You do not have permission to access this page.
', { isRegister: false }));
}
try {
const decoded = jwt.verify(token, JWT_SECRET);
req.userUid = decoded.uid;
next();
} catch (error) {
res.status(500).send(getBaseHtml('Tagly', 'Server error during role check.
', { isRegister: false }));
}
};
const roleMiddleware = (roles) => {
return async (req, res, next) => {
try {
const user = await User.findOne({ uid: req.userUid });
if (!user || !roles.includes(user.role)) {
return res.status(403).send(getBaseHtml('Tagly', 'You do not have permission to access this page.
', {}));
}
next();
} catch (error) {
console.error(error);
res.status(500).send(getBaseHtml('Tagly', 'Server error during role check.
', {}));
}
};
};
const getBaseHtml = (title, bodyContent, styleContent = {}) => `
${sanitizeText(title)}
${errorMessage ? `
${sanitizeText(errorMessage)}
` : ''}
${successMessage ? `
${sanitizeText(successMessage)}
` : ''}
`;
return getBaseHtml('Tagly', bodyContent, {
isRegister: isRegister,
customCss: authFormCss
});
};
app.get('/register', (req, res) => {
const num1 = Math.floor(Math.random() * 10);
const num2 = Math.floor(Math.random() * 10);
const captchaa = num1 + num2;
const captchaq = `${num1} + ${num2} = ?`;
res.cookie('captcha', captchaa.toString(), {
httpOnly: true,
maxAge: 300000
});
const registerForm = getAuthFormHtml('register');
const modifiedForm = registerForm.replace(
'',
`
PREMIUM DASHBOARD
Get exclusive features
🧪 PRO FEATURES
Unlock much thing!
- Up to 20 links per profile
- Clicks per day
- Custom themes (CSS HEX/RGBA)
- Add a profile image (max 100kb)
- Secret links visible only with a code
- Custom profile background image
${hasProAccess ? `
Your PRO Settings:
Add secret links by checking "Secret Link" when adding a link.
` : '
You need to upgrade to PRO to use these features.
Upgrade to PRO'}
🎭 ALIAS
Create multiple alernatives
- Up to 3 alternative usernames
- All point to your same profile
- Great for those who change style or nickname often
${hasAliasAccess ? `
Your ALIAS Settings:
Current Aliases: ${user.aliases.length > 0 ? user.aliases.map(a => sanitizeText(a)).join(', ') : 'None'}
${user.aliases.map(alias => `
${sanitizeText(alias)}
`).join('')}
` : '
You need to upgrade to ALIAS to use these features.
Upgrade to ALIAS'}
🧱 API ACCESS
Direct access to your profile data for developers.
- Access to your profile as JSON API
- Download your profile as .json
- API Key for coding access
- Perfect for integrating it anywhere
${hasDevAccess ? `
Your DEV Settings:
Your Raw Access Key: ${sanitizeText(user.raw_access_key || 'Not Generated')}
Download your profile as JSON: Download JSON
API Endpoint: /api/profile/${sanitizeText(user.username)}?key=YOUR_API_KEY
` : '
You need to upgrade to DEV to use these features.
Upgrade to DEV'}
🧬 CREW MODE
Manage multiple profiles for your collective.
- Up to 5 linked profiles
- One dashboard to manage them all
- Custom crew name
- Ability to include "drops" in your bio
${hasCrewAccess ? `
Your CREW MODE Settings:
Linked Profile UIDs: ${user.crew_profiles.length > 0 ? user.crew_profiles.map(uid => sanitizeText(uid)).join(', ') : 'None'}
${user.crew_profiles.map(crewUid => `
${sanitizeText(crewUid)}
`).join('')}
Bio Drops:
Current Drops: ${user.bio_drops.length > 0 ? user.bio_drops.map(d => `[${sanitizeText(d.key)}] = "${sanitizeText(d.value)}"`).join(', ') : 'None'}
${user.bio_drops.map(drop => `
[${sanitizeText(drop.key)}] = "${sanitizeText(drop.value)}"
`).join('')}
` : '
You need to upgrade to CREW to use these features.
