finish updating dependencies

Signed-off-by: code002lover <code002lover@ipost.rocks>

.dockerignore

@@ -0,0 +1,10 @@
+node_modules
+npm-debug.log
+.git
+.gitignore
+.env
+*.md
+logs
+*.log
+cookiesecret.txt
+mysql_password.txt

.gitignore

@@ -7,4 +7,5 @@ ignore/*
 avatars/*
 etc/*
 *newrelic*
-user_uploads/*
+user_uploads/*
+swagger-api.json

Dockerfile

@@ -0,0 +1,18 @@
+FROM node:slim
+
+WORKDIR /app
+
+# Copy package files
+COPY package*.json ./
+
+# Install dependencies
+RUN npm install
+
+# Copy application code
+COPY . .
+
+# Expose ports
+EXPOSE 80
+
+# Start the application
+CMD ["node", "server.js"] 

README.md

@@ -1,3 +1,3 @@
 # IPost
-IPost, formerly known as "authwebsite" is a chatting platform that mainly has one thing in mind: privacy.  
+IPost, formerly known as "authwebsite" is a chatting platform that also server as a gateway for me to have authentication for my other projects.
 You can visit IPost under https://ipost.rocks

docker-compose.yml

@@ -0,0 +1,35 @@
+services:
+  app:
+    build: .
+    ports:
+      - "23080:80"
+    environment:
+      - MYSQL_HOST=db
+      - MYSQL_USER=ipost
+      - MYSQL_PASSWORD=ipost_password
+      - MYSQL_DATABASE=ipost
+    depends_on:
+      - db
+    volumes:
+      - ./logs:/app/logs
+      - ./server_config.json:/app/server_config.json
+      - ./cookiesecret.txt:/app/cookiesecret.txt
+      - ./mysql_password.txt:/app/mysql_password.txt
+    restart: unless-stopped
+
+  db:
+    image: mysql:8.0
+    environment:
+      - MYSQL_ROOT_PASSWORD=root_password
+      - MYSQL_DATABASE=ipost
+      - MYSQL_USER=ipost
+      - MYSQL_PASSWORD=ipost_password
+    volumes:
+      - mysql_data:/var/lib/mysql
+      - ./createSchema.sql:/docker-entrypoint-initdb.d/createSchema.sql
+    ports:
+      - "3306:3306"
+    restart: unless-stopped
+
+volumes:
+  mysql_data: 

error_codes.txt

@@ -4,7 +4,7 @@
 403: login error (no cookie)
 404: invalid url / not found
 410-419: argument/data error
-420: invalid authetication object
+420: invalid authentication object
 429: ratelimit
 
 500: server error

js/htmlescape.js

@@ -56,9 +56,9 @@ const cape = m => unes[m];
 const unescape = un => replace.call(un, es, cape);
 
 function escape_special(str) {
-  return str.replace(/\\/g,"\\\\").replace(/`/g,"\\`")
+  return str.replace(/\\/g,"\\\\").replace(/`/g,"\\`");
 }
 
 function unescape_special(str) {
-  return str.replace(/\\\\/g,"\\").replace(/\\`/,"`")
+  return str.replace(/\\\\/g,"\\").replace(/\\`/,"`");
 }

js/warn_message.js

@@ -1,6 +1,6 @@
 const warn_messages = [
   ["%cDo not paste any text in here","background: red; color: yellow; font-size: x-large"],
-  ["Pasting anything in here may give others access to your account.",""]
+  ["Pasting anything in here may give others access to your account."]
 ]
 function warnmessage() {
   for (let message of warn_messages) {

package.json

@@ -1,23 +1,23 @@
 {
   "dependencies": {
-    "body-parser": "^1.20.1",
+    "body-parser": "^2.2",
-    "clean-css": "^5.3.2",
+    "clean-css": "^5.3",
-    "compression": "^1.7.4",
+    "compression": "^1.8",
-    "cookie-parser": "^1.4.6",
+    "cookie-parser": "^1.4",
-    "ejs": "^3.1.8",
+    "ejs": "^3.1",
-    "express": "^4.18.2",
+    "express": "^5.1",
-    "express-fileupload": "^1.3.1",
+    "express-fileupload": "^1.5",
-    "express-useragent": "^1.0.15",
+    "express-useragent": "^1.0",
-    "hcaptcha": "^0.1.1",
+    "hcaptcha": "^0.2",
-    "html-minifier-terser": "^7.1.0",
+    "html-minifier-terser": "^7.2.0",
-    "lru-cache": "^7.14.1",
+    "lru-cache": "^11.1",
-    "mysql2": "^3.1.2",
+    "mysql2": "^3.14",
-    "newrelic": "^9.8.1",
+    "sharp": "^0.34",
-    "sharp": "^0.31.3",
+    "swagger-autogen": "^2.23",
-    "spdy": "^4.0.2",
+    "uglify-js": "^3.19",
-    "uglify-js": "^3.17.4",
     "unsafe_encrypt": "^1.0.4",
-    "ws": "^8.12.0"
+    "ws": "^8.13.0",
+    "cookie-signature": "^1.2.2"
   },
   "scripts": {
     "start": "node server.js",

pnpm-workspace.yaml

@@ -0,0 +1,2 @@
+onlyBuiltDependencies:
+  - sharp

routes/api/all.js

@@ -1,39 +1,41 @@
 import fs from "fs";
-import {SHA256} from "../../extra_modules/SHA.js";
+import { SHA256 } from "../../extra_modules/SHA.js";
-import {unsign} from "../../extra_modules/unsign.js";
+import { unsign } from "../../extra_modules/unsign.js";
 const config = JSON.parse(fs.readFileSync("server_config.json"));
 const HASHES_DB = config.cookies.server_hashes;
 const HASHES_COOKIE = config.cookies.client_hashes;
 const HASHES_DIFF = HASHES_DB - HASHES_COOKIE;
 
