if (p === '/api/my/viewchallenge' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const t = earnTokens.get(s.email);
|
|
if (!t || t.token !== String(u.searchParams.get('token') || ''))
|
|
return json(res, 400, { error: 'That view is no longer open.' });
|
|
const dwellMs = (ads.rates().viewDwellSeconds || 5) * 1000;
|
|
const age = Date.now() - t.ts;
|
|
if (age < dwellMs - 400) return json(res, 200, { early: true, wait: Math.ceil((dwellMs - age) / 1000) });
|
|
if (age > 5 * 60 * 1000) { earnTokens.delete(s.email); return json(res, 400, { error: 'That ad went stale. Load a fresh one.' }); }
|
|
const pick = CAPTCHA.slice().sort(() => Math.random() - 0.5).slice(0, 5);
|
|
const answer = Math.floor(Math.random() * pick.length);
|
|
t.challenge = { answer };
|
|
return json(res, 200, { prompt: pick[answer][1], options: pick.map(x => x[0]) });
|
|
}
|
|
if (p === '/api/my/adview' && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const b = await readBody(req);
|
|
const t = earnTokens.get(s.email);
|
|
const dwellMs = (ads.rates().viewDwellSeconds || 5) * 1000;
|
|
if (!t || t.token !== String(b.token || '')) return json(res, 400, { error: 'That view did not check out. Load the next ad and let it finish.' });
|
|
const age = Date.now() - t.ts;
|
|
if (age < dwellMs - 400) return json(res, 400, { error: 'Watch the full ad first.' });
|
|
if (age > 5 * 60 * 1000) { earnTokens.delete(s.email); return json(res, 400, { error: 'That ad went stale. Load a fresh one.' }); }
|
|
// the human check must be solved on the same token
|
|
if (!t.challenge) return json(res, 400, { error: 'Finish the quick check first.', retry: true });
|
|
if (Number(b.answer) !== t.challenge.answer) {
|
|
t.attempts = (t.attempts || 0) + 1;
|
|
t.challenge = null; // force a fresh challenge for the next try
|
|
if (t.attempts >= 3) { earnTokens.delete(s.email); return json(res, 400, { error: 'Three misses — that view is void. Head back and load the next ad.' }); }
|
|
return json(res, 400, { error: 'Wrong pick.', retry: true });
|
|
}
|
|
earnTokens.delete(s.email); // single use
|
|
return json(res, 200, await ads.recordView(s.email));
|
|
}
|
|
if (p === '/api/my/claim' && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const r = await ads.claimDaily(s.email);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
// -- downline lineage: 3 levels, usernames+IDs; email only for directs
|
|
if (p === '/api/my/line' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const levels = await accounts.downline(s.email, 3);
|
|
const out = levels.map(L => ({ level: L.level, members: L.members.map(m => ({
|
|
memberId: m.memberId || 0,
|
|
name: m.username ? '@' + m.username : m.memberId ? 'member #' + m.memberId : 'member',
|
|
email: L.level === 1 ? m.email : null, // directs only
|
|
joined: m.created })) }));
|
|
return json(res, 200, { levels: out, counts: out.map(L => L.members.length) });
|
|
}
|
|
// -- broadcast a message to your downline (1/day), on-site inbox + email
|
|
if (p === '/api/my/broadcast' && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const b = await readBody(req);
|
|
const subject = String(b.subject || '').trim().slice(0, 160);
|
|
const body = ads.sanitizeRich(b.body);
|
|
const plain = body.replace(/<[^>]*>/g, ' ').replace(/\s+/g, ' ').trim();
|
|
if (!subject) return json(res, 400, { error: 'Give your message a subject.' });
|
|
if (plain.length < 10) return json(res, 400, { error: 'Write a message first.' });
|
|
const last = await messages.lastBroadcastAt(s.email);
|
|
if (Date.now() - last < 24 * 3600 * 1000)
|
|
return json(res, 429, { error: 'You can send one broadcast a day. Try again in ' + Math.ceil((24 * 3600 * 1000 - (Date.now() - last)) / 3600000) + 'h.' });
|
|
const depth = b.scope === 'direct' ? 1 : 3;
|
|
const levels = await accounts.downline(s.email, depth);
|
|
const recipients = [...new Set(levels.flatMap(L => L.members.map(m => m.email)).filter(Boolean))];
|
|
if (!recipients.length) return json(res, 400, { error: 'No one in your line to message yet.' });
|
|
const memberId = s.memberId || await auth.refreshMemberId(s);
|
|
await messages.deliver(memberId, s.email, recipients, subject, body);
|
|
// email each recipient too (best-effort; never blocks the on-site delivery)
|
|
if (mailer.hasKey()) {
|
|
const who = (await accounts.byEmail(s.email));
|
|
const from = who && who.username ? '@' + who.username : 'your sponsor';
|
|
for (const to of recipients) {
|
|
mailer.send(to, 'Message from ' + from + ': ' + subject,
|
|
plain + '\n\n— sent via your InstantAdPay upline. Read it in your dashboard: https://instantadpay.com/my#line')
|
|
.catch(() => {});
|
|
}
|
|
}
|
|
return json(res, 200, { ok: true, sent: recipients.length });
|
|
}
|
|
// -- sponsor messages: this member's inbox from their upline
|
|
if (p === '/api/my/messages' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const items = await messages.inbox(s.email);
|
|
const names = await accounts.namesForMembers([...new Set(items.map(i => i.fromMember).filter(Boolean))]);
|
|
for (const i of items) i.fromName = (i.fromMember && names[i.fromMember]) ? '@' + names[i.fromMember]
|
|
: i.fromMember ? 'member #' + i.fromMember : 'your upline';
|
|
return json(res, 200, { items, unread: items.filter(i => !i.read).length });
|
|
}
|
|
m = /^\/api\/my\/messages\/(\d+)\/read$/.exec(p);
|
|
if (m && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
return json(res, 200, await messages.markRead(s.email, m[1]));
|
|
}
|
|
// -- QR code (SVG) for any InstantAdPay URL — used on bio/wall pages
|
|
if (p === '/api/qr' && req.method === 'GET') {
|
|
const data = String(u.searchParams.get('d') || '').slice(0, 300);
|
|
if (!QR || !data) { res.writeHead(404, baseHeaders()); return res.end(); }
|
|
try {
|
|
const svg = await QR.toString(data, { type: 'svg', margin: 1, width: 240,
|
|
color: { dark: '#0b1512', light: '#eef7f3' } });
|
|
res.writeHead(200, baseHeaders({ 'Content-Type': 'image/svg+xml', 'Cache-Control': 'public, max-age=3600' }));
|
|
return res.end(svg);
|
|
} catch (e) { res.writeHead(500, baseHeaders()); return res.end(); }
|
|
}
|
|
// -- profile: avatar + bio
|
|
if (p === '/api/my/profile-details' && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const b = await readBody(req);
|
|
const avatar = b.avatarUrl === undefined ? undefined : String(b.avatarUrl || '').trim();
|
|
if (avatar && !/^(\/uploads\/[a-z0-9]{24}\.(png|jpg|webp|gif)|https:\/\/[^\s]+)$/i.test(avatar))
|
|
return json(res, 400, { error: 'Avatar must be an uploaded image or an https image URL.' });
|
|
const bio = b.bio === undefined ? undefined : String(b.bio || '').trim().slice(0, 600);
|
|
const r = await accounts.setProfile(s.email, avatar, bio);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
// -- line banner: the member's viral slot on welcome tours + their wall
|
|
if (p === '/api/my/linebanner' && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const b = await readBody(req);
|
|
const target = String(b.targetUrl || '').trim();
|
|
if (!/^https?:\/\/[^\s]+$/i.test(target)) return json(res, 400, { error: 'Destination URL must start with http(s)://' });
|
|
const fc = await frameCheck(target); // welcome tours frame it full screen
|
|
if (!fc.ok) return json(res, 400, { error: fc.reason });
|
|
const banner = String(b.bannerUrl || '').trim();
|
|
if (banner && !/^(\/uploads\/[a-z0-9]{24}\.(png|jpg|webp|gif)|https:\/\/[^\s]+)$/i.test(banner))
|
|
return json(res, 400, { error: 'Banner must be an uploaded image or an https image URL.' });
|
|
const r = await accounts.setLineBanner(s.email, banner || null, target);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
// -- welcome tour (gauntlet): meet the 3-level upline, then unlock welcome credits
|
|
if (p === '/api/my/gauntlet' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
if (await ads.welcomeGranted(s.email)) return json(res, 200, { pending: false });
|
|
const slides = (await uplineSlides(s.email)).filter(a => a.lineTargetUrl)
|
|
.map((a, i) => ({ name: a.username ? '@' + a.username : a.memberId ? 'member #' + a.memberId : 'a member',
|
|
bannerUrl: a.lineBannerUrl || null, targetUrl: a.lineTargetUrl }));
|
|
if (!slides.length) return json(res, 200, { pending: false });
|
|
const token = crypto.randomBytes(16).toString('hex');
|
|
gauntletTokens.set(s.email, { token, ts: Date.now(), n: slides.length });
|
|
return json(res, 200, { pending: true, slides, dwell: 10, token });
|
|
}
|
|
if (p === '/api/my/gauntlet/complete' && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const b = await readBody(req);
|
|
const t = gauntletTokens.get(s.email);
|
|
if (!t || t.token !== String(b.token || '')) return json(res, 400, { error: 'That tour is no longer open. Reload and try again.' });
|
|
if (Date.now() - t.ts < t.n * 10 * 1000 - 1500) return json(res, 400, { error: 'Give each site its ten seconds first.' });
|
|
gauntletTokens.delete(s.email);
|
|
await ads.grantWelcome(s.email);
|
|
return json(res, 200, { ok: true, credited: ads.rates().welcomeCredits || 0 });
|
|
}
|
|
// -- public banner wall
|
|
m = /^\/api\/wall\/([A-Za-z0-9_]{1,20})$/.exec(p);
|
|
if (m && req.method === 'GET') {
|
|
const tok = m[1].toLowerCase();
|
|
let a = await accounts.byUsername(tok);
|
|
if (!a) a = await accounts.byCode(tok);
|
|
if (!a) return json(res, 404, { error: 'No wall under that name.' });
|
|
const ladder = [a, ...await uplineSlides(a.email, 2)].slice(0, 3)
|
|
.map(x => ({ name: x.username ? '@' + x.username : x.memberId ? 'member #' + x.memberId : 'a member',
|
|
bannerUrl: x.lineBannerUrl || null, targetUrl: x.lineTargetUrl || null }));
|
|
const joinPath = '/join/' + (a.username || a.code);
|
|
return json(res, 200, { name: a.username ? '@' + a.username : 'member #' + (a.memberId || 0),
|
|
avatarUrl: a.avatarUrl || null, bio: a.bio || null,
|
|
joinUrl: joinPath, qrUrl: '/api/qr?d=' + encodeURIComponent('https://instantadpay.com' + joinPath), ladder });
|
|
}
|
|
// -- watch-to-earn video ads: serve one, then reward a server-clock-verified watch
|
|
if (p === '/api/my/videos' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const status = await ads.videoStatus(s.email);
|
|
if (status.left <= 0) return json(res, 200, { ad: null, status });
|
|
const ad = await ads.serveVideo({ excludeEmail: s.email }); // never your own video
|
|
if (!ad) return json(res, 200, { ad: null, status });
|
|
const token = crypto.randomBytes(16).toString('hex');
|
|
videoTokens.set(s.email, { token, ts: Date.now(), id: ad.id, secs: ad.watchSecs });
|
|
return json(res, 200, { ad, token, status });
|
|
}
|
|
if (p === '/api/my/videowatch' && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const b = await readBody(req);
|
|
const t = videoTokens.get(s.email);
|
|
if (!t || t.token !== String(b.token || '')) return json(res, 400, { error: 'That video is no longer open. Load the next one.' });
|
|
const age = Date.now() - t.ts;
|
|
if (age < t.secs * 1000 - 600) return json(res, 400, { error: 'Watch the full video first.' });
|
|
if (age > t.secs * 1000 + 10 * 60 * 1000) { videoTokens.delete(s.email); return json(res, 400, { error: 'That watch went stale. Load a fresh video.' }); }
|
|
videoTokens.delete(s.email); // single use
|
|
const tier = await ads.chargeVideoView(t.id); // charge advertiser; null if it ran dry
|
|
if (!tier) return json(res, 200, { ok: true, credited: 0, status: await ads.videoStatus(s.email), gone: true });
|
|
await ads.addEarned(s.email, tier.reward);
|
|
const status = await ads.recordVideoWatch(s.email);
|
|
return json(res, 200, { ok: true, credited: tier.reward, status });
|
|
}
|
|
// -- onsite solo ads: member inbox with read rewards
|
|
if (p === '/api/my/inbox' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const r = await ads.inboxList(s.email);
|
|
const names = await accounts.namesForMembers([...new Set(r.items.map(i => i.fromMemberId).filter(Boolean))]);
|
|
for (const i of r.items) i.fromName = (i.fromMemberId && names[i.fromMemberId]) ? '@' + names[i.fromMemberId]
|
|
: i.fromMemberId ? 'member #' + i.fromMemberId : 'a member';
|
|
return json(res, 200, r);
|
|
}
|
|
m = /^\/api\/my\/inbox\/(\d+)$/.exec(p);
|
|
if (m && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const r = await ads.inboxOpen(s.email, m[1]);
|
|
if (!r.error) {
|
|
const names = r.fromMemberId ? await accounts.namesForMembers([r.fromMemberId]) : {};
|
|
r.fromName = (r.fromMemberId && names[r.fromMemberId]) ? '@' + names[r.fromMemberId]
|
|
: r.fromMemberId ? 'member #' + r.fromMemberId : 'a member';
|
|
}
|
|
return json(res, r.error ? 404 : 200, r);
|
|
}
|
|
// media upload for solo ads: raw body, size-capped, magic-byte verified
|
|
if (p === '/api/my/upload' && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const ct = String(req.headers['content-type'] || '').split(';')[0].trim().toLowerCase();
|
|
const EXT = { 'image/png': 'png', 'image/jpeg': 'jpg', 'image/webp': 'webp', 'image/gif': 'gif',
|
|
'video/mp4': 'mp4', 'video/webm': 'webm' };
|
|
if (!EXT[ct]) return json(res, 400, { error: 'Use a PNG, JPG, WebP, GIF, MP4 or WebM file.' });
|
|
const isVideo = ct.startsWith('video/');
|
|
const key = s.email + ':' + new Date().toISOString().slice(0, 10);
|
|
if ((uploadCounts.get(key) || 0) >= 10) return json(res, 400, { error: 'Upload limit for today reached (10 files).' });
|
|
let buf;
|
|
try { buf = await readRaw(req, isVideo ? 25 * 1024 * 1024 : 3 * 1024 * 1024); }
|
|
catch (e) { return json(res, 400, { error: 'File too large. Images up to 3MB, video up to 25MB.' }); }
|
|
const magicOk = buf.length > 16 && (
|
|
(ct === 'image/png' && buf[0] === 0x89 && buf[1] === 0x50 && buf[2] === 0x4e && buf[3] === 0x47) ||
|
|
(ct === 'image/jpeg' && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) ||
|
|
(ct === 'image/webp' && buf.slice(0, 4).toString() === 'RIFF' && buf.slice(8, 12).toString() === 'WEBP') ||
|
|
(ct === 'image/gif' && buf.slice(0, 4).toString() === 'GIF8') ||
|
|
(ct === 'video/mp4' && buf.slice(4, 8).toString() === 'ftyp') ||
|
|
(ct === 'video/webm' && buf[0] === 0x1a && buf[1] === 0x45 && buf[2] === 0xdf && buf[3] === 0xa3));
|
|
if (!magicOk) return json(res, 400, { error: 'That file does not look like a real ' + EXT[ct].toUpperCase() + '.' });
|
|
const name = crypto.randomBytes(12).toString('hex') + '.' + EXT[ct];
|
|
fs.writeFileSync(path.join(UPLOADS_DIR, name), buf);
|
|
uploadCounts.set(key, (uploadCounts.get(key) || 0) + 1);
|
|
return json(res, 200, { url: '/uploads/' + name, type: isVideo ? 'video' : 'image' });
|
|
}
|
|
m = /^\/api\/my\/inbox\/(\d+)\/visit$/.exec(p);
|
|
if (m && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const r = await ads.markSoloVisit(s.email, m[1]);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
m = /^\/api\/my\/inbox\/(\d+)\/claim$/.exec(p);
|
|
if (m && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const r = await ads.claimSoloRead(s.email, m[1]);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
if (p === '/api/my/activity' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s) return json(res, 401, { error: 'Sign in first.' });
|
|
const id = s.memberId || await auth.refreshMemberId(s);
|
|
if (!id) return json(res, 200, { memberId: 0, earnings: [], purchases: [], referrals: [] });
|
|
const evs = chain.recentEvents(600);
|
|
return json(res, 200, {
|
|
memberId: id,
|
|
earnings: await attachNames(evs.filter(e => (e.type === 'TierPaid' && e.recipientId === id) || (e.type === 'AwardPaid' && e.toId === id))),
|
|
purchases: await attachNames(evs.filter(e => e.type === 'Purchase' && e.buyerId === id)),
|
|
referrals: await attachNames(evs.filter(e => (e.type === 'MemberActivated' && e.sponsorId === id) || (e.type === 'BuyerCounted' && e.sponsorId === id)))
|
|
});
|
|
}
|
|
|
|
// -- ad engine (spec §8b v1: banners, text, login ads)
|
|
if (p === '/api/ads/slot' && req.method === 'GET') {
|
|
const t = String(u.searchParams.get('type') || 'banner');
|
|
const ad = await ads.serve(t);
|
|
// login ads: the member clicks "Open Ad" (a real, counted click into a
|
|
// new tab) while the countdown runs on our interstitial page
|
|
if (ad && t === 'login') ad.dwell = ads.rates().loginDwellSeconds || 10;
|
|
return json(res, 200, { ad });
|
|
}
|
|
m = /^\/api\/ads\/click\/(\d+)$/.exec(p);
|
|
if (m && req.method === 'GET') {
|
|
const target = await ads.click(m[1]);
|
|
if (!target) { res.writeHead(404, baseHeaders()); return res.end(); }
|
|
res.writeHead(302, baseHeaders({ Location: target }));
|
|
return res.end();
|
|
}
|
|
if (p === '/api/my/campaigns' && req.method === 'GET') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const memberId = await auth.refreshMemberId(s);
|
|
const out = { campaigns: await ads.listCampaigns(s.email), rates: ads.rates(), bannerSizes: ads.bannerSizes() };
|
|
out.purchasedCredits = memberId ? await ads.availableCredits(memberId) : 0;
|
|
out.earnedCredits = await ads.earnedBalance(s.email);
|
|
out.availableCredits = out.purchasedCredits + out.earnedCredits;
|
|
return json(res, 200, out);
|
|
}
|
|
if (p === '/api/my/campaigns' && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const memberId = await auth.refreshMemberId(s); // 0 is fine: earned credits fund banner/text
|
|
const b = await readBody(req);
|
|
if (!['login', 'solo', 'video'].includes(String(b.type || ''))) { // banner/text surf views frame the target: catch frame-breakers (login/video/solo open in a new tab or play in our own player)
|
|
const fc = await frameCheck(b.targetUrl);
|
|
if (!fc.ok) return json(res, 400, { error: fc.reason });
|
|
}
|
|
const r = await ads.createCampaign(s.email, memberId, b);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
