Spaces:

mlmPenguin
/

SecretSwap

Sleeping

File size: 6,720 Bytes

badff6c

/*  Secret-Swap – minimal Express server with flat-file storage  */
import express from 'express';
import fs from 'fs';
import path from 'path';
import crypto from 'crypto';
import { fileURLToPath } from 'url';

const __filename = fileURLToPath(import.meta.url);
const __dirname  = path.dirname(__filename);

const USERS_FILE = path.join(__dirname, 'users.json');
const EXCH_FILE  = path.join(__dirname, 'exchanges.json');
const PORT       = process.env.PORT || 3000;

/* ---------- helpers ---------- */
const readJSON  = (f, d = {}) => (fs.existsSync(f) ? JSON.parse(fs.readFileSync(f)) : d);
const writeJSON = (f, o)      => fs.writeFileSync(f, JSON.stringify(o, null, 2));

const sessions = new Map(); // token → username
const genToken = () => crypto.randomUUID();

function hashPass(pw, salt = crypto.randomBytes(16).toString('hex')) {
  const hash = crypto.scryptSync(pw, salt, 64).toString('hex');
  return `${salt}:${hash}`;
}
function checkPass(pw, stored) {
  const [salt, ref] = stored.split(':');
  const hash = crypto.scryptSync(pw, salt, 64).toString('hex');
  return crypto.timingSafeEqual(Buffer.from(hash, 'hex'), Buffer.from(ref, 'hex'));
}

/* ---------- tiny templating ---------- */
const page = (title, body) => `<!DOCTYPE html><html><head><meta charset=utf-8><title>${title}</title><link rel="stylesheet" href="/style.css"></head><body><h1>${title}</h1>${body}</body></html>`;
const input = (n,l,t='text') => `<label>${l}: <input type="${t}" name="${n}" required></label><br>`;

/* ---------- app ---------- */
const app = express();
app.use(express.urlencoded({extended:true}));
app.use(express.static(path.join(__dirname,'public')));

app.use((req, _res, next) => {
  const token = (req.headers.cookie||'').split(';').map(c=>c.trim().split('='))[0]?.[1];
  req.user = sessions.get(token);
  req.token = token;
  next();
});
const needAuth = (req,res,next)=>req.user?next():res.redirect('/login');

/* ---------- auth ---------- */
app.get('/register', (req,res)=>res.send(page('Register',`
  <form method=post action=/register>
    ${input('username','Username')}
    ${input('password','Password','password')}
    <button>Register</button>
  </form>
  <p><a href=/login>Have an account? Login</a></p>`)));

app.post('/register',(req,res)=>{
  const {username,password}=req.body;
  const users=readJSON(USERS_FILE,{});
  if(users[username])return res.send(page('Error','<p>User exists.</p>'));
  users[username]=hashPass(password);
  writeJSON(USERS_FILE,users);
  res.redirect('/login');
});

app.get('/login',(req,res)=>res.send(page('Login',`
  <form method=post action=/login>
    ${input('username','Username')}
    ${input('password','Password','password')}
    <button>Login</button>
  </form>
  <p><a href=/register>No account? Register</a></p>`)));

app.post('/login',(req,res)=>{
  const {username,password}=req.body;
  const users=readJSON(USERS_FILE,{});
  if(!users[username]||!checkPass(password,users[username]))
    return res.send(page('Error','<p>Bad credentials.</p>'));
  const token=genToken();
  sessions.set(token,username);
  res.setHeader('Set-Cookie',`token=${token}; HttpOnly; Path=/`);
  res.redirect('/dashboard');
});

app.get('/logout',(req,res)=>{
  if(req.token) sessions.delete(req.token);
  res.setHeader('Set-Cookie','token=; Max-Age=0; Path=/');
  res.redirect('/login');
});

