PrivateHUB

PrivateHUB

NEW NOTE ADDED

📝 New Note

${note.title}

\n ${note.description ? `

${note.description}

` : \"\"}\n ${note.bin ? `🗑️ ${note.bin}` : \"\"}\n ${note.location ? `📍 ${note.location}` : \"\"}\n ${note.link ? `

🚀 Open Link

` : \"\"}\n

Hi {{NAME}} — you're receiving this because you're a member of PrivateHUB.
Visit: PrivateHUB

`.replace(\"{{NAME}}\", userName);\n}\n\nfunction binEmailHtml(bin: { title: string; bin_data: string; description?: string }, userName: string) {\n return `\n\n

PrivateHUB

NEW BIN ADDED

💳 New Bin

${bin.title}

${bin.bin_data}

\n ${bin.description ? `

${bin.description}

` : \"\"}\n

Hi {{NAME}} — you're receiving this because you're a member of PrivateHUB.
Visit: PrivateHUB

`.replace(\"{{NAME}}\", userName);\n}\n\nfunction hitterEmailHtml(link: { link: string; user_name: string }, userName: string) {\n return `\n\n

🔥 HitterHouse

NEW CHECKOUT LINK DROPPED

🚀 Checkout Link

Dropped by: ${link.user_name}

${link.link}

\n 🔥 Open & Hit\n

Hi {{NAME}} — you're receiving this because you're a member of PrivateHUB.
Visit: PrivateHUB

`.replace(\"{{NAME}}\", userName);\n}\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS notes (id INTEGER PRIMARY KEY AUTOINCREMENT, number INTEGER, title TEXT NOT NULL, description TEXT, link TEXT, bin TEXT, location TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS settings (key TEXT PRIMARY KEY, value TEXT)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, email TEXT UNIQUE NOT NULL, password TEXT NOT NULL, telegram TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS comments (id INTEGER PRIMARY KEY AUTOINCREMENT, note_id INTEGER NOT NULL, user_id INTEGER NOT NULL, user_name TEXT NOT NULL, content TEXT NOT NULL, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS hitter_links (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL, user_name TEXT NOT NULL, link TEXT NOT NULL, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS bins_list (id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL, bin_data TEXT NOT NULL, description TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);\nawait sqlite.execute(`INSERT OR IGNORE INTO settings (key,value) VALUES ('public_password','')`);\n\nconst OWNER_PASSWORD = \"Random@2001\";\nconst ADMIN_SECRET_PATH = \"/xK9mP2qR7vL4nT8\";\nconst COOLDOWN_MS = 60000; // 1 minute\n\nfunction hashPwd(p: string) { return btoa(encodeURIComponent(p + \"ph_salt_2024\")); }\n\nconst HTML = `\n\n\n\n\nPrivateHUB\n\n\n\n\n

\n\n\n

PrivateHUB

Secure Notes Vault

📧 Email

🔒 Password

\n \n

📱 Telegram Login:
Register with your Telegram @username as email + any password.
👉 Join @PrivateHub4Bins

\n \n

\n\n\n

PrivateHUB

\n \n \n \n \n

\n\n \n

📝 Notes

🔥 HitterHouse

💳 Bins List

\n\n

\n \n

Notes

Links

Bins

Hits

Bin Cards

\n\n \n

\n \n

ADD NEW NOTE

📌 Title

#️⃣ Number

📝 Description

🔗 Link / URL

🗑️ Bin

📍 Location

\n \n \n

📭

📢 JOIN OUR CHANNEL

⚡ PrivateHub4Bins

\n \n \n JOIN CHANNEL\n \n

\n\n \n

🔥 HitterHouse

Drop your checkout link • 1 minute cooldown per user

LIVE

\n\n

\n \n \n

\n ⏳ Cooldown — wait before dropping again\n 60s\n

\n\n

🎯

\n\n \n

💳 Bins List

Click any bin to copy instantly

0 Bins

\n \n

\n\n

ADD NEW BIN

📌 Title / Name

💳 Bin Data

📝 Description (optional)

\n \n \n

\n\n \n\n

💳

\n\n\n

\n \n

\n\n\n

\n \n

\n\n\n

\n \n

\n\n

\n\n\n\n`;\n\n// Admin Panel HTML (compact)\nconst ADMIN_HTML = `PrivateHUB Admin\n

ADMIN PANEL

PRIVATEHUB CONTROL

🔑 Admin Password

#	Name	Email	Joined	Del
Loading...

User	Link	Posted	Del
Loading...

