instbyte 1.9.4 → 1.11.0

package/server/server.js

@@ -19,6 +19,9 @@ const db = require("./db");
 
 const config = require("./config");
 
+let mdns = null;
+try { mdns = require('multicast-dns'); } catch (e) { }
+
 const UPLOADS_DIR = process.env.INSTBYTE_UPLOADS
   || path.join(__dirname, "../uploads");
 
@@ -63,8 +66,16 @@ app.use(helmet({
 
 app.use((req, res, next) => {
   if (req.path === '/upload') return next();
+
+  const ct = req.headers['content-type'] || '';
+
+  if (ct.startsWith('text/plain')) {
+    return express.text({ limit: '10mb' })(req, res, next);
+  }
+
   express.json()(req, res, next);
 });
+
 app.use(cookieParser());
 app.use(requireAuth);
 app.use("/uploads", (req, res, next) => {
@@ -225,19 +236,28 @@ const COOKIE_MAX_AGE = 7 * 24 * 60 * 60 * 1000; // 7 days
 const sessions = new Map();
 
 function requireAuth(req, res, next) {
-  if (!config.auth.passphrase) return next(); // no passphrase set, skip
+  if (!config.auth.passphrase) return next();
 
-  // Allow the login route itself through
   if (req.path === "/login" || req.path === "/info" || req.path === "/health") return next();
 
+  // Terminal / API clients — accept passphrase via header
+  const headerPass = req.headers["x-passphrase"];
+  if (headerPass && headerPass === config.auth.passphrase) return next();
 
-  // Check cookie holds a valid session token
+  // Browser clients — check session cookie
   const cookie = req.cookies[COOKIE_NAME];
   if (cookie && sessions.has(cookie)) return next();
 
-  // Not authenticated
   if (req.path.startsWith("/socket.io")) return next();
-  if (req.headers["content-type"] === "application/json" || req.xhr) {
+
+  // Return JSON 401 for any non-browser request
+  const ct = req.headers["content-type"] || "";
+  const isApiRequest = ct.startsWith("application/json") ||
+    ct.startsWith("text/plain") ||
+    req.xhr ||
+    req.headers["x-passphrase"] !== undefined;
+
+  if (isApiRequest) {
     return res.status(401).json({ error: "Unauthorized" });
   }
 
@@ -364,6 +384,13 @@ const channelLimiter = rateLimit({
   message: { error: "Too many requests,  try again later" }
 });
 
+const broadcastLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 5,
+  skip: () => process.env.NODE_ENV === 'test',
+  message: { error: "Too many broadcast attempts, slow down" }
+});
+
 /* LOGIN POST */
 app.post("/login", loginLimiter, (req, res) => {
   if (!config.auth.passphrase) return res.redirect("/");
@@ -446,9 +473,27 @@ app.use((err, req, res, next) => {
   next(err);
 });
 
-/* TEXT/LINK */
-app.post("/text", dropLimiter, (req, res) => {
-  const { content, channel, uploader } = req.body;
+/* TEXT/LINK — accepts application/json and text/plain */
+function handleTextPost(req, res) {
+  let content, channel, uploader;
+
+  if (req.is("text/plain")) {
+    // Terminal path — body is raw string, metadata comes from headers
+    content = typeof req.body === "string" ? req.body : String(req.body);
+    channel = (req.headers["x-channel"] || "general").trim();
+    uploader = (req.headers["x-uploader"] || "terminal").trim();
+  } else {
+    // Browser / JSON path — existing behaviour unchanged
+    ({ content, channel, uploader } = req.body || {});
+  }
+
+  if (!content || !content.trim()) {
+    return res.status(400).json({ error: "Content is required" });
+  }
+
+  if (!channel) {
+    return res.status(400).json({ error: "Channel is required" });
+  }
 
   const item = {
     type: "text",
@@ -469,7 +514,11 @@ app.post("/text", dropLimiter, (req, res) => {
       res.json(item);
     }
   );
-});
+}
+
+app.post("/text", dropLimiter, handleTextPost);
+app.post("/push", dropLimiter, handleTextPost); // terminal-friendly alias
+
 
 /* DELETE ITEM */
 app.delete("/item/:id", (req, res) => {
@@ -812,6 +861,62 @@ app.get("/health", (req, res) => {
   });
 });
 
