@@ -1678,8 +1855,22 @@ function showRenameNestModal(nestId, currentName) {
`;
overlay.style.display = 'flex';
+ const logoInput = $a('#modal-edit-nest-logo');
+ logoInput?.addEventListener('input', () => {
+ const preview = $a('#modal-nest-logo-preview');
+ const img = preview?.querySelector('img');
+ if (logoInput.value) {
+ if (preview) preview.style.display = 'block';
+ if (img) img.src = logoInput.value;
+ } else {
+ if (preview) preview.style.display = 'none';
+ }
+ });
+
$a('#btn-confirm-rename-nest')?.addEventListener('click', async () => {
const name = $a('#modal-rename-nest-name').value.trim();
+ const logo = $a('#modal-edit-nest-logo').value.trim() || null;
+ const description = $a('#modal-edit-nest-description').value.trim() || null;
if (!name) {
const err = $a('#rename-nest-error');
if (err) { err.textContent = 'Name is required'; err.style.display = 'block'; }
@@ -1693,7 +1884,7 @@ function showRenameNestModal(nestId, currentName) {
try {
await adminApi(`/settings/nests/${nestId}`, {
method: 'PUT',
- body: JSON.stringify({ name }),
+ body: JSON.stringify({ name, logo, description }),
});
closeAdminModal();
renderAdminEggsSettings();
@@ -1774,10 +1965,24 @@ window.addEventListener('popstate', () => {
$a('#admin-page-server-detail')?.classList.add('active');
$a('#admin-page-servers')?.classList.remove('active');
renderAdminServerDetail(pid);
+ const tab = pathParts[2];
+ if (tab) {
+ setTimeout(() => {
+ const tabBtn = document.querySelector('#admin-server-tabs .tab[data-tab="' + tab + '"]');
+ if (tabBtn) tabBtn.click();
+ }, 50);
+ }
} else if (basePage === 'user' && param) {
const uid = parseInt(param, 10);
$a('#admin-page-user-detail')?.classList.add('active');
renderAdminUserDetail(uid);
+ const tab = pathParts[2];
+ if (tab) {
+ setTimeout(() => {
+ const tabBtn = document.querySelector('#admin-user-tabs .tab[data-tab="' + tab + '"]');
+ if (tabBtn) tabBtn.click();
+ }, 50);
+ }
} else if (basePage === 'users') {
adminNavigateTo('users');
} else if (basePage === 'dashboard' || !basePage || basePage === 'login') {
diff --git a/public/js/app.js b/public/js/app.js
index f355db2..07bf82a 100644
--- a/public/js/app.js
+++ b/public/js/app.js
@@ -1,2705 +1,3070 @@
-function initIcons() { if (window.lucide) lucide.createIcons(); }
-
-const API_BASE = window.location.origin;
-
-const state = {
- user: null,
- token: localStorage.getItem('zh_token'),
- currentPage: 'overview',
- servers: [],
- rgpdConsent: JSON.parse(localStorage.getItem('zh_rgpd_consent') || 'null'),
- serverDetailTab: 'info',
- notifications: [],
- unreadCount: 0,
- notifPanelOpen: false,
-};
-
-function setRgpdConsent(preferences) {
- state.rgpdConsent = preferences;
- localStorage.setItem('zh_rgpd_consent', JSON.stringify(preferences));
-}
-
-function renderCookieBanner() {
- if (state.rgpdConsent) return;
- const existing = document.getElementById('cookie-consent-banner');
- if (existing) return;
- const banner = document.createElement('div');
- banner.id = 'cookie-consent-banner';
- banner.className = 'cookie-banner';
- banner.innerHTML = `
-
-
- We use cookies for authentication and security (Cap). No tracking or advertising cookies are used.
- For more information, read our privacy policy.
-
-
-
-
-
-
- `;
- document.body.appendChild(banner);
-
- document.getElementById('cookie-essential-btn').addEventListener('click', () => {
- setRgpdConsent({ essential: true, analytics: false, timestamp: new Date().toISOString() });
- banner.remove();
- });
- document.getElementById('cookie-accept-all-btn').addEventListener('click', () => {
- setRgpdConsent({ essential: true, analytics: true, timestamp: new Date().toISOString() });
- banner.remove();
- });
-}
-
-const PTERO_URL = 'https://panel.zero-host.org';
-
-function openPyrodactylPanel(serverIdentifier) {
- const url = `${PTERO_URL}${serverIdentifier ? '/server/' + serverIdentifier : ''}`;
- window.open(url, '_blank');
-}
-
-async function sendPowerCommand(identifier, signal, event) {
- const btn = event?.target;
- if (btn) {
- btn.disabled = true;
- btn.innerHTML = '
';
- }
- try {
- await api(`/servers/power/${identifier}`, { method: 'POST', body: JSON.stringify({ signal }) });
- } catch (err) {
- const overlay = $('#modal-overlay');
- const content = $('#modal-content');
- content.innerHTML = html`
-
Command Failed
-
-
-
Failed to send ${signal} command:
-
${err.message}
-
-
-
-
- `;
- overlay.classList.add('open');
- } finally {
- if (btn) {
- btn.disabled = false;
- btn.textContent = signal.charAt(0).toUpperCase() + signal.slice(1);
- }
- }
-}
-
-function $(sel) { return document.querySelector(sel); }
-function md5(s) {
- function F(x,y,z) { return (x & y) | (~x & z); }
- function G(x,y,z) { return (x & z) | (y & ~z); }
- function H(x,y,z) { return x ^ y ^ z; }
- function I(x,y,z) { return y ^ (x | ~z); }
- function rol(x,n) { return (x << n) | (x >>> (32 - n)); }
- function add(x,y) { return (x + y) >>> 0; }
- function toHex(n) { let h=''; for(let i=0;i<4;i++) h+=((n>>(i*8))&0xFF).toString(16).padStart(2,'0'); return h; }
- const T = new Array(64);
- for(let i=1;i<=64;i++) T[i-1] = Math.floor(Math.abs(Math.sin(i)) * 0x100000000) >>> 0;
- const s_ = [7,12,17,22,5,9,14,20,4,11,16,23,6,10,15,21];
- const S = (function(){ const r=[]; for(let i=0;i<64;i++) r[i]=s_[(i>>3<<2)+(i%4)]; return r; })();
- const K = [0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3];
- s = unescape(encodeURIComponent(s));
- const len = s.length;
- const msg = []; for(let i=0;i
>(8-(i%2)*8))&0xFF);
- const bitLen = len * 8;
- msg.push(0x80);
- while((msg.length+8)%64!=0) msg.push(0);
- for(let i=0;i<8;i++) msg.push((bitLen>>>(i*8))&0xFF);
- let h0=0x67452301,h1=0xEFCDAB89,h2=0x98BADCFE,h3=0x10325476;
- for(let i=0;i acc + str + (values[i] ?? ''), '');
-}
-
-async function api(path, options = {}) {
- const headers = { 'Content-Type': 'application/json', ...options.headers };
- if (state.token) {
- headers['Authorization'] = `Bearer ${state.token}`;
- }
- let res;
- try {
- res = await fetch(`${API_BASE}/api${path}`, { ...options, headers });
- } catch {
- throw new Error('Unable to reach the server. Please check your connection and try again.');
- }
- const text = await res.text();
- let data;
- try {
- data = JSON.parse(text);
- } catch {
- throw new Error('Server error: please try again in a few moments.');
- }
- if (res.status === 403 && data.error === 'Invalid or expired token') {
- state.token = null;
- state.user = null;
- localStorage.removeItem('zh_token');
- localStorage.removeItem('zh_user');
- navigateTo('login');
- throw new Error('Session expired. Please sign in again.');
- }
- if (!res.ok) throw new Error(data.error || 'Request failed');
- return data;
-}
-
-function showToast(message, type = 'success') {
- const container = $('#toast-container') || (() => {
- const el = document.createElement('div');
- el.id = 'toast-container';
- el.className = 'toast-container';
- document.body.appendChild(el);
- return el;
- })();
-
- const toast = document.createElement('div');
- toast.className = `toast toast-${type}`;
- toast.textContent = message;
- container.appendChild(toast);
- setTimeout(() => toast.remove(), 4000);
-}
-
-function showError(form, message) {
- const errorEl = form.querySelector('.auth-error');
- if (errorEl) {
- errorEl.textContent = message;
- errorEl.classList.add('show');
- }
-}
-
-function hideError(form) {
- const errorEl = form.querySelector('.auth-error');
- if (errorEl) errorEl.classList.remove('show');
-}
-
-const NOTIF_ICONS = {
- success: '',
- error: '',
- warning: '',
- info: '',
-};
-
-function timeAgo(dateStr) {
- const diff = Date.now() - new Date(dateStr).getTime();
- const minutes = Math.floor(diff / 60000);
- if (minutes < 1) return 'just now';
- if (minutes < 60) return minutes + 'm ago';
- const hours = Math.floor(minutes / 60);
- if (hours < 24) return hours + 'h ago';
- const days = Math.floor(hours / 24);
- if (days < 7) return days + 'd ago';
- return new Date(dateStr).toLocaleDateString();
-}
-
-async function fetchUnreadCount() {
- try {
- const data = await api('/notifications/unread-count');
- state.unreadCount = data.count;
- updateNotifBadge();
- } catch {}
-}
-
-async function fetchNotifications() {
- try {
- const data = await api('/notifications');
- state.notifications = data.notifications;
- renderNotifications();
- } catch {}
-}
-
-function renderNotifications() {
- const list = $('#notif-panel-list');
- if (!list) return;
- if (state.notifications.length === 0) {
- list.innerHTML = 'No notifications yet
';
- return;
- }
- list.innerHTML = state.notifications.map(n => html`
-
-
${NOTIF_ICONS[n.type] || NOTIF_ICONS.info}
-
-
${n.title}
-
${n.message}
-
${timeAgo(n.created_at)}
-
- ${n.is_read ? '' : '
'}
-
-
-
-
-
ZeroHost
-
-
Welcome back
-
Sign in to your dashboard
-
-
-
-
-
-
-
-
ZeroHost
-
-
Create account
-
Start hosting for free
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Account Restricted — Your account has been restricted. You cannot create or renew servers.
-
-
-
-
-
-
-
-
-
-
- ${data.pteroError}
-
- `);
- }
-
- $('#stat-total').textContent = data.totalServers;
- $('#stat-active').textContent = data.activeServers;
- const limit = data.serverLimit || 3;
- $('#stat-slots').textContent = data.totalServers + '/' + limit;
- const toRenew = data.servers.filter(s => {
- const meta = s.serverMeta;
- if (!meta) return false;
- return new Date(meta.expires_at) <= new Date();
- }).length;
- $('#stat-renew').textContent = toRenew;
- state.servers = data.servers;
-
- if (data.servers.length === 0 && !data.pteroError) {
- $('#recent-servers-list').innerHTML = html`
-
-
-
No servers yet
-
Create your first server to get started
-
-
- ${data.servers.slice(0, 6).map(s => renderServerCard(s)).join('')}
-
- `;
- }
-
- } catch (err) {
- $('#recent-servers-list').innerHTML = html`
- Failed to load: ${err.message}
- `;
- }
-
- initIcons();
-}
-
-let activityIcons = {
- server_created: '',
- server_renewed: '',
- server_renamed: '',
- server_reinstalled: '',
- server_deleted: '',
- account_registered: '',
- password_changed: '',
- email_changed: '',
- account_deleted: '',
- api_key_updated: '',
- avatar_updated: '',
- admin_suspend: '',
- admin_unsuspend: '',
- admin_renew_now: '',
-};
-
-function formatRelativeTime(dateStr) {
- const diff = Date.now() - new Date(dateStr).getTime();
- const mins = Math.floor(diff / 60000);
- if (mins < 1) return 'just now';
- if (mins < 60) return mins + 'm ago';
- const hours = Math.floor(mins / 60);
- if (hours < 24) return hours + 'h ago';
- const days = Math.floor(hours / 24);
- if (days < 7) return days + 'd ago';
- return formatDate(dateStr);
-}
-
-function getActionLabel(action) {
- const labels = {
- server_created: 'Created server',
- server_renewed: 'Renewed server',
- server_renamed: 'Renamed server',
- server_reinstalled: 'Reinstalled server',
- server_deleted: 'Deleted server',
- account_registered: 'Account created',
- password_changed: 'Password changed',
- email_changed: 'Email changed',
- account_deleted: 'Account deleted',
- api_key_updated: 'API key updated',
- avatar_updated: 'Profile picture updated',
- admin_suspend: 'Server suspended (Admin)',
- admin_unsuspend: 'Server unsuspended (Admin)',
- admin_renew_now: 'Server force-renewed (Admin)',
- };
- return labels[action] || action;
-}
-
-async function renderLog(pageNum) {
- const el = $('#page-logs');
- pageNum = pageNum || 1;
- const limit = 50;
- const offset = (pageNum - 1) * limit;
-
- el.innerHTML = html`
-
-
- `;
-
- try {
- const data = await api(`/activity?limit=${limit}&offset=${offset}`);
- const list = $('#log-list');
-
- if (data.activities.length === 0) {
- list.innerHTML = 'No activity found.
';
- return;
- }
-
- const pageInfo = data.totalPages > 1 ? html`
-
- ` : '';
-
- list.innerHTML = html`
- ${pageInfo}
-
- ${data.activities.map(a => html`
-
-
${activityIcons[a.action] || ''}
-
-
${getActionLabel(a.action)}
-
${a.details || ''}
-
-
${formatRelativeTime(a.created_at)}
-
- `).join('')}
-
Could not load activity log.
';
- }
-}
-
-function formatDate(d) {
- if (!d) return 'N/A';
- const date = new Date(d);
- return date.toLocaleDateString('en-GB', { day: 'numeric', month: 'short', year: 'numeric' });
-}
-
-function daysRemaining(expiresAt) {
- if (!expiresAt) return null;
- const diff = new Date(expiresAt) - new Date();
- return Math.ceil(diff / (1000 * 60 * 60 * 24));
-}
-
-function renderServerCard(s) {
- const eggName = s.eggDetails?.name || `Egg #${s.egg}`;
- const alloc = s.allocationDetails;
- const isInstalling = s.status === 'installing' || s.installed === 0 || s.installed === '0' || s.installed === false;
- const isSuspended = s.status === 'suspended';
- const meta = s.serverMeta;
- const days = meta ? daysRemaining(meta.expires_at) : null;
- const canRenew = days !== null && days <= 7 && days >= -7;
- const isAdminSuspended = isSuspended && meta?.suspended_by === 'admin';
- const isExpiredRenewable = isSuspended && canRenew && !isAdminSuspended;
- const statusClass = isAdminSuspended ? 'status-suspended' : (isExpiredRenewable ? 'status-expired' : (isInstalling ? 'status-installing' : 'status-active'));
- const statusLabel = isAdminSuspended ? 'Suspended' : (isExpiredRenewable ? 'Expired' : (isInstalling ? 'Installing' : 'Active'));
- const allocStr = alloc ? `${alloc.alias || alloc.nodeFqdn || alloc.ip}:${alloc.port}` : (s.nodeFqdn || `Node #${s.node}`);
- const expClass = days !== null && days <= 0 ? 'expired' : (days !== null && days <= 7 ? 'expiring' : '');
- return html`
-
-
- ${s.name}
- ${statusLabel}
-
-
- ${eggName}
- ${allocStr}
-
-
- ${meta ? html`
-
- Expires: ${formatDate(meta.expires_at)}
- ${days !== null ? html`(${days > 0 ? days + ' days' : 'Expired'})` : ''}
-
- ` : ''}
-
-
- ${canRenew && !isAdminSuspended ? html`
-
- ` : ''}
-
-
- | ${s.name} |
- ${eggName} |
- ${allocStr} |
-
- ${statusLabel}
- |
-
-
- Settings
-
- ${canRenew && !isAdminSuspended ? html`
-
- ` : ''}
- |
-
- `;
-}
-
-// ===== SERVERS PAGE =====
-async function renderServers() {
- const el = $('#page-servers');
- el.innerHTML = html`
-
-
-
-
-
-
- | Name |
- Egg |
- Allocation |
- Status |
- Actions |
-
-
-
- | Loading... |
-
-
-
-
-
No servers yet
-
Create your first server to get started
-
-
| No servers match your search. |
- `;
- }
- }
-
- $('#server-search-input').addEventListener('input', applyFilters);
-
- document.querySelectorAll('#server-filters .filter-btn').forEach(btn => {
- btn.addEventListener('click', () => {
- document.querySelectorAll('#server-filters .filter-btn').forEach(b => b.classList.remove('active'));
- btn.classList.add('active');
- applyFilters();
- });
- });
-
- applyFilters();
- } catch (err) {
- $('#servers-table-body').innerHTML = html`
- | Error: ${err.message} |
- `;
- }
-
- initIcons();
-}
-
-// ===== CREATE SERVER =====
-let eggCache = [];
-
-async function renderCreateServer() {
- const el = $('#page-create');
- el.innerHTML = html`
-
-
- `;
-
- $('#custom-egg-trigger').addEventListener('click', e => {
- e.stopPropagation();
- $('#custom-egg-dropdown').classList.toggle('open');
- });
- document.addEventListener('click', function closeSelect(e) {
- if (!e.target.closest('.custom-select')) {
- $('#custom-egg-dropdown')?.classList.remove('open');
- }
- });
- $('#create-server-form').addEventListener('submit', handleCreateServer);
-
- try {
- const data = await api('/servers/eggs');
- eggCache = data.eggs;
- const dropdown = $('#custom-egg-dropdown');
- const grouped = {};
- for (const e of data.eggs) {
- if (!grouped[e.nestId]) grouped[e.nestId] = { name: e.nestName, eggs: [] };
- grouped[e.nestId].eggs.push(e);
- }
- let htmlStr = '';
- for (const nestId of Object.keys(grouped).sort()) {
- htmlStr += `${grouped[nestId].name || `Nest ${nestId}`}
`;
- for (const e of grouped[nestId].eggs) {
- htmlStr += `${e.name}
`;
- }
- }
- dropdown.innerHTML = htmlStr;
- dropdown.querySelectorAll('.custom-select-option').forEach(opt => {
- opt.addEventListener('click', () => {
- $('#custom-egg-label').textContent = opt.textContent;
- $('#custom-egg-trigger').dataset.value = opt.dataset.value;
- dropdown.classList.remove('open');
- handleEggChange();
- });
- });
- } catch (err) {
- $('#custom-egg-label').textContent = 'Failed to load eggs';
- $('#custom-egg-trigger').disabled = true;
- showToast('Could not load eggs: ' + err.message, 'error');
- }
-
- initIcons();
-}
-
-function handleEggChange() {}
-
-async function handleCreateServer(e) {
- e.preventDefault();
- const btn = $('#create-btn');
- btn.disabled = true;
- btn.innerHTML = ' Creating...';
-
- const name = $('#create-name').value.trim();
- const eggVal = $('#custom-egg-trigger').dataset.value;
- if (!name || !eggVal) {
- showToast('Please fill in all fields', 'error');
- btn.disabled = false;
- btn.innerHTML = 'Create Server';
- return;
- }
- if (name.length < 1 || name.length > 255) {
- showToast('Server name must be between 1 and 255 characters', 'error');
- btn.disabled = false;
- btn.innerHTML = 'Create Server';
- return;
- }
-
- const [eggId, nestId] = eggVal.split(',').map(Number);
- const environment = {};
-
- try {
- const capToken = document.querySelector('[name="cap-token"]')?.value || '';
- await api('/servers/create', {
- method: 'POST',
- body: JSON.stringify({ name, nestId, eggId, environment, capToken }),
- });
- showToast(`Server "${name}" created successfully!`, 'success');
- navigateTo('servers');
- } catch (err) {
- showToast(err.message, 'error');
- } finally {
- btn.disabled = false;
- btn.innerHTML = 'Create Server';
- }
-}
-
-// ===== PYRODACTYL PAGE =====
-function renderPyrodactyl() {
- const el = $('#page-pyrodactyl');
- el.innerHTML = html`
-
-
-
-
-
-
-
Opening Pyrodactyl...