User	Note	Comment	Del
Loading...

Title	Bin Data	Desc	Del
Loading...

\n\n`;\n\nexport default async function(req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname;\n const json = (d: unknown, s = 200) => new Response(JSON.stringify(d), { status: s, headers: { \"Content-Type\": \"application/json\" } });\n\n if (path === ADMIN_SECRET_PATH || path === ADMIN_SECRET_PATH + \"/\")\n return new Response(ADMIN_HTML, { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n\n if (path === \"/api/admin-login\" && req.method === \"POST\") {\n const b = await req.json(); return json({ ok: b.password === OWNER_PASSWORD });\n }\n\n const adminToken = req.headers.get(\"X-Admin-Token\");\n const isAdmin = adminToken === OWNER_PASSWORD;\n\n if (path === \"/api/admin/stats\" && isAdmin) {\n const [u, n, c, h, b] = await Promise.all([\n sqlite.execute(\"SELECT COUNT(*) FROM users\"),\n sqlite.execute(\"SELECT COUNT(*) FROM notes\"),\n sqlite.execute(\"SELECT COUNT(*) FROM comments\"),\n sqlite.execute(\"SELECT COUNT(*) FROM hitter_links\"),\n sqlite.execute(\"SELECT COUNT(*) FROM bins_list\"),\n ]);\n return json({ users: u.rows[0][0], notes: n.rows[0][0], comments: c.rows[0][0], hits: h.rows[0][0], bins: b.rows[0][0] });\n }\n if (path === \"/api/admin/users\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,name,email,created_at FROM users ORDER BY id DESC\");\n return json({ users: r.rows.map((x: any[]) => ({ id: x[0], name: x[1], email: x[2], created_at: x[3] })) });\n }\n if (path.startsWith(\"/api/admin/users/\") && req.method === \"DELETE\" && isAdmin) {\n await sqlite.execute({ sql: \"DELETE FROM users WHERE id=?\", args: [path.split(\"/\")[4]] }); return json({ ok: true });\n }\n if (path === \"/api/admin/comments\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,note_id,user_name,content,created_at FROM comments ORDER BY id DESC LIMIT 100\");\n return json({ comments: r.rows.map((x: any[]) => ({ id: x[0], note_id: x[1], user_name: x[2], content: x[3], created_at: x[4] })) });\n }\n if (path.startsWith(\"/api/admin/comments/\") && req.method === \"DELETE\" && isAdmin) {\n await sqlite.execute({ sql: \"DELETE FROM comments WHERE id=?\", args: [path.split(\"/\")[4]] }); return json({ ok: true });\n }\n if (path === \"/api/admin/hitter\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,user_name,link,created_at FROM hitter_links ORDER BY id DESC LIMIT 100\");\n return json({ links: r.rows.map((x: any[]) => ({ id: x[0], user_name: x[1], link: x[2], created_at: x[3] })) });\n }\n if (path === \"/api/admin/bins\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,title,bin_data,description,created_at FROM bins_list ORDER BY id DESC\");\n return json({ bins: r.rows.map((x: any[]) => ({ id: x[0], title: x[1], bin_data: x[2], description: x[3], created_at: x[4] })) });\n }\n\n // Auth\n if (path === \"/api/register\" && req.method === \"POST\") {\n const b = await req.json();\n const name = b.name?.trim(), email = b.email?.trim()?.toLowerCase(), pwd = b.password?.trim();\n if (!name || !email || !pwd) return json({ ok: false, msg: \"All fields required.\" });\n const ex = await sqlite.execute({ sql: \"SELECT id FROM users WHERE email=?\", args: [email] });\n if (ex.rows.length) return json({ ok: false, msg: \"Email already registered.\" });\n await sqlite.execute({ sql: \"INSERT INTO users (name,email,password) VALUES (?,?,?)\", args: [name, email, hashPwd(pwd)] });\n return json({ ok: true });\n }\n if (path === \"/api/user-login\" && req.method === \"POST\") {\n const b = await req.json();\n const email = b.email?.trim()?.toLowerCase(), pwd = b.password?.trim();\n if (!email || !pwd) return json({ ok: false, msg: \"Enter email and password.\" });\n if (email === \"owner@privatehub.admin\" && pwd === OWNER_PASSWORD)\n return json({ ok: true, user: { id: 0, name: \"Owner\", email, role: \"owner\" } });\n const pubRes = await sqlite.execute(\"SELECT value FROM settings WHERE key='public_password'\");\n const pubPwd = pubRes.rows[0]?.