@serifpersia/dango 3.3.4

package/server/dist/utils/cache.utils.js

@@ -0,0 +1,25 @@
+import { LRUCache } from 'lru-cache';
+export class AppCache {
+    cache;
+    constructor(options = {}) {
+        this.cache = new LRUCache({
+            max: options.maxKeys ?? 5000,
+            ttl: (options.ttlSeconds ?? 3600) * 1000,
+        });
+    }
+    get(key) {
+        return this.cache.get(key);
+    }
+    set(key, value, ttlSeconds) {
+        const entry = value;
+        if (ttlSeconds === undefined) {
+            this.cache.set(key, entry);
+        }
+        else {
+            this.cache.set(key, entry, { ttl: ttlSeconds * 1000 });
+        }
+    }
+    delete(key) {
+        this.cache.delete(key);
+    }
+}

package/server/dist/utils/cookie.utils.js

@@ -0,0 +1,13 @@
+export function sanitizeCfClearance(raw) {
+    if (!raw)
+        return '';
+    let s = String(raw).trim();
+    s = s.replace(/^cf_clearance/i, '');
+    s = s.replace(/^[:=]\s*/, '');
+    s = s.replace(/["']/g, '').trim();
+    return s;
+}
+export function buildCfClearanceCookie(raw) {
+    const c = sanitizeCfClearance(raw);
+    return c ? `cf_clearance=${c}` : '';
+}

package/server/dist/utils/db-utils.js

@@ -0,0 +1,9 @@
+export const dbAll = (db, sql, params = []) => {
+    return db.all(sql, params);
+};
+export const dbGet = (db, sql, params = []) => {
+    return db.get(sql, params);
+};
+export const dbRun = (db, sql, params = []) => {
+    db.run(sql, params);
+};

package/server/dist/utils/env.utils.js

@@ -0,0 +1,77 @@
+import fs from 'fs';
+import { CONFIG } from '../config.js';
+const lockPath = `${CONFIG.ENV_PATH}.lock`;
+async function acquireLock() {
+    let handle;
+    let attempts = 0;
+    while (!handle) {
+        try {
+            handle = await fs.promises.open(lockPath, 'wx');
+        }
+        catch {
+            if (++attempts >= 100) {
+                fs.promises.unlink(lockPath).catch(() => { });
+                throw new Error('Failed to acquire lock on .env file - another process may be holding it');
+            }
+            await new Promise((r) => setTimeout(r, 100));
+        }
+    }
+    return handle;
+}
+function releaseLock(handle) {
+    handle.close().catch(() => { });
+    fs.promises.unlink(lockPath).catch(() => { });
+}
+export async function updateEnvFile(updates) {
+    const lockHandle = await acquireLock();
+    try {
+        const envPath = CONFIG.ENV_PATH;
+        let envContent = '';
+        if (fs.existsSync(envPath)) {
+            envContent = fs.readFileSync(envPath, 'utf8');
+        }
+        const lines = envContent.split('\n');
+        const newLines = [...lines];
+        Object.entries(updates).forEach(([rawKey, rawValue]) => {
+            const key = rawKey.trim();
+            if (!/^[A-Z0-9_]+$/i.test(key)) {
+                throw new Error(`Invalid environment variable key: ${key}`);
+            }
+            const value = String(rawValue ?? '').replace(/[\r\n]/g, '');
+            let found = false;
+            for (let i = 0; i < newLines.length; i++) {
+                const line = newLines[i];
+                if (line && line.startsWith(`${key}=`)) {
+                    if (value === '') {
+                        newLines.splice(i, 1);
+                        continue;
+                    }
+                    else {
+                        newLines[i] = `${key}=${value}`;
+                    }
+                    found = true;
+                    break;
+                }
+            }
+            if (!found && value !== '') {
+                newLines.push(`${key}=${value}`);
+            }
+        });
+        const finalContent = newLines
+            .join('\n')
+            .replace(/\n{2,}/g, '\n')
+            .trim() + '\n';
+        fs.writeFileSync(envPath, finalContent);
+        Object.entries(updates).forEach(([key, value]) => {
+            if (value === '') {
+                delete process.env[key];
+            }
+            else {
+                process.env[key] = value;
+            }
+        });
+    }
+    finally {
+        releaseLock(lockHandle);
+    }
+}