-
- Click the button below to open the Pyrodactyl panel.
-
-
-
-
-
-
-
-
-
-
-
-
- `;
-
- $('#account-menu-edit').addEventListener('click', () => navigateTo('account/edit'));
- $('#account-menu-logs').addEventListener('click', () => navigateTo('logs'));
- $('#account-menu-dangerous').addEventListener('click', () => navigateTo('account/dangerous'));
- $('#account-menu-logout').addEventListener('click', async () => {
- initIcons();
- try { await api('/auth/logout', { method: 'POST' }); } catch {}
- state.token = null;
- state.user = null;
- localStorage.removeItem('zh_token');
- localStorage.removeItem('zh_user');
- navigateTo('login');
- });
-}
-
-function renderAccountEdit() {
- const el = $('#page-account');
- el.innerHTML = html`
-
-
-
-
Profile Picture
-
-
-
})
-
${state.user?.username?.[0]?.toUpperCase() || 'U'}
-
-
-
- Upload a profile picture. Supported formats: PNG, JPEG, GIF, WebP. Max size: 2MB.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Pyrodactyl API Key
-
- Add your Pyrodactyl Client API key to enable live resource monitoring and server power state detection directly in the dashboard.
- Generate one at panel.zero-host.org/account/api.
-
-
-
-
-
- Your Pyrodactyl API key is saved and active.
-
-
-
-
-
-
Modify API Key
-
- Enter your new Pyrodactyl API key. The old key will be replaced.
-
-
-
-
-
-
-
-
-
- `;
- overlay.classList.add('open');
- $('#confirm-modify-api-key-btn').addEventListener('click', handleConfirmModifyApiKey);
-}
-
-function handleDeleteApiKey() {
- const overlay = $('#modal-overlay');
- const content = $('#modal-content');
- content.innerHTML = html`
- Delete API Key
-
- Are you sure you want to delete your Pyrodactyl API key? Live resource monitoring and power state detection will stop working.
-
-
-
-
-
- `;
- overlay.classList.add('open');
- $('#confirm-delete-api-key-btn').addEventListener('click', handleConfirmDeleteApiKey);
-}
-
-async function handleConfirmModifyApiKey() {
- const btn = $('#confirm-modify-api-key-btn');
- const input = $('#modal-api-key-input');
- const key = input.value.trim();
-
- if (!key) {
- showToast('Please enter an API key', 'error');
- return;
- }
-
- btn.disabled = true;
- btn.innerHTML = '';
-
- try {
- await api('/servers/client-api-key', {
- method: 'PUT',
- body: JSON.stringify({ apiKey: key }),
- });
- $('#modal-overlay').classList.remove('open');
- showToast('Pyrodactyl API key updated', 'success');
- renderApiKeySaved();
- } catch (err) {
- showToast(err.message, 'error');
- } finally {
- btn.disabled = false;
- btn.innerHTML = 'Save';
- }
-}
-
-async function handleConfirmDeleteApiKey() {
- const btn = $('#confirm-delete-api-key-btn');
- btn.disabled = true;
- btn.innerHTML = '';
-
- try {
- await api('/servers/client-api-key', {
- method: 'DELETE',
- });
- $('#modal-overlay').classList.remove('open');
- showToast('Pyrodactyl API key deleted', 'success');
- renderApiKeyForm();
- } catch (err) {
- showToast(err.message, 'error');
- } finally {
- btn.disabled = false;
- btn.innerHTML = 'Delete';
- }
-}
-
-async function handleChangeEmail(e) {
- e.preventDefault();
- const btn = $('#change-email-btn');
- btn.disabled = true;
- btn.innerHTML = '';
- try {
- const newEmail = $('#acc-new-email').value.trim();
- const password = $('#acc-email-pw').value;
- if (!newEmail || !password) {
- showToast('Please fill in all fields', 'error');
- return;
- }
- const data = await api('/auth/change-email', {
- method: 'POST',
- body: JSON.stringify({ newEmail, password }),
- });
- state.token = data.token;
- state.user = data.user;
- localStorage.setItem('zh_token', data.token);
- localStorage.setItem('zh_user', JSON.stringify(data.user));
- $('#acc-new-email').placeholder = newEmail;
- $('#acc-new-email').value = '';
- $('#acc-email-pw').value = '';
- showToast('Email updated successfully', 'success');
- } catch (err) {
- showToast(err.message, 'error');
- } finally {
- btn.disabled = false;
- btn.innerHTML = 'Change Email';
- }
-}
-
-async function handleChangePassword(e) {
- e.preventDefault();
- const btn = $('#change-pw-btn');
- const currentPw = $('#acc-current-pw').value;
- const newPw = $('#acc-new-pw').value;
- const confirmPw = $('#acc-confirm-pw').value;
-
- if (!currentPw || !newPw || !confirmPw) {
- showToast('Please fill in all fields', 'error');
- return;
- }
-
- if (newPw.length < 8) {
- showToast('New password must be at least 8 characters', 'error');
- return;
- }
-
- if (newPw !== confirmPw) {
- showToast('New passwords do not match', 'error');
- return;
- }
-
- btn.disabled = true;
- btn.innerHTML = ' Updating...';
-
- try {
- await api('/auth/change-password', {
- method: 'POST',
- body: JSON.stringify({ currentPassword: currentPw, newPassword: newPw }),
- });
- showToast('Password changed successfully', 'success');
- $('#change-password-form').reset();
- } catch (err) {
- showToast(err.message, 'error');
- } finally {
- btn.disabled = false;
- btn.innerHTML = 'Change Password';
- }
-}
-
-function renderDangerous() {
- const el = $('#page-account');
- el.innerHTML = html`
-
-
-
-
Delete Account
-
- This action is irreversible. All your servers will be deleted and your account will be permanently removed.
-
-
-
-
-
-
Data Export (RGPD)
-
- Under Article 15 and 20 of the RGPD, you have the right to access and port your personal data. Click below to download a copy of all data we hold about you.
-
-
-
-
Delete Account
-
- This will permanently delete your account ${state.user?.username || ''} and all associated servers. This cannot be undone.
-
-
-
-
-
-
-
-
-
- `;
- overlay.classList.add('open');
-
- document.getElementById('confirm-delete-acc-btn').addEventListener('click', handleConfirmDeleteAccount);
-}
-
-async function handleConfirmDeleteAccount() {
- const password = $('#delete-acc-pw').value;
- if (!password) {
- showToast('Please enter your password', 'error');
- return;
- }
-
- const btn = $('#confirm-delete-acc-btn');
- btn.disabled = true;
- btn.innerHTML = ' Deleting...';
-
- try {
- await api('/auth/delete-account', {
- method: 'POST',
- body: JSON.stringify({ password }),
- });
- $('#modal-overlay').classList.remove('open');
- showToast('Account deleted. Redirecting...', 'success');
- state.token = null;
- state.user = null;
- localStorage.removeItem('zh_token');
- localStorage.removeItem('zh_user');
- setTimeout(() => navigateTo('login'), 1500);
- } catch (err) {
- showToast(err.message, 'error');
- btn.disabled = false;
- btn.innerHTML = 'Delete Forever';
- }
-}
-
-// ===== SERVER DETAIL PAGE =====
-async function renderServerDetail(serverId) {
- const el = $('#page-server-detail');
-
- try {
- const data = await api(`/servers/details/${serverId}`);
- const s = data.server;
- state.serverIdentifier = s.identifier;
- const meta = s.serverMeta;
- const eggName = s.eggDetails?.name || `Egg #${s.egg}`;
- const alloc = s.allocationDetails;
- const allocStr = alloc ? `${alloc.alias || alloc.nodeFqdn || alloc.ip}:${alloc.port}` : (s.nodeFqdn || `Node #${s.node}`);
- const isInstalling = s.status === 'installing' || s.installed === 0 || s.installed === '0' || s.installed === false;
- const isSuspended = s.status === 'suspended';
- const days = meta ? daysRemaining(meta.expires_at) : null;
- const canRenew = days !== null && days <= 7 && days >= -7;
- const isAdminSuspended = isSuspended && meta?.suspended_by === 'admin';
- const isExpiredRenewable = isSuspended && canRenew && !isAdminSuspended;
- const statusClass = isAdminSuspended ? 'status-suspended' : (isExpiredRenewable ? 'status-expired' : (isInstalling ? 'status-installing' : 'status-active'));
- const statusLabel = isAdminSuspended ? 'Suspended' : (isExpiredRenewable ? 'Expired' : (isInstalling ? 'Installing' : 'Active'));
- const expClass = days !== null && days <= 0 ? 'expired' : (days !== null && days <= 7 ? 'expiring' : '');
-
- const activeTab = state.serverDetailTab || 'info';
-
- el.innerHTML = html`
-
-
- ${isAdminSuspended && meta?.suspend_reason ? html`
-
-
Server Suspended
-
${meta.suspend_reason}
-
-
Server Expired
-
This server has expired. Renew it to reactivate it instantly.
-
-
-
-
-
-
-
-
-
Server Info
-
-
Egg${eggName}
-
Allocation${allocStr}
-
IO${s.limits.io}
-
Swap${s.limits.swap > 0 ? s.limits.swap + ' MB' : 'Disabled'}
-
Identifier${s.identifier}
-
-
-
-
-
Resources
-
-
-
${s.limits.memory > 0 ? s.limits.memory + ' MB' : 'โ'}
-
Memory
-
-
${s.limits.memory > 0 ? '512 MB max' : 'No limit'}
-
-
-
${s.limits.cpu}%
-
CPU
-
-
50% max
-
-
-
${s.limits.disk > 0 ? (s.limits.disk / 1024).toFixed(1) + ' GB' : 'โ'}
-
Disk
-
-
3 GB max
-
-
-
-
-
-
Lifetime
- ${meta ? html`
-
-
Created${formatDate(meta.created_at)}
-
Expires${formatDate(meta.expires_at)} ${days !== null ? '(' + (days > 0 ? days + ' days' : 'Expired') + ')' : ''}
-
Status${isExpiredRenewable ? 'expired' : meta.status}
- ${isAdminSuspended && meta.suspend_reason ? html`
-
Reason${meta.suspend_reason}
- ` : ''}
-
- ${canRenew && !isAdminSuspended ? html`
-
- ` : html`
- ${days < -7 ? html`
This server has expired. Contact support to renew.
` : ''}
- ${days > 7 ? html`
Renewal available within 7 days of expiration.
` : ''}
- `}
- ` : html`
-
No lifetime data available for this server.
- `}
-
-
-
-
-
-
Live Resource Usage
-
-
-
-
Fetching live data...
-
-
-
- ${isAdminSuspended ? html`
-
-
-
Server Suspended
-
This server has been suspended by an administrator. No actions are available.
-
Please contact support via Discord for assistance.
-
- ` : isExpiredRenewable ? html`
-
-
-
Server Expired
-
This server has expired. Renew it to reactivate it instantly and get 90 more days.
-
-
- ` : isSuspended ? html`
-
-
-
Server Expired
-
This server has been expired for too long. Please contact support to renew.
-
Reach out via Discord for assistance.
-
- ` : html`
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- `}
-
-
-
Server not found
-
${err.message}
-
-
-
No live data
-
- ${data.error || 'Add your Pyrodactyl API key in Account โ Linked Accounts to enable live monitoring.'}
-
-
-
-
-
${cpuPct}%
-
CPU
-
-
${cpuPct >= 80 ? 'High load' : cpuPct >= 50 ? 'Moderate' : 'Idle'}
-
-
-
${memUsed} / ${memLimit} MB
-
Memory
-
-
${memPct}% used
-
-
-
${(diskUsed / 1024).toFixed(1)} / ${(diskLimit / 1024).toFixed(1)} GB
-
Disk
-
-
${diskPct}% used
-
-
- Updated ${formatRelativeTime(new Date().toISOString())} ยท
- ${currentState ? html`Status: ${currentState}` : ''}
-
- `;
-
- const refreshBtn = $('#refresh-resources-btn');
- if (refreshBtn && !refreshBtn.dataset.listenerAttached) {
- refreshBtn.dataset.listenerAttached = '1';
- refreshBtn.addEventListener('click', () => {
- container.innerHTML = ' Fetching live data...
';
- fetchLiveResources(identifier);
- });
- }
-
- } catch (err) {
- if (container) {
- container.innerHTML = html`
-
- Could not load live resources: ${err.message}
-
- `;
- }
- }
-}
-
-// ===== TAB SWITCHING =====
-function switchTab(tabBtn) {
- if (!$('#tab-indicator')) return;
- const tabName = tabBtn.dataset.tab;
- state.serverDetailTab = tabName;
-
- document.querySelectorAll('#server-detail-tabs .tab').forEach(t => t.classList.remove('active'));
- tabBtn.classList.add('active');
-
- document.querySelectorAll('#page-server-detail .tab-content').forEach(c => c.style.display = 'none');
- const target = $('#server-tab-' + tabName);
- if (target) target.style.display = 'block';
-
- const indicator = $('#tab-indicator');
- if (indicator) {
- indicator.style.left = tabBtn.offsetLeft + 'px';
- indicator.style.width = tabBtn.offsetWidth + 'px';
- }
-
- if (tabName === 'resources') {
- const container = $('#live-resources-container');
- if (container && container.querySelector('.resource-gauge') === null) {
- fetchLiveResources(state.serverIdentifier);
- }
- }
-
- const newUrl = `/server/${state.serverId}/${tabName}`;
- history.pushState({ page: 'server', serverId: state.serverId, tab: tabName }, '', newUrl);
-}
-
-// ===== DELETE SERVER =====
-document.addEventListener('click', function(e) {
- const tabBtn = e.target.closest('.tab');
- if (tabBtn && !tabBtn.classList.contains('active')) {
- e.preventDefault();
- switchTab(tabBtn);
- return;
- }
-
- const renewBtn = e.target.closest('.btn-renew-server');
- if (renewBtn) {
- e.preventDefault();
- const serverId = parseInt(renewBtn.dataset.serverId);
- renewBtn.disabled = true;
- renewBtn.innerHTML = '';
-
- api(`/servers/renew/${serverId}`, { method: 'POST' })
- .then(() => {
- showToast('Server renewed for another 90 days!', 'success');
- if (state.currentPage === 'overview') renderOverview();
- else if (state.currentPage === 'servers') renderServers();
- })
- .catch(err => {
- showToast(err.message, 'error');
- renewBtn.disabled = false;
- renewBtn.innerHTML = 'Renew';
- });
- return;
- }
-
- const renameBtn = e.target.closest('.btn-rename-server');
- if (renameBtn) {
- e.preventDefault();
- const serverId = parseInt(renameBtn.dataset.serverId);
- const serverName = renameBtn.dataset.serverName;
- const overlay = $('#modal-overlay');
- const content = $('#modal-content');
- content.innerHTML = html`
- Rename Server
-
- Enter a new name for ${serverName}.
-
-
-
-
-
-
-
-
-
- `;
- overlay.classList.add('open');
- const input = $('#rename-server-input');
- input.focus();
- input.setSelectionRange(input.value.length, input.value.length);
- return;
- }
-
- const reinstallBtn = e.target.closest('.btn-reinstall-server');
- if (reinstallBtn) {
- e.preventDefault();
- const serverId = parseInt(reinstallBtn.dataset.serverId);
- const serverName = reinstallBtn.dataset.serverName;
- const overlay = $('#modal-overlay');
- const content = $('#modal-content');
- content.innerHTML = html`
- Reinstall Server
-
- Are you sure you want to reinstall ${serverName}?
-
-
-
- This will delete all files, configurations, and data on the server and reinstall it from scratch.