 export const setup = function (router, con, server) {
-    router.use("/*", (req, res, next) => {
+    router.use("/*path", (req, res, next) => {
         res.set("Access-Control-Allow-Origin", "*"); //we'll allow it for now
         let unsigned;
-        if (req.body.user === undefined || req.body.pass === undefined) {
+
-            if(typeof req.get("ipost-auth-token") === "string") {
+        req.body = req.body || {};
-                try{
+
-                    req.body.auth = JSON.parse(req.get("ipost-auth-token"))
+        if (typeof req.get("ipost-auth-token") === "string") {
-                } catch(err) {
+            try {
-                    console.log("error parsing header",err)
+                req.body.auth = JSON.parse(req.get("ipost-auth-token"))
-                }
+            } catch (err) {
+                console.log("error parsing header", err)
             }
-            if(req.body.auth !== undefined && req.originalUrl !== "/redeemauthcode") {
+        }
-                if(typeof req.body.auth === "string") {
+        if (req.body.auth !== undefined && req.originalUrl !== "/redeemauthcode") {
-                    try{
+            if (typeof req.body.auth === "string") {
-                        req.body.auth = JSON.parse(req.body.auth)
+                try {
-                    } catch(err) {
+                    req.body.auth = JSON.parse(req.body.auth)
-                        console.log("error parsing",err)
+                } catch (err) {
-                    }
+                    console.log("error parsing", err)
-                } else 
+                }
-                if(
+            } else
-                    typeof req.body.auth            !== "object" || 
+                if (
-                    typeof req.body.auth.secret     !== "string" || 
+                    typeof req.body.auth !== "object" ||
-                    typeof req.body.auth.appid      !== "number" || 
+                    typeof req.body.auth.secret !== "string" ||
-                    typeof req.body.auth.auth_token !== "string" || 
+                    typeof req.body.auth.appid !== "number" ||
-                    req.body.auth.secret.length     !== 200      || 
+                    typeof req.body.auth.auth_token !== "string" ||
-                    req.body.auth.auth_token.length !== 200      ||
+                    req.body.auth.secret.length !== 200 ||
-                    Buffer.from(req.body.auth.secret,"base64").length !== 150
+                    req.body.auth.auth_token.length !== 200 ||
+                    Buffer.from(req.body.auth.secret, "base64").length !== 150
                 ) {
                     res.status(420).send("invalid authentication object")
                     return;
@@ -42,10 +44,10 @@ export const setup = function (router, con, server) {
                     //appid     : number
                     //auth_token: string(200 chars)
                     let sql = "select User_ID,User_Name,User_Bio,User_Avatar,User_Settings from ipost.auth_tokens inner join ipost.application on auth_token_isfrom_application_id=application_id inner join ipost.users on auth_token_u_id=User_ID where auth_token=? and application_secret=? and application_id=?"
-                    con.query(sql,[SHA256(req.body.auth.auth_token,req.body.auth.appid, HASHES_DB),SHA256(req.body.auth.secret,req.body.auth.appid, HASHES_DB),req.body.auth.appid],(err,result) => {
+                    con.query(sql, [SHA256(req.body.auth.auth_token, req.body.auth.appid, HASHES_DB), SHA256(req.body.auth.secret, req.body.auth.appid, HASHES_DB), req.body.auth.appid], (err, result) => {
-                        if(err) throw err;
+                        if (err) throw err;
 
-                        if(result.length !== 1) {
+                        if (result.length !== 1) {
                             res.status(420).send("invalid authentication object (or server error?)")
                             return;
                         }
@@ -62,24 +64,16 @@ export const setup = function (router, con, server) {
                     })
                     return;
                 }
-            } else {
+        } else {
-                if(!req.cookies.AUTH_COOKIE) {
+            if (!req.cookies.AUTH_COOKIE) {
-                    next()
+                next()
-                    return
+                return
-                }
+            }
-                unsigned = unsign(req.cookies.AUTH_COOKIE, req, res);
+            unsigned = unsign(req.cookies.AUTH_COOKIE, req, res);
-                if (!unsigned){
+            if (!unsigned) {
-                    next()
+                next()
-                    return
+                return
-                }
             }
-            
-        }
-        else {
-            unsigned = `${req.body.user} ${SHA256(req.body.pass, req.body.user, HASHES_COOKIE)}`;
-            res.set("message","user+pass authentication is deprecated as of february 2023, consider switching to auth tokens")
-            //basically we generate the unsigned cookie
-            res.locals.isbot = true; //only bots use user+pass
         }
         let sql = `select User_ID,User_Name,User_Bio,User_Avatar,User_Settings from ipost.users where User_Name=? and User_PW=?;`;
         let values = unsigned.split(" ");
@@ -92,24 +86,24 @@ export const setup = function (router, con, server) {
                 throw err;
             if (result[0] && result[0].User_Name && result[0].User_Name === values[0]) {
 
-                res.locals.userid   = result[0].User_ID;
+                res.locals.userid = result[0].User_ID;
                 res.locals.username = result[0].User_Name;
-                res.locals.bio      = result[0].User_Bio || "";
+                res.locals.bio = result[0].User_Bio || "";
-                res.locals.avatar   = result[0].User_Avatar || "";
+                res.locals.avatar = result[0].User_Avatar || "";
                 res.locals.settings = result[0].User_Settings || {};
-                
+
             }
             next()
         });
     });
 