/* ---------- dashboard ---------- */
app.get(['/','/dashboard'],needAuth,(req,res)=>{
  const exchanges=readJSON(EXCH_FILE,{});
  const list=Object.entries(exchanges)
    .filter(([id,x])=>x.owner===req.user||x.partner===req.user)
    .map(([id,x])=>{
      const role = x.owner===req.user? 'owner':'partner';
      return `<li>[${role}] “${x.secret}” → <a href=/respond/${id}>link</a>${x.responses.length?` (${x.responses.length} reply)`:' '}</li>`;
    }).join('');
  res.send(page('Dashboard',`
    <p>Logged in as <strong>${req.user}</strong> | <a href=/logout>Logout</a></p>
    <h2>Create new secret swap</h2>
    <form method=post action=/create>
      ${input('partner','Partner username')}
      ${input('secret','Your secret')}
      <button>Create & share</button>
    </form>
    <h2>Your swaps</h2>
    <ul>${list||'<li>(none yet)</li>'}</ul>`));
});

/* ---------- create ---------- */
app.post('/create',needAuth,(req,res)=>{
  const {secret,partner}=req.body;
  const users=readJSON(USERS_FILE,{});
  if(!users[partner]) return res.send(page('Error','<p>Partner username not found.</p>'));
  const exchanges=readJSON(EXCH_FILE,{});
  const id=crypto.randomUUID();
  exchanges[id]={id,owner:req.user,partner,secret,responses:[]};
  writeJSON(EXCH_FILE,exchanges);
  const host=req.headers.host;
  res.send(page('Swap created',`
    <p>Send this link to <strong>${partner}</strong>:</p>
    <p><a href=/respond/${id}>http://${host}/respond/${id}</a></p>
    <p><a href=/dashboard>Return to dashboard</a></p>`));
});

/* ---------- respond ---------- */
app.get('/respond/:id',needAuth,(req,res)=>{
  const ex=readJSON(EXCH_FILE,{})[req.params.id];
  if(!ex) return res.send(page('Error','<p>Swap not found.</p>'));
  if(req.user!==ex.partner && req.user!==ex.owner)
    return res.send(page('Forbidden','<p>You are not part of this swap.</p>'));
  if(req.user===ex.owner)
    return res.redirect(`/view/${req.params.id}`);
  const done=ex.responses.some(r=>r.from===req.user);
  if(done) return res.redirect(`/view/${req.params.id}`);
  res.send(page('Respond to secret',
    `<p>Original secret will be revealed after you submit yours.</p>
     <form method=post action=/respond/${req.params.id}>
       ${input('response','Your secret')}
       <button>Submit</button>
     </form>`));
});

app.post('/respond/:id',needAuth,(req,res)=>{
  const data=readJSON(EXCH_FILE,{});
  const ex=data[req.params.id];
  if(!ex||req.user!==ex.partner) return res.send(page('Error','<p>Not allowed.</p>'));
  ex.responses.push({from:req.user,secret:req.body.response});
  writeJSON(EXCH_FILE,data);
  res.send(page('Secret revealed',`<p>Original secret from ${ex.owner}: <strong>${ex.secret}</strong></p>
    <p><a href=/dashboard>Back to dashboard</a></p>`));
});

/* ---------- view (owner) ---------- */
app.get('/view/:id',needAuth,(req,res)=>{
  const ex=readJSON(EXCH_FILE,{})[req.params.id];
  if(!ex||req.user!==ex.owner) return res.send(page('Error','<p>Not allowed.</p>'));
  const list=ex.responses.map(r=>`<li>${r.from}: ${r.secret}</li>`).join('')||'<li>(no response yet)</li>';
  res.send(page('Swap responses',`
    <p>Your secret: <strong>${ex.secret}</strong></p>
    <ul>${list}</ul>
    <p><a href=/dashboard>Back to dashboard</a></p>`));
});

/* ---------- start ---------- */
app.listen(PORT,()=>console.log(`Secret-Swap listening on ${PORT}`));