- Only do this if you are experiencing issues with the server.
-
-
-
-
-
- `;
- overlay.classList.add('open');
- return;
- }
-
- const delBtn = e.target.closest('.btn-delete-server');
- if (delBtn) {
- e.preventDefault();
- const serverId = parseInt(delBtn.dataset.serverId);
- const serverName = delBtn.dataset.serverName;
- const overlay = $('#modal-overlay');
- const content = $('#modal-content');
- content.innerHTML = html`
- Delete Server
-
- Are you sure you want to delete ${serverName}?
- This action is irreversible and will permanently remove the server.
-
-
-
-
-
- `;
- overlay.classList.add('open');
- return;
- }
-
- if (e.target.closest('.modal-cancel-btn') || e.target.closest('.modal-overlay') && !e.target.closest('.modal')) {
- $('#modal-overlay').classList.remove('open');
- return;
- }
-
- const confirmBtn = e.target.closest('#confirm-delete-btn');
- if (confirmBtn) {
- const serverId = parseInt(confirmBtn.dataset.serverId);
- confirmBtn.disabled = true;
- confirmBtn.innerHTML = ' Deleting...';
-
- api(`/servers/${serverId}`, { method: 'DELETE' })
- .then(() => {
- $('#modal-overlay').classList.remove('open');
- showToast('Server deleted successfully', 'success');
- if (state.currentPage === 'overview') renderOverview();
- else if (state.currentPage === 'servers') renderServers();
- else navigateTo('servers');
- })
- .catch(err => {
- showToast(err.message, 'error');
- confirmBtn.disabled = false;
- confirmBtn.innerHTML = 'Delete Forever';
- });
- return;
- }
-
- const confirmRenameBtn = e.target.closest('#confirm-rename-btn');
- if (confirmRenameBtn) {
- const serverId = parseInt(confirmRenameBtn.dataset.serverId);
- const input = $('#rename-server-input');
- const name = input.value.trim();
- if (!name) {
- showToast('Server name cannot be empty', 'error');
- input.focus();
- return;
- }
- confirmRenameBtn.disabled = true;
- confirmRenameBtn.innerHTML = ' Renaming...';
-
- api(`/servers/${serverId}`, { method: 'PATCH', body: JSON.stringify({ name }) })
- .then(() => {
- $('#modal-overlay').classList.remove('open');
- showToast('Server renamed successfully', 'success');
- renderServerDetail(serverId);
- })
- .catch(err => {
- showToast(err.message, 'error');
- confirmRenameBtn.disabled = false;
- confirmRenameBtn.innerHTML = 'Rename';
- });
- return;
- }
-
- const confirmReinstallBtn = e.target.closest('#confirm-reinstall-btn');
- if (confirmReinstallBtn) {
- const serverId = parseInt(confirmReinstallBtn.dataset.serverId);
- confirmReinstallBtn.disabled = true;
- confirmReinstallBtn.innerHTML = ' Reinstalling...';
-
- api(`/servers/${serverId}/reinstall`, { method: 'POST' })
- .then(() => {
- $('#modal-overlay').classList.remove('open');
- showToast('Server reinstall has been initiated', 'success');
- renderServerDetail(serverId);
- })
- .catch(err => {
- showToast(err.message, 'error');
- confirmReinstallBtn.disabled = false;
- confirmReinstallBtn.innerHTML = 'Reinstall';
- });
- return;
- }
-});
-
-// ===== RGPD: DATA EXPORT (Art. 15 & 20) =====
-async function handleExportData() {
- const btn = $('#export-data-btn');
- if (!btn) return;
- btn.disabled = true;
- btn.innerHTML = ' Exporting...';
-
- try {
- const data = await api('/auth/export-data');
- const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
- const url = URL.createObjectURL(blob);
- const a = document.createElement('a');
- a.href = url;
- a.download = `zerohost-data-export-${new Date().toISOString().slice(0, 10)}.json`;
- document.body.appendChild(a);
- a.click();
- document.body.removeChild(a);
- URL.revokeObjectURL(url);
- showToast('Data exported successfully', 'success');
- } catch (err) {
- showToast('Failed to export data: ' + err.message, 'error');
- } finally {
- btn.disabled = false;
- btn.innerHTML = ` Export My Data`;
- }
-}
-
-// ===== INIT =====
-function init() {
- const path = window.location.pathname;
-
- // Skip if admin route - handled by admin.js
- if (path.startsWith('/admin')) return;
-
- const basePage = path.replace(/^\//, '').split('/')[0] || '';
- const token = localStorage.getItem('zh_token');
-
- if (token) {
- state.token = token;
- try {
- const user = JSON.parse(localStorage.getItem('zh_user'));
- if (user) state.user = user;
- } catch {}
- }
-
- if (basePage === 'login' || basePage === 'signup') {
- if (state.token) {
- history.replaceState({ page: 'overview' }, '', '/');
- renderDashboard();
- } else if (basePage === 'login') {
- renderLoginPage();
- } else {
- renderRegisterPage();
- }
- } else if (state.token) {
- api('/servers/overview').then(() => {
- renderDashboard();
- fetchUnreadCount();
- setInterval(fetchUnreadCount, 30000);
- }).catch(() => {
- renderDashboard();
- });
- } else {
- renderLoginPage();
- history.replaceState({ page: 'login' }, '', '/login');
- }
-
- renderCookieBanner();
-}
-
-init();
-
+function initIcons() { if (window.lucide) lucide.createIcons(); }
+
+const API_BASE = window.location.origin;
+
+const state = {
+ user: null,
+ token: localStorage.getItem('zh_token'),
+ currentPage: 'overview',
+ servers: [],
+ rgpdConsent: JSON.parse(localStorage.getItem('zh_rgpd_consent') || 'null'),
+ serverDetailTab: 'info',
+ notifications: [],
+ unreadCount: 0,
+ notifPanelOpen: false,
+};
+
+function setRgpdConsent(preferences) {
+ state.rgpdConsent = preferences;
+ localStorage.setItem('zh_rgpd_consent', JSON.stringify(preferences));
+}
+
+function renderCookieBanner() {
+ if (state.rgpdConsent) return;
+ const existing = document.getElementById('cookie-consent-banner');
+ if (existing) return;
+ const banner = document.createElement('div');
+ banner.id = 'cookie-consent-banner';
+ banner.className = 'cookie-banner';
+ banner.innerHTML = `
+
+
+ We use cookies for authentication and security (Cap). No tracking or advertising cookies are used.
+ For more information, read our privacy policy.
+
+
+
+
+
+ `;
+ document.body.appendChild(banner);
+
+ document.getElementById('cookie-essential-btn').addEventListener('click', () => {
+ setRgpdConsent({ essential: true, analytics: false, timestamp: new Date().toISOString() });
+ banner.remove();
+ });
+ document.getElementById('cookie-accept-all-btn').addEventListener('click', () => {
+ setRgpdConsent({ essential: true, analytics: true, timestamp: new Date().toISOString() });
+ banner.remove();
+ });
+}
+
+const PTERO_URL = 'https://panel.zero-host.org';
+
+function openPyrodactylPanel(serverIdentifier) {
+ const url = `${PTERO_URL}${serverIdentifier ? '/server/' + serverIdentifier : ''}`;
+ window.open(url, '_blank');
+}
+
+async function sendPowerCommand(identifier, signal, event) {
+ const btn = event?.target;
+ if (btn) {
+ btn.disabled = true;
+ btn.innerHTML = '';
+ }
+ try {
+ await api(`/servers/power/${identifier}`, { method: 'POST', body: JSON.stringify({ signal }) });
+ } catch (err) {
+ const overlay = $('#modal-overlay');
+ const content = $('#modal-content');
+ content.innerHTML = html`
+ Command Failed
+
+
+
Failed to send ${signal} command:
+
${err.message}
+
+
+
+ `;
+ overlay.classList.add('open');
+ } finally {
+ if (btn) {
+ btn.disabled = false;
+ btn.textContent = signal.charAt(0).toUpperCase() + signal.slice(1);
+ }
+ }
+}
+
+function $(sel) { return document.querySelector(sel); }
+function md5(s) {
+ function F(x,y,z) { return (x & y) | (~x & z); }
+ function G(x,y,z) { return (x & z) | (y & ~z); }
+ function H(x,y,z) { return x ^ y ^ z; }
+ function I(x,y,z) { return y ^ (x | ~z); }
+ function rol(x,n) { return (x << n) | (x >>> (32 - n)); }
+ function add(x,y) { return (x + y) >>> 0; }
+ function toHex(n) { let h=''; for(let i=0;i<4;i++) h+=((n>>(i*8))&0xFF).toString(16).padStart(2,'0'); return h; }
+ const T = new Array(64);
+ for(let i=1;i<=64;i++) T[i-1] = Math.floor(Math.abs(Math.sin(i)) * 0x100000000) >>> 0;
+ const s_ = [7,12,17,22,5,9,14,20,4,11,16,23,6,10,15,21];
+ const S = (function(){ const r=[]; for(let i=0;i<64;i++) r[i]=s_[(i>>3<<2)+(i%4)]; return r; })();
+ const K = [0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3,0,1,2,3];
+ s = unescape(encodeURIComponent(s));
+ const len = s.length;
+ const msg = []; for(let i=0;i>(8-(i%2)*8))&0xFF);
+ const bitLen = len * 8;
+ msg.push(0x80);
+ while((msg.length+8)%64!=0) msg.push(0);
+ for(let i=0;i<8;i++) msg.push((bitLen>>>(i*8))&0xFF);
+ let h0=0x67452301,h1=0xEFCDAB89,h2=0x98BADCFE,h3=0x10325476;
+ for(let i=0;i': '>', '"': '"', "'": ''' };
+ return str.replace(/[&<>"']/g, m => map[m]);
+}
+
+function html(strings, ...values) {
+ return strings.reduce((acc, str, i) => acc + str + (values[i] ?? ''), '');
+}
+
+async function api(path, options = {}) {
+ const headers = { 'Content-Type': 'application/json', ...options.headers };
+ if (state.token) {
+ headers['Authorization'] = `Bearer ${state.token}`;
+ }
+ let res;
+ try {
+ res = await fetch(`${API_BASE}/api${path}`, { ...options, headers });
+ } catch {
+ throw new Error('Unable to reach the server. Please check your connection and try again.');
+ }
+ const text = await res.text();
+ let data;
+ try {
+ data = JSON.parse(text);
+ } catch {
+ throw new Error('Server error: please try again in a few moments.');
+ }
+ if (res.status === 403 && data.error === 'Invalid or expired token') {
+ state.token = null;
+ state.user = null;
+ localStorage.removeItem('zh_token');
+ localStorage.removeItem('zh_user');
+ navigateTo('login');
+ throw new Error('Session expired. Please sign in again.');
+ }
+ if (!res.ok) throw new Error(data.error || 'Request failed');
+ return data;
+}
+
+function showToast(message, type = 'success') {
+ const container = $('#toast-container') || (() => {
+ const el = document.createElement('div');
+ el.id = 'toast-container';
+ el.className = 'toast-container';
+ document.body.appendChild(el);
+ return el;
+ })();
+
+ const toast = document.createElement('div');
+ toast.className = `toast toast-${type}`;
+ toast.textContent = message;
+ container.appendChild(toast);
+ setTimeout(() => toast.remove(), 4000);
+}
+
+function showError(form, message) {
+ const errorEl = form.querySelector('.auth-error');
+ if (errorEl) {
+ errorEl.textContent = message;
+ errorEl.classList.add('show');
+ }
+}
+
+function hideError(form) {
+ const errorEl = form.querySelector('.auth-error');
+ if (errorEl) errorEl.classList.remove('show');
+}
+
+const NOTIF_ICONS = {
+ success: '',
+ error: '',
+ warning: '',
+ info: '',
+};
+
+function timeAgo(dateStr) {
+ const diff = Date.now() - new Date(dateStr).getTime();
+ const minutes = Math.floor(diff / 60000);
+ if (minutes < 1) return 'just now';
+ if (minutes < 60) return minutes + 'm ago';
+ const hours = Math.floor(minutes / 60);
+ if (hours < 24) return hours + 'h ago';
+ const days = Math.floor(hours / 24);
+ if (days < 7) return days + 'd ago';
+ return new Date(dateStr).toLocaleDateString();
+}
+
+async function fetchUnreadCount() {
+ try {
+ const data = await api('/notifications/unread-count');
+ state.unreadCount = data.count;
+ updateNotifBadge();
+ } catch {}
+}
+
+async function fetchNotifications() {
+ try {
+ const data = await api('/notifications');
+ state.notifications = data.notifications;
+ renderNotifications();
+ } catch {}
+}
+
+function showNotifDetailModal(notif) {
+ const existing = $('#notif-view-modal');
+ if (existing) existing.remove();
+
+ const overlay = document.createElement('div');
+ overlay.className = 'notif-view-modal';
+ overlay.id = 'notif-view-modal';
+ overlay.innerHTML = html`
+
+
+
${escapeHtml(notif.message)}
+
No notifications yet
';
+ return;
+ }
+ list.innerHTML = state.notifications.map(n => html`
+
+
${NOTIF_ICONS[n.type] || NOTIF_ICONS.info}
+
+
${escapeHtml(n.title)}
+
${escapeHtml(n.message)}
+
${timeAgo(n.created_at)}
+
+ ${n.is_read ? '' : '
'}
+
+
+
+
+
ZeroHost
+
+
Welcome back
+
Sign in to your dashboard
+
+
+
+
+
+
+
+
ZeroHost
+
+
Create account
+
Start hosting for free
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Account Restricted — Your account has been restricted. You cannot create or renew servers.
+
+
+
+
+
+
+
+
+
+
+
Failed to load data: ${escapeHtml(err.message)}
+
+
+
Failed to load data: ${escapeHtml(err.message)}
+
+
+ ${data.pteroError}
+
+ `);
+ }
+
+ $('#stat-total').textContent = data.totalServers;
+ $('#stat-active').textContent = data.activeServers;
+ const limit = data.serverLimit || 3;
+ $('#stat-slots').textContent = data.totalServers + '/' + limit;
+ const toRenew = data.servers.filter(s => {
+ const meta = s.serverMeta;
+ if (!meta) return false;
+ return new Date(meta.expires_at) <= new Date();
+ }).length;
+ $('#stat-renew').textContent = toRenew;
+ state.servers = data.servers;
+
+ if (data.servers.length === 0 && !data.pteroError) {
+ $('#recent-servers-list').innerHTML = html`
+
+
+
No servers yet
+
Create your first server to get started
+
+
+ ${data.servers.slice(0, 6).map(s => renderServerCard(s)).join('')}
+
+ `;
+ }
+
+ } catch (err) {
+ $('#recent-servers-list').innerHTML = html`
+ Failed to load: ${err.message}
+ `;
+ }
+
+ initIcons();
+}
+
+let activityIcons = {
+ server_created: '',
+ server_renewed: '',
+ server_renamed: '',
+ server_reinstalled: '',
+ server_deleted: '',
+ account_registered: '',
+ password_changed: '',
+ email_changed: '',
+ account_deleted: '',
+ api_key_updated: '',
+ avatar_updated: '',
+ admin_suspend: '',
+ admin_unsuspend: '',
+ admin_renew_now: '',
+};
+
+function formatRelativeTime(dateStr) {
+ const diff = Date.now() - new Date(dateStr).getTime();
+ const mins = Math.floor(diff / 60000);
+ if (mins < 1) return 'just now';
+ if (mins < 60) return mins + 'm ago';
+ const hours = Math.floor(mins / 60);
+ if (hours < 24) return hours + 'h ago';
+ const days = Math.floor(hours / 24);
+ if (days < 7) return days + 'd ago';
+ return formatDate(dateStr);
+}
+
+function getActionLabel(action) {
+ const labels = {
+ server_created: 'Created server',
+ server_renewed: 'Renewed server',
+ server_renamed: 'Renamed server',
+ server_reinstalled: 'Reinstalled server',
+ server_deleted: 'Deleted server',
+ account_registered: 'Account created',
+ password_changed: 'Password changed',
+ email_changed: 'Email changed',
+ account_deleted: 'Account deleted',
+ api_key_updated: 'API key updated',
+ avatar_updated: 'Profile picture updated',
+ admin_suspend: 'Server suspended (Admin)',
+ admin_unsuspend: 'Server unsuspended (Admin)',
+ admin_renew_now: 'Server force-renewed (Admin)',
+ };
+ return labels[action] || action;
+}
+
+async function renderLog(pageNum) {
+ const el = $('#page-logs');
+ pageNum = pageNum || 1;
+ const limit = 50;
+ const offset = (pageNum - 1) * limit;
+
+ el.innerHTML = html`
+
+
+ `;
+
+ try {
+ const data = await api(`/activity?limit=${limit}&offset=${offset}`);
+ const list = $('#log-list');
+
+ if (data.activities.length === 0) {
+ list.innerHTML = 'No activity found.
';
+ return;
+ }
+
+ const pageInfo = data.totalPages > 1 ? html`
+
+ ` : '';
+
+ list.innerHTML = html`
+ ${pageInfo}
+
+ ${data.activities.map(a => html`
+
+
${activityIcons[a.action] || ''}
+
+
${escapeHtml(getActionLabel(a.action))}
+
${escapeHtml(a.details || '')}
+
+
${formatRelativeTime(a.created_at)}
+
+ `).join('')}
+
Could not load activity log.
';
+ }
+}
+
+function formatDate(d) {
+ if (!d) return 'N/A';
+ const date = new Date(d);
+ return date.toLocaleDateString('en-GB', { day: 'numeric', month: 'short', year: 'numeric' });
+}
+
+function daysRemaining(expiresAt) {
+ if (!expiresAt) return null;
+ const diff = new Date(expiresAt) - new Date();
+ return Math.ceil(diff / (1000 * 60 * 60 * 24));
+}
+
+function renderServerCard(s) {
+ const eggName = s.eggDetails?.name || `Egg #${s.egg}`;
+ const alloc = s.allocationDetails;
+ const isInstalling = s.status === 'installing' || s.installed === 0 || s.installed === '0' || s.installed === false;
+ const isSuspended = s.status === 'suspended';
+ const meta = s.serverMeta;
+ const days = meta ? daysRemaining(meta.expires_at) : null;
+ const canRenew = days !== null && days <= 7 && days >= -7;
+ const isAdminSuspended = isSuspended && meta?.suspended_by === 'admin';
+ const isExpiredRenewable = isSuspended && canRenew && !isAdminSuspended;
+ const statusClass = isAdminSuspended ? 'status-suspended' : (isExpiredRenewable ? 'status-expired' : (isInstalling ? 'status-installing' : 'status-active'));
+ const statusLabel = isAdminSuspended ? 'Suspended' : (isExpiredRenewable ? 'Expired' : (isInstalling ? 'Installing' : 'Active'));
+ const allocStr = alloc ? `${alloc.alias || alloc.nodeFqdn || alloc.ip}:${alloc.port}` : (s.nodeFqdn || `Node #${s.node}`);
+ const expClass = days !== null && days <= 0 ? 'expired' : (days !== null && days <= 7 ? 'expiring' : '');
+ return html`
+
+
+ ${escapeHtml(s.name)}
+ ${statusLabel}
+
+
+ ${eggName}
+ ${allocStr}
+
+
+ ${meta ? html`
+
+ Expires: ${formatDate(meta.expires_at)}
+ ${days !== null ? html`(${days > 0 ? days + ' days' : 'Expired'})` : ''}
+
+ ` : ''}
+
+
+ ${canRenew && !isAdminSuspended ? html`
+
+ ` : ''}
+
+
+ | ${escapeHtml(s.name)} |
+ ${eggName} |
+ ${allocStr} |
+
+ ${statusLabel}
+ |
+
+
+ Settings
+
+ ${canRenew && !isAdminSuspended ? html`
+
+ ` : ''}
+ |
+
+ `;
+}
+
+// ===== SERVERS PAGE =====
+async function renderServers() {
+ const el = $('#page-servers');
+ el.innerHTML = html`
+
+
+
+
+
+
+ | Name |
+ Egg |
+ Allocation |
+ Status |
+ Actions |
+
+
+
+ | Loading... |
+
+
+
+
+
No servers yet
+
Create your first server to get started
+
+
| No servers match your search. |
+ `;
+ }
+ }
+
+ $('#server-search-input').addEventListener('input', applyFilters);
+
+ document.querySelectorAll('#server-filters .filter-btn').forEach(btn => {
+ btn.addEventListener('click', () => {
+ document.querySelectorAll('#server-filters .filter-btn').forEach(b => b.classList.remove('active'));
+ btn.classList.add('active');
+ applyFilters();
+ });
+ });
+
+ applyFilters();
+ } catch (err) {
+ $('#servers-table-body').innerHTML = html`
+ | Error: ${err.message} |
+ `;
+ }
+
+ initIcons();
+}
+
+// ===== CREATE SERVER (Wizard) =====
+const createState = {
+ nests: [],
+ selectedNest: null,
+ selectedEgg: null,
+ selectedDockerImage: null,
+ serverName: '',
+ step: 0,
+};
+
+function renderWizardStep(step, direction) {
+ const prevStep = createState.step;
+ createState.step = step;
+ const container = $('#create-wizard');
+ const headerEl = document.querySelector('#page-create .page-header');
+ const steps = [
+ { label: 'Nest', icon: 'layout-grid' },
+ { label: 'Egg', icon: 'egg' },
+ { label: 'Name', icon: 'type' },
+ { label: 'Summary', icon: 'file-text' },
+ ];
+
+ const totalSteps = steps.length;
+ const stepsHtml = steps.map((s, i) => html`
+
+ `).join('');
+
+ let contentHtml = '';
+ if (step === 0) contentHtml = renderNestStep();
+ else if (step === 1) contentHtml = renderEggStep();
+ else if (step === 2) contentHtml = renderNameStep();
+ else if (step === 3) contentHtml = renderSummaryStep();
+
+ const slideClass = direction === 'next' ? 'slide-left' : direction === 'back' ? 'slide-right' : '';
+
+ const progressHtml = html`
+
+ `;
+
+ if (headerEl) {
+ const existing = headerEl.querySelector('.wizard-progress');
+ if (existing) existing.remove();
+ headerEl.insertAdjacentHTML('beforeend', progressHtml);
+ }
+
+ container.innerHTML = html`
+
+ `;
+
+ initIcons();
+ attachWizardListeners(step);
+}
+
+function renderNestStep() {
+ if (createState.nests.length === 0) {
+ return html``;
+ }
+ return html`
+ Choose a Nest
+ Select the type of server you want to create
+
+ ${createState.nests.map(n => html`
+
+
+ ${n.logo ? html`
` : html`
`}
+
+
${escapeHtml(n.name)}
+ ${n.description ? html`
${escapeHtml(n.description)}
` : ''}
+
+ `).join('')}
+
+
+
+ `;
+}
+
+function renderEggStep() {
+ const nest = createState.selectedNest;
+ if (!nest || !nest.eggs || nest.eggs.length === 0) {
+ return html`No eggs available in this nest.
+
+ ${e.logo ? html`
` : html`
`}
+
+
+
${escapeHtml(e.name)}
+ ${e.description ? html`
${escapeHtml(e.description)}
` : ''}
+
+
${escapeHtml(shortName)}
`;
+ }).join('');
+ const currentLabel = createState.selectedDockerImage
+ ? (images.find(([, img]) => img === createState.selectedDockerImage)?.[0] || createState.selectedDockerImage.split('/').pop().split(':').pop())
+ : 'Select an image';
+ dockerSection = html`
+
+
Docker Image
+
Choose a Docker image for this egg
+
+
+ ${escapeHtml(currentLabel)}
+
+
+
${optionsHtml}
+
+
Choose an Egg
+ Select the software or game you want to run
+ ${eggCards}
+ ${dockerSection}
+
+
+
+
+ `;
+}
+
+function renderNameStep() {
+ return html`
+ Name Your Server
+ Give your server a memorable name
+
+
+
+
+
+
+ Allowed: letters, numbers, spaces, dots, dashes, underscores
+
+
+
+
+
+ `;
+}
+
+function renderSummaryStep() {
+ const nest = createState.selectedNest;
+ const egg = createState.selectedEgg;
+ let dockerLabel = 'Default';
+ if (egg && createState.selectedDockerImage) {
+ const images = Object.entries(egg.dockerImages || {});
+ const found = images.find(([, img]) => img === createState.selectedDockerImage);
+ if (found) {
+ dockerLabel = found[0] || createState.selectedDockerImage.split('/').pop().split(':').pop() || createState.selectedDockerImage;
+ } else {
+ const raw = createState.selectedDockerImage;
+ dockerLabel = raw.split('/').pop().split(':').pop() || raw || 'Default';
+ }
+ }
+
+ return html`
+ Summary
+ Review your choices before creating the server
+
+
+ Nest
+ ${escapeHtml(nest?.name || 'โ')}
+
+
+ Egg
+ ${escapeHtml(egg?.name || 'โ')}
+
+
+ Docker Image
+ ${escapeHtml(dockerLabel)}
+
+
+ Server Name
+ ${escapeHtml(createState.serverName)}
+
+
+
Default Resources
+
+ ${egg?.memory_limit != null ? egg.memory_limit + ' MB' : '512 MB'} RAM
+ ${egg?.cpu_limit != null ? egg.cpu_limit + '%' : '50%'} CPU
+ ${egg?.disk_limit != null ? (egg.disk_limit / 1024).toFixed(1) + ' GB' : '3 GB'} Disk
+
+
+
+
+
+
+
+
+ `;
+}
+
+function attachWizardListeners(step) {
+ const backBtn = $('#wizard-back-btn');
+ const nextBtn = $('#wizard-next-btn');
+ const createBtn = $('#wizard-create-btn');
+
+ if (backBtn) {
+ backBtn.addEventListener('click', () => renderWizardStep(step - 1));
+ }
+
+ if (step === 0) {
+ const cards = document.querySelectorAll('.nest-card');
+ cards.forEach(c => {
+ c.addEventListener('click', () => {
+ cards.forEach(c2 => c2.classList.remove('selected'));
+ c.classList.add('selected');
+ const nestId = parseInt(c.dataset.nestId, 10);
+ createState.selectedNest = createState.nests.find(n => n.pteroNestId === nestId) || null;
+ createState.selectedEgg = null;
+ createState.selectedDockerImage = null;
+ const next = $('#wizard-next-btn');
+ if (next) next.disabled = false;
+ });
+ });
+ if (nextBtn) {
+ nextBtn.addEventListener('click', () => renderWizardStep(1));
+ }
+ }
+
+ if (step === 1) {
+ const eggCards = document.querySelectorAll('.egg-card');
+ eggCards.forEach(c => {
+ c.addEventListener('click', () => {
+ eggCards.forEach(c2 => c2.classList.remove('selected'));
+ c.classList.add('selected');
+ const eggId = parseInt(c.dataset.eggId, 10);
+ const nest = createState.selectedNest;
+ createState.selectedEgg = nest?.eggs.find(e => e.eggId === eggId) || null;
+ createState.selectedDockerImage = null;
+ renderWizardStep(1);
+ });
+ });
+
+ const dockerSelect = document.querySelector('#docker-select');
+ if (dockerSelect) {
+ const trigger = dockerSelect.querySelector('.custom-select-trigger');
+ const label = dockerSelect.querySelector('.custom-select-label');
+
+ trigger.addEventListener('click', (e) => {
+ e.stopPropagation();
+ document.querySelectorAll('.custom-select.open').forEach(s => s.classList.remove('open'));
+ dockerSelect.classList.add('open');
+ });
+
+ dockerSelect.querySelectorAll('.custom-select-option').forEach(opt => {
+ opt.addEventListener('click', (e) => {
+ e.stopPropagation();
+ createState.selectedDockerImage = opt.dataset.value;
+ label.textContent = opt.textContent;
+ dockerSelect.classList.remove('open');
+ });
+ });
+
+ document.addEventListener('click', () => {
+ dockerSelect.classList.remove('open');
+ });
+ }
+
+ if (nextBtn) {
+ nextBtn.addEventListener('click', () => {
+ if (!createState.selectedEgg) return;
+ const images = Object.entries(createState.selectedEgg.dockerImages || {});
+ if (images.length === 1) {
+ createState.selectedDockerImage = images[0][1];
+ } else if (images.length > 1 && !createState.selectedDockerImage) {
+ showToast('Please select a Docker image', 'error');
+ return;
+ } else if (images.length > 1 && createState.selectedDockerImage) {
+ // already selected
+ }
+ renderWizardStep(2);
+ });
+ }
+ }
+
+ if (step === 2) {
+ const input = $('#create-name-input');
+ if (input) {
+ input.focus();
+ input.addEventListener('input', () => {
+ const val = input.value.trim();
+ createState.serverName = val;
+ const next = $('#wizard-next-btn');
+ if (next) {
+ next.disabled = !isValidServerName(val);
+ }
+ });
+ // Trigger initial validation
+ if (createState.serverName) {
+ input.value = createState.serverName;
+ const next = $('#wizard-next-btn');
+ if (next) next.disabled = !isValidServerName(createState.serverName);
+ }
+ }
+ if (nextBtn) {
+ nextBtn.addEventListener('click', () => {
+ const name = createState.serverName;
+ if (!name) { showToast('Please enter a server name', 'error'); return; }
+ if (!isValidServerName(name)) { showToast('Server name contains invalid characters', 'error'); return; }
+ renderWizardStep(3);
+ });
+ }
+ }
+
+ if (step === 3 && createBtn) {
+ createBtn.addEventListener('click', handleWizardCreate);
+ }
+}
+
+function isValidServerName(name) {
+ return name && name.length >= 1 && name.length <= 255 && /^[a-zA-Z0-9 _.-]+$/.test(name);
+}
+
+async function handleWizardCreate() {
+ const btn = $('#wizard-create-btn');
+ btn.disabled = true;
+ btn.innerHTML = ' Creating...';
+
+ const name = createState.serverName;
+ const nest = createState.selectedNest;
+ const egg = createState.selectedEgg;
+ if (!name || !nest || !egg) {
+ showToast('Missing required selections', 'error');
+ btn.disabled = false;
+ btn.innerHTML = 'Create Server';
+ return;
+ }
+
+ const environment = {};
+ const dockerImage = createState.selectedDockerImage || '';
+
+ try {
+ const capToken = document.querySelector('[name="cap-token"]')?.value || '';
+ await api('/servers/create', {
+ method: 'POST',
+ body: JSON.stringify({ name, nestId: nest.pteroNestId, eggId: egg.eggId, environment, capToken, dockerImage }),
+ });
+ showToast(`Server "${name}" created successfully!`, 'success');
+ navigateTo('servers');
+ } catch (err) {
+ showToast(err.message, 'error');
+ btn.disabled = false;
+ btn.innerHTML = ' Create Server';
+ initIcons();
+ }
+}
+
+// ===== PYRODACTYL PAGE =====
+function renderPyrodactyl() {
+ const el = $('#page-pyrodactyl');
+ el.innerHTML = html`
+
+
+
+
+
+
+
Opening Pyrodactyl...
+
+ Click the button below to open the Pyrodactyl panel.
+
+
+
+
+
+
+
+
+
+
+
+
+ `;
+
+ $('#account-menu-edit').addEventListener('click', () => navigateTo('account/edit'));
+ $('#account-menu-logs').addEventListener('click', () => navigateTo('logs'));
+ $('#account-menu-dangerous').addEventListener('click', () => navigateTo('account/dangerous'));
+ $('#account-menu-logout').addEventListener('click', async () => {
+ initIcons();
+ try { await api('/auth/logout', { method: 'POST' }); } catch {}
+ state.token = null;
+ state.user = null;
+ localStorage.removeItem('zh_token');
+ localStorage.removeItem('zh_user');
+ navigateTo('login');
+ });
+}
+
+function renderAccountEdit() {
+ const el = $('#page-account');
+ el.innerHTML = html`
+
+
+
+
Profile Picture
+
+
+
+
${state.user?.username?.[0]?.toUpperCase() || 'U'}
+
+
+
+ Upload a profile picture. Supported formats: PNG, JPEG, GIF, WebP. Max size: 2MB.
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Pyrodactyl API Key
+
+ Add your Pyrodactyl Client API key to enable live resource monitoring and server power state detection directly in the dashboard.
+ Generate one at panel.zero-host.org/account/api.
+
+
+
+
+
+ Your Pyrodactyl API key is saved and active.
+
+
+
+
+
+
Modify API Key
+
+ Enter your new Pyrodactyl API key. The old key will be replaced.
+
+
+
+
+
+
+
+
+
+ `;
+ overlay.classList.add('open');
+ $('#confirm-modify-api-key-btn').addEventListener('click', handleConfirmModifyApiKey);
+}
+
+function handleDeleteApiKey() {
+ const overlay = $('#modal-overlay');
+ const content = $('#modal-content');
+ content.innerHTML = html`
+ Delete API Key
+
+ Are you sure you want to delete your Pyrodactyl API key? Live resource monitoring and power state detection will stop working.
+
+
+
+
+
+ `;
+ overlay.classList.add('open');
+ $('#confirm-delete-api-key-btn').addEventListener('click', handleConfirmDeleteApiKey);
+}
+
+async function handleConfirmModifyApiKey() {
+ const btn = $('#confirm-modify-api-key-btn');
+ const input = $('#modal-api-key-input');
+ const key = input.value.trim();
+
+ if (!key) {
+ showToast('Please enter an API key', 'error');
+ return;
+ }
+
+ btn.disabled = true;
+ btn.innerHTML = '';
+
+ try {
+ await api('/servers/client-api-key', {
+ method: 'PUT',
+ body: JSON.stringify({ apiKey: key }),
+ });
+ $('#modal-overlay').classList.remove('open');
+ showToast('Pyrodactyl API key updated', 'success');
+ renderApiKeySaved();
+ } catch (err) {
+ showToast(err.message, 'error');
+ } finally {
+ btn.disabled = false;
+ btn.innerHTML = 'Save';
+ }
+}
+
+async function handleConfirmDeleteApiKey() {
+ const btn = $('#confirm-delete-api-key-btn');
+ btn.disabled = true;
+ btn.innerHTML = '';
+
+ try {
+ await api('/servers/client-api-key', {
+ method: 'DELETE',
+ });
+ $('#modal-overlay').classList.remove('open');
+ showToast('Pyrodactyl API key deleted', 'success');
+ renderApiKeyForm();
+ } catch (err) {
+ showToast(err.message, 'error');
+ } finally {
+ btn.disabled = false;
+ btn.innerHTML = 'Delete';
+ }
+}
+
+async function handleChangeEmail(e) {
+ e.preventDefault();
+ const btn = $('#change-email-btn');
+ btn.disabled = true;
+ btn.innerHTML = '';
+ try {
+ const newEmail = $('#acc-new-email').value.trim();
+ const password = $('#acc-email-pw').value;
+ if (!newEmail || !password) {
+ showToast('Please fill in all fields', 'error');
+ return;
+ }
+ const data = await api('/auth/change-email', {
+ method: 'POST',
+ body: JSON.stringify({ newEmail, password }),
+ });
+ state.token = data.token;
+ state.user = data.user;
+ localStorage.setItem('zh_token', data.token);
+ localStorage.setItem('zh_user', JSON.stringify(data.user));
+ $('#acc-new-email').placeholder = newEmail;
+ $('#acc-new-email').value = '';
+ $('#acc-email-pw').value = '';
+ showToast('Email updated successfully', 'success');
+ } catch (err) {
+ showToast(err.message, 'error');
+ } finally {
+ btn.disabled = false;
+ btn.innerHTML = 'Change Email';
+ }
+}
+
+async function handleChangePassword(e) {
+ e.preventDefault();
+ const btn = $('#change-pw-btn');
+ const currentPw = $('#acc-current-pw').value;
+ const newPw = $('#acc-new-pw').value;
+ const confirmPw = $('#acc-confirm-pw').value;
+
+ if (!currentPw || !newPw || !confirmPw) {
+ showToast('Please fill in all fields', 'error');
+ return;
+ }
+
+ if (newPw.length < 8) {
+ showToast('New password must be at least 8 characters', 'error');
+ return;
+ }
+
+ if (newPw !== confirmPw) {
+ showToast('New passwords do not match', 'error');
+ return;
+ }
+
+ btn.disabled = true;
+ btn.innerHTML = ' Updating...';
+
+ try {
+ await api('/auth/change-password', {
+ method: 'POST',
+ body: JSON.stringify({ currentPassword: currentPw, newPassword: newPw }),
+ });
+ showToast('Password changed successfully', 'success');
+ $('#change-password-form').reset();
+ } catch (err) {
+ showToast(err.message, 'error');
+ } finally {
+ btn.disabled = false;
+ btn.innerHTML = 'Change Password';
+ }
+}
+
+function renderDangerous() {
+ const el = $('#page-account');
+ el.innerHTML = html`
+
+
+
+
Delete Account
+
+ This action is irreversible. All your servers will be deleted and your account will be permanently removed.