package/server/dist/utils/http.utils.js

@@ -0,0 +1,70 @@
+import { brotliDecompressSync, gunzipSync, inflateSync } from 'node:zlib';
+export class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message || `Upstream request failed with status ${status}`);
+        this.name = 'HttpError';
+        this.status = status;
+    }
+}
+export function decodeMaybeGzip(bytes) {
+    if (bytes.length > 2 && bytes[0] === 0x1f && bytes[1] === 0x8b)
+        return gunzipSync(bytes);
+    return bytes;
+}
+export async function parseJsonBody(res) {
+    const buf = Buffer.from(await res.arrayBuffer());
+    const text = decodeMaybeGzip(buf).toString('utf8');
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        const attempts = [() => brotliDecompressSync(buf), () => inflateSync(buf)];
+        for (const attempt of attempts) {
+            try {
+                return JSON.parse(attempt().toString('utf8'));
+            }
+            catch {
+                // ignore
+            }
+        }
+        throw err;
+    }
+}
+export function isAbortError(err) {
+    if (!err || typeof err !== 'object')
+        return false;
+    const name = err.name;
+    return name === 'AbortError' || name === 'TimeoutError';
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function isRetryableStatus(status) {
+    return status === 408 || status === 429 || status >= 500;
+}
+export async function fetchWithRetry(input, init = {}, options = {}) {
+    const { retries = 0, baseDelayMs = 100, timeoutMs = 30000, signal } = options;
+    let attempt = 0;
+    for (;;) {
+        const timeoutSignal = AbortSignal.timeout(timeoutMs);
+        const combined = signal ? AbortSignal.any([signal, timeoutSignal]) : timeoutSignal;
+        try {
+            const response = await fetch(input, { ...init, signal: combined });
+            if (!isRetryableStatus(response.status) || attempt >= retries)
+                return response;
+            try {
+                await response.body?.cancel();
+            }
+            catch {
+                // ignore
+            }
+        }
+        catch (err) {
+            if (signal?.aborted || attempt >= retries)
+                throw err;
+            if (!isAbortError(err) && !(err instanceof TypeError))
+                throw err;
+        }
+        attempt += 1;
+        await sleep(Math.min(baseDelayMs * 2 ** (attempt - 1), 3000));
+    }
+}

package/server/dist/utils/machine-id.js

@@ -0,0 +1,40 @@
+import { execSync } from 'child_process';
+import os from 'os';
+import crypto from 'crypto';
+import fs from 'fs';
+export function getMachineId() {
+    let hardwareId = '';
+    try {
+        if (process.platform === 'win32') {
+            hardwareId = execSync('reg query "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid')
+                .toString()
+                .split('REG_SZ')[1]
+                .trim();
+        }
+        else if (process.platform === 'linux') {
+            if (fs.existsSync('/etc/machine-id')) {
+                hardwareId = fs.readFileSync('/etc/machine-id', 'utf8').trim();
+            }
+            else if (fs.existsSync('/var/lib/dbus/machine-id')) {
+                hardwareId = fs.readFileSync('/var/lib/dbus/machine-id', 'utf8').trim();
+            }
+        }
+        else if (process.platform === 'darwin') {
+            hardwareId = execSync("ioreg -rd1 -c IOPlatformExpertDevice | grep -E 'IOPlatformUUID' | awk -F'\"' '{print $4}'")
+                .toString()
+                .trim();
+        }
+    }
+    catch (err) {
+        const interfaces = os.networkInterfaces();
+        const macs = Object.values(interfaces)
+            .flat()
+            .filter((iface) => iface && !iface.internal && iface.mac !== '00:00:00:00:00:00')
+            .map((iface) => iface.mac)
+            .sort();
+        hardwareId = macs.length > 0 ? macs.join('-') : os.hostname();
+    }
+    const username = os.userInfo().username;
+    const seed = `${hardwareId}:${username}:${process.platform}`;
+    return crypto.createHash('sha256').update(seed).digest('hex');
+}

package/server/dist/utils/megaplay.utils.js

@@ -0,0 +1,41 @@
+import { createHmac } from 'node:crypto';
+const MEGAPLAY_CDN_TOKEN_KEY = 'MpCdnT0k3n!9f2K#xQ7vL5mR8wN1pY4s';
+export const MEGAPLAY_CDN_TOKEN_TTL_SECONDS = 120;
+export const MEGAPLAY_ORIGIN = 'https://megaplay.buzz';
+export const MEGAPLAY_REFERER = 'https://megaplay.buzz/';
+function base64UrlEncode(input) {
+    return Buffer.from(input)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+export function isNexabloomMasterUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return (parsed.hostname.toLowerCase().endsWith('nexabloom.top') &&
+            parsed.pathname.includes('master.m3u8'));
+    }
+    catch {
+        return false;
+    }
+}
+export function signNexabloomMasterUrl(masterUrl, ttlSeconds = MEGAPLAY_CDN_TOKEN_TTL_SECONDS) {
+    const match = masterUrl.match(/\/([a-f0-9]{32})\/([a-f0-9]{32})\//i);
+    if (!match)
+        return masterUrl;
+    const path = `${match[1].toLowerCase()}/${match[2].toLowerCase()}`;
+    const expires = Math.floor(Date.now() / 1000) + ttlSeconds;
+    const message = `${expires}|${path}`;
+    const signature = base64UrlEncode(createHmac('sha256', MEGAPLAY_CDN_TOKEN_KEY).update(message).digest());
+    const token = `${base64UrlEncode(message)}.${signature}`;
+    try {
+        const parsed = new URL(masterUrl);
+        parsed.searchParams.set('token', token);
+        return parsed.href;
+    }
+    catch {
+        const separator = masterUrl.includes('?') ? '&' : '?';
+        return `${masterUrl}${separator}token=${encodeURIComponent(token)}`;
+    }
+}

package/server/dist/utils/request-context.js

@@ -0,0 +1,2 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+export const requestContext = new AsyncLocalStorage();

