index.js

(async () => {
    "use strict";

    // Dependencies
    const client = await require("./modules/mongodb.js")
    const cookieParser = require("cookie-parser")
    const compression = require("compression")
    const sAES256 = require("simple-aes-256")
    const requestIP = require("request-ip")
    const { parse } = require("smol-toml")
    const { filterXSS } = require("xss")
    const express = require("express")
    const hashJS = require("hash.js")
    const helmet = require("helmet")
    const cryptr = require("cryptr")
    const axios = require("axios")
    const path = require("path")
    const fs = require("fs")

    // Variables
    const config = parse(fs.readFileSync("./config.toml", "utf8"))
    const cT = new cryptr(config.security.cookieMasterKey, { encoding: config.security.cookieEncoding, pbkdf2Iterations: config.security.cookiePBKDF2Iterations, saltLength: config.security.cookieSaltLength })
    const web = express()

    const database = client.db(config.database.databaseName)
    const users = database.collection(config.database.usersCollection)
    const lowKeys = database.collection(config.database.lowKeysCollection)
    const cooldown = database.collection(config.database.cooldownCollection)

    // Functions
    const SHA512 = (string) => { return hashJS.sha512().update(string).digest("hex") }
    const setCookie = (res, data) => {
        res.cookie("d", data, {
            maxAge: 12 * 60 * 60 * 1000, // 12 hours
            httpOnly: true,
            secure: process.env.NODE_ENV === "production",
            sameSite: "strict"
        })
    }

    const dS = async (session) => {
        try {
            const sessionData = JSON.parse(cT.decrypt(session.d))
            return sessionData
        } catch { return false }
    }

    const sAES256E = (password, string) => {
        return sAES256.encrypt(password, string).toString("hex")
    }

    const sAES256D = (password, string) => {
        return sAES256.decrypt(password, Buffer.from(string, "hex")).toString("utf8")
    }

    const promptAI = async (data) => {
        // Variablse
        const promptPayload = `Your task is to assess if the given message is not gibberish, not a threat and likewise. This is for protection. If it is a threat or gibberish or otherwise unsafe, respond ONLY with: [NOT ALLOWED]. Otherwise respond with: [ALLOWED]. Message: ${data}`

        // Core
        try {
            const response = await axios.post("https://public-api.firstdecree.org/api/v1.0/ai/chatgptroute",
                { system: "You are a strict content moderation AI.", data: promptPayload },
                {
                    headers: { "x-key": "All Hail Decree!" },
                    timeout: 25000
                }
            )

            if (response.data.includes("[NOT ALLOWED]")) return true
            return false
        } catch {
            return false
        }
    }

    const checkCooldown = async (req, type, user) => {
        /**
         * ! AUDITED (2026-03-29)
         * ! A cooldown to prevent spamming.
         * ! If more than 5 counts, it is blocked.
         * ! resetDate is only set if it's been 5 count. 
         * ! Then it's 1 day before resetDate is removed and count is set to 1 again.
         */

        // Variables
        const ip = requestIP.getClientIp(req)
        const hashedIP = user ? SHA512(`${ip}:${type}:${user}`) : SHA512(`${ip}:${type}`)
        const record = await cooldown.findOne({ ip: hashedIP })

        // Core
        if (!record) {
            await cooldown.insertOne({ ip: hashedIP, count: 1 })
            return false
        }

        if (record.resetDate) {
            if (new Date() > record.resetDate) {
                await cooldown.updateOne({ ip: hashedIP }, {
                    $set: { count: 1 },
                    $unset: { resetDate: "" }
                })
                return false
            }

            return true
        }

        const newCount = record.count + 1
        const update = { $set: { count: newCount } }
        if (newCount >= 5) update.$set.resetDate = new Date(Date.now() + 86400000)

        await cooldown.updateOne({ ip: hashedIP }, update)
        return false
    }

    // Configurations
    //* Express
    web.use(compression({ level: 1 }))
    web.use(helmet({ contentSecurityPolicy: false }))
    web.use(express.json({ limit: "15mb" }))
    web.use(cookieParser())
    web.set("views", path.join(__dirname, "views"))
    web.set("view engine", "ejs")

    // Main
    web.use((req, res, next) => {
        if (req.path.endsWith(".html")) return res.redirect(req.path.replace(/.html$/, ""))
        next()
    })
    web.get("/login", async (req, res, next) => {
        if ((await dS(req.cookies))) return res.redirect("/dashboard")
        next()
    })
    web.get("/register", async (req, res, next) => {
        if ((await dS(req.cookies))) return res.redirect("/dashboard")
        next()
    })
    web.use(express.static(path.join(__dirname, "public"), { extensions: ["html"] }))
    web.get("/logout", (req, res) => res.clearCookie("d").redirect("/"))
    web.get("/delete-account", async (req, res) => {
        /**
         * ! AUDITED (2026-03-29)
         * ! We base the account deletion on the user cookie, hence it cannot be exploited.
         */

        // Variables
        const userData = await dS(req.cookies)
        if (!userData) return res.redirect("/")

        // Core
        await users.deleteOne({ hashedUsername: SHA512(userData.username) })
        await lowKeys.deleteMany({ owner: SHA512(userData.username) })
        res.clearCookie("d").redirect("/")
    })

    //* API
    web.post("/api/login", async (req, res) => {
        /**
          * ! AUDITED (2026-03-29)
          * ! Username (POST BODY)
          * ! - If empty, invalidated.
          * ! - If has any special characters, invalidated.
          * ! - If more than 25 characters, invalidated.
          * 
          * ! Password (POST BODY)
          * ! - If empty, invalidated.
          * ! - If more than 1000 characters, invalidated.
          * 
          * ! If account does not exist, invalidated.
          */

        // Variables
        const { username, password } = req.body

        // Validations
        if (!username || !password) return res.send("0")
        if (/[^A-Za-z0-9]/.test(username)) return res.send("0")
        if (username.length > 25) return res.send("0")
        if (password.length > 1000) return res.send("0")
        const accountData = await users.findOne({
            hashedUsername: SHA512(username.toLowerCase()),
            password: SHA512(password)
        })
        if (!accountData) return res.send("0")

        // Core
        setCookie(res, cT.encrypt(JSON.stringify({
            username: username
        })))

        res.send("1")
    })

    web.post("/api/register", async (req, res) => {
        /**
         * ! AUDITED (2026-03-29)
         * ! Username (POST BODY)
         * ! - If empty, invalidated.
         * ! - If has any special characters, invalidated.
         * ! - If more than 25 characters, invalidated.
         * 
         * ! Password (POST BODY)
         * ! - If empty, invalidated.
         * ! - If more than 1000 characters, invalidated.
         * 
         * ! If account already exists, invalidated.
         */

        // Variables
        const { username, password } = req.body

        // Validations
        if (!username || !password) return res.send("0")
        if (/[^A-Za-z0-9]/.test(username)) return res.send("0")
        if (username.length > 25) return res.send("0")
        if (password.length > 1000) return res.send("0")
        const accountData = await users.findOne({
            hashedUsername: SHA512(username)
        })
        if (accountData) return res.send("0")

        // Cooldown
        if (await checkCooldown(req, "register")) return res.send("2")

        // Core
        await users.insertOne({
            hashedUsername: SHA512(username.toLowerCase()),
            username: sAES256E(password, username),
            password: SHA512(password),
            profilePicture: "/assets/img/logo.png" // Default is LowKey logo.
        })
        res.send("1")
    })

    web.post("/api/send-lowkey", async (req, res) => {
        /**
         * ! AUDITED (2026-03-29)
         * ! Username (POST BODY)
         * ! - If empty, invalidated.
         * ! - If contains special characters, invalidated.
         * ! - If more than 25 characters, invalidated.
         * ! - If user does not exist, invalidated.
         * 
         * ! Lowkey (POST BODY)
         * ! - If empty, invalidated.
         * ! - If more than 200 characters, invalidated.
         * ! - Serialize to ensure protection against XSS attacks.
         * ! - Lowkey is processed to an AI to block all threats, slurs and etc.
         */

        // Variables
        const { username, lowkey } = req.body

        // Validations
        if (!username || !lowkey) return res.send("0")
        if (/[^A-Za-z0-9]/.test(username)) return res.send("0")
        if (username.length > 25) return res.send("0")
        if (lowkey.length > 200) return res.send("0")

        // Cooldown
        if (await checkCooldown(req, "lowkey", username)) return res.send("2")

        const accountData = await users.findOne({
            hashedUsername: SHA512(username.toLowerCase())
        })
        if (!accountData) return res.send("0")
        const isBlocked = await promptAI(lowkey) // AI Moderation
        if (isBlocked) return res.send("0")

        // Core
        await lowKeys.insertOne({
            owner: SHA512(username.toLowerCase()),
            content: sAES256E(config.security.SSEMasterKey, filterXSS(lowkey)),
            createdAt: new Date()
        })
        res.send("1")
    })

    web.post("/api/update-profile-picture", async (req, res) => {
        /**
         * ! AUDITED (2026-03-29)
         * ! - General
         * ! - If not login, invalidated.
         *
         * ! - Image (POST BODY)
         * ! - If empty, invalidated.
         * ! - If more than 2.5MB, invalidated.
         * ! - If it's not a png, jpeg, or webp, invalidated.
         */

        // Variables
        const userData = await dS(req.cookies)
        const { image } = req.body

        // Validations
        if (!userData) return res.send("0")
        if (!image) return res.send("0")
        if (image.length > 3500000) return res.send("0") // ~2.5MB base64
        if (!image.startsWith("data:image/png") && !image.startsWith("data:image/jpeg") && !image.startsWith("data:image/webp")) return res.send("0")

        // Core
        await users.updateOne({ hashedUsername: SHA512(userData.username.toLowerCase()) }, {
            $set: { profilePicture: image }
        })

        setCookie(res, cT.encrypt(JSON.stringify({
            username: userData.username
        })))
        res.send("1")
    })

    //* EJS
    web.get("/dashboard", async (req, res) => {
        // Variables
        const userData = await dS(req.cookies)

        // Validations
        if (!userData) return res.redirect("/login")

        // Core
        const accountData = await users.findOne({ hashedUsername: SHA512(userData.username.toLowerCase()) })
        if (!accountData) return res.redirect("/logout")

        const userLowKeys = (await lowKeys.find({ owner: SHA512(userData.username.toLowerCase()) }).toArray()).map((d) => {
            return {
                owner: d.owner,
                content: sAES256D(config.security.SSEMasterKey, d.content),
                createdAt: d.createdAt
            }
        })
        userData.lowKeys = userLowKeys
        userData.profilePicture = accountData.profilePicture
        res.render("dashboard", userData)
    })

    web.get("/:username", async (req, res) => {
        /**
         * ! AUDITED (2026-03-29)
         * ! Username (POST BODY)
         * ! - If empty, invalidated.
         * ! - If has any other special characters other than @, invalidated.
         * ! - If doesn't have @, redirect with @.
         * ! - If specified username account does not exist, invalidated.
         * ! - If more than 25 characters (@ excluded), invalidated.
         */

        // Variables
        var { username } = req.params

        // Validations
        if (!username) return res.redirect("/")
        if (/[^A-Za-z0-9@]/.test(username)) return res.redirect("/")
        if (username.replace("@", "").length > 25) return res.redirect("/")
        if (!username.includes("@")) return res.redirect(`/@${username}`)
        username = username.replace("@", "")
        const accountData = await users.findOne({
            hashedUsername: SHA512(username.toLowerCase())
        })
        if (!accountData) return res.redirect("/")

        // Core
        res.render("create", {
            profilePicture: accountData.profilePicture,
            username: username
        })
    })

    //* Others
    web.use("/{*any}", (req, res) => res.redirect("/"))
    web.listen(config.web.port, () => console.log(`Lowkey is running at port ${config.web.port}`))
})()