[0] as string;\n if (pubPwd && pwd === pubPwd) {\n const eu = await sqlite.execute({ sql: \"SELECT id,name,email FROM users WHERE email=?\", args: [email] });\n if (eu.rows.length) { const u = eu.rows[0]; return json({ ok: true, user: { id: u[0], name: u[1], email: u[2], role: \"user\" } }); }\n }\n const r = await sqlite.execute({ sql: \"SELECT id,name,email FROM users WHERE email=? AND password=?\", args: [email, hashPwd(pwd)] });\n if (!r.rows.length) return json({ ok: false, msg: \"Invalid email or password.\" });\n const u = r.rows[0]; return json({ ok: true, user: { id: u[0], name: u[1], email: u[2], role: \"user\" } });\n }\n if (path === \"/api/verify-owner\" && req.method === \"POST\") {\n const b = await req.json(); return json({ ok: b.password?.trim() === OWNER_PASSWORD });\n }\n if (path === \"/api/get-public-password\" && req.method === \"GET\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const r = await sqlite.execute(\"SELECT value FROM settings WHERE key='public_password'\");\n return json({ password: r.rows[0]?.[0] || \"\" });\n }\n if (path === \"/api/set-public-password\" && req.method === \"POST\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const b = await req.json(); const p = b.password?.trim(); if (!p) return json({ ok: false });\n await sqlite.execute({ sql: \"INSERT OR REPLACE INTO settings (key,value) VALUES ('public_password',?)\", args: [p] });\n return json({ ok: true });\n }\n\n // Notes\n if (path === \"/api/notes\" && req.method === \"GET\") {\n const r = await sqlite.execute(\"SELECT * FROM notes ORDER BY number ASC, id DESC\");\n return json({ notes: r.rows.map((x: any[]) => ({ id: x[0], number: x[1], title: x[2], description: x[3], link: x[4], bin: x[5], location: x[6], created_at: x[7] })) });\n }\n if (path === \"/api/notes\" && req.method === \"POST\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const b = await req.json(); let num = b.number ? parseInt(b.number) : null;\n if (!num) { const mx = await sqlite.execute(\"SELECT MAX(number) FROM notes\"); num = mx.rows[0]?.[0] ? Number(mx.rows[0][0]) + 1 : 1; }\n await sqlite.execute({ sql: \"INSERT INTO notes (number,title,description,link,bin,location) VALUES (?,?,?,?,?,?)\", args: [num, b.title, b.description || null, b.link || null, b.bin || null, b.location || null] });\n // Blast email to all users\n blastUsers(\n `📝 New Note on PrivateHUB: ${b.title}`,\n noteEmailHtml({ title: b.title, description: b.description, link: b.link, bin: b.bin, location: b.location }, \"{{NAME}}\")\n );\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/notes/\") && req.method === \"PUT\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const id = path.split(\"/\")[3]; const b = await req.json();\n await sqlite.execute({ sql: \"UPDATE notes SET number=?,title=?,description=?,link=?,bin=?,location=? WHERE id=?\", args: [b.number || null, b.title, b.description || null, b.link || null, b.bin || null, b.location || null, id] });\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/notes/\") && req.method === \"DELETE\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n await sqlite.execute({ sql: \"DELETE FROM notes WHERE id=?\", args: [path.split(\"/\")[3]] }); return json({ ok: true });\n }\n\n // Comments\n if (path.startsWith(\"/api/comments/\") && req.method === \"GET\") {\n const r = await sqlite.execute({ sql: \"SELECT id,user_name,content,created_at FROM comments WHERE note_id=? ORDER BY id ASC\", args: [path.split(\"/\")[3]] });\n return json({ comments: r.rows.map((x: any[]) => ({ id: x[0], user_name: x[1], content: x[2], created_at: x[3] })) });\n }\n if (path === \"/api/comments\" && req.method === \"POST\") {\n const b = await req.json(); if (!b.content?.trim() || !b.note_id || !b.user_name) return json({ ok: false });\n await sqlite.execute({ sql: \"INSERT INTO comments (note_id,user_id,user_name,content) VALUES (?,?,?,?)