+
+
+
+
+
+
Data Export (RGPD)
+
+ Under Article 15 and 20 of the RGPD, you have the right to access and port your personal data. Click below to download a copy of all data we hold about you.
+
+
+
+
Delete Account
+
+ This will permanently delete your account ${state.user?.username || ''} and all associated servers. This cannot be undone.
+
+
+
+
+
+
+
+
+
+ `;
+ overlay.classList.add('open');
+
+ document.getElementById('confirm-delete-acc-btn').addEventListener('click', handleConfirmDeleteAccount);
+}
+
+async function handleConfirmDeleteAccount() {
+ const password = $('#delete-acc-pw').value;
+ if (!password) {
+ showToast('Please enter your password', 'error');
+ return;
+ }
+
+ const btn = $('#confirm-delete-acc-btn');
+ btn.disabled = true;
+ btn.innerHTML = ' Deleting...';
+
+ try {
+ await api('/auth/delete-account', {
+ method: 'POST',
+ body: JSON.stringify({ password }),
+ });
+ $('#modal-overlay').classList.remove('open');
+ showToast('Account deleted. Redirecting...', 'success');
+ state.token = null;
+ state.user = null;
+ localStorage.removeItem('zh_token');
+ localStorage.removeItem('zh_user');
+ setTimeout(() => navigateTo('login'), 1500);
+ } catch (err) {
+ showToast(err.message, 'error');
+ btn.disabled = false;
+ btn.innerHTML = 'Delete Forever';
+ }
+}
+
+// ===== SERVER DETAIL PAGE =====
+async function renderServerDetail(serverId) {
+ const el = $('#page-server-detail');
+
+ try {
+ const data = await api(`/servers/details/${serverId}`);
+ const s = data.server;
+ state.serverIdentifier = s.identifier;
+ const meta = s.serverMeta;
+ const eggName = s.eggDetails?.name || `Egg #${s.egg}`;
+ const alloc = s.allocationDetails;
+ const allocStr = alloc ? `${alloc.alias || alloc.nodeFqdn || alloc.ip}:${alloc.port}` : (s.nodeFqdn || `Node #${s.node}`);
+ const isInstalling = s.status === 'installing' || s.installed === 0 || s.installed === '0' || s.installed === false;
+ const isSuspended = s.status === 'suspended';
+ const days = meta ? daysRemaining(meta.expires_at) : null;
+ const canRenew = days !== null && days <= 7 && days >= -7;
+ const isAdminSuspended = isSuspended && meta?.suspended_by === 'admin';
+ const isExpiredRenewable = isSuspended && canRenew && !isAdminSuspended;
+ const statusClass = isAdminSuspended ? 'status-suspended' : (isExpiredRenewable ? 'status-expired' : (isInstalling ? 'status-installing' : 'status-active'));
+ const statusLabel = isAdminSuspended ? 'Suspended' : (isExpiredRenewable ? 'Expired' : (isInstalling ? 'Installing' : 'Active'));
+ const expClass = days !== null && days <= 0 ? 'expired' : (days !== null && days <= 7 ? 'expiring' : '');
+
+ const activeTab = state.serverDetailTab || 'info';
+
+ el.innerHTML = html`
+
+
+ ${isAdminSuspended && meta?.suspend_reason ? html`
+
+
Server Suspended
+
${meta.suspend_reason}
+
+
Server Expired
+
This server has expired. Renew it to reactivate it instantly.
+
+
+
+
+
+
+
+
+
Server Info
+
+
Egg${eggName}
+
Allocation${allocStr}
+
IO${s.limits.io}
+
Swap${s.limits.swap > 0 ? s.limits.swap + ' MB' : 'Disabled'}
+
Identifier${s.identifier}
+
+
+
+
+
Resources
+
+
+
${s.limits.memory > 0 ? s.limits.memory + ' MB' : 'โ'}
+
Memory
+
+
${s.limits.memory > 0 ? '512 MB max' : 'No limit'}
+
+
+
${s.limits.cpu}%
+
CPU
+
+
50% max
+
+
+
${s.limits.disk > 0 ? (s.limits.disk / 1024).toFixed(1) + ' GB' : 'โ'}
+
Disk
+
+
3 GB max
+
+
+
+
+
+
Lifetime
+ ${meta ? html`
+
+
Created${formatDate(meta.created_at)}
+
Expires${formatDate(meta.expires_at)} ${days !== null ? '(' + (days > 0 ? days + ' days' : 'Expired') + ')' : ''}
+
Status${isExpiredRenewable ? 'expired' : meta.status}
+ ${isAdminSuspended && meta.suspend_reason ? html`
+
Reason${meta.suspend_reason}
+ ` : ''}
+
+ ${canRenew && !isAdminSuspended ? html`
+
+ ` : html`
+ ${days < -7 ? html`
This server has expired. Contact support to renew.
` : ''}
+ ${days > 7 ? html`
Renewal available within 7 days of expiration.
` : ''}
+ `}
+ ` : html`
+
No lifetime data available for this server.
+ `}
+
+
+
+
+
+
Live Resource Usage
+
+
+
+
Fetching live data...
+
+
+
+ ${isAdminSuspended ? html`
+
+
+
Server Suspended
+
This server has been suspended by an administrator. No actions are available.
+
Please contact support via Discord for assistance.
+
+ ` : isExpiredRenewable ? html`
+
+
+
Server Expired
+
This server has expired. Renew it to reactivate it instantly and get 90 more days.
+
+
+ ` : isSuspended ? html`
+
+
+
Server Expired
+
This server has been expired for too long. Please contact support to renew.
+
Reach out via Discord for assistance.
+
+ ` : html`
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ `}
+
+
+
Server not found
+
${err.message}
+
+
+
No live data
+
+ ${data.error || 'Add your Pyrodactyl API key in Account โ Linked Accounts to enable live monitoring.'}
+
+
+
+
+
${cpuPct}%
+
CPU
+
+
${cpuPct >= 80 ? 'High load' : cpuPct >= 50 ? 'Moderate' : 'Idle'}
+
+
+
${memUsed} / ${memLimit} MB
+
Memory
+
+
${memPct}% used
+
+
+
${(diskUsed / 1024).toFixed(1)} / ${(diskLimit / 1024).toFixed(1)} GB
+
Disk
+
+
${diskPct}% used
+
+
+ Updated ${formatRelativeTime(new Date().toISOString())} ยท
+ ${currentState ? html`Status: ${currentState}` : ''}
+
+ `;
+
+ const refreshBtn = $('#refresh-resources-btn');
+ if (refreshBtn && !refreshBtn.dataset.listenerAttached) {
+ refreshBtn.dataset.listenerAttached = '1';
+ refreshBtn.addEventListener('click', () => {
+ container.innerHTML = ' Fetching live data...
';
+ fetchLiveResources(identifier);
+ });
+ }
+
+ } catch (err) {
+ if (container) {
+ container.innerHTML = html`
+
+ Could not load live resources: ${err.message}
+
+ `;
+ }
+ }
+}
+
+// ===== TAB SWITCHING =====
+function switchTab(tabBtn) {
+ if (!$('#tab-indicator')) return;
+ const tabName = tabBtn.dataset.tab;
+ state.serverDetailTab = tabName;
+
+ document.querySelectorAll('#server-detail-tabs .tab').forEach(t => t.classList.remove('active'));
+ tabBtn.classList.add('active');
+
+ document.querySelectorAll('#page-server-detail .tab-content').forEach(c => c.style.display = 'none');
+ const target = $('#server-tab-' + tabName);
+ if (target) target.style.display = 'block';
+
+ const indicator = $('#tab-indicator');
+ if (indicator) {
+ indicator.style.left = tabBtn.offsetLeft + 'px';
+ indicator.style.width = tabBtn.offsetWidth + 'px';
+ }
+
+ if (tabName === 'resources') {
+ const container = $('#live-resources-container');
+ if (container && container.querySelector('.resource-gauge') === null) {
+ fetchLiveResources(state.serverIdentifier);
+ }
+ }
+
+ const newUrl = `/server/${state.serverId}/${tabName}`;
+ history.pushState({ page: 'server', serverId: state.serverId, tab: tabName }, '', newUrl);
+}
+
+// ===== DELETE SERVER =====
+document.addEventListener('click', function(e) {
+ const tabBtn = e.target.closest('.tab');
+ if (tabBtn && !tabBtn.classList.contains('active')) {
+ e.preventDefault();
+ switchTab(tabBtn);
+ return;
+ }
+
+ const renewBtn = e.target.closest('.btn-renew-server');
+ if (renewBtn) {
+ e.preventDefault();
+ const serverId = parseInt(renewBtn.dataset.serverId);
+ renewBtn.disabled = true;
+ renewBtn.innerHTML = '';
+
+ api(`/servers/renew/${serverId}`, { method: 'POST' })
+ .then(() => {
+ showToast('Server renewed for another 90 days!', 'success');
+ if (state.currentPage === 'overview') renderOverview();
+ else if (state.currentPage === 'servers') renderServers();
+ })
+ .catch(err => {
+ showToast(err.message, 'error');
+ renewBtn.disabled = false;
+ renewBtn.innerHTML = 'Renew';
+ });
+ return;
+ }
+
+ const renameBtn = e.target.closest('.btn-rename-server');
+ if (renameBtn) {
+ e.preventDefault();
+ const serverId = parseInt(renameBtn.dataset.serverId);
+ const serverName = renameBtn.dataset.serverName;
+ const overlay = $('#modal-overlay');
+ const content = $('#modal-content');
+ content.innerHTML = html`
+ Rename Server
+
+ Enter a new name for ${serverName}.
+
+
+
+
+
+
+
+
+
+ `;
+ overlay.classList.add('open');
+ const input = $('#rename-server-input');
+ input.focus();
+ input.setSelectionRange(input.value.length, input.value.length);
+ return;
+ }
+
+ const reinstallBtn = e.target.closest('.btn-reinstall-server');
+ if (reinstallBtn) {
+ e.preventDefault();
+ const serverId = parseInt(reinstallBtn.dataset.serverId);
+ const serverName = reinstallBtn.dataset.serverName;
+ const overlay = $('#modal-overlay');
+ const content = $('#modal-content');
+ content.innerHTML = html`
+ Reinstall Server
+
+ Are you sure you want to reinstall ${serverName}?
+
+
+
+ This will delete all files, configurations, and data on the server and reinstall it from scratch.
+ Only do this if you are experiencing issues with the server.
+
+
+
+
+
+ `;
+ overlay.classList.add('open');
+ return;
+ }
+
+ const delBtn = e.target.closest('.btn-delete-server');
+ if (delBtn) {
+ e.preventDefault();
+ const serverId = parseInt(delBtn.dataset.serverId);
+ const serverName = delBtn.dataset.serverName;
+ const overlay = $('#modal-overlay');
+ const content = $('#modal-content');
+ content.innerHTML = html`
+ Delete Server
+
+ Are you sure you want to delete ${serverName}?
+ This action is irreversible and will permanently remove the server.
+
+
+
+
+
+ `;
+ overlay.classList.add('open');
+ return;
+ }
+
+ if (e.target.closest('.modal-cancel-btn') || e.target.closest('.modal-overlay') && !e.target.closest('.modal')) {
+ $('#modal-overlay').classList.remove('open');
+ return;
+ }
+
+ const confirmBtn = e.target.closest('#confirm-delete-btn');
+ if (confirmBtn) {
+ const serverId = parseInt(confirmBtn.dataset.serverId);
+ confirmBtn.disabled = true;
+ confirmBtn.innerHTML = ' Deleting...';
+
+ api(`/servers/${serverId}`, { method: 'DELETE' })
+ .then(() => {
+ $('#modal-overlay').classList.remove('open');
+ showToast('Server deleted successfully', 'success');
+ if (state.currentPage === 'overview') renderOverview();
+ else if (state.currentPage === 'servers') renderServers();
+ else navigateTo('servers');
+ })
+ .catch(err => {
+ showToast(err.message, 'error');
+ confirmBtn.disabled = false;
+ confirmBtn.innerHTML = 'Delete Forever';
+ });
+ return;
+ }
+
+ const confirmRenameBtn = e.target.closest('#confirm-rename-btn');
+ if (confirmRenameBtn) {
+ const serverId = parseInt(confirmRenameBtn.dataset.serverId);
+ const input = $('#rename-server-input');
+ const name = input.value.trim();
+ if (!name) {
+ showToast('Server name cannot be empty', 'error');
+ input.focus();
+ return;
+ }
+ confirmRenameBtn.disabled = true;
+ confirmRenameBtn.innerHTML = ' Renaming...';
+
+ api(`/servers/${serverId}`, { method: 'PATCH', body: JSON.stringify({ name }) })
+ .then(() => {
+ $('#modal-overlay').classList.remove('open');
+ showToast('Server renamed successfully', 'success');
+ renderServerDetail(serverId);
+ })
+ .catch(err => {
+ showToast(err.message, 'error');
+ confirmRenameBtn.disabled = false;
+ confirmRenameBtn.innerHTML = 'Rename';
+ });
+ return;
+ }
+
+ const confirmReinstallBtn = e.target.closest('#confirm-reinstall-btn');
+ if (confirmReinstallBtn) {
+ const serverId = parseInt(confirmReinstallBtn.dataset.serverId);
+ confirmReinstallBtn.disabled = true;
+ confirmReinstallBtn.innerHTML = ' Reinstalling...';
+
+ api(`/servers/${serverId}/reinstall`, { method: 'POST' })
+ .then(() => {
+ $('#modal-overlay').classList.remove('open');
+ showToast('Server reinstall has been initiated', 'success');
+ renderServerDetail(serverId);
+ })
+ .catch(err => {
+ showToast(err.message, 'error');
+ confirmReinstallBtn.disabled = false;
+ confirmReinstallBtn.innerHTML = 'Reinstall';
+ });
+ return;
+ }
+});
+
+// ===== RGPD: DATA EXPORT (Art. 15 & 20) =====
+async function handleExportData() {
+ const btn = $('#export-data-btn');
+ if (!btn) return;
+ btn.disabled = true;
+ btn.innerHTML = ' Exporting...';
+
+ try {
+ const data = await api('/auth/export-data');
+ const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+ const url = URL.createObjectURL(blob);
+ const a = document.createElement('a');
+ a.href = url;
+ a.download = `zerohost-data-export-${new Date().toISOString().slice(0, 10)}.json`;
+ document.body.appendChild(a);
+ a.click();
+ document.body.removeChild(a);
+ URL.revokeObjectURL(url);
+ showToast('Data exported successfully', 'success');
+ } catch (err) {
+ showToast('Failed to export data: ' + err.message, 'error');
+ } finally {
+ btn.disabled = false;
+ btn.innerHTML = ` Export My Data`;
+ }
+}
+
+// ===== INIT =====
+function init() {
+ const path = window.location.pathname;
+
+ // Skip if admin route - handled by admin.js
+ if (path.startsWith('/admin')) return;
+
+ const basePage = path.replace(/^\//, '').split('/')[0] || '';
+ const token = localStorage.getItem('zh_token');
+
+ if (token) {
+ state.token = token;
+ try {
+ const user = JSON.parse(localStorage.getItem('zh_user'));
+ if (user) state.user = user;
+ } catch {}
+ }
+
+ if (basePage === 'login' || basePage === 'signup') {
+ if (state.token) {
+ history.replaceState({ page: 'overview' }, '', '/');
+ renderDashboard();
+ } else if (basePage === 'login') {
+ renderLoginPage();
+ } else {
+ renderRegisterPage();
+ }
+ } else if (state.token) {
+ api('/servers/overview').then(() => {
+ renderDashboard();
+ fetchUnreadCount();
+ setInterval(fetchUnreadCount, 30000);
+ }).catch(() => {
+ renderDashboard();
+ });
+ } else {
+ renderLoginPage();
+ history.replaceState({ page: 'login' }, '', '/login');
+ }
+
+ renderCookieBanner();
+}
+
+init();
+
diff --git a/routes/admin.js b/routes/admin.js
index 19725fd..186efee 100644
--- a/routes/admin.js
+++ b/routes/admin.js
@@ -1,4 +1,5 @@
import { Router } from 'express';
+import rateLimit from 'express-rate-limit';
import argon2 from 'argon2';
import jwt from 'jsonwebtoken';
import { authenticateToken } from '../middleware/auth.js';
@@ -11,7 +12,15 @@ import { createNotification } from '../services/notification.js';
const router = Router();
const JWT_SECRET = process.env.JWT_SECRET;
const PTERO_URL = process.env.PTERO_URL;
-const PANEL_DB_NAME = process.env.PANEL_DB_NAME || 'panel';
+const PANEL_DB_NAME = (process.env.PANEL_DB_NAME || 'panel').replace(/[^a-zA-Z0-9_]/g, '');
+
+const adminLoginLimiter = rateLimit({
+ windowMs: 15 * 60 * 1000,
+ max: 10,
+ message: { error: 'Too many admin login attempts, try again later' },
+ standardHeaders: true,
+ legacyHeaders: false,
+});
function requireAdmin(req, res, next) {
if (!req.user?.isAdmin) {
@@ -20,13 +29,17 @@ function requireAdmin(req, res, next) {
next();
}
-router.post('/login', async (req, res) => {
+router.post('/login', adminLoginLimiter, async (req, res) => {
try {
const { email, password, capToken } = req.body;
if (!email || !password) {
return res.status(400).json({ error: 'Email and password are required' });
}
+ if (typeof email !== 'string' || typeof password !== 'string') {
+ return res.status(400).json({ error: 'Invalid input types' });
+ }
+
if (!await verifyCap(capToken)) {
return res.status(400).json({ error: 'Please complete the security check' });
}
@@ -125,7 +138,8 @@ router.post('/servers/:id/suspend', authenticateToken, requireAdmin, async (req,
return res.status(400).json({ error: 'Invalid server ID' });
}
- const reason = req.body.reason || 'Suspended by an Administrator. Please contact support.';
+ const reason = (req.body.reason && typeof req.body.reason === 'string')
+ ? req.body.reason.slice(0, 500) : 'Suspended by an Administrator. Please contact support.';
await suspendPteroServer(serverId);
await query('UPDATE server_meta SET status = ?, suspend_reason = ?, suspended_by = ? WHERE ptero_server_id = ?', ['suspended', reason, 'admin', serverId]);
@@ -406,12 +420,21 @@ router.post('/users/:id/notify', authenticateToken, requireAdmin, async (req, re
}
const { title, message, type } = req.body;
- if (!title || !title.trim()) {
+ if (typeof title !== 'string' || typeof message !== 'string') {
+ return res.status(400).json({ error: 'Invalid input types' });
+ }
+ if (!title.trim()) {
return res.status(400).json({ error: 'Title is required' });
}
- if (!message || !message.trim()) {
+ if (title.trim().length > 255) {
+ return res.status(400).json({ error: 'Title must be 255 characters or less' });
+ }
+ if (!message.trim()) {
return res.status(400).json({ error: 'Message is required' });
}
+ if (message.trim().length > 5000) {
+ return res.status(400).json({ error: 'Message must be 5000 characters or less' });
+ }
const users = await query('SELECT id FROM users WHERE id = ?', [userId]);
if (users.length === 0) {
@@ -431,6 +454,46 @@ router.post('/users/:id/notify', authenticateToken, requireAdmin, async (req, re
}
});
+router.post('/notify-all', authenticateToken, requireAdmin, async (req, res) => {
+ try {
+ const { title, message, type } = req.body;
+ if (typeof title !== 'string' || typeof message !== 'string') {
+ return res.status(400).json({ error: 'Invalid input types' });
+ }
+ if (!title.trim()) {
+ return res.status(400).json({ error: 'Title is required' });
+ }
+ if (title.trim().length > 255) {
+ return res.status(400).json({ error: 'Title must be 255 characters or less' });
+ }
+ if (!message.trim()) {
+ return res.status(400).json({ error: 'Message is required' });
+ }
+ if (message.trim().length > 5000) {
+ return res.status(400).json({ error: 'Message must be 5000 characters or less' });
+ }
+
+ const validTypes = ['info', 'success', 'warning', 'error'];
+ const notifType = validTypes.includes(type) ? type : 'info';
+
+ const users = await query('SELECT id FROM users');
+ if (users.length === 0) {
+ return res.status(404).json({ error: 'No users found' });
+ }
+
+ for (const user of users) {
+ await createNotification(user.id, title.trim(), message.trim(), notifType);
+ }
+
+ await logActivity(req.user.userId, 'admin_notify_all', `Sent notification to all ${users.length} user(s): ${title.trim()}`, null);
+
+ res.json({ success: true, count: users.length });
+ } catch (err) {
+ console.error('Admin notify-all error:', err.message);
+ res.status(500).json({ error: 'Failed to send notifications: ' + err.message });
+ }
+});
+
router.delete('/users/:id', authenticateToken, requireAdmin, async (req, res) => {
try {
const userId = parseInt(req.params.id, 10);
@@ -530,7 +593,7 @@ router.get('/settings/nests', authenticateToken, requireAdmin, async (req, res)
const nests = await query('SELECT * FROM nests ORDER BY name ASC');
res.json({ nests });
} catch (err) {
- res.status(500).json({ error: 'Failed to fetch nests' });
+ res.status(500).json({ error: 'Failed to fetch nests: ' + err.message });
}
});
@@ -550,6 +613,15 @@ router.post('/settings/nests', authenticateToken, requireAdmin, async (req, res)
try {
const { pteroNestId, name } = req.body;
if (!pteroNestId) return res.status(400).json({ error: 'Nest ID is required' });
+ if (typeof pteroNestId !== 'number' || isNaN(pteroNestId)) {
+ return res.status(400).json({ error: 'Nest ID must be a valid number' });
+ }
+ if (!name || typeof name !== 'string' || name.trim().length === 0) {
+ return res.status(400).json({ error: 'Nest name is required' });
+ }
+ if (name.trim().length > 255) {
+ return res.status(400).json({ error: 'Nest name must be 255 characters or less' });
+ }
const pteroNests = await getPteroNests();
const nest = pteroNests.find(n => n.id === pteroNestId);
@@ -570,12 +642,20 @@ router.post('/settings/nests', authenticateToken, requireAdmin, async (req, res)
router.put('/settings/nests/:id', authenticateToken, requireAdmin, async (req, res) => {
try {
const id = parseInt(req.params.id, 10);
- const { name } = req.body;
- if (!name) return res.status(400).json({ error: 'Name is required' });
- await query('UPDATE nests SET name = ? WHERE id = ?', [name, id]);
+ const { name, logo, description } = req.body;
+ if (name !== undefined && (typeof name !== 'string' || name.trim().length === 0)) return res.status(400).json({ error: 'Name cannot be empty' });
+ if (name && name.trim().length > 255) return res.status(400).json({ error: 'Name must be 255 characters or less' });
+ const updates = [];
+ const params = [];
+ if (name !== undefined) { updates.push('name = ?'); params.push(name.trim()); }
+ if (logo !== undefined) { updates.push('logo = ?'); params.push(logo || null); }
+ if (description !== undefined) { updates.push('description = ?'); params.push(description || null); }
+ if (updates.length === 0) return res.status(400).json({ error: 'No fields to update' });
+ params.push(id);
+ await query(`UPDATE nests SET ${updates.join(', ')} WHERE id = ?`, params);
res.json({ success: true });
} catch (err) {
- res.status(500).json({ error: 'Failed to rename nest' });
+ res.status(500).json({ error: 'Failed to update nest: ' + err.message });
}
});
@@ -615,10 +695,10 @@ router.get('/settings/nests/:nestId/eggs', authenticateToken, requireAdmin, asyn
router.get('/settings/eggs/:nestId/:eggId', authenticateToken, requireAdmin, async (req, res) => {
try {
const { nestId, eggId } = req.params;
- const [resources] = await query('SELECT * FROM egg_resources WHERE ptero_nest_id = ? AND ptero_egg_id = ?', [nestId, eggId]);
+ const [resources] = await query('SELECT * FROM egg_resources WHERE ptero_nest_id = ? AND ptero_egg_id = ?', [parseInt(nestId, 10), parseInt(eggId, 10)]);
let eggDetails = null;
try {
- eggDetails = await getEgg(nestId, eggId);
+ eggDetails = await getEgg(parseInt(nestId, 10), parseInt(eggId, 10));
} catch {}
res.json({ resources: resources || null, egg: eggDetails });
} catch (err) {
@@ -628,20 +708,38 @@ router.get('/settings/eggs/:nestId/:eggId', authenticateToken, requireAdmin, asy
router.put('/settings/eggs/:nestId/:eggId', authenticateToken, requireAdmin, async (req, res) => {
try {
- const { nestId, eggId } = req.params;
- const { cpu_limit, memory_limit, disk_limit } = req.body;
+ const nestId = parseInt(req.params.nestId, 10);
+ const eggId = parseInt(req.params.eggId, 10);
+ if (isNaN(nestId) || isNaN(eggId)) return res.status(400).json({ error: 'Invalid nest or egg ID' });
+ const { cpu_limit, memory_limit, disk_limit, logo } = req.body;
+
+ const sanitized = {
+ cpu_limit: (cpu_limit != null && !isNaN(Number(cpu_limit))) ? Number(cpu_limit) : null,
+ memory_limit: (memory_limit != null && !isNaN(Number(memory_limit))) ? Number(memory_limit) : null,
+ disk_limit: (disk_limit != null && !isNaN(Number(disk_limit))) ? Number(disk_limit) : null,
+ logo: logo !== undefined ? (logo || null) : undefined,
+ };
+
+ if (sanitized.cpu_limit != null && sanitized.cpu_limit < 0) return res.status(400).json({ error: 'CPU limit cannot be negative' });
+ if (sanitized.memory_limit != null && sanitized.memory_limit < 0) return res.status(400).json({ error: 'Memory limit cannot be negative' });
+ if (sanitized.disk_limit != null && sanitized.disk_limit < 0) return res.status(400).json({ error: 'Disk limit cannot be negative' });
const [existing] = await query('SELECT id FROM egg_resources WHERE ptero_nest_id = ? AND ptero_egg_id = ?', [nestId, eggId]);
if (existing) {
- await query('UPDATE egg_resources SET cpu_limit = ?, memory_limit = ?, disk_limit = ? WHERE id = ?',
- [cpu_limit ?? null, memory_limit ?? null, disk_limit ?? null, existing.id]);
+ const updates = ['cpu_limit = ?', 'memory_limit = ?', 'disk_limit = ?'];
+ const vals = [sanitized.cpu_limit, sanitized.memory_limit, sanitized.disk_limit];
+ if (sanitized.logo !== undefined) { updates.push('logo = ?'); vals.push(sanitized.logo); }
+ vals.push(existing.id);
+ await query(`UPDATE egg_resources SET ${updates.join(', ')} WHERE id = ?`, vals);
} else {
- await query('INSERT INTO egg_resources (ptero_nest_id, ptero_egg_id, cpu_limit, memory_limit, disk_limit) VALUES (?, ?, ?, ?, ?)',
- [nestId, eggId, cpu_limit ?? null, memory_limit ?? null, disk_limit ?? null]);
+ const cols = ['ptero_nest_id', 'ptero_egg_id', 'cpu_limit', 'memory_limit', 'disk_limit'];
+ const vals = [nestId, eggId, sanitized.cpu_limit, sanitized.memory_limit, sanitized.disk_limit];
+ if (sanitized.logo !== undefined) { cols.push('logo'); vals.push(sanitized.logo); }
+ await query(`INSERT INTO egg_resources (${cols.join(', ')}) VALUES (${cols.map(() => '?').join(', ')})`, vals);
}
res.json({ success: true });
} catch (err) {
- res.status(500).json({ error: 'Failed to save egg settings' });
+ res.status(500).json({ error: 'Failed to save egg settings: ' + err.message });
}
});
@@ -650,14 +748,24 @@ router.post('/settings/eggs/:nestId/:eggId/apply-all', authenticateToken, requir
const { nestId, eggId } = req.params;
const { cpu_limit, memory_limit, disk_limit } = req.body;
+ const sanitized = {
+ cpu_limit: (cpu_limit != null && !isNaN(Number(cpu_limit))) ? Number(cpu_limit) : null,
+ memory_limit: (memory_limit != null && !isNaN(Number(memory_limit))) ? Number(memory_limit) : null,
+ disk_limit: (disk_limit != null && !isNaN(Number(disk_limit))) ? Number(disk_limit) : null,
+ };
+
+ if (sanitized.cpu_limit != null && sanitized.cpu_limit < 0) return res.status(400).json({ error: 'CPU limit cannot be negative' });
+ if (sanitized.memory_limit != null && sanitized.memory_limit < 0) return res.status(400).json({ error: 'Memory limit cannot be negative' });
+ if (sanitized.disk_limit != null && sanitized.disk_limit < 0) return res.status(400).json({ error: 'Disk limit cannot be negative' });
+
// Save to egg_resources first
const [existing] = await query('SELECT id FROM egg_resources WHERE ptero_nest_id = ? AND ptero_egg_id = ?', [nestId, eggId]);
if (existing) {
await query('UPDATE egg_resources SET cpu_limit = ?, memory_limit = ?, disk_limit = ? WHERE id = ?',
- [cpu_limit ?? null, memory_limit ?? null, disk_limit ?? null, existing.id]);
+ [sanitized.cpu_limit, sanitized.memory_limit, sanitized.disk_limit, existing.id]);
} else {
await query('INSERT INTO egg_resources (ptero_nest_id, ptero_egg_id, cpu_limit, memory_limit, disk_limit) VALUES (?, ?, ?, ?, ?)',
- [nestId, eggId, cpu_limit ?? null, memory_limit ?? null, disk_limit ?? null]);
+ [nestId, eggId, sanitized.cpu_limit, sanitized.memory_limit, sanitized.disk_limit]);
}
// Find all panel servers using this egg
@@ -668,9 +776,9 @@ router.post('/settings/eggs/:nestId/:eggId/apply-all', authenticateToken, requir
}
const limits = {};
- if (cpu_limit != null) limits.cpu = cpu_limit;
- if (memory_limit != null) limits.memory = memory_limit;
- if (disk_limit != null) limits.disk = disk_limit;
+ if (sanitized.cpu_limit != null) limits.cpu = sanitized.cpu_limit;
+ if (sanitized.memory_limit != null) limits.memory = sanitized.memory_limit;
+ if (sanitized.disk_limit != null) limits.disk = sanitized.disk_limit;
let updated = 0;
for (const id of pteroIds) {
diff --git a/routes/auth.js b/routes/auth.js
index 432d28c..f5b66a8 100644
--- a/routes/auth.js
+++ b/routes/auth.js
@@ -1,9 +1,10 @@
import { Router } from 'express';
+import rateLimit from 'express-rate-limit';
import argon2 from 'argon2';
import jwt from 'jsonwebtoken';
import { readdir, writeFile, unlink, mkdir } from 'fs/promises';
import { existsSync } from 'fs';
-import { join, dirname, extname } from 'path';
+import { join, dirname, extname, resolve } from 'path';
import { fileURLToPath } from 'url';
import { query } from '../config/db.js';
import { generateToken, authenticateToken } from '../middleware/auth.js';
@@ -16,8 +17,55 @@ const UPLOAD_DIR = join(__dirname, '..', 'uploads', 'avatars');
const router = Router();
+const loginAttempts = new Map();
+
+function getLoginDelay(ip) {
+ const now = Date.now();
+ const entry = loginAttempts.get(ip);
+ if (!entry) return 0;
+ const sinceFirst = now - entry.firstAttempt;
+ if (sinceFirst > 15 * 60 * 1000) {
+ loginAttempts.delete(ip);
+ return 0;
+ }
+ if (entry.count <= 3) return 0;
+ if (entry.count <= 5) return 1000;
+ if (entry.count <= 8) return 3000;
+ if (entry.count <= 12) return 5000;
+ return 10000;
+}
+
+function recordLoginAttempt(ip, success) {
+ if (success) {
+ loginAttempts.delete(ip);
+ return;
+ }
+ const now = Date.now();
+ const entry = loginAttempts.get(ip);
+ if (entry) {
+ entry.count++;
+ } else {
+ loginAttempts.set(ip, { count: 1, firstAttempt: now });
+ }
+}
+
+setInterval(() => {
+ const cutoff = Date.now() - 15 * 60 * 1000;
+ for (const [ip, entry] of loginAttempts) {
+ if (entry.firstAttempt < cutoff) loginAttempts.delete(ip);
+ }
+}, 60 * 1000);
+
const MIME_TYPES = { png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif', webp: 'image/webp' };
+const sensitiveLimiter = rateLimit({
+ windowMs: 15 * 60 * 1000,
+ max: 5,
+ message: { error: 'Too many sensitive operations, try again later' },
+ standardHeaders: true,
+ legacyHeaders: false,
+});
+
function getClientIp(req) {
const forwarded = req.headers['x-forwarded-for'];
if (forwarded) return forwarded.split(',')[0].trim();
@@ -48,11 +96,17 @@ async function isVpnOrProxy(ip) {
}
}
+const MAX_EMAIL_LENGTH = 254;
+const MAX_USERNAME_LENGTH = 32;
+const MAX_PASSWORD_LENGTH = 128;
+
function validateEmail(email) {
+ if (typeof email !== 'string' || email.length > MAX_EMAIL_LENGTH) return false;
return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email);
}
function validateUsername(username) {
+ if (typeof username !== 'string' || username.length > MAX_USERNAME_LENGTH) return false;
return /^[a-zA-Z0-9_-]{3,32}$/.test(username);
}
@@ -61,10 +115,20 @@ router.post('/register', async (req, res) => {
try {
const { email, username, password, capToken, rgpdConsent } = req.body;
+ const ip = getClientIp(req);
+ const delay = getLoginDelay(ip);
+ if (delay > 0) {
+ await new Promise(r => setTimeout(r, delay));
+ }
+
if (!email || !username || !password) {
return res.status(400).json({ error: 'Email, username and password are required' });
}
+ if (typeof email !== 'string' || typeof username !== 'string' || typeof password !== 'string') {
+ return res.status(400).json({ error: 'Invalid input types' });
+ }
+
if (!rgpdConsent) {
return res.status(400).json({ error: 'You must accept the privacy policy to create an account.' });
}
@@ -77,27 +141,28 @@ router.post('/register', async (req, res) => {
return res.status(400).json({ error: 'Username must be 3-32 chars (letters, numbers, underscore, hyphen)' });
}
- if (password.length < 8) {
- return res.status(400).json({ error: 'Password must be at least 8 characters' });
+ if (password.length < 8 || password.length > MAX_PASSWORD_LENGTH) {
+ return res.status(400).json({ error: 'Password must be between 8 and 128 characters' });
}
if (!await verifyCap(capToken)) {
+ recordLoginAttempt(ip, false);
return res.status(400).json({ error: 'Please complete the security check' });
}
- const ip = getClientIp(req);
-
if (await isVpnOrProxy(ip)) {
return res.status(403).json({ error: 'VPNs and proxies are not allowed. Please disable them to register.' });
}
const ipCount = await query('SELECT COUNT(DISTINCT user_id) AS cnt FROM user_ips WHERE ip_address = ?', [ip]);
if (ipCount[0].cnt >= 2) {
+ recordLoginAttempt(ip, false);
return res.status(403).json({ error: 'Too many accounts registered from this IP address.' });
}
const existing = await query('SELECT id FROM users WHERE email = ? OR username = ?', [email, username]);
if (existing.length > 0) {
+ recordLoginAttempt(ip, false);
return res.status(409).json({ error: 'Email or username already exists' });
}
@@ -143,6 +208,8 @@ router.post('/register', async (req, res) => {
await logActivity(localUserId, 'account_registered', 'Created account');
+ recordLoginAttempt(ip, true);
+
res.status(201).json({
token,
user: {
@@ -177,19 +244,27 @@ router.post('/login', async (req, res) => {
return res.status(400).json({ error: 'Email and password are required' });
}
+ const ip = getClientIp(req);
+ const delay = getLoginDelay(ip);
+ if (delay > 0) {
+ await new Promise(r => setTimeout(r, delay));
+ }
+
// Cap verification
if (!await verifyCap(capToken)) {
+ recordLoginAttempt(ip, false);
return res.status(400).json({ error: 'Please complete the security check' });
}
// VPN / Proxy detection
- const ip = getClientIp(req);
+
if (await isVpnOrProxy(ip)) {
return res.status(403).json({ error: 'VPNs and proxies are not allowed. Please disable them to sign in.' });
}
const users = await query('SELECT * FROM users WHERE email = ?', [email]);
if (users.length === 0) {
+ recordLoginAttempt(ip, false);
if (process.env.NODE_ENV !== 'production') console.log('[LOGIN] User not found for email:', email);
return res.status(401).json({ error: 'Invalid email or password' });
}
@@ -204,6 +279,7 @@ router.post('/login', async (req, res) => {
const validPassword = await argon2.verify(user.password_hash, password, { type: argon2.argon2id });
if (!validPassword) {
+ recordLoginAttempt(ip, false);
if (process.env.NODE_ENV !== 'production') console.log('[LOGIN] Password mismatch for user:', user.id);
return res.status(401).json({ error: 'Invalid email or password' });
}
@@ -224,6 +300,8 @@ router.post('/login', async (req, res) => {
maxAge: 2 * 60 * 60 * 1000,
});
+ recordLoginAttempt(ip, true);
+
res.json({
token,
user: {
@@ -243,7 +321,7 @@ router.post('/login', async (req, res) => {
}
});
-router.post('/change-password', authenticateToken, async (req, res) => {
+router.post('/change-password', authenticateToken, sensitiveLimiter, async (req, res) => {
try {
const { currentPassword, newPassword } = req.body;
const pteroId = req.user?.pteroId;
@@ -252,8 +330,12 @@ router.post('/change-password', authenticateToken, async (req, res) => {
return res.status(400).json({ error: 'Current password and new password are required' });
}
- if (newPassword.length < 8) {
- return res.status(400).json({ error: 'New password must be at least 8 characters' });
+ if (typeof currentPassword !== 'string' || typeof newPassword !== 'string') {
+ return res.status(400).json({ error: 'Invalid input types' });
+ }
+
+ if (newPassword.length < 8 || newPassword.length > MAX_PASSWORD_LENGTH) {
+ return res.status(400).json({ error: 'New password must be between 8 and 128 characters' });
}
const users = await query('SELECT * FROM users WHERE ptero_user_id = ?', [pteroId]);
@@ -275,7 +357,7 @@ router.post('/change-password', authenticateToken, async (req, res) => {
parallelism: 4,
});
- await query('UPDATE users SET password_hash = ? WHERE id = ?', [passwordHash, user.id]);
+ await query('UPDATE users SET password_hash = ?, token_version = token_version + 1 WHERE id = ?', [passwordHash, user.id]);
try {
await updatePteroPassword(pteroId, newPassword);
@@ -291,7 +373,7 @@ router.post('/change-password', authenticateToken, async (req, res) => {
}
});
-router.post('/change-email', authenticateToken, async (req, res) => {
+router.post('/change-email', authenticateToken, sensitiveLimiter, async (req, res) => {
try {
const { newEmail, password } = req.body;
const pteroId = req.user?.pteroId;
@@ -301,6 +383,10 @@ router.post('/change-email', authenticateToken, async (req, res) => {
return res.status(400).json({ error: 'New email and password are required' });
}
+ if (typeof newEmail !== 'string' || typeof password !== 'string') {
+ return res.status(400).json({ error: 'Invalid input types' });
+ }
+
if (!validateEmail(newEmail)) {
return res.status(400).json({ error: 'Invalid email format' });
}
@@ -364,7 +450,7 @@ router.post('/change-email', authenticateToken, async (req, res) => {
}
});
-router.post('/delete-account', authenticateToken, async (req, res) => {
+router.post('/delete-account', authenticateToken, sensitiveLimiter, async (req, res) => {
try {
const { password } = req.body;
const userId = req.user?.userId;
@@ -434,7 +520,7 @@ router.post('/delete-account', authenticateToken, async (req, res) => {
}
});
-router.post('/upload-avatar', authenticateToken, async (req, res) => {
+router.post('/upload-avatar', authenticateToken, sensitiveLimiter, async (req, res) => {
try {
const { image } = req.body;
if (!image) {
@@ -447,6 +533,11 @@ router.post('/upload-avatar', authenticateToken, async (req, res) => {
}
const ext = matches[1] === 'jpeg' ? 'jpg' : matches[1];
+
+ if (!MIME_TYPES[ext]) {
+ return res.status(400).json({ error: 'Unsupported image format' });
+ }
+
const data = Buffer.from(matches[2], 'base64');
if (data.length > 2 * 1024 * 1024) {
@@ -465,7 +556,12 @@ router.post('/upload-avatar', authenticateToken, async (req, res) => {
}
const filename = `avatar_${req.user.userId}.${ext}`;
- await writeFile(join(UPLOAD_DIR, filename), data);
+ const filePath = join(UPLOAD_DIR, filename);
+ const resolvedPath = resolve(filePath);
+ if (!resolvedPath.startsWith(resolve(UPLOAD_DIR))) {
+ return res.status(403).json({ error: 'Access denied' });
+ }
+ await writeFile(resolvedPath, data);
await query('UPDATE users SET avatar = ? WHERE id = ?', [filename, req.user.userId]);
@@ -514,11 +610,16 @@ router.get('/avatar/:userId', async (req, res) => {
return res.status(404).json({ error: 'No avatar found' });
}
+ const resolvedPath = resolve(join(UPLOAD_DIR, avatarFile));
+ if (!resolvedPath.startsWith(UPLOAD_DIR)) {
+ return res.status(403).json({ error: 'Access denied' });
+ }
+
const mimeType = MIME_TYPES[extname(avatarFile).toLowerCase().slice(1)] || 'application/octet-stream';
res.set('Content-Type', mimeType);
res.set('Cache-Control', 'private, max-age=3600');
- res.sendFile(join(UPLOAD_DIR, avatarFile));
+ res.sendFile(resolvedPath);
} catch (err) {
if (err.name === 'JsonWebTokenError' || err.name === 'TokenExpiredError') {
return res.status(401).json({ error: 'Invalid or expired token' });
@@ -533,7 +634,7 @@ router.post('/logout', (req, res) => {
res.json({ message: 'Logged out' });
});
-router.get('/export-data', authenticateToken, async (req, res) => {
+router.get('/export-data', authenticateToken, sensitiveLimiter, async (req, res) => {
try {
const userId = req.user.userId;
const pteroId = req.user.pteroId;
diff --git a/routes/notifications.js b/routes/notifications.js
index 1e0e245..7f17a64 100644
--- a/routes/notifications.js
+++ b/routes/notifications.js
@@ -35,7 +35,7 @@ router.get('/unread-count', authenticateToken, async (req, res) => {
router.patch('/:id/read', authenticateToken, async (req, res) => {
try {
const id = parseInt(req.params.id, 10);
- if (isNaN(id)) return res.status(400).json({ error: 'Invalid notification ID' });
+ if (isNaN(id) || id < 1) return res.status(400).json({ error: 'Invalid notification ID' });
await markAsRead(id, req.user.userId);
res.json({ success: true });
} catch (err) {
diff --git a/routes/servers.js b/routes/servers.js
index bcdb575..c3bb030 100644
--- a/routes/servers.js
+++ b/routes/servers.js
@@ -1,4 +1,5 @@
import { Router } from 'express';
+import rateLimit from 'express-rate-limit';
import { authenticateToken } from '../middleware/auth.js';
import {
getServersByUser,
@@ -19,6 +20,46 @@ import { createNotification } from '../services/notification.js';
const router = Router();
+const createServerLimiter = rateLimit({
+ windowMs: 60 * 60 * 1000,
+ max: 3,
+ message: { error: 'Server creation limit reached. Max 3 per hour.' },
+ standardHeaders: true,
+ legacyHeaders: false,
+});
+
+const renameLimiter = rateLimit({
+ windowMs: 60 * 60 * 1000,
+ max: 10,
+ message: { error: 'Too many rename requests. Max 10 per hour.' },
+ standardHeaders: true,
+ legacyHeaders: false,
+});
+
+const renewLimiter = rateLimit({
+ windowMs: 60 * 60 * 1000,
+ max: 5,
+ message: { error: 'Too many renew requests. Max 5 per hour.' },
+ standardHeaders: true,
+ legacyHeaders: false,
+});
+
+const reinstallLimiter = rateLimit({
+ windowMs: 24 * 60 * 60 * 1000,
+ max: 2,
+ message: { error: 'Too many reinstall requests. Max 2 per day.' },
+ standardHeaders: true,
+ legacyHeaders: false,
+});
+
+const powerLimiter = rateLimit({
+ windowMs: 60 * 1000,
+ max: 20,
+ message: { error: 'Too many power actions. Max 20 per minute.' },
+ standardHeaders: true,
+ legacyHeaders: false,
+});
+
router.get('/list', authenticateToken, async (req, res) => {
try {
const pteroId = req.user.pteroId;
@@ -74,6 +115,58 @@ router.get('/list', authenticateToken, async (req, res) => {
}
});
+router.get('/nests', authenticateToken, async (req, res) => {
+ try {
+ const dbNests = await query('SELECT ptero_nest_id, name, logo, description FROM nests');
+ const nestIds = dbNests.map(n => n.ptero_nest_id);
+
+ const eggs = await getAllEggs(nestIds);
+ const nestMap = {};
+ for (const n of dbNests) {
+ nestMap[n.ptero_nest_id] = n;
+ }
+
+ const eggResources = await query('SELECT ptero_nest_id, ptero_egg_id, logo, cpu_limit, memory_limit, disk_limit FROM egg_resources');
+ const eggResMap = {};
+ for (const r of eggResources) {
+ eggResMap[`${r.ptero_nest_id}-${r.ptero_egg_id}`] = r;
+ }
+
+ const result = [];
+ const nestEggs = {};
+ for (const { nest, egg } of eggs) {
+ if (!nestEggs[nest]) nestEggs[nest] = [];
+ const key = `${nest}-${egg.id}`;
+ const res = eggResMap[key] || {};
+ nestEggs[nest].push({
+ eggId: egg.id,
+ name: egg.name,
+ description: egg.description || '',
+ dockerImages: egg.docker_images || {},
+ logo: res.logo || null,
+ cpu_limit: res.cpu_limit ?? null,
+ memory_limit: res.memory_limit ?? null,
+ disk_limit: res.disk_limit ?? null,
+ });
+ }
+
+ for (const n of dbNests) {
+ result.push({
+ pteroNestId: n.ptero_nest_id,
+ name: n.name,
+ logo: n.logo || null,
+ description: n.description || '',
+ eggs: nestEggs[n.ptero_nest_id] || [],
+ });
+ }
+
+ res.json({ nests: result });
+ } catch (err) {
+ console.error('Get nests error:', err.message);
+ res.status(500).json({ error: 'Failed to fetch nests: ' + err.message });
+ }
+});
+
router.get('/eggs', authenticateToken, async (req, res) => {
try {
const dbNests = await query('SELECT ptero_nest_id, name FROM nests');
@@ -107,9 +200,9 @@ router.get('/eggs', authenticateToken, async (req, res) => {
}
});
-router.post('/create', authenticateToken, async (req, res) => {
+router.post('/create', authenticateToken, createServerLimiter, async (req, res) => {
try {
- const { name, nestId, eggId, environment, capToken } = req.body;
+ const { name, nestId, eggId, environment, capToken, dockerImage: reqDockerImage } = req.body;
const pteroId = req.user.pteroId;
const userCheck = await query('SELECT restricted FROM users WHERE id = ?', [req.user.userId]);
@@ -117,6 +210,10 @@ router.post('/create', authenticateToken, async (req, res) => {
return res.status(403).json({ error: 'Your account is restricted. Server creation is disabled.' });
}
+ if (typeof name !== 'string') {
+ return res.status(400).json({ error: 'Server name must be a string' });
+ }
+
if (!name || !nestId || !eggId) {
return res.status(400).json({ error: 'Name, nest ID and egg ID are required' });
}
@@ -125,6 +222,10 @@ router.post('/create', authenticateToken, async (req, res) => {
return res.status(400).json({ error: 'Server name must be between 1 and 255 characters' });
}
+ if (!/^[a-zA-Z0-9 _.-]+$/.test(name)) {
+ return res.status(400).json({ error: 'Server name contains invalid characters' });
+ }
+
if (!await verifyCap(capToken)) {
return res.status(400).json({ error: 'Please complete the security check' });
}
@@ -135,7 +236,16 @@ router.post('/create', authenticateToken, async (req, res) => {
}
const egg = await getEgg(nestId, eggId);
- const dockerImage = Object.values(egg.docker_images)[0] || Object.keys(egg.docker_images)[0];
+ let dockerImage;
+ if (reqDockerImage && egg.docker_images) {
+ if (egg.docker_images[reqDockerImage]) {
+ dockerImage = egg.docker_images[reqDockerImage];
+ } else {
+ dockerImage = reqDockerImage;
+ }
+ } else {
+ dockerImage = Object.values(egg.docker_images || {})[0] || Object.keys(egg.docker_images || {})[0];
+ }
const eggVars = await query(`SELECT env_variable, default_value FROM ${PANEL_DB_NAME}.egg_variables WHERE egg_id = ?`, [eggId]);
@@ -222,7 +332,7 @@ router.get('/details/:id', authenticateToken, async (req, res) => {
}
});
-router.post('/renew/:id', authenticateToken, async (req, res) => {
+router.post('/renew/:id', authenticateToken, renewLimiter, async (req, res) => {
try {
const serverId = parseInt(req.params.id, 10);
if (isNaN(serverId)) {
@@ -292,7 +402,7 @@ router.post('/renew/:id', authenticateToken, async (req, res) => {
}
});
-router.patch('/:id', authenticateToken, async (req, res) => {
+router.patch('/:id', authenticateToken, renameLimiter, async (req, res) => {
try {
const { name } = req.body;
const serverId = parseInt(req.params.id, 10);
@@ -301,12 +411,15 @@ router.patch('/:id', authenticateToken, async (req, res) => {
}
const pteroId = req.user.pteroId;
- if (!name || typeof name !== 'string' || name.trim().length === 0) {
+ if (typeof name !== 'string' || name.trim().length === 0) {
return res.status(400).json({ error: 'Server name is required' });
}
- if (name.length > 255) {
+ if (name.trim().length > 255) {
return res.status(400).json({ error: 'Server name must be 255 characters or less' });
}
+ if (!/^[a-zA-Z0-9 _.-]+$/.test(name.trim())) {
+ return res.status(400).json({ error: 'Server name contains invalid characters' });
+ }
const servers = await getServersByUser(pteroId);
const owned = servers.find(s => s.id === serverId);
@@ -324,7 +437,7 @@ router.patch('/:id', authenticateToken, async (req, res) => {
}
});
-router.post('/:id/reinstall', authenticateToken, async (req, res) => {
+router.post('/:id/reinstall', authenticateToken, reinstallLimiter, async (req, res) => {
try {
const serverId = parseInt(req.params.id, 10);
if (isNaN(serverId)) {
@@ -446,12 +559,17 @@ router.get('/resources/:identifier', authenticateToken, async (req, res) => {
}
});
-router.post('/power/:identifier', authenticateToken, async (req, res) => {
+router.post('/power/:identifier', authenticateToken, powerLimiter, async (req, res) => {
try {
const { identifier } = req.params;
const { signal } = req.body;
const userId = req.user.userId;
+ const VALID_SIGNALS = ['start', 'stop', 'restart', 'kill'];
+ if (!signal || typeof signal !== 'string' || !VALID_SIGNALS.includes(signal)) {
+ return res.status(400).json({ error: 'Invalid power signal. Valid signals: start, stop, restart, kill' });
+ }
+
const users = await query('SELECT ptero_client_api_key FROM users WHERE id = ?', [userId]);
if (!users[0]?.ptero_client_api_key) {
return res.status(400).json({ error: 'No Pyrodactyl API key configured' });
@@ -501,6 +619,10 @@ router.put('/client-api-key', authenticateToken, async (req, res) => {
return res.status(400).json({ error: 'API key is required' });
}
+ if (apiKey.trim().length > 255) {
+ return res.status(400).json({ error: 'API key must be 255 characters or less' });
+ }
+
await query('UPDATE users SET ptero_client_api_key = ? WHERE id = ?', [apiKey.trim(), userId]);
await logActivity(req.user.userId, 'api_key_updated', 'Updated Pyrodactyl API key');
diff --git a/server.js b/server.js
index ad69275..aa7203c 100644
--- a/server.js
+++ b/server.js
@@ -6,6 +6,18 @@ import { readFile } from 'fs/promises';
const __dirname = dirname(fileURLToPath(import.meta.url));
dotenv.config({ path: resolve(__dirname, '.env') });
+const REQUIRED_ENV_VARS = ['JWT_SECRET', 'DB_HOST', 'DB_USER', 'DB_PASSWORD', 'DB_NAME', 'CAP_SECRET', 'CAP_ENDPOINT', 'COOKIE_SECRET'];
+const missing = REQUIRED_ENV_VARS.filter(v => !process.env[v]);
+if (missing.length > 0) {
+ console.error(`Missing required environment variables: ${missing.join(', ')}`);
+ process.exit(1);
+}
+
+if (process.env.JWT_SECRET && /[\$\(\)]/.test(process.env.JWT_SECRET)) {
+ console.error('JWT_SECRET contains unresolved shell expansion characters. Generate a proper random key.');
+ process.exit(1);
+}
+
import express from 'express';
import helmet from 'helmet';
import cors from 'cors';
@@ -13,14 +25,15 @@ import cookieParser from 'cookie-parser';
import rateLimit from 'express-rate-limit';
import jwt from 'jsonwebtoken';
import path from 'path';
+import crypto from 'crypto';
import authRoutes from './routes/auth.js';
import serverRoutes from './routes/servers.js';
import adminRoutes from './routes/admin.js';
import notificationRoutes from './routes/notifications.js';
-import { startScheduler } from './services/scheduler.js';
+import { startScheduler, stopScheduler } from './services/scheduler.js';
import { migrate } from './config/migrate.js';
-import { query } from './config/db.js';
+import { query, closePool, getPoolStatus } from './config/db.js';
import { getRecentActivity } from './services/activity.js';
const app = express();
@@ -35,11 +48,43 @@ async function getPort() {
}
const PORT = process.env.PORT || await getPort();
+const SHUTDOWN_TIMEOUT = parseInt(process.env.SHUTDOWN_TIMEOUT, 10) || 10000;
const trustProxy = process.env.NODE_ENV === 'production';
app.set('trust proxy', trustProxy ? 1 : 0);
+app.use((req, res, next) => {
+ req.requestId = crypto.randomUUID();
+ res.setHeader('X-Request-Id', req.requestId);
+ res.setHeader('X-Content-Type-Options', 'nosniff');
+ next();
+});
+
+const activeRequests = new Map();
+
+app.use((req, res, next) => {
+ const ip = req.ip || req.socket.remoteAddress || '0.0.0.0';
+ const count = (activeRequests.get(ip) || 0) + 1;
+ if (count > 20) {
+ return res.status(429).json({ error: 'Too many concurrent requests' });
+ }
+ activeRequests.set(ip, count);
+ res.on('finish', () => {
+ const c = activeRequests.get(ip);
+ if (c && c <= 1) activeRequests.delete(ip);
+ else if (c) activeRequests.set(ip, c - 1);
+ });
+ next();
+});
+
+app.use((req, res, next) => {
+ res.setTimeout(30000, () => {
+ res.status(503).json({ error: 'Request timeout', requestId: req.requestId });
+ });
+ next();
+});
+
app.use(helmet({
contentSecurityPolicy: {
directives: {
@@ -53,6 +98,7 @@ app.use(helmet({
workerSrc: ["'self'", "blob:"],
frameSrc: ["https://cap.zero-host.org"],
objectSrc: ["'none'"],
+ upgradeInsecureRequests: [],
},
},
hsts: {
@@ -76,8 +122,41 @@ app.use(cors({
}));
app.use(express.json({ limit: '1mb' }));
+app.use(express.urlencoded({ extended: false, limit: '1mb' }));
+
+app.use((req, res, next) => {
+ if (req.path.startsWith('/api/') && !['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(req.method)) {
+ return res.status(405).json({ error: 'Method not allowed', requestId: req.requestId });
+ }
+ next();
+});
+
+app.use((req, res, next) => {
+ if (['POST', 'PUT', 'PATCH'].includes(req.method) && req.path.startsWith('/api/')) {
+ const ct = req.headers['content-type'] || '';
+ if (!ct.startsWith('application/json') && !ct.startsWith('application/x-www-form-urlencoded') && !ct.startsWith('multipart/form-data')) {
+ return res.status(415).json({ error: 'Unsupported content type. Use application/json.', requestId: req.requestId });
+ }
+ }
+ next();
+});
+
+app.use((err, req, res, next) => {
+ if (err instanceof SyntaxError && err.status === 400 && 'body' in err) {
+ return res.status(400).json({ error: 'Invalid JSON in request body', requestId: req.requestId });
+ }
+ next();
+});
app.use(cookieParser(process.env.COOKIE_SECRET));
+app.use((req, res, next) => {
+ res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+ res.setHeader('X-Robots-Tag', 'noindex, nofollow');
+ res.setHeader('X-DNS-Prefetch-Control', 'off');
+ res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
+ next();
+});
+
const authLimiter = rateLimit({
windowMs: 15 * 60 * 1000,
max: 20,
@@ -96,10 +175,49 @@ const apiLimiter = rateLimit({
trustProxy: trustProxy ? 1 : 0,
});
+const activityLimiter = rateLimit({
+ windowMs: 60 * 1000,
+ max: 30,
+ message: { error: 'Too many requests' },
+ standardHeaders: true,
+ legacyHeaders: false,
+ trustProxy: trustProxy ? 1 : 0,
+});
+
app.use('/api/auth/login', authLimiter);
app.use('/api/auth/register', authLimiter);
+app.use('/api/activity', activityLimiter);
+app.use('/api/notifications', authLimiter);
+app.use('/api/servers', apiLimiter);
app.use('/api', apiLimiter);
+const userRateMap = new Map();
+const USER_RATE_MAX = 200;
+const USER_RATE_WINDOW = 60000;
+
+app.use('/api', (req, res, next) => {
+ const userId = req.user?.userId;
+ if (!userId) return next();
+ const now = Date.now();
+ let entry = userRateMap.get(userId);
+ if (!entry || now - entry.windowStart > USER_RATE_WINDOW) {
+ entry = { count: 0, windowStart: now };
+ userRateMap.set(userId, entry);
+ }
+ entry.count++;
+ if (entry.count > USER_RATE_MAX) {
+ return res.status(429).json({ error: 'User rate limit exceeded. Slow down.', requestId: req.requestId });
+ }
+ next();
+});
+
+setInterval(() => {
+ const cutoff = Date.now() - USER_RATE_WINDOW;
+ for (const [uid, entry] of userRateMap) {
+ if (entry.windowStart < cutoff) userRateMap.delete(uid);
+ }
+}, 60000);
+
app.use('/api/auth', authRoutes);
app.use('/api/servers', serverRoutes);
app.use('/api/admin', adminRoutes);
@@ -130,7 +248,7 @@ app.get('/api/activity', async (req, res) => {
if (err.name === 'JsonWebTokenError' || err.name === 'TokenExpiredError') {
return res.status(401).json({ error: 'Invalid or expired token' });
}
- console.error('Activity route error:', err.message, err.stack?.split('\n')[1]);
+ console.error(`[${req.requestId}] Activity route error:`, err.message, err.stack?.split('\n')[1]);
res.status(500).json({ error: 'Failed to fetch activities' });
}
});
@@ -138,9 +256,23 @@ app.get('/api/activity', async (req, res) => {
app.get('/api/health', async (req, res) => {
try {
await query('SELECT 1');
- res.json({ status: 'ok', db: 'connected', timestamp: new Date().toISOString() });
+ const poolStats = await getPoolStatus();
+ const memUsage = process.memoryUsage();
+ res.json({
+ status: 'ok',
+ db: 'connected',
+ pool: poolStats,
+ memory: {
+ rss: Math.round(memUsage.rss / 1024 / 1024) + 'MB',
+ heapTotal: Math.round(memUsage.heapTotal / 1024 / 1024) + 'MB',
+ heapUsed: Math.round(memUsage.heapUsed / 1024 / 1024) + 'MB',
+ },
+ uptime: Math.floor(process.uptime()),
+ timestamp: new Date().toISOString(),
+ requestId: req.requestId,
+ });
} catch {
- res.status(503).json({ status: 'error', db: 'disconnected', timestamp: new Date().toISOString() });
+ res.status(503).json({ status: 'error', db: 'disconnected', timestamp: new Date().toISOString(), requestId: req.requestId });
}
});
@@ -164,26 +296,56 @@ app.get('*', (req, res) => {
});
app.use((err, req, res, _next) => {
- console.error('Unhandled error:', err);
- res.status(500).json({ error: 'Internal server error' });
+ console.error(`[${req.requestId}] Unhandled error:`, err);
+ const message = process.env.NODE_ENV === 'production' ? 'Internal server error' : err.message;
+ res.status(err.status || 500).json({ error: message, requestId: req.requestId });
+});
+
+migrate().then(() => {
+ const server = app.listen(PORT, () => {
+ console.log(`ZeroHost Dashboard running on port ${PORT}`);
+ startScheduler();
+ });
+
+ function shutdown(signal) {
+ console.log(`\nReceived ${signal}, shutting down gracefully...`);
+ stopScheduler();
+ server.close(() => {
+ closePool();
+ process.exit(0);
+ });
+ setTimeout(() => {
+ console.error('Forced shutdown after timeout');
+ process.exit(1);
+ }, SHUTDOWN_TIMEOUT);
+ }
+
+ process.on('SIGTERM', () => shutdown('SIGTERM'));
+ process.on('SIGINT', () => shutdown('SIGINT'));
+}).catch(err => {
+ console.error('Migration failed:', err);
+ process.exit(1);
});
process.on('unhandledRejection', (reason) => {
console.error('Unhandled Promise rejection:', reason);
- process.exit(1);
});
process.on('uncaughtException', (err) => {
console.error('Uncaught exception:', err);
- process.exit(1);
});
-migrate().then(() => {
- app.listen(PORT, () => {
- console.log(`ZeroHost Dashboard running on port ${PORT}`);
- startScheduler();
- });
-}).catch(err => {
- console.error('Migration failed:', err);
- process.exit(1);
+process.on('warning', (warning) => {
+ if (warning.name === 'MaxListenersExceededWarning') {
+ console.error('Memory leak detected:', warning.message);
+ }
});
+
+setInterval(() => {
+ const mem = process.memoryUsage();
+ if (mem.heapUsed > 500 * 1024 * 1024) {
+ console.error(`High memory usage warning: ${Math.round(mem.heapUsed / 1024 / 1024)}MB heap used`);
+ }
+}, 60000);
+
+
diff --git a/services/pyrodactyl.js b/services/pyrodactyl.js
index a3d5b69..a4e23b0 100644
--- a/services/pyrodactyl.js
+++ b/services/pyrodactyl.js
@@ -4,6 +4,11 @@ const FETCH_TIMEOUT = 15000;
const CACHE_TTL = 5 * 60 * 1000;
const CACHE_MAX_SIZE = 50;
const nodeCache = new Map();
+let cacheCleanupTimer = null;
+
+function recordPteroError(errMsg) {
+ console.warn(`Pterodactyl API error: ${errMsg}`);
+}
async function fetchWithTimeout(url, options = {}, timeout = FETCH_TIMEOUT) {
const controller = new AbortController();
@@ -22,14 +27,45 @@ const headers = {
'Content-Type': 'application/json',
};
+function startCacheCleanup() {
+ if (cacheCleanupTimer) return;
+ cacheCleanupTimer = setInterval(() => {
+ const cutoff = Date.now() - CACHE_TTL;
+ let cleaned = 0;
+ for (const [id, entry] of nodeCache) {
+ if (entry.ts < cutoff) {
+ nodeCache.delete(id);
+ cleaned++;
+ }
+ }
+ if (cleaned > 0) {
+ console.log(`Cleaned ${cleaned} stale cache entries (${nodeCache.size} remaining)`);
+ }
+ }, CACHE_TTL);
+}
+
+startCacheCleanup();
+
async function pteroFetch(path, options = {}) {
const url = `${PTERO_URL}/api/application${path}`;
const maxRetries = 3;
for (let attempt = 1; attempt <= maxRetries; attempt++) {
- const res = await fetchWithTimeout(url, {
- ...options,
- headers: { ...headers, ...options.headers },
- });
+ let res;
+ try {
+ res = await fetchWithTimeout(url, {
+ ...options,
+ headers: { ...headers, ...options.headers },
+ });
+ } catch (err) {
+ recordPteroError(err.message);
+ if (attempt < maxRetries) {
+ const wait = Math.min(1000 * Math.pow(2, attempt - 1), 8000);
+ console.warn(`pteroFetch network error (${err.message}), retry ${attempt}/${maxRetries} after ${wait}ms`);
+ await new Promise(r => setTimeout(r, wait));
+ continue;
+ }
+ throw err;
+ }
if (res.status === 204) return null;
if (res.status === 429 && attempt < maxRetries) {
const wait = Math.min(1000 * Math.pow(2, attempt - 1), 8000);
@@ -37,12 +73,12 @@ async function pteroFetch(path, options = {}) {
await new Promise(r => setTimeout(r, wait));
continue;
}
- const data = await res.json();
if (!res.ok) {
- const detail = data?.errors?.[0]?.detail || JSON.stringify(data);
- throw new Error(detail);
+ recordPteroError(`${res.status} ${res.statusText}`);
+ const text = await res.text();
+ throw new Error(`Pterodactyl API error ${res.status}: ${text.slice(0, 200)}`);
}
- return data;
+ return await res.json();
}
}
@@ -108,7 +144,8 @@ export async function getAllServers() {
let page = 1;
let hasMore = true;
- while (hasMore) {
+ const MAX_PAGES = 20;
+ while (hasMore && page <= MAX_PAGES) {
const data = await pteroFetch(`/servers?page=${page}&per_page=50`);
const servers = data.data.map(s => s.attributes);
allServers = allServers.concat(servers);
@@ -143,7 +180,8 @@ export async function getServersByUser(userId) {
let page = 1;
let hasMore = true;
- while (hasMore) {
+ const MAX_PAGES = 20;
+ while (hasMore && page <= MAX_PAGES) {
const data = await pteroFetch(`/servers?page=${page}&per_page=50`);
const servers = data.data.map(s => s.attributes).filter(s => s.user === userId);
allServers = allServers.concat(servers);
@@ -275,7 +313,8 @@ export async function getPergoServerIdsByEgg(nestId, eggId) {
const ids = [];
let page = 1;
let hasMore = true;
- while (hasMore) {
+ const MAX_PAGES = 20;
+ while (hasMore && page <= MAX_PAGES) {
const data = await pteroFetch(`/servers?page=${page}&per_page=100`);
const servers = data.data.map(s => s.attributes);
for (const s of servers) {
diff --git a/services/scheduler.js b/services/scheduler.js
index c615387..435622e 100644
--- a/services/scheduler.js
+++ b/services/scheduler.js
@@ -33,10 +33,25 @@ function msUntilMidnight() {
return midnight.getTime() - now.getTime();
}
+let schedulerTimer = null;
+let schedulerRunning = false;
+
+export function stopScheduler() {
+ schedulerRunning = false;
+ if (schedulerTimer) {
+ clearTimeout(schedulerTimer);
+ schedulerTimer = null;
+ }
+}
+
export function startScheduler() {
+ if (schedulerRunning) return;
+ schedulerRunning = true;
suspendExpiredServers().catch(err => console.error('Initial scheduler run failed:', err.message));
const tick = () => {
- setTimeout(async () => {
+ if (!schedulerRunning) return;
+ schedulerTimer = setTimeout(async () => {
+ if (!schedulerRunning) return;
try {
await suspendExpiredServers();
} catch (err) {
@@ -47,4 +62,33 @@ export function startScheduler() {
};
tick();
console.log('Server lifetime scheduler started');
+
+ cleanupOldNotifications().catch(err => console.error('Initial notification cleanup failed:', err.message));
+ cleanupOldActivityLogs().catch(err => console.error('Initial activity log cleanup failed:', err.message));
+}
+
+async function cleanupOldNotifications() {
+ try {
+ const result = await query(
+ "DELETE FROM notifications WHERE created_at < NOW() - INTERVAL 90 DAY AND is_read = 1"
+ );
+ if (result.affectedRows > 0) {
+ console.log(`Cleaned up ${result.affectedRows} old read notification(s)`);
+ }
+ } catch (err) {
+ console.error('Notification cleanup error:', err.message);
+ }
+}
+
+async function cleanupOldActivityLogs() {
+ try {
+ const result = await query(
+ "DELETE FROM activity_log WHERE created_at < NOW() - INTERVAL 90 DAY"
+ );
+ if (result.affectedRows > 0) {
+ console.log(`Cleaned up ${result.affectedRows} old activity log(s)`);
+ }
+ } catch (err) {
+ console.error('Activity log cleanup error:', err.message);
+ }
}