-    router.use("/api/*", (req, res, next) => {
+    router.use("/api/*path", (req, res, next) => {
         res.set("Access-Control-Allow-Origin", "*"); //we'll allow it for now
         if (config["allow_getotheruser_without_cookie"] && req.originalUrl.split("\?")[0] === "/api/getotheruser") {
             next();
             return;
         }
-        if (!server.increaseAPICall(req, res))return;
+        if (!server.increaseAPICall(req, res)) return;
 
         if (res.locals.username !== undefined) {
             next();
@@ -118,6 +112,9 @@ export const setup = function (router, con, server) {
             res.status(402);
             res.json({ "error": "you cannot access the api without being logged in" });
         }
+        /* #swagger.security = [{
+               "appTokenAuthHeader": []
+        }] */
     });
 };
 export default {

routes/api/dms/PersonalMessages.js

@@ -20,6 +20,9 @@ export const setup = function (router, con, server) {
                 throw err;
             res.json(result);
         });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.get("/api/dms/conversations",  function (req, res) {
         res.set("Access-Control-Allow-Origin", "*");
@@ -30,10 +33,16 @@ export const setup = function (router, con, server) {
                 throw err;
             res.json(result);
         });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.get("/api/dms/encrypt.js",  function (req, res) {
         res.set("Access-Control-Allow-Origin", "*");
         res.send(web_version());
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     //
     router.get("/api/dms/getDM",  function (req, res) {
@@ -52,6 +61,9 @@ export const setup = function (router, con, server) {
                 res.json({ "error": "there is no such dm!" });
             }
         });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
 };
 export default {

routes/api/dms/post.js

@@ -19,6 +19,9 @@ export const setup = function (router, con, server) {
     router.get("/api/dms/pid",  function (req, res) {
         res.set("Access-Control-Allow-Origin", "*");
         res.json({ "pid": createPID() });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.post("/api/dms/post",  function (req, res) {
         if (!req.body.message) {
@@ -89,6 +92,10 @@ export const setup = function (router, con, server) {
             console.log(5, `posted new dm by ${res.locals.username} to ${otherperson} : ${xor(encodeURIComponent(res.locals.username), otherperson)}`);
         });
         //TODO: bring dms up-to-date with normal posts
+
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     return createPID
 };

routes/api/getFileIcon.js

@@ -31,8 +31,8 @@ async function addTextOnImage(text,buf) {
 }
 
 export const setup = function (router, con, server) {
-    router.get("/api/getFileIcon/*",async function(req,res){
+    router.get("/api/getFileIcon/:icon",async function(req,res){
-        let path = req.path.split("/api/getFileIcon/")[1]
+        let path = req.params.icon
         if(path.length > 4) {
             res.status(410).json({"error":"file ending is too long"})
             return;
@@ -41,5 +41,8 @@ export const setup = function (router, con, server) {
             res.set("content-type","image/png")
             res.send(buf)
         })
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     })
 }

routes/api/getPosts.js

@@ -1,8 +1,4 @@
 export const setup = function (router, con, server) {
-    router.get("/api/getPosts/*",  function (_req, res) {
-        res.set("Access-Control-Allow-Origin", "");
-        res.redirect("/api/getPosts");
-    });
     router.get("/api/getPosts",  function (req, res) {
         res.set("Access-Control-Allow-Origin", "*");
         if (req.query.channel !== undefined) {
@@ -21,6 +17,9 @@ export const setup = function (router, con, server) {
                 res.json(result);
             });
         }
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.get("/api/getPostsLowerThan",  function (req, res) {
         res.set("Access-Control-Allow-Origin", "*");
@@ -40,6 +39,9 @@ export const setup = function (router, con, server) {
                 res.json(result);
             });
         }
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.get("/api/getPost",  function (req, res) {
         res.set("Access-Control-Allow-Origin", "*");
@@ -56,5 +58,8 @@ export const setup = function (router, con, server) {
                 res.json({ "error": "there is no such post!" });
             }
         });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
 }

routes/api/post.js

@@ -32,6 +32,9 @@ export const setup = function (router, con, server) {
     router.get("/api/pid",  function (req, res) {
         res.set("Access-Control-Allow-Origin", "*");
         res.json({ "pid": createPID() });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
 
     function validateMessage(message) {
@@ -204,6 +207,9 @@ export const setup = function (router, con, server) {
                 res.json({"error":"internal server error", "status": 500})
             }
         }
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     return createPID
 };

routes/api/search.js

@@ -34,5 +34,9 @@ export const setup = function (router, con, server) {
         else {
             res.json({ "error": "invalid type passed along, expected `user` or `post`", "message": "search has been deprecated as of 11/30/2022"});
         }
+
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
 }

routes/api/settingshandler.js

@@ -4,6 +4,10 @@ const allowed_settings = {
 export const setup = function (router, con, server) {
     router.get("/api/settings", function (req, res) {
         res.json(res.locals.settings);
+
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.post("/api/settings", function (req, res) {
         if (!req.body.setting) {
@@ -45,6 +49,10 @@ export const setup = function (router, con, server) {
             }
             res.json({ "status": "success" });
         });
+
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
 };
 export default {

