PrivateHUB

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_162":163,"_164":165},"routes/_app.x.$handle.$name",{"_102":101,"_38":51,"_110":92,"_33":111,"_13":14,"_112":-5,"_11":113,"_114":115,"_116":117,"_118":119,"_120":121,"_26":-5,"_122":-5,"_123":-5,"_124":31,"_125":126,"_127":128,"_129":-5,"_130":-5,"_131":132},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_49":50,"_38":51,"_44":52,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":-5,"_59":-5,"_19":60,"_61":-5,"_62":31,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":31},"version",12,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","e09641bf-d5b6-4cb6-8ae7-6554bf18edaa","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":34,"_39":40,"_41":43,"_44":45,"_46":14,"_47":48,"_30":31},"previous",{"_36":37,"_38":34,"_39":40,"_41":42},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","b075f32e-1005-11f1-95a2-42dde27851f2","name","fileType","http","content","import { sqlite } from \"https://esm.town/v/std/sqlite@14-main/main.ts\";\nimport { email as sendEmail } from \"https://esm.town/v/std/email?v=9\";\n\n// ── Blast email to all registered users with a real email address ──\nasync function blastUsers(subject: string, htmlBody: string) {\n try {\n const r = await sqlite.execute(\"SELECT email, name FROM users WHERE email LIKE '%@%' AND email NOT LIKE '%@telegram%'\");\n for (const row of r.rows) {\n const userEmail = row[0] as string;\n const userName = row[1] as string;\n if (!userEmail.includes(\"@\") || userEmail.startsWith(\"@\")) continue;\n try {\n await sendEmail({\n to: userEmail,\n subject,\n html: htmlBody.replace(\"{{NAME}}\", userName || \"Member\"),\n });\n } catch (_) { /* skip invalid emails silently */ }\n }\n } catch (_) { /* fail silently */ }\n}\n\nfunction noteEmailHtml(note: { title: string; description?: string; link?: string; bin?: string; location?: string }, userName: string) {\n return `\n\n

PrivateHUB

NEW NOTE ADDED

📝 New Note

${note.title}

\n ${note.description ? `

${note.description}

` : \"\"}\n ${note.bin ? `🗑️ ${note.bin}` : \"\"}\n ${note.location ? `📍 ${note.location}` : \"\"}\n ${note.link ? `

🚀 Open Link

` : \"\"}\n

Hi {{NAME}} — you're receiving this because you're a member of PrivateHUB.
Visit: PrivateHUB

`.replace(\"{{NAME}}\", userName);\n}\n\nfunction binEmailHtml(bin: { title: string; bin_data: string; description?: string }, userName: string) {\n return `\n\n

PrivateHUB

NEW BIN ADDED

💳 New Bin

${bin.title}

${bin.bin_data}

\n ${bin.description ? `

${bin.description}

` : \"\"}\n

Hi {{NAME}} — you're receiving this because you're a member of PrivateHUB.
Visit: PrivateHUB

`.replace(\"{{NAME}}\", userName);\n}\n\nfunction hitterEmailHtml(link: { link: string; user_name: string }, userName: string) {\n return `\n\n

🔥 HitterHouse

NEW CHECKOUT LINK DROPPED

🚀 Checkout Link

Dropped by: ${link.user_name}

${link.link}

\n 🔥 Open & Hit\n

Hi {{NAME}} — you're receiving this because you're a member of PrivateHUB.
Visit: PrivateHUB

`.replace(\"{{NAME}}\", userName);\n}\n\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS notes (id INTEGER PRIMARY KEY AUTOINCREMENT, number INTEGER, title TEXT NOT NULL, description TEXT, link TEXT, bin TEXT, location TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS settings (key TEXT PRIMARY KEY, value TEXT)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS users (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL, email TEXT UNIQUE NOT NULL, password TEXT NOT NULL, telegram TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS comments (id INTEGER PRIMARY KEY AUTOINCREMENT, note_id INTEGER NOT NULL, user_id INTEGER NOT NULL, user_name TEXT NOT NULL, content TEXT NOT NULL, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS hitter_links (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER NOT NULL, user_name TEXT NOT NULL, link TEXT NOT NULL, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS bins_list (id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT NOT NULL, bin_data TEXT NOT NULL, description TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);\nawait sqlite.execute(`INSERT OR IGNORE INTO settings (key,value) VALUES ('public_password','')`);\n\nconst OWNER_PASSWORD = \"Random@2001\";\nconst ADMIN_SECRET_PATH = \"/xK9mP2qR7vL4nT8\";\nconst COOLDOWN_MS = 60000; // 1 minute\n\nfunction hashPwd(p: string) { return btoa(encodeURIComponent(p + \"ph_salt_2024\")); }\n\nconst HTML = `\n\n\n\n\nPrivateHUB\n\n\n\n\n