Upgrade to CREW'}
DOMAINS
Elevate your presence with a personalized domain and dedicated assistance.
- Use your own domain (e.g., yourname.com)
- Direct priority support via dedicated channel
${hasOwnerAccess || hasStaffAccess ? `
This feature is for Staff/Owner roles only.
Contact support to set up your custom domain and access priority support.
` : '
You need STAFF or OWNER role to use these features.
Upgrade to Staff/Owner'}
`;
const adminDashboardLink = hasStaffAccess || hasOwnerAccess ? '
YOUR PROFILE
Your profile link: /${sanitizeText(user.username)}
Last Login: ${user.ip_last_login ? sanitizeText(new Date(user.ip_last_login).toLocaleString()) : 'Never'}
Profile Views: ${user.profile_views}
YOUR LINKS (${user.links.length}/${maxLinks})
${user.links.map(link => `
`).join('')}
${user.links.length < maxLinks ? `
` : `
You have reached the maximum number of links (${maxLinks}). Upgrade to PRO to add more!
`}
${premiumDashboardContent}
`;
res.send(getBaseHtml('Dashboard', dashboardHtml, {
fontFamily: user.font_family,
profileBackground: user.profile_background_image,
accentColor: currentTheme.accentColor,
headerFont: currentTheme.headerFont,
glitchClass: currentTheme.glitchClass,
customCss: user.custom_css_hex
}));
} catch (error) {
console.error(error);
res.status(500).send(getBaseHtml('Tagly', 'Server error loading dashboard.
', {}));
}
});
app.post('/update-profile', authMiddleware, async (req, res) => {
try {
const { bio, tagline, theme, font_family, welcome_message } = req.body;
await User.updateOne({ uid: req.userUid }, {
bio: sanitizeText(bio),
tagline: sanitizeText(tagline),
theme: sanitizeText(theme),
font_family: sanitizeText(font_family),
welcome_message: sanitizeText(welcome_message)
});
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error updating profile.');
}
});
app.post('/add-link', authMiddleware, async (req, res) => {
try {
const { label, url, emoji, is_secret } = req.body;
const user = await User.findOne({ uid: req.userUid });
if (!user) {
return res.status(404).send('User not found.');
}
const maxLinks = (['pro', 'owner', 'staff'].includes(user.role)) ? 20 : 6;
if (user.links.length >= maxLinks) {
return res.status(400).send('Maximum number of links reached. Upgrade to PRO for more.');
}
user.links.push({
label: sanitizeText(label),
url: sanitizeText(url),
emoji: sanitizeText(emoji),
is_secret: is_secret === 'true'
});
await user.save();
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error adding link.');
}
});
app.post('/delete-link', authMiddleware, async (req, res) => {
try {
const { label } = req.body;
await User.updateOne({ uid: req.userUid }, { $pull: { links: { label: sanitizeText(label) } } });
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error deleting link.');
}
});
app.get('/logout', (req, res) => {
res.clearCookie('token');
res.redirect('/login');
});
app.get('/shop', authMiddleware, async (req, res) => {
try {
const user = await User.findOne({ uid: req.userUid });
if (!user) {
return res.status(404).send('User not found.');
}
const shopContent = `
🧪 PRO FEATURES
Unlock much other features for your profile.
- Up to 20 links per profile
- Advanced link analytics (clicks per day)
- Custom themes (CSS HEX/RGBA)
- Add a profile image (max 100kb)
- "Secret" links visible only with a code
- Custom profile background image
${user.role === 'pro' || user.role === 'dev' || user.role === 'crew' || user.role === 'alias' || user.role === 'staff' || user.role === 'owner' ? '
You already have this!
' : '
'}
🎭 ALIAS
Create multiple names for your profile.
- Up to 3 alternative usernames
- All point to your same profile
- Great for those who change style or nickname often
${user.role === 'alias' || user.role === 'dev' || user.role === 'crew' || user.role === 'staff' || user.role === 'owner' ? '
You already have this!