routes/api/userRoutes.js

@@ -47,10 +47,16 @@ export const setup = function (router, con, server) {
                     res.json({ "success": "updated avatar" });
                 });
             })
-        });         
+        });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.get("/api/getuser",  function (_req, res) {
         res.json({ "username": res.locals.username, "bio": res.locals.bio, "avatar": res.locals.avatar, "userid": res.locals.userid });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.get("/api/getalluserinformation",  function (req, res) {
         res.set("Access-Control-Allow-Origin", ""); //we don't want that here
@@ -73,6 +79,9 @@ export const setup = function (router, con, server) {
                 res.json({ "error": "you cannot access the api without being logged in" });
             }
         });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.get("/api/getotheruser",  function (req, res) {
         res.set("Access-Control-Allow-Origin", "*");
@@ -109,6 +118,9 @@ export const setup = function (router, con, server) {
                 throw err;
             res.json({ "success": "updated bio" });
         });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.post("/api/changePW", (req, res) => {
         res.set("Access-Control-Allow-Origin", "");
@@ -149,6 +161,9 @@ export const setup = function (router, con, server) {
                 res.json({ "error": "invalid password" });
             }
         });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
     router.post("/api/changeUsername",  function (req, res) {
         res.set("Access-Control-Allow-Origin", "");
@@ -212,5 +227,8 @@ export const setup = function (router, con, server) {
                 res.json({ "error": "invalid password" });
             }
         });
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     });
 }

routes/authorize.js

@@ -20,10 +20,10 @@ export const setup = function (router, con, server) {
             if(typeof appid === "number") {
 
                 const token = randomBytes(150).toString("base64")
-                
+
                 let tokencode;
                 while(tokencode===undefined || temp_code_to_token[tokencode]!==undefined) {
-                    tokencode = randomBytes(15).toString("base64")
+                    tokencode = randomBytes(15).toString("base64").replaceAll("/","f").replaceAll("+","A") //"/" and "+" may break some apps
                 }
                 temp_code_to_token[tokencode]={
                     "userid":res.locals.userid,
@@ -35,7 +35,7 @@ export const setup = function (router, con, server) {
                     if(data !== undefined && data.token===token && data.appid === appid && data.userid === res.locals.userid) {
                         temp_code_to_token[tokencode]=undefined
                     }
-                }, 300000); //wait for 5 minutes
+                }, 1000*60*5);
 
                 const sql = "SELECT application_auth_url FROM ipost.application where application_id=?"
 
@@ -45,16 +45,24 @@ export const setup = function (router, con, server) {
                         res.redirect(`/authorize?id=${req.body.application_id}`)
                         return
                     }
-                    res.redirect(`${result[0].application_auth_url}?code=${tokencode}`)
+                    let extra = ""
+                    if(req.body.application_extra !== "") {
+                        extra = "&extra="+String(req.body.application_extra)
+                    }
+                    res.redirect(`${result[0].application_auth_url}?code=${tokencode}${extra}`)
                 })
 
-                
+
-                
+
                 return
             }
         }
 
         res.redirect(`/authorize?id=${req.body.application_id}`)
+
+        /* #swagger.security = [{
+            "appTokenAuthHeader": []
+        }] */
     })
 
     router.post("/redeemauthcode", (req,res) => {
@@ -71,12 +79,12 @@ export const setup = function (router, con, server) {
             } catch(err) {
                 console.log("error parsing",err)
             }
-        } 
+        }
         if(
-            typeof req.body.auth            !== "object" || 
+            typeof req.body.auth            !== "object" ||
-            typeof req.body.auth.secret     !== "string" || 
+            typeof req.body.auth.secret     !== "string" ||
-            typeof req.body.auth.appid      !== "number" || 
+            typeof req.body.auth.appid      !== "number" ||
-            req.body.auth.secret.length     !== 200      || 
+            req.body.auth.secret.length     !== 200      ||
             Buffer.from(req.body.auth.secret,"base64").length !== 150 ||
             req.body.auth.appid !== temp_code_to_token[req.body.authcode].appid
         ) {
@@ -102,10 +110,10 @@ export const setup = function (router, con, server) {
 
             let data = temp_code_to_token[req.body.authcode]
             temp_code_to_token[req.body.authcode] = undefined
-            
+
-            
+
             const sql = "INSERT INTO `ipost`.`auth_tokens`(`auth_token`,`auth_token_u_id`,`auth_token_isfrom_application_id`) VALUES(?,?,?);"
-            
+
             const values = [SHA256(data.token,appid,10000),data.userid,data.appid] //token,id,appid
             con.query(sql,values,(err,result) => {
                 if(err) {
@@ -117,7 +125,11 @@ export const setup = function (router, con, server) {
             })
         })
 
-        
+
-    
+
     })
+
+    /* #swagger.security = [{
+        "appTokenAuthHeader": []
+    }] */
 }

routes/serve_static_files.js

@@ -5,43 +5,43 @@ export const setup = function (router, con, server) {
     const __dirname = server.dirname
     const dir = __dirname + "/"
     