package/server/dist/utils/security.utils.js

@@ -0,0 +1,94 @@
+import { CONFIG } from '../config.js';
+export function isSafeExternalUrl(rawUrl) {
+    if (typeof rawUrl !== 'string' || !rawUrl.trim()) {
+        return { safe: false, error: 'URL required' };
+    }
+    let parsed;
+    try {
+        parsed = new URL(rawUrl.trim());
+    }
+    catch {
+        return { safe: false, error: 'Invalid URL format' };
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        return { safe: false, error: 'Only http and https protocols are supported' };
+    }
+    const hostname = parsed.hostname.toLowerCase();
+    if (hostname === 'localhost' ||
+        hostname === '127.0.0.1' ||
+        hostname === '::1' ||
+        hostname === '0.0.0.0' ||
+        hostname.endsWith('.localhost') ||
+        hostname.endsWith('.local') ||
+        hostname.endsWith('.internal')) {
+        return { safe: false, error: 'Access to loopback/local addresses is forbidden' };
+    }
+    const ipv4Match = hostname.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (ipv4Match) {
+        const o1 = Number(ipv4Match[1]);
+        const o2 = Number(ipv4Match[2]);
+        const o3 = Number(ipv4Match[3]);
+        const o4 = Number(ipv4Match[4]);
+        if ([o1, o2, o3, o4].some((o) => o < 0 || o > 255)) {
+            return { safe: false, error: 'Invalid IP address format' };
+        }
+        if (o1 === 0 ||
+            o1 === 10 ||
+            o1 === 127 ||
+            (o1 === 172 && o2 >= 16 && o2 <= 31) ||
+            (o1 === 192 && o2 === 168) ||
+            (o1 === 169 && o2 === 254)) {
+            return { safe: false, error: 'Access to private or link-local IP addresses is forbidden' };
+        }
+    }
+    if (hostname.startsWith('[') || hostname.includes(':')) {
+        const cleanIpv6 = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+        if (cleanIpv6 === '::1' ||
+            cleanIpv6 === '::' ||
+            cleanIpv6.startsWith('fe80:') ||
+            cleanIpv6.startsWith('fc00:') ||
+            cleanIpv6.startsWith('fd00:') ||
+            cleanIpv6.startsWith('::ffff:127.') ||
+            cleanIpv6.startsWith('::ffff:192.168.') ||
+            cleanIpv6.startsWith('::ffff:10.') ||
+            cleanIpv6.startsWith('::ffff:172.') ||
+            cleanIpv6.startsWith('::ffff:169.254.')) {
+            return { safe: false, error: 'Access to private or link-local IPv6 addresses is forbidden' };
+        }
+    }
+    return { safe: true, url: parsed };
+}
+export function isAllowedOrigin(origin) {
+    if (!origin)
+        return true; // Non-browser clients, same-origin, or mobile webview
+    try {
+        const parsed = new URL(origin);
+        const host = parsed.hostname.toLowerCase();
+        const isLocal = host === 'localhost' || host === '127.0.0.1' || host === '::1';
+        if (CONFIG.HOST === '0.0.0.0') {
+            return true;
+        }
+        return isLocal;
+    }
+    catch {
+        return false;
+    }
+}
+export function crossSiteProtectionMiddleware(req, res, next) {
+    const method = req.method.toUpperCase();
+    const isMutating = ['POST', 'PUT', 'DELETE', 'PATCH'].includes(method);
+    if (!isMutating)
+        return next();
+    const secFetchSite = req.headers['sec-fetch-site'];
+    if (secFetchSite === 'cross-site') {
+        const origin = req.headers.origin;
+        if (!isAllowedOrigin(origin)) {
+            return res.status(403).json({ error: 'Forbidden: cross-site request rejected' });
+        }
+    }
+    const origin = req.headers.origin;
+    if (origin && !isAllowedOrigin(origin)) {
+        return res.status(403).json({ error: 'Forbidden: cross-origin request rejected' });
+    }
+    next();
+}

package/server/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "dango-server",
+  "private": true,
+  "version": "3.3.4",
+  "type": "module",
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "scripts": {
+    "start": "node --max-old-space-size=256 dist/server.js",
+    "dev": "tsx watch src/server.ts --dev",
+    "build": "tsc",
+    "format": "prettier --write .",
+    "lint": "eslint ."
+  },
+  "dependencies": {
+    "@octokit/auth-oauth-device": "^8.0.3",
+    "@octokit/rest": "^22.0.1",
+    "@xhayper/discord-rpc": "^1.3.4",
+    "cheerio": "^1.2.0",
+    "compression": "^1.8.1",
+    "cors": "^2.8.5",
+    "dotenv": "^17.4.2",
+    "express": "^5.1.0",
+    "fast-xml-parser": "^5.11.1",
+    "got-scraping": "^3.2.9",
+    "lru-cache": "^11.5.2",
+    "multer": "^2.0.2",
+    "pino": "^10.3.1",
+    "ws": "^8.18.0",
+    "youtubei.js": "^18.1.0"
+  },
+  "devDependencies": {
+    "@types/compression": "^1.8.1",
+    "@types/cors": "^2.8.19",
+    "@types/express": "^5.0.0",
+    "@types/express-serve-static-core": "^5.1.3",
+    "@types/multer": "^2.1.0",
+    "@types/node": "^22.5.0",
+    "@types/ws": "^8.5.10",
+    "pino-pretty": "^13.1.1",
+    "tsx": "^4.23.13"
+  }
+}