' : '
'}
🧱 API ACCESS
Direct access to your profile data for developers.
- Access to your profile as JSON API
- Download your profile as .json
- API Key for coding access
- Perfect for integrating it anywhere
${user.role === 'dev' || user.role === 'crew' || user.role === 'staff' || user.role === 'owner' ? '
You already have this!
' : '
'}
🧬 CREW MODE
Manage multiple profiles for your collective.
- Up to 5 linked profiles
- One dashboard to manage them all
- Custom crew name
- Ability to include "drops" in your bio
${user.role === 'crew' || user.role === 'staff' || user.role === 'owner' ? '
You already have this!
' : '
'}
DOMAINS
Get a custom domain
- Use your own domain
- Direct priority support via discord
${user.role === 'staff' || user.role === 'owner' ? '
You already have this!
' : '
Contact support to upgrade to STAFF/OWNER role for this feature.
'}
Server error loading shop.
', {}));
}
});
app.post('/update-premium-profile', authMiddleware, async (req, res) => {
try {
const { profile_image, profile_background_image, custom_css_hex } = req.body;
const user = await User.findOne({ uid: req.userUid });
if (!user || !['pro', 'owner', 'staff'].includes(user.role)) {
return res.status(403).send('Forbidden: Not a PRO user.');
}
await User.updateOne({ uid: req.userUid }, {
profile_image: sanitizeText(profile_image),
profile_background_image: sanitizeText(profile_background_image),
custom_css_hex: sanitizeText(custom_css_hex)
});
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error updating premium profile.');
}
});
app.post('/generate-secret-link-code', authMiddleware, async (req, res) => {
try {
const user = await User.findOne({ uid: req.userUid });
if (!user || !['pro', 'owner', 'staff'].includes(user.role)) {
return res.status(403).send('Forbidden: Not a PRO user.');
}
const secret_link_code = generateRandomCode();
await User.updateOne({ uid: req.userUid }, { secret_link_code });
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error generating secret link code.');
}
});
app.post('/generate-raw-access-key', authMiddleware, async (req, res) => {
try {
const user = await User.findOne({ uid: req.userUid });
if (!user || !['dev', 'owner', 'staff'].includes(user.role)) {
return res.status(403).send('Forbidden: Not a DEV user.');
}
const raw_access_key = generateRandomCode() + generateRandomCode();
await User.updateOne({ uid: req.userUid }, { raw_access_key });
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error generating raw access key.');
}
});
app.post('/add-alias', authMiddleware, async (req, res) => {
try {
const { alias } = req.body;
const user = await User.findOne({ uid: req.userUid });
if (!user || !['alias', 'owner', 'staff'].includes(user.role)) {
return res.status(403).send('Forbidden: Not an ALIAS user.');
}
if (user.aliases.length >= 3) {
return res.status(400).send('Maximum 3 aliases allowed.');
}
const specialCharRegex = /[^\w]/;
if (specialCharRegex.test(alias)) {
return res.status(400).send('Alias cannot contain special characters (only letters, numbers, and underscores).');
}
const existingUserOrAlias = await User.findOne({ $or: [{ username: alias }, { nickname: alias }, { aliases: alias }] });
if (existingUserOrAlias) {
return res.status(409).send('Alias, username, or nickname already taken.');
}
user.aliases.push(sanitizeText(alias));
await user.save();
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error adding alias.');
}
});
app.post('/delete-alias', authMiddleware, async (req, res) => {
try {
const { alias } = req.body;
const user = await User.findOne({ uid: req.userUid });
if (!user || !['alias', 'owner', 'staff'].includes(user.role)) {
return res.status(403).send('Forbidden: Not an ALIAS user.');
}
await User.updateOne({ uid: req.userUid }, { $pull: { aliases: sanitizeText(alias) } });
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error deleting alias.');
}
});