-    router.get("/users/*",  function (req, res) {
+    router.get("/users/:user",  function (req, res) {
         if (!increaseUSERCall(req, res))
             return;
         res.sendFile(dir + "views/otheruser.html");
     });
-    router.get("/css/*", (request, response) => {
+    router.get("/css/:file", (request, response) => {
         if (!increaseUSERCall(request, response))
             return;
-        if (existsSync(__dirname + request.originalUrl)) {
+        if (existsSync(`${__dirname}/css/${request.params.file}`)) {
-            response.sendFile(__dirname + request.originalUrl);
+            response.sendFile(`${__dirname}/css/${request.params.file}`);
         }
         else {
             response.status(404).send("no file with that name found");
         }
         return;
     });
-    router.get("/js/*", (request, response) => {
+    router.get("/js/:file", (request, response) => {
         if (!increaseUSERCall(request, response))
             return;
-        if (existsSync(__dirname + request.originalUrl)) {
+        if (existsSync(`${__dirname}/js/${request.params.file}`)) {
-            response.sendFile(__dirname + request.originalUrl);
+            response.sendFile(`${__dirname}/js/${request.params.file}`);
         }
         else {
             response.status(404).send("no file with that name found");
         }
         return;
     });
-    router.get("/images/*", (request, response) => {
+    router.get("/images/:file", (request, response) => {
         if (!increaseUSERCall(request, response))
             return;
-        if (existsSync(__dirname + request.originalUrl)) {
+        if (existsSync(`${__dirname}/images/${request.params.file}`)) {
             response.set('Cache-Control', 'public, max-age=2592000'); //cache it for one month-ish
-            response.sendFile(__dirname + request.originalUrl);
+            response.sendFile(`${__dirname}/images/${request.params.file}`);
         }
-        else if(existsSync(__dirname + request.originalUrl.toLowerCase())){
+        else if(existsSync(`${__dirname}/images/${request.params.file.toLowerCase()}`)){
             response.set('Cache-Control', 'public, max-age=2592000'); //cache it for one month-ish
-            response.sendFile(__dirname + request.originalUrl.toLowerCase());
+            response.sendFile(`${__dirname}/images/${request.params.file.toLowerCase()}`);
         }
         else {
             response.status(404).send("no file with that name found");
@@ -49,12 +49,12 @@ export const setup = function (router, con, server) {
         return;
     });
     
-    router.get("/user_uploads/*", (request, response) => {
+    router.get("/user_uploads/:file", (request, response) => {
         if (!increaseUSERCall(request, response))
             return;
-        if (existsSync(__dirname + request.originalUrl)) {
+        if (existsSync(`${__dirname}/user_uploads/${request.params.file}`)) {
             response.set('Cache-Control', 'public, max-age=2592000'); //cache it for one month-ish
-            response.sendFile(__dirname + request.originalUrl);
+            response.sendFile(`${__dirname}/user_uploads/${request.params.file}`);
         }
         else {
             response.status(404).send("no file with that name found");
@@ -62,13 +62,12 @@ export const setup = function (router, con, server) {
         return;
     });
     
-    router.get("/avatars/*", (request, response) => {
+    router.get("/avatars/:avatar", (request, response) => {
         if (!increaseUSERCall(request, response))
             return;
         response.set('Cache-Control', 'public, max-age=2592000'); //cache it for one month-ish
-        let originalUrl = request.originalUrl.split("?").shift();
+        if (existsSync(`${__dirname}/avatars/${request.params.avatar}`)) {
-        if (existsSync(dir + originalUrl)) {
+            return response.sendFile(`${__dirname}/avatars/${request.params.avatar}`);
-            return response.sendFile(dir + originalUrl);
         }
         response.status(404).send("No avatar with that name found");
     });

routes/userfiles.js

@@ -1,17 +1,17 @@
 import ejs from "ejs"
-import LRU from "lru-cache"
+import { LRUCache as LRU } from "lru-cache"
-import {minify as min_js} from "uglify-js"
+import { minify as min_js } from "uglify-js"
 import Clean from 'clean-css';
 import Minifier from 'html-minifier-terser';
 import { web_version } from "unsafe_encrypt";
-import {existsSync, readFileSync, readFile} from "fs"
+import { existsSync, readFileSync, readFile } from "fs"
 
 export const setup = function (router, con, server) {
 
     const increaseUSERCall = server.increaseUSERCall
     const dir = server.dirname + "/"
 
-    ejs.cache = new LRU({max:20})
+    ejs.cache = new LRU({ max: 20 })
 
     const load_var_cache = new LRU({
         max: 20,
@@ -25,62 +25,66 @@ export const setup = function (router, con, server) {
         updateAgeOnHas: true
     })
 
-    function load_var(fina) {
+    function load_var(filePath) {
-        if(load_var_cache.get(fina))return load_var_cache.get(fina)
+        if (load_var_cache.has(filePath)) {
-        if(!existsSync(fina)) {
+            return load_var_cache.get(filePath);
-            console.log(1,"tried loading non-existent file",fina)
-            load_var_cache.set(fina,"")
-            return "";
-        }
-        let out = readFileSync(fina)
-        if(fina.endsWith(".js")) {
-            out = min_js(out.toString()).code
-        }
-        else if(fina.endsWith(".css")) {
-            const {
-                styles,
-            } = new Clean({}).minify(out.toString());
-            out = styles
         }
 
-        load_var_cache.set(fina,out)
+        if (!existsSync(filePath)) {
-        
+            console.log(1, 'Tried loading non-existent file', filePath);
-        return out
+            load_var_cache.set(filePath, '');
+            return '';
+        }
+
+        let output = readFileSync(filePath);
+
+        if (filePath.endsWith('.js')) {
+            output = min_js(output.toString()).code;
+        } else if (filePath.endsWith('.css')) {
+            const { styles } = new Clean({}).minify(output.toString());
+            output = styles;
+        }
+        load_var_cache.set(filePath, output);
+        return output;
     }
 
-    function get_channels(){
+    function get_channels() {
-        return new Promise(function(resolve, reject) {
+        return new Promise(function (resolve, reject) {
             let sql = `select post_receiver_name from ipost.posts where post_is_private = '0' group by post_receiver_name;`;
             con.query(sql, [], function (err, result) {
-                if (err)reject(err)
+                if (err) reject(err)
-    
+
                 let out = []
-    
+
-                for(let channel of result){
+                for (let channel of result) {
-                    if(channel.post_receiver_name === "")continue;
+                    if (channel.post_receiver_name === "") continue;
                     out[out.length] = channel.post_receiver_name
                 }
-    
+
                 resolve(out)
             });
         })
     }
 
-    const appId_Cache = new LRU({max:20,ttl: 1000 * 60 * 15}) //cache for 15 minutes
+    const appId_Cache = new LRU({ max: 20, ttl: 1000 * 60 * 15 }) //cache for 15 minutes
     function getAppWithId(appid) {
         appid = Number(appid)
-        return new Promise((res,rej) => {
+        return new Promise((res, rej) => {
-            if(appId_Cache.has(appid)) {
+            if (isNaN(appid)) {
+                res({})
+                return
+            }
+            if (appId_Cache.has(appid)) {
                 res(appId_Cache.get(appid) || {})
                 return
             }
-            con.query("SELECT * FROM ipost.application WHERE application_id=?",[appid],(err,result) => {
+            con.query("SELECT * FROM ipost.application WHERE application_id=?", [appid], (err, result) => {
-                if(err) {
+                if (err) {
                     console.error(err)
                     rej({})
                     return
                 }
-                appId_Cache.set(appid,result[0])
+                appId_Cache.set(appid, result[0])
                 res(result[0] || {})
             })
         })
@@ -97,7 +101,6 @@ export const setup = function (router, con, server) {
         getChannels: get_channels,
         encryptJS: min_js(web_version().toString()).code,
         cookiebanner: `<script id="cookieyes" type="text/javascript" src="https://cdn-cookieyes.com/client_data/3cf33f6b631f3587bf83813b/script.js" async></script>`,
-        newrelic: load_var("./extra_modules/newrelic_monitor.html"),
         getPID: server.global_page_variables.getPID,
         getDMPID: server.global_page_variables.getDMPID,
         unauthorized_description: "Chat now by creating an account on IPost",
@@ -105,22 +108,24 @@ export const setup = function (router, con, server) {
         getAppWithId: getAppWithId
     }
 
-    
+
 
     async function handleUserFiles(request, response, overrideurl) {
-        if (!increaseUSERCall(request, response))return;
+        if (!increaseUSERCall(request, response)) return;
-        if(typeof overrideurl !== "string")overrideurl = undefined;
+        if (typeof overrideurl !== "string") overrideurl = undefined;
-    
+
-        let originalUrl = overrideurl || request.originalUrl.split("?").shift();
+        let originalUrl = overrideurl
-    
+            || request.params.file
+            || request.originalUrl.split("?").shift(); //backup in case anything goes wrong
+
         let path = ""
-        if (existsSync(dir + "views" + originalUrl)) {
+        if (existsSync(dir + "views/" + originalUrl)) {
-            path = dir + "views" + originalUrl
+            path = dir + "views/" + originalUrl
             //send .txt files as plaintext to help browsers interpret it correctly
-            if(originalUrl.endsWith(".txt")) {
+            if (originalUrl.endsWith(".txt")) {
                 response.set('Content-Type', 'text/plain');
-                readFile(path,(err,data)=> {
+                readFile(path, (err, data) => {
-                    if(err)return
+                    if (err) return
                     response.send(data)
                 })
                 return
@@ -135,25 +140,26 @@ export const setup = function (router, con, server) {
         if (existsSync(dir + "views" + originalUrl + ".html")) {
             path = dir + "views" + originalUrl + ".html"
         }
-    
+
-        if(path !== "" && originalUrl !== "/favicon.ico" && originalUrl !== "/api/documentation/") {
+        if (path !== "" && originalUrl !== "favicon.ico" && originalUrl !== "api_documentation" && originalUrl !== "api_documentation.html") {
+            console.log(originalUrl)
             global_page_variables.user = { "username": response.locals.username, "bio": response.locals.bio, "avatar": response.locals.avatar }
             global_page_variables.query = request.query
-            if(originalUrl === "/authorize") {
+            if (originalUrl === "authorize") {
                 global_page_variables.application = await getAppWithId(request.query.id)
             }
-            ejs.renderFile(path,global_page_variables,{async: true},async function(err,str){
+            ejs.renderFile(path, global_page_variables, { async: true }, async function (err, str) {
                 str = await str
                 err = await err
-                if(err) {
+                if (err) {
-                    console.log(1,err)
+                    console.log(1, err)
                     response.status(500)
                     response.send("error")
                     //TODO: make error page
                     return
                 }
                 try {
-                    str = await Minifier.minify(str,{
+                    str = await Minifier.minify(str, {
                         removeComments: true,
                         removeCommentsFromCDATA: true,
                         removeCDATASectionsFromCDATA: true,
@@ -164,46 +170,51 @@ export const setup = function (router, con, server) {
                         useShortDoctype: true,
                         removeEmptyAttributes: true
                     })
-                } catch(ignored){
+                } catch (ignored) {
-                    console.log(2,"error minifying",originalUrl);
+                    console.log(2, "error minifying", originalUrl);
                 }
-    
+
                 try {
                     response.send(str)
-                } catch(err) {
+                } catch (err) {
                     console.error(err)
                 }
             })
             return;
         }
-    
+
-        if(originalUrl === "/favicon.ico") {
+        if (originalUrl === "api_documentation" || originalUrl === "api_documentation.html") {
+            response.set('Cache-Control', 'public, max-age=2592000');
+            response.set('Content-Type', 'text/html')
+            response.send(load_var("./views/api_documentation.html"))
+            return
+        }
+
+        if (originalUrl === "favicon.ico") {
             response.set('Cache-Control', 'public, max-age=2592000');
             response.sendFile(dir + "/views/favicon.ico")
             return
         }
-    
+
-        if(originalUrl === "/api/documentation/") {
+        console.log(5, "no file found", originalUrl);
-            readFile(path,function(_err,res){
-                response.send(res.toString())
-            })
-            return
-        }
-    
-        console.log(5,"no file found",originalUrl);
         try {
             response.status(404).send("No file with that name found");
-        } catch(err) {
+        } catch (err) {
             console.error(err)
         }
     }
-    
+
-    /** 
+    /**
     * Handle default URI as /index (interpreted redirect: "localhost" -> "localhost/index" )
     */
-    router.get("/", function (req, res) {
+    router.get("/", (req, res) => {
-        handleUserFiles(req,res,"/index")
+        req.params.file = "index"
+        handleUserFiles(req, res, "/index")
+    });
+
+    router.get("/:file", handleUserFiles);
+    router.get("/:folder/:file", (req, res) => {
+        req.params.file = req.params.folder + "/" + req.params.file
+        handleUserFiles(req, res)
     });
-    
-    router.get("/*", handleUserFiles);
 }