m = /^\/api\/my\/campaigns\/(\d+)\/(pause|resume)$/.exec(p);
|
|
if (m && req.method === 'POST') {
|
|
const s = await auth.fromRequest(req);
|
|
if (!s || !s.email) return json(res, 401, { error: 'Sign in first.' });
|
|
const r = await ads.setStatus(s.email, m[1], m[2] === 'pause' ? 'paused' : 'active');
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
|
|
// -- admin (Bearer ADMIN_PASSWORD)
|
|
if (p === '/api/admin/burns' && req.method === 'GET') {
|
|
if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
|
|
return json(res, 200, { pending: await ads.pendingBurns() });
|
|
}
|
|
if (p === '/api/admin/burns/mark' && req.method === 'POST') {
|
|
if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
|
|
const b = await readBody(req);
|
|
const r = await ads.markBurned(b.id, b.tx);
|
|
return json(res, r.error ? 400 : 200, r);
|
|
}
|
|
if (p === '/api/admin/rates' && req.method === 'PATCH') {
|
|
if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
|
|
const b = await readBody(req);
|
|
return json(res, 200, { ok: true, rates: ads.setRates(b) });
|
|
}
|
|
|
|
if (p === '/api/admin/site' && req.method === 'PATCH') {
|
|
if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
|
|
const b = await readBody(req);
|
|
const cur = siteConfig();
|
|
fs.writeFileSync(SITE_FILE, JSON.stringify(Object.assign(cur, b), null, 2));
|
|
return json(res, 200, { ok: true, site: siteConfig() });
|
|
}
|
|
if (p === '/api/admin/chain' && req.method === 'PATCH') {
|
|
if (!isAdmin(req)) return json(res, 401, { error: 'auth' });
|
|
const b = await readBody(req);
|
|
const file = path.join(DATA_DIR, 'config.json');
|
|
let cur = {}; try { cur = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (e) {}
|
|
fs.writeFileSync(file, JSON.stringify(Object.assign(cur, b), null, 2));
|
|
chain.reloadConfig();
|
|
return json(res, 200, { ok: true, config: chain.getConfig() });
|
|
}
|
|
|
|
// -- pages
|
|
if (req.method === 'GET') {
|
|
if (p === '/') return sendFile(res, path.join(PUBLIC_DIR, 'index.html'));
|
|
if (p === '/ledger') return sendFile(res, path.join(PUBLIC_DIR, 'ledger.html'));
|
|
if (p === '/contract') return sendFile(res, path.join(PUBLIC_DIR, 'contract.html'));
|
|
if (p === '/my') return sendFile(res, path.join(PUBLIC_DIR, 'my.html'));
|
|
if (/^\/view\/[a-f0-9]{32}$/.test(p)) return sendFile(res, path.join(PUBLIC_DIR, 'view.html'));
|
|
m = /^\/uploads\/([a-z0-9]{24}\.(?:png|jpg|webp|gif|mp4|webm))$/.exec(p);
|
|
if (m) return sendFile(res, path.join(UPLOADS_DIR, m[1]));
|
|
if (/^\/tx\/0x[0-9a-fA-F]{64}$/.test(p)) return sendFile(res, path.join(PUBLIC_DIR, 'tx.html'));
|
|
if (/^\/wall\/[A-Za-z0-9_]{1,20}$/.test(p)) return sendFile(res, path.join(PUBLIC_DIR, 'wall.html'));
|
|
const safe = path.normalize(p).replace(/^([.\\/])+/, '');
|
|
const file = path.join(PUBLIC_DIR, safe);
|
|
if (file.startsWith(PUBLIC_DIR) && fs.existsSync(file) && fs.statSync(file).isFile()) return sendFile(res, file);
|
|
}
|
|
|
|
res.writeHead(404, baseHeaders({ 'Content-Type': 'text/plain' }));
|
|
res.end('Not found');
|
|
} catch (e) {
|
|
console.error('request error', req.url, e.message);
|
|
try { json(res, 500, { error: 'server error' }); } catch (_) {}
|
|
}
|
|
});
|
|
boot().then(() => {
|
|
server.listen(PORT, () => console.log(`InstantAdPay site on :${PORT} — chain: ${chain.getConfig().chainName} — store: ${db.enabled() ? 'MySQL' : 'volume JSON'}`));
|
|
}).catch(e => { console.error('boot failed:', e.message); process.exit(1); });
|