app.post('/add-crew-profile', authMiddleware, async (req, res) => {
try {
const { crew_uid } = req.body;
const user = await User.findOne({ uid: req.userUid });
if (!user || !['crew', 'owner', 'staff'].includes(user.role)) {
return res.status(403).send('Forbidden: Not a CREW user.');
}
if (user.crew_profiles.length >= 5) {
return res.status(400).send('Maximum 5 crew profiles allowed.');
}
const crewUserExists = await User.findOne({ uid: crew_uid });
if (!crewUserExists) {
return res.status(404).send('Crew profile not found.');
}
user.crew_profiles.push(sanitizeText(crew_uid));
await user.save();
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error adding crew profile.');
}
});
app.post('/remove-crew-profile', authMiddleware, async (req, res) => {
try {
const { crew_uid } = req.body;
const user = await User.findOne({ uid: req.userUid });
if (!user || !['crew', 'owner', 'staff'].includes(user.role)) {
return res.status(403).send('Forbidden: Not a CREW user.');
}
await User.updateOne({ uid: req.userUid }, { $pull: { crew_profiles: sanitizeText(crew_uid) } });
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error removing crew profile.');
}
});
app.post('/add-bio-drop', authMiddleware, async (req, res) => {
try {
const { drop_key, drop_value } = req.body;
const user = await User.findOne({ uid: req.userUid });
if (!user || !['crew', 'owner', 'staff'].includes(user.role)) {
return res.status(403).send('Forbidden: Not a CREW user.');
}
user.bio_drops.push({ key: sanitizeText(drop_key), value: sanitizeText(drop_value) });
await user.save();
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error adding bio drop.');
}
});
app.post('/remove-bio-drop', authMiddleware, async (req, res) => {
try {
const { drop_key } = req.body;
const user = await User.findOne({ uid: req.userUid });
if (!user || !['crew', 'owner', 'staff'].includes(user.role)) {
return res.status(403).send('Forbidden: Not a CREW user.');
}
await User.updateOne({ uid: req.userUid }, { $pull: { bio_drops: { key: sanitizeText(drop_key) } } });
res.redirect('/dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error removing bio drop.');
}
});
app.get('/admin-dashboard', authMiddleware, roleMiddleware(['staff', 'owner']), async (req, res) => {
try {
const users = await User.find({});
const adminContent = `
Server error loading admin dashboard.
', {}));
}
});
app.post('/admin/update-role', authMiddleware, roleMiddleware(['staff', 'owner']), async (req, res) => {
try {
const { uid, role } = req.body;
await User.updateOne({ uid: sanitizeText(uid) }, { role: sanitizeText(role) });
res.redirect('/admin-dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error updating user role.');
}
});
app.post('/admin/delete-user', authMiddleware, roleMiddleware(['owner']), async (req, res) => {
try {
const { uid } = req.body;
await User.deleteOne({ uid: sanitizeText(uid) });
res.redirect('/admin-dashboard');
} catch (error) {
console.error(error);
res.status(500).send('Server error deleting user.');
}
});
app.get('/download-profile-json', authMiddleware, roleMiddleware(['dev', 'owner', 'staff']), async (req, res) => {
try {
const { key } = req.query;
const user = await User.findOne({ uid: req.userUid });
if (!user || user.raw_access_key !== key) {
return res.status(403).send('Forbidden: Invalid key or not authorized.');
}
const userProfile = {
uid: user.uid,
nickname: user.nickname,
email: user.email,
username: user.username,
theme: user.theme,
font_family: user.font_family,
ip_register: user.ip_register,
ip_last_login: user.ip_last_login,
bio: user.bio,
tagline: user.tagline,
links: user.links,
profile_image: user.profile_image,
profile_background_image: user.profile_background_image,
secret_link_code: user.secret_link_code,
aliases: user.aliases,
created_at: user.created_at,
role: user.role,
custom_css_hex: user.custom_css_hex,
bio_drops: user.bio_drops,
profile_views: user.profile_views,