server.js

@@ -1,5 +1,3 @@
-import "newrelic"
-
 import http from "http";
 import express,{Router} from "express";
 import useragent from "express-useragent";
@@ -57,7 +55,7 @@ function log_info(level, ...info) {
         });
     }
 }
-console.log = log_info;
+//console.log = log_info;
 
 
 const hcaptcha_secret = config.hcaptcha_secret
@@ -262,6 +260,16 @@ app.use(fileUpload({
     }
 }));
 
+app.use((_req, res, next) => {
+    res.set("x-powered-by", "ipost");
+    res.set("X-Frame-Options","DENY");
+    res.set("X-XSS-Protection","1; mode=block");
+    res.set("X-Content-Type-Options","nosniff");
+    res.set("Referrer-Policy","no-referrer");
+
+    next()
+})
+
 app.use(bodyParser.default.json({ limit: "100mb" }));
 app.use(bodyParser.default.urlencoded({ limit: "100mb", extended: true }));
 app.use(cookieParser(cookiesecret));
@@ -291,20 +299,7 @@ app.use(function (_req, res, next) {
     next();
 });
 
-//auto redirect to https
+app.use("/*path", function (req, res, next) {
-app.use((req, res, next) => {
-    if (req.secure) {
-        //already secure
-        next();
-    }
-    else {
-        //redirect to https
-        res.redirect('https://' + req.headers.host + req.url);
-    }
-});
-
-app.use("/*", function (req, res, next) {
-    res.set("x-powered-by", "ipost");
     for (let i = 0; i < blocked_headers.length; i++) {
         if (req.header(blocked_headers[i]) !== undefined) {
             res.json({ "error": "we don't allow proxies on our website." });
@@ -358,6 +353,9 @@ router.get("/api/getChannels",  function (_req, res) {
             throw err;
         res.json(result);
     });
+    /* #swagger.security = [{
+        "appTokenAuthHeader": []
+    }] */
 });
 /*
 
@@ -371,21 +369,9 @@ const httpServer = http.createServer(app);
 httpServer.listen(config["ports"]["http"], function () {
     console.log(5, "HTTP Server is listening");
 });
-const privateKey = readFileSync(config["ssl"]["privateKey"]).toString();
-const certificate = readFileSync(config["ssl"]["certificate"]).toString();
-const credentials = { key: privateKey, cert: certificate };
-var httpsServer;
-
-import spdy from "spdy"
-
-httpsServer = spdy.createServer(credentials,app)
-//httpsServer = https.createServer(credentials, app);
-httpsServer.listen(config["ports"]["https"], function () {
-    console.log(5, "HTTPS Server is listening");
-});
 
 wss = new WebSocket({
-    server: httpsServer,
+    server: httpServer,
     perMessageDeflate: {
         zlibDeflateOptions: {
             chunkSize: 1024,

server_config.json

@@ -4,8 +4,8 @@
   "only_prefer_when_ip": "::ffff:127.0.0.1",
   "mysql": {
     "connections":1000,
-    "host":"localhost",
+    "host":"db",
-    "user":"root",
+    "user":"ipost",
     "password_file":"mysql_password.txt"
   },
   "cookies": {
@@ -155,12 +155,12 @@
     "level": 5
   },
   "ssl": {
-    "privateKey": "./etc/letsencrypt/live/ipost.rocks/privkey.pem",
+    "privateKey": "/etc/letsencrypt/live/ipost.rocks-0002/privkey.pem",
-    "certificate" : "./etc/letsencrypt/live/ipost.rocks/fullchain.pem"
+    "certificate" : "/etc/letsencrypt/live/ipost.rocks-0002/fullchain.pem"
   },
   "ports": {
-    "http": 9999,
+    "http": 80,
-    "https": 9998
+    "https": 443
   },
   "disallow_proxies_by_headers": true,
   "hcaptcha_secret": "0x0000000000000000000000000000000000000000",