+/*   BROADCAST*/
+/* GET /broadcast/status — returns current broadcast or null */
+app.get("/broadcast/status", (req, res) => {
+  if (!currentBroadcast) return res.json({ live: false });
+  res.json({
+    live: true,
+    uploader: currentBroadcast.uploader,
+    channel: currentBroadcast.channel,
+    startedAt: currentBroadcast.startedAt
+  });
+});
+
+/* POST /broadcast/start */
+app.post("/broadcast/start", broadcastLimiter, (req, res) => {
+
+  if (currentBroadcast) {
+    return res.status(409).json({
+      error: "Broadcast already in progress",
+      uploader: currentBroadcast.uploader
+    });
+  }
+
+  const { uploader, channel, socketId } = req.body;
+  if (!uploader || !channel) {
+    return res.status(400).json({ error: "uploader and channel required" });
+  }
+
+  currentBroadcast = {
+    uploader,
+    channel,
+    startedAt: Date.now(),
+    lastFrame: null,
+    socketId
+  };
+
+  io.emit("broadcast-started", {
+    uploader: currentBroadcast.uploader,
+    channel: currentBroadcast.channel,
+    startedAt: currentBroadcast.startedAt
+  });
+
+  console.log(`Broadcast started by ${uploader}`);
+  res.json({ ok: true, ...currentBroadcast });
+});
+
+/* POST /broadcast/end */
+app.post("/broadcast/end", (req, res) => {
+  if (!currentBroadcast) return res.status(400).json({ error: "No broadcast in progress" });
+
+  const uploader = currentBroadcast.uploader;
+  currentBroadcast = null;
+
+  io.emit("broadcast-ended", { uploader });
+  console.log(`Broadcast ended by ${uploader}`);
+  res.json({ ok: true });
+});
 
 /* FAVICON */
 app.get("/favicon-dynamic.png", async (req, res) => {
@@ -867,6 +972,9 @@ app.get("/logo-dynamic.png", (req, res) => {
 // resets on server restart, no DB needed
 const seenBy = new Map();
 
+// Broadcast state — null when IDLE, populated when LIVE
+let currentBroadcast = null;
+
 let connectedUsers = 0;
 
 io.on("connection", (socket) => {
@@ -889,10 +997,56 @@ io.on("connection", (socket) => {
     io.emit("seen-update", { id, count });
   });
 
+  // WebRTC — viewer joins, notify broadcaster to initiate peer connection
+  socket.on("broadcast-join", () => {
+    if (!currentBroadcast) return;
+    // tell broadcaster a new viewer has joined, pass viewer's socket id
+    const broadcasterSocket = io.sockets.sockets.get(currentBroadcast.socketId);
+    if (broadcasterSocket) {
+      broadcasterSocket.emit("webrtc-viewer-joined", { viewerId: socket.id });
+    }
+  });
+
+  // WebRTC — broadcaster sends offer to a specific viewer
+  socket.on("webrtc-offer", ({ offer, viewerId }) => {
+    const viewerSocket = io.sockets.sockets.get(viewerId);
+    if (viewerSocket) {
+      viewerSocket.emit("webrtc-offer", { offer, broadcasterId: socket.id });
+    }
+  });
+
+  // WebRTC — viewer sends answer back to broadcaster
+  socket.on("webrtc-answer", ({ answer, broadcasterId }) => {
+    const broadcasterSocket = io.sockets.sockets.get(broadcasterId);
+    if (broadcasterSocket) {
+      broadcasterSocket.emit("webrtc-answer", { answer, viewerId: socket.id });
+    }
+  });
+
+  // WebRTC — ICE candidate exchange, both directions
+  socket.on("webrtc-ice", ({ candidate, targetId }) => {
+    const targetSocket = io.sockets.sockets.get(targetId);
+    if (targetSocket) {
+      targetSocket.emit("webrtc-ice", { candidate, fromId: socket.id });
+    }
+  });
+
+  // Broadcast — raise hand, relay to broadcaster
+  socket.on("broadcast-reaction", ({ from }) => {
+    if (!currentBroadcast) return;
+    io.emit("broadcast-reaction-received", { from });
+  });
+
   socket.on("disconnect", () => {
     connectedUsers--;
     console.log(username + " disconnected | total:", connectedUsers);
     io.emit("user-count", connectedUsers);
+
+    if (currentBroadcast && currentBroadcast.socketId === socket.id) {
+      currentBroadcast = null;
+      io.emit("broadcast-ended");
+      console.log("Broadcast ended — broadcaster disconnected");
+    }
   });
 });
 
@@ -925,14 +1079,74 @@ function getLocalIP() {
   return preferred ? preferred.address : "localhost";
 }
 