welcome_message: user.welcome_message
};
res.setHeader('Content-disposition', `attachment; filename=tagly_profile_${user.username}.json`);
res.setHeader('Content-type', 'application/json');
res.status(200).send(JSON.stringify(userProfile, null, 2));
} catch (error) {
console.error(error);
res.status(500).send('Server error generating JSON profile.');
}
});
app.get('/api/profile/:username', async (req, res) => {
try {
const { username } = req.params;
const { key } = req.query;
const user = await User.findOne({ $or: [{ username }, { aliases: username }] });
if (!user) {
return res.status(404).json({ message: 'Profile not found.' });
}
if (!key || user.raw_access_key !== key) {
return res.status(403).json({ message: 'Forbidden: Invalid API key.' });
}
const profileData = {
uid: user.uid,
nickname: user.nickname,
username: user.username,
theme: user.theme,
font_family: user.font_family,
bio: user.bio,
tagline: user.tagline,
links: user.links.filter(link => !link.is_secret),
profile_image: user.profile_image,
profile_background_image: user.profile_background_image,
aliases: user.aliases,
created_at: user.created_at,
role: user.role,
custom_css_hex: user.custom_css_hex,
bio_drops: user.bio_drops,
profile_views: user.profile_views,
welcome_message: user.welcome_message
};
res.status(200).json(profileData);
} catch (error) {
console.error(error);
res.status(500).json({ message: 'Server error retrieving profile data.' });
}
});
app.get('/api/profile/:username/secretlinks', async (req, res) => {
try {
const { username } = req.params;
const { code, key } = req.query;
const user = await User.findOne({ $or: [{ username }, { aliases: username }] });
if (!user) {
return res.status(404).json({ message: 'Profile not found.' });
}
if (user.raw_access_key !== key) {
return res.status(403).json({ message: 'Forbidden: Invalid API key.' });
}
if (!user.secret_link_code || user.secret_link_code !== code) {
return res.status(403).json({ message: 'Forbidden: Invalid secret code.' });
}
const secretLinks = user.links.filter(link => link.is_secret);
res.status(200).json(secretLinks);
} catch (error) {
console.error(error);
res.status(500).json({ message: 'Server error retrieving secret links.' });
}
});
app.get('/:username', async (req, res) => {
try {
const { username } = req.params;
const { code } = req.query;
const user = await User.findOne({ $or: [{ username }, { aliases: username }] });
if (!user) {
return res.status(404).send(getBaseHtml('Not Found', 'The profile you are looking for does not exist.
', {}));
}
if (!user.profile_views) {
user.profile_views = 0;
}
user.profile_views += 1;
await user.save();
const themeStyles = {
'drip-dark': { accentColor: 'lime', headerFont: "'UnifrakturCook', cursive", customCss: '' },
'glitch-neon': { accentColor: '#00ffff', headerFont: "'Spline Sans Mono', monospace", glitchClass: 'glitch', customCss: '' },
'pure-black': { accentColor: '#f0f0f0', headerFont: "'Spline Sans Mono', monospace", customCss: '' },
'chrome-vibe': { accentColor: '#ff00ff', headerFont: "'UnifrakturCook', cursive", customCss: '' }
};
const currentTheme = themeStyles[user.theme] || themeStyles['drip-dark'];
const profileLinks = user.links.filter(link => !link.is_secret || (link.is_secret && user.secret_link_code && user.secret_link_code === code));
const roleTagMap = {
'pro': '[PRO]',
'dev': '[DEV]',
'crew': '[CREW]',
'alias': '[ALIAS]',
'staff': '[STAFF]',
'owner': '[OWN]'
};
const roleTag = user.role !== 'user' ? `${sanitizeText(roleTagMap[user.role] || '')} ` : '';
const bioDropsHtml = user.bio_drops.map(drop => {
const regex = new RegExp(`\\b${escapeRegExp(drop.key)}\\b`, 'g');
return user.bio.replace(regex, `Server error loading profile.
', {}));
}
});
function escapeRegExp(string) {
return string.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}
app.get('/', (req, res) => {
const landingHtml = `
})
` : ''}