swagger.cjs

@@ -0,0 +1,78 @@
+const fs = require('fs');
+const swaggerAutogen = require('swagger-autogen')();
+
+const doc = {
+  info: {
+    title: 'IPost API',
+    description: 'the official IPost.rocks API documentation',
+  },
+  host: 'ipost.rocks',
+  schemes: ['https'],
+  securityDefinitions: {
+    appTokenAuthHeader: {
+      type: 'apiKey',
+      in: 'header', // can be 'header', 'query' or 'cookie'
+      name: 'ipost-auth-token', // name of the header, query parameter or cookie
+      description: 'authenticate using the authentication object in the header'
+    }
+  }
+};
+
+const outputFile = './swagger-api.json';
+const tempFile = './swagger-output.json';
+const endpointsFiles = ['./server.js'];
+
+function pushdirectory(currentpath) {
+  fs.readdirSync(currentpath, {
+    withFileTypes: true
+  }).forEach(dirent => {
+    if (dirent.isFile()) {
+      endpointsFiles.push(currentpath + dirent.name);
+    } else {
+      pushdirectory(currentpath + dirent.name + "/");
+    }
+  });
+}
+
+pushdirectory("./routes/");
+
+swaggerAutogen(tempFile, endpointsFiles, doc);
+
+/*
+  Replace some error codes with own error codes, as described in error_codes.txt
+*/
+const to_replace = {
+  "401": "login error (invalid cookie)",
+  "402": "login error (bad cookie)",
+  "403": "login error (no cookie)",
+  
+  "410": "argument/data error",
+  "411": "argument/data error",
+  "412": "argument/data error",
+  "413": "argument/data error",
+  "414": "argument/data error",
+  "415": "argument/data error",
+  "416": "argument/data error",
+  "417": "argument/data error",
+  "418": "argument/data error",
+  "419": "argument/data error",
+  "420": "invalid authetication object",
+  
+}
+
+let file = JSON.parse(fs.readFileSync(tempFile, 'utf8'));
+
+for (let path in file.paths) {
+  for (let method in file.paths[path]) {
+    for (let response in file.paths[path][method].responses) {
+      if (to_replace[response]) {
+        file.paths[path][method].responses[response].description = to_replace[response];
+      }
+    }
+  }
+}
+
+file = JSON.stringify(file);
+console.log(file)
+fs.writeFileSync(outputFile, file);
+fs.rmSync(tempFile);

views/PrivacyPolicy.html

@@ -4,7 +4,7 @@
     <meta charset="utf-8">
     <title>IPost Privacy Policy</title>
     <meta name="description" content="IPosts PrivacyPolicy">
-    <%- newrelic %>
+
     <script>
       <%- warnmessagejs %>
     </script>

views/ToS.html

@@ -3,7 +3,7 @@
   <head>
     <meta charset="utf-8">
     <title>IPost Terms of Service</title>
-    <%- newrelic %>
+
     <meta name="description" content="IPosts Terms of Service">
     <script src="/js/addnavbar.js" charset="utf-8"></script>
     <script src="/js/warn_message.js" charset="utf-8"></script>

views/authorize.html

@@ -27,6 +27,7 @@
         <p>Please authorize the app "<%= application.application_name %>" to access your information:</p>
         <form action="/authorize" method="post">
             <input type="number" value=<%= query.id %> class="hidden" name="application_id" id="application_id">
+            <input type="number" value=<%= query.extra || "" %> class="hidden" name="application_extra" id="application_extra">
             <div class="h-captcha" data-sitekey="<%- hcaptcha_sitekey %>"></div>
             <input type="submit" value="Authorize">
         </form>

views/dms.html

@@ -11,7 +11,7 @@
     <% if(user.username === undefined) { %>
       <script> document.location.href = '/no_login?r='+encodeURIComponent(document.location.pathname) </script>
     <% } %>
-    <%- newrelic %>
+
     <style>
       <%- globalcss %>
       <%- loadfile("./css/posts.css") %>

views/index.html

@@ -4,7 +4,6 @@
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
 	<title>IPost</title>
   <meta name="description" content="<%-unauthorized_description%>">
-  <%- newrelic %>
   <style>
     <%- globalcss %>
     <%- loadfile("./css/logon.css") %>

views/login.html

@@ -4,7 +4,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Login | IPost</title>
     <meta name="description" content="Chat on IPost by logging in today">
-    <%- newrelic %>
+
     <link rel="stylesheet" href="/css/logon.css">
     <script src="/js/warn_message.js" charset="utf-8"></script>
     <script src="/js/addnavbar.js" charset="utf-8"></script>

views/otheruser.html

@@ -6,7 +6,7 @@
       <meta name="viewport" content="width=device-width, initial-scale=1.0">
       <title>USERS Page</title>
       <meta name="description" content="view other users pages on IPost today">
-      <%- newrelic %>
+  
       <link rel="stylesheet" href="/css/style.css">
       <link rel="stylesheet" href="/css/global.css">
       <script src="/js/addnavbar.js" charset="utf-8"></script>

views/posts.html

@@ -9,7 +9,7 @@
       <meta name="description" content="Chat on IPost now">
     <% } %>
     <title>Posts | IPost</title>
-    <%- newrelic %>
+
     <style>
       <%- globalcss %>
       <%- loadfile("./css/posts.css") %>

views/register.html

@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html lang="en" dir="ltr">
 <head>
-    <%- newrelic %>
+
     <link rel="stylesheet" href="/css/logon.css">
     <script src="/js/warn_message.js" charset="utf-8"></script>
     <script src="/js/addnavbar.js" charset="utf-8"></script>

views/search.html

@@ -10,7 +10,7 @@
     <% } else { %>
       <meta name="description" content="search IPost now">
     <% } %>
-    <%- newrelic %>
+
     <link rel="stylesheet" href="/css/search.css">
     <script type="text/javascript" src="/js/htmlescape.js"></script>
     <link rel="stylesheet" href="/css/global.css">

views/settings.html

@@ -13,7 +13,7 @@
     <% if(user.username === undefined) { %>
       <script> document.location.href = '/no_login?r='+encodeURIComponent(document.location.pathname) </script>
     <% } %>
-    <%- newrelic %>
+
     <link rel="stylesheet" href="/css/style.css">
     <link rel="stylesheet" href="/css/global.css">
     <script src="/js/addnavbar.js" charset="utf-8"></script>

views/user.html

@@ -13,7 +13,7 @@
     <% if(user.username === undefined) { %>
       <script> document.location.href = '/no_login?r='+encodeURIComponent(document.location.pathname) </script>
     <% } %>
-    <%- newrelic %>
+
     <style>
       <%- globalcss %>
       <%- loadfile("./css/style.css") %>