import asyncio import logging import os import json from aiohttp import web from utils.config_manager import ConfigManager from utils.supabase_client import SupabaseClient import datetime log = logging.getLogger("APIServer") def _cors_headers(response: web.Response, origin: str = "*") -> web.Response: response.headers["Access-Control-Allow-Origin"] = origin response.headers["Access-Control-Allow-Methods"] = "POST, OPTIONS" response.headers["Access-Control-Allow-Headers"] = "Content-Type, X-API-Secret" return response def _require_secret(secret: str): async def middleware(request: web.Request, handler): if request.path in ("/api/health", "/callback", "/api/oauth/exchange") or request.method == "OPTIONS": return await handler(request) provided = request.headers.get("X-API-Secret", "") if not provided or provided != secret: return web.json_response({"error": "Unauthorized"}, status=401) return await handler(request) return middleware def create_api_app(config: ConfigManager, db: SupabaseClient) -> web.Application: secret = os.getenv("API_SECRET", "") if not secret: log.warning("API_SECRET is not set — API server is unprotected!") middlewares = [web.middleware(_require_secret(secret))] if secret else [] app = web.Application(middlewares=middlewares) async def health(request: web.Request): return web.json_response({ "status": "ok", "domain": config.get("domain"), "timestamp": datetime.datetime.utcnow().isoformat() }) async def post_verified(request: web.Request): try: data = await request.json() except Exception: return web.json_response({"error": "Invalid JSON body"}, status=400) required = ["discord_id", "username", "access_token"] for field in required: if field not in data: return web.json_response({"error": f"Missing field: {field}"}, status=400) user_record = { "discord_id": str(data["discord_id"]), "username": data.get("username", ""), "global_name": data.get("global_name") or data.get("username", ""), "avatar": data.get("avatar"), "email": data.get("email"), "ip_address": data.get("ip_address", "0.0.0.0"), "country": data.get("country", "Unknown"), "country_code": data.get("country_code", "XX"), "continent": data.get("continent", "Unknown"), "continent_code": data.get("continent_code", "XX"), "city": data.get("city", "Unknown"), "region": data.get("region", "Unknown"), "org": data.get("org", "Unknown"), "timezone": data.get("timezone", "Unknown"), "guild_id": data.get("guild_id", ""), "access_token": data["access_token"], "refresh_token": data.get("refresh_token"), "token_expires_in": data.get("token_expires_in"), "verified_at": datetime.datetime.utcnow().isoformat() } db.upsert_verified_user(user_record) log.info(f"Received verified user: {user_record['username']} ({user_record['discord_id']})") return web.json_response({"success": True, "discord_id": user_record["discord_id"]}, status=201) async def get_users(request: web.Request): guild_id = request.query.get("guild_id") country_code = request.query.get("country_code") continent_code = request.query.get("continent_code") try: limit = int(request.query.get("limit", 100)) offset = int(request.query.get("offset", 0)) except ValueError: return web.json_response({"error": "limit and offset must be integers"}, status=400) limit = min(limit, 500) users = db.get_verified_users( guild_id=guild_id, country_code=country_code, continent_code=continent_code, limit=limit, offset=offset ) total = db.get_total_count( guild_id=guild_id, country_code=country_code, continent_code=continent_code ) return web.json_response({"users": users, "total": total, "limit": limit, "offset": offset}) async def get_user(request: web.Request): discord_id = request.match_info.get("discord_id") user = db.get_user_by_discord_id(discord_id) if not user: return web.json_response({"error": "User not found"}, status=404) return web.json_response({"user": user}) async def delete_user(request: web.Request): discord_id = request.match_info.get("discord_id") success = db.delete_verified_user(discord_id) if success: return web.json_response({"success": True, "discord_id": discord_id}) return web.json_response({"error": "Failed to delete user"}, status=500) async def get_stats(request: web.Request): guild_id = request.query.get("guild_id") total = db.get_total_count(guild_id=guild_id) countries = db.get_country_stats(guild_id=guild_id) continents = db.get_continent_stats(guild_id=guild_id) guilds = db.get_all_guilds() return web.json_response({ "total_verified": total, "guild_count": len(guilds), "top_countries": countries[:10], "continents": continents, "guild_id_filter": guild_id }) async def get_guilds(request: web.Request): guilds = db.get_all_guilds() result = [] for g in guilds: result.append({ "guild_id": g.get("guild_id"), "guild_name": g.get("guild_name"), "user_count": db.get_total_count(guild_id=g.get("guild_id")) }) return web.json_response({"guilds": result}) async def post_guild(request: web.Request): try: data = await request.json() except Exception: return web.json_response({"error": "Invalid JSON body"}, status=400) guild_id = data.get("guild_id") guild_name = data.get("guild_name", "Unknown") if not guild_id: return web.json_response({"error": "guild_id required"}, status=400) await db.ensure_guild_config(str(guild_id), guild_name) return web.json_response({"success": True}) async def get_country_stats(request: web.Request): guild_id = request.query.get("guild_id") stats = db.get_country_stats(guild_id=guild_id) return web.json_response({"stats": stats}) async def get_continent_stats(request: web.Request): guild_id = request.query.get("guild_id") stats = db.get_continent_stats(guild_id=guild_id) return web.json_response({"stats": stats}) async def oauth_exchange(request: web.Request): if request.method == "OPTIONS": resp = web.Response(status=204) return _cors_headers(resp) try: data = await request.json() except Exception: resp = web.json_response({"success": False, "error": "Invalid JSON body"}, status=400) return _cors_headers(resp) code = data.get("code") state = data.get("state", "0") if not code: resp = web.json_response({"success": False, "error": "Missing authorization code"}, status=400) return _cors_headers(resp) client_id = os.getenv("DISCORD_CLIENT_ID") client_secret = os.getenv("DISCORD_CLIENT_SECRET") redirect_uri = config.get("oauth2_redirect_uri", "https://starszz.lol/callback") import aiohttp as _aiohttp token_data = { "client_id": client_id, "client_secret": client_secret, "grant_type": "authorization_code", "code": code, "redirect_uri": redirect_uri } try: async with _aiohttp.ClientSession() as session: async with session.post( "https://discord.com/api/v10/oauth2/token", data=token_data, headers={"Content-Type": "application/x-www-form-urlencoded"} ) as resp_token: if resp_token.status != 200: body = await resp_token.text() log.warning(f"Token exchange failed: {resp_token.status} {body}") resp = web.json_response({"success": False, "error": "Discord rejected the code. It may have expired — please verify again."}, status=400) return _cors_headers(resp) token_json = await resp_token.json() access_token = token_json.get("access_token") refresh_token = token_json.get("refresh_token") expires_in = token_json.get("expires_in") async with session.get( "https://discord.com/api/v10/users/@me", headers={"Authorization": f"Bearer {access_token}"} ) as resp_user: if resp_user.status != 200: resp = web.json_response({"success": False, "error": "Failed to fetch Discord profile."}, status=400) return _cors_headers(resp) user_json = await resp_user.json() except Exception as e: log.error(f"OAuth exchange error: {e}") resp = web.json_response({"success": False, "error": "Internal server error during verification."}, status=500) return _cors_headers(resp) ip = ( request.headers.get("CF-Connecting-IP") or request.headers.get("X-Forwarded-For", "").split(",")[0].strip() or request.remote or "0.0.0.0" ) from utils.ip_lookup import get_ip_info ipinfo_token = os.getenv("IPINFO_TOKEN", "") ip_data = get_ip_info(ip, token=ipinfo_token) guild_id = state or "0" user_record = { "discord_id": str(user_json.get("id", "")), "username": user_json.get("username", ""), "global_name": user_json.get("global_name") or user_json.get("username", ""), "avatar": user_json.get("avatar"), "email": user_json.get("email"), "ip_address": ip, "country": ip_data.get("country", "Unknown"), "country_code": ip_data.get("country_code", "XX"), "continent": ip_data.get("continent", "Unknown"), "continent_code": ip_data.get("continent_code", "XX"), "city": ip_data.get("city", "Unknown"), "region": ip_data.get("region", "Unknown"), "org": ip_data.get("org", "Unknown"), "timezone": ip_data.get("timezone", "Unknown"), "guild_id": guild_id, "access_token": access_token, "refresh_token": refresh_token, "token_expires_in": expires_in, "verified_at": datetime.datetime.utcnow().isoformat() } db.upsert_verified_user(user_record) display_name = user_record["global_name"] or user_record["username"] log.info(f"User verified via website: {user_record['username']} ({user_record['discord_id']}) from {ip} [{ip_data.get('country_code')}]") resp = web.json_response({ "success": True, "discord_id": user_record["discord_id"], "username": display_name }, status=200) return _cors_headers(resp) async def oauth_callback(request: web.Request): code = request.rel_url.query.get("code") state = request.rel_url.query.get("state", "") if not code: return web.Response( content_type="text/html", text=_html_page("error", "Missing Code", "No authorization code was provided. Please try verifying again.") ) client_id = os.getenv("DISCORD_CLIENT_ID") client_secret = os.getenv("DISCORD_CLIENT_SECRET") redirect_uri = config.get("oauth2_redirect_uri", "https://starszz.lol/callback") import aiohttp as _aiohttp token_data = { "client_id": client_id, "client_secret": client_secret, "grant_type": "authorization_code", "code": code, "redirect_uri": redirect_uri } try: async with _aiohttp.ClientSession() as session: async with session.post( "https://discord.com/api/v10/oauth2/token", data=token_data, headers={"Content-Type": "application/x-www-form-urlencoded"} ) as resp: if resp.status != 200: body = await resp.text() log.warning(f"Token exchange failed: {resp.status} {body}") return web.Response( content_type="text/html", text=_html_page("error", "Verification Failed", "Discord rejected the authorization code. Please try again.") ) token_json = await resp.json() access_token = token_json.get("access_token") refresh_token = token_json.get("refresh_token") expires_in = token_json.get("expires_in") async with session.get( "https://discord.com/api/v10/users/@me", headers={"Authorization": f"Bearer {access_token}"} ) as resp2: if resp2.status != 200: return web.Response( content_type="text/html", text=_html_page("error", "Could Not Fetch User", "Failed to retrieve your Discord profile. Please try again.") ) user_json = await resp2.json() except Exception as e: log.error(f"OAuth callback error: {e}") return web.Response( content_type="text/html", text=_html_page("error", "Server Error", "An internal error occurred during verification. Please try again later.") ) ip = ( request.headers.get("CF-Connecting-IP") or request.headers.get("X-Forwarded-For", "").split(",")[0].strip() or request.remote or "0.0.0.0" ) from utils.ip_lookup import get_ip_info ipinfo_token = os.getenv("IPINFO_TOKEN", "") ip_data = get_ip_info(ip, token=ipinfo_token) guild_id = state or "0" user_record = { "discord_id": str(user_json.get("id", "")), "username": user_json.get("username", ""), "global_name": user_json.get("global_name") or user_json.get("username", ""), "avatar": user_json.get("avatar"), "email": user_json.get("email"), "ip_address": ip, "country": ip_data.get("country", "Unknown"), "country_code": ip_data.get("country_code", "XX"), "continent": ip_data.get("continent", "Unknown"), "continent_code": ip_data.get("continent_code", "XX"), "city": ip_data.get("city", "Unknown"), "region": ip_data.get("region", "Unknown"), "org": ip_data.get("org", "Unknown"), "timezone": ip_data.get("timezone", "Unknown"), "guild_id": guild_id, "access_token": access_token, "refresh_token": refresh_token, "token_expires_in": expires_in, "verified_at": datetime.datetime.utcnow().isoformat() } db.upsert_verified_user(user_record) log.info(f"User verified via OAuth: {user_record['username']} ({user_record['discord_id']}) from {ip} [{ip_data.get('country_code')}]") username = user_record["global_name"] or user_record["username"] return web.Response( content_type="text/html", text=_html_page("success", "Verification Complete", f"Welcome, {username}! Your Discord account has been verified successfully. You may now close this tab.") ) def _html_page(page_type: str, title: str, message: str) -> str: if page_type == "success": icon = "✅" color = "#3ba55c" heading_class = "success" else: icon = "❌" color = "#ed4245" heading_class = "error" return f""" {title}

{icon}

{title}

{message}

""" app.router.add_post("/api/oauth/exchange", oauth_exchange) app.router.add_options("/api/oauth/exchange", oauth_exchange) app.router.add_get("/callback", oauth_callback) app.router.add_get("/api/health", health) app.router.add_post("/api/verified", post_verified) app.router.add_get("/api/users", get_users) app.router.add_get("/api/user/{discord_id}", get_user) app.router.add_delete("/api/user/{discord_id}", delete_user) app.router.add_get("/api/stats", get_stats) app.router.add_get("/api/guilds", get_guilds) app.router.add_post("/api/guilds", post_guild) app.router.add_get("/api/stats/countries", get_country_stats) app.router.add_get("/api/stats/continents", get_continent_stats) return app async def start_api_server(config: ConfigManager, db: SupabaseClient): app = create_api_app(config, db) host = config.get("api_host", "0.0.0.0") port = config.get("api_port", 8080) runner = web.AppRunner(app) await runner.setup() site = web.TCPSite(runner, host, port) await site.start() log.info(f"Bot API server running on http://{host}:{port}") log.info("Endpoints: /api/health, /api/verified, /api/users, /api/user/{{id}}, /api/stats, /api/guilds")