-function findFreePort(start) {
+
+function getMdnsName() {
+  const appName = config.branding && config.branding.appName;
+  if (appName && appName.toLowerCase() !== 'instbyte') {
+    return appName.toLowerCase().replace(/\s+/g, '-') + '.local';
+  }
+  return 'instbyte.local';
+}
+
+function getHostnameFallback() {
+  return os.hostname().toLowerCase() + '.local';
+}
+
+function probeMdns(name) {
   return new Promise((resolve) => {
-    const srv = net.createServer();
-    srv.listen(start, () => {
-      const port = srv.address().port;
-      srv.close(() => resolve(port));
+    if (!mdns) return resolve(false);
+    const m = mdns();
+    const timer = setTimeout(() => {
+      m.destroy();
+      resolve(false); // no response = name is free
+    }, 2000);
+
+    m.on('response', (response) => {
+      const taken = response.answers.some(a =>
+        a.name === name && a.type === 'A'
+      );
+      if (taken) {
+        clearTimeout(timer);
+        m.destroy();
+        resolve(true); // name is taken
+      }
+    });
+
+    m.query({ questions: [{ name, type: 'A' }] });
+  });
+}
+
+function startMdnsAdvertise(name, ip) {
+  if (!mdns) return null;
+  try {
+    const m = mdns();
+    m.on('query', (query) => {
+      query.questions.forEach(q => {
+        if (q.name === name && q.type === 'A') {
+          m.respond({
+            answers: [{ name, type: 'A', ttl: 300, data: ip }]
+          });
+        }
+      });
+    });
+    return m;
+  } catch (e) {
+    return null;
+  }
+}
+
+
+function listenOnFreePort(server, preferredPort) {
+  return new Promise((resolve, reject) => {
+    server.listen(preferredPort, () => resolve(server.address().port));
+    server.on('error', (err) => {
+      if (err.code === 'EADDRINUSE') {
+        server.removeAllListeners('error');
+        listenOnFreePort(server, preferredPort + 1).then(resolve).catch(reject);
+      } else {
+        reject(err);
+      }
     });
-    srv.on("error", () => resolve(findFreePort(start + 1)));
   });
 }
 
@@ -941,19 +1155,52 @@ const PREFERRED = parseInt(process.env.PORT) || config.server.port;
 const localIP = getLocalIP();
 
 let PORT;
-findFreePort(PREFERRED).then(p => {
-  PORT = p;
-  server.listen(PORT, () => {
+let mdnsAdvertiser = null;
+
+if (process.env.INSTBYTE_BOOT === '1') {
+  listenOnFreePort(server, PREFERRED).then(async p => {
+    PORT = p;
     console.log("\nInstbyte running");
     console.log("Local:   http://localhost:" + PORT);
     console.log("Network: http://" + localIP + ":" + PORT);
     if (PORT !== PREFERRED) {
       console.log(`(port ${PREFERRED} was busy, switched to ${PORT})`);
     }
+
+    // mDNS
+    if (mdns) {
+      try {
+        const preferredName = getMdnsName();
+        const isTaken = await probeMdns(preferredName);
+
+        let mdnsName;
+        if (isTaken) {
+          mdnsName = getHostnameFallback();
+          if (os.platform() !== 'win32') {
+            console.log(`mDNS:    http://${preferredName} already in use on this network`);
+            console.log(`mDNS:    http://${mdnsName}`);
+          }
+        } else {
+          mdnsName = preferredName;
+          if (os.platform() !== 'win32') {
+            console.log(`mDNS:    http://${mdnsName}`);
+          }
+        }
+
+        mdnsAdvertiser = startMdnsAdvertise(mdnsName, localIP);
+
+      } catch (e) {
+        console.log("mDNS:    unavailable on this network — use IP or QR code to join");
+      }
+    }
+
     console.log("");
     scanOrphans();
+  }).catch(err => {
+    console.error("Failed to start server:", err.message);
+    process.exit(1);
   });
-});
+}
 
 module.exports = { app, server, sessions };
 
@@ -964,6 +1211,11 @@ module.exports = { app, server, sessions };
 function shutdown(signal) {
   console.log(`\n${signal} received — shutting down gracefully...`);
 
+  // destroy mDNS advertiser if running
+  if (typeof mdnsAdvertiser !== 'undefined' && mdnsAdvertiser) {
+    try { mdnsAdvertiser.destroy(); } catch (e) { }
+  }
+
   // stop accepting new connections
   server.close(() => {
     console.log("HTTP server closed");