\", args: [b.note_id, b.user_id || 0, b.user_name, b.content.trim()] });\n return json({ ok: true });\n }\n\n // Hitter House\n if (path === \"/api/hitter\" && req.method === \"GET\") {\n const r = await sqlite.execute(\"SELECT id,user_id,user_name,link,created_at FROM hitter_links ORDER BY id DESC LIMIT 50\");\n return json({ links: r.rows.map((x: any[]) => ({ id: x[0], user_id: x[1], user_name: x[2], link: x[3], created_at: x[4] })) });\n }\n if (path === \"/api/hitter\" && req.method === \"POST\") {\n const b = await req.json(); if (!b.link?.trim() || !b.user_name) return json({ ok: false });\n // Server-side cooldown check per user\n const uid = b.user_id || 0;\n if (uid > 0) {\n const lastPost = await sqlite.execute({ sql: \"SELECT created_at FROM hitter_links WHERE user_id=? ORDER BY id DESC LIMIT 1\", args: [uid] });\n if (lastPost.rows.length) {\n const lastTime = new Date(lastPost.rows[0][0] as string).getTime();\n if (Date.now() - lastTime < COOLDOWN_MS) return json({ ok: false, msg: \"Cooldown active. Wait 1 minute.\" });\n }\n }\n await sqlite.execute({ sql: \"INSERT INTO hitter_links (user_id,user_name,link) VALUES (?,?,?)\", args: [uid, b.user_name, b.link.trim()] });\n // Blast email to all users\n blastUsers(\n `🔥 New Checkout Link in HitterHouse — by ${b.user_name}`,\n hitterEmailHtml({ link: b.link.trim(), user_name: b.user_name }, \"{{NAME}}\")\n );\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/hitter/\") && req.method === \"DELETE\") {\n const role = req.headers.get(\"X-Role\"); const adminTk = req.headers.get(\"X-Admin-Token\");\n if (role !== \"owner\" && adminTk !== OWNER_PASSWORD) return json({ error: \"Forbidden\" }, 403);\n await sqlite.execute({ sql: \"DELETE FROM hitter_links WHERE id=?\", args: [path.split(\"/\")[3]] }); return json({ ok: true });\n }\n\n // Bins List\n if (path === \"/api/bins\" && req.method === \"GET\") {\n const r = await sqlite.execute(\"SELECT id,title,bin_data,description,created_at FROM bins_list ORDER BY id DESC\");\n return json({ bins: r.rows.map((x: any[]) => ({ id: x[0], title: x[1], bin_data: x[2], description: x[3], created_at: x[4] })) });\n }\n if (path === \"/api/bins\" && req.method === \"POST\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const b = await req.json(); if (!b.title?.trim() || !b.bin_data?.trim()) return json({ ok: false });\n await sqlite.execute({ sql: \"INSERT INTO bins_list (title,bin_data,description) VALUES (?,?,?)\", args: [b.title.trim(), b.bin_data.trim(), b.description?.trim() || null] });\n // Blast email to all users\n blastUsers(\n `💳 New Bin on PrivateHUB: ${b.title}`,\n binEmailHtml({ title: b.title, bin_data: b.bin_data, description: b.description }, \"{{NAME}}\")\n );\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/bins/\") && req.method === \"PUT\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const id = path.split(\"/\")[3]; const b = await req.json();\n await sqlite.execute({ sql: \"UPDATE bins_list SET title=?,bin_data=?,description=? WHERE id=?\", args: [b.title, b.bin_data, b.description || null, id] });\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/bins/\") && req.method === \"DELETE\") {\n const role = req.headers.get(\"X-Role\"); const adminTk = req.headers.get(\"X-Admin-Token\");\n if (role !== \"owner\" && adminTk !== OWNER_PASSWORD) return json({ error: \"Forbidden\" }, 403);\n await sqlite.execute({ sql: \"DELETE FROM bins_list WHERE id=?\", args: [path.split(\"/\")[3]] }); return json({ ok: true });\n }\n\n return new Response(HTML, { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n}\n","deleted","label",[100],"permalink","https://www.val.town/x/shelbystifflerr/PrivateHUB/code/main.ts","extension","actionData","errors"]