\n\n\n

PrivateHUB

Secure Notes Vault

📧 Email

🔒 Password

\n \n

📱 Telegram Login:
Register with your Telegram @username as email + any password.
👉 Join @PrivateHub4Bins

\n \n

\n\n\n

PrivateHUB

\n \n \n \n \n

\n\n \n

📝 Notes

🔥 HitterHouse

💳 Bins List

\n\n

\n \n

Notes

Links

Bins

Hits

Bin Cards

\n\n \n

\n \n

ADD NEW NOTE

📌 Title

#️⃣ Number

📝 Description

🔗 Link / URL

🗑️ Bin

📍 Location

\n \n \n

📭

📢 JOIN OUR CHANNEL

⚡ PrivateHub4Bins

\n \n \n JOIN CHANNEL\n \n

\n\n \n

🔥 HitterHouse

Drop your checkout link • 1 minute cooldown per user

LIVE

\n\n

\n \n \n

\n ⏳ Cooldown — wait before dropping again\n 60s\n

\n\n

🎯

\n\n \n

💳 Bins List

Click any bin to copy instantly

0 Bins

\n \n

\n\n

ADD NEW BIN

📌 Title / Name

💳 Bin Data

📝 Description (optional)

\n \n \n

\n\n \n\n

💳

\n\n\n

\n \n

\n\n\n

\n \n

\n\n\n

\n \n

\n\n

\n\n\n\n`;\n\n// Admin Panel HTML (compact)\nconst ADMIN_HTML = `PrivateHUB Admin\n

ADMIN PANEL

PRIVATEHUB CONTROL

🔑 Admin Password

#	Name	Email	Joined	Del
Loading...

User	Link	Posted	Del
Loading...

User	Note	Comment	Del
Loading...

Title	Bin Data	Desc	Del
Loading...

\n\n`;\n\nexport default async function(req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname;\n const json = (d: unknown, s = 200) => new Response(JSON.stringify(d), { status: s, headers: { \"Content-Type\": \"application/json\" } });\n\n if (path === ADMIN_SECRET_PATH || path === ADMIN_SECRET_PATH + \"/\")\n return new Response(ADMIN_HTML, { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n\n if (path === \"/api/admin-login\" && req.method === \"POST\") {\n const b = await req.json(); return json({ ok: b.password === OWNER_PASSWORD });\n }\n\n const adminToken = req.headers.get(\"X-Admin-Token\");\n const isAdmin = adminToken === OWNER_PASSWORD;\n\n if (path === \"/api/admin/stats\" && isAdmin) {\n const [u, n, c, h, b] = await Promise.all([\n sqlite.execute(\"SELECT COUNT(*) FROM users\"),\n sqlite.execute(\"SELECT COUNT(*) FROM notes\"),\n sqlite.execute(\"SELECT COUNT(*) FROM comments\"),\n sqlite.execute(\"SELECT COUNT(*) FROM hitter_links\"),\n sqlite.execute(\"SELECT COUNT(*) FROM bins_list\"),\n ]);\n return json({ users: u.rows[0][0], notes: n.rows[0][0], comments: c.rows[0][0], hits: h.rows[0][0], bins: b.rows[0][0] });\n }\n if (path === \"/api/admin/users\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,name,email,created_at FROM users ORDER BY id DESC\");\n return json({ users: r.rows.map((x: any[]) => ({ id: x[0], name: x[1], email: x[2], created_at: x[3] })) });\n }\n if (path.startsWith(\"/api/admin/users/\") && req.method === \"DELETE\" && isAdmin) {\n await sqlite.execute({ sql: \"DELETE FROM users WHERE id=?\", args: [path.split(\"/\")[4]] }); return json({ ok: true });\n }\n if (path === \"/api/admin/comments\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,note_id,user_name,content,created_at FROM comments ORDER BY id DESC LIMIT 100\");\n return json({ comments: r.rows.map((x: any[]) => ({ id: x[0], note_id: x[1], user_name: x[2], content: x[3], created_at: x[4] })) });\n }\n if (path.startsWith(\"/api/admin/comments/\") && req.method === \"DELETE\" && isAdmin) {\n await sqlite.execute({ sql: \"DELETE FROM comments WHERE id=?\", args: [path.split(\"/\")[4]] }); return json({ ok: true });\n }\n if (path === \"/api/admin/hitter\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,user_name,link,created_at FROM hitter_links ORDER BY id DESC LIMIT 100\");\n return json({ links: r.rows.map((x: any[]) => ({ id: x[0], user_name: x[1], link: x[2], created_at: x[3] })) });\n }\n if (path === \"/api/admin/bins\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,title,bin_data,description,created_at FROM bins_list ORDER BY id DESC\");\n return json({ bins: r.rows.map((x: any[]) => ({ id: x[0], title: x[1], bin_data: x[2], description: x[3], created_at: x[4] })) });\n }\n\n // Auth\n if (path === \"/api/register\" && req.method === \"POST\") {\n const b = await req.json();\n const name = b.name?.trim(), email = b.email?.trim()?.toLowerCase(), pwd = b.password?.trim();\n if (!name || !email || !pwd) return json({ ok: false, msg: \"All fields required.\" });\n const ex = await sqlite.execute({ sql: \"SELECT id FROM users WHERE email=?\", args: [email] });\n if (ex.rows.length) return json({ ok: false, msg: \"Email already registered.\" });\n await sqlite.execute({ sql: \"INSERT INTO users (name,email,password) VALUES (?,?,?)\", args: [name, email, hashPwd(pwd)] });\n return json({ ok: true });\n }\n if (path === \"/api/user-login\" && req.method === \"POST\") {\n const b = await req.json();\n const email = b.email?.trim()?.toLowerCase(), pwd = b.password?.trim();\n if (!email || !pwd) return json({ ok: false, msg: \"Enter email and password.\" });\n if (email === \"owner@privatehub.admin\" && pwd === OWNER_PASSWORD)\n return json({ ok: true, user: { id: 0, name: \"Owner\", email, role: \"owner\" } });\n const pubRes = await sqlite.execute(\"SELECT value FROM settings WHERE key='public_password'\");\n const pubPwd = pubRes.rows[0]?.[0] as string;\n if (pubPwd && pwd === pubPwd) {\n const eu = await sqlite.execute({ sql: \"SELECT id,name,email FROM users WHERE email=?\", args: [email] });\n if (eu.rows.length) { const u = eu.rows[0]; return json({ ok: true, user: { id: u[0], name: u[1], email: u[2], role: \"user\" } }); }\n }\n const r = await sqlite.execute({ sql: \"SELECT id,name,email FROM users WHERE email=? AND password=?\", args: [email, hashPwd(pwd)] });\n if (!r.rows.length) return json({ ok: false, msg: \"Invalid email or password.\" });\n const u = r.rows[0]; return json({ ok: true, user: { id: u[0], name: u[1], email: u[2], role: \"user\" } });\n }\n if (path === \"/api/verify-owner\" && req.method === \"POST\") {\n const b = await req.json(); return json({ ok: b.password?.trim() === OWNER_PASSWORD });\n }\n if (path === \"/api/get-public-password\" && req.method === \"GET\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const r = await sqlite.execute(\"SELECT value FROM settings WHERE key='public_password'\");\n return json({ password: r.rows[0]?.[0] || \"\" });\n }\n if (path === \"/api/set-public-password\" && req.method === \"POST\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const b = await req.json(); const p = b.password?.trim(); if (!p) return json({ ok: false });\n await sqlite.execute({ sql: \"INSERT OR REPLACE INTO settings (key,value) VALUES ('public_password',?)\", args: [p] });\n return json({ ok: true });\n }\n\n // Notes\n if (path === \"/api/notes\" && req.method === \"GET\") {\n const r = await sqlite.execute(\"SELECT * FROM notes ORDER BY number ASC, id DESC\");\n return json({ notes: r.rows.map((x: any[]) => ({ id: x[0], number: x[1], title: x[2], description: x[3], link: x[4], bin: x[5], location: x[6], created_at: x[7] })) });\n }\n if (path === \"/api/notes\" && req.method === \"POST\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const b = await req.json(); let num = b.number ? parseInt(b.number) : null;\n if (!num) { const mx = await sqlite.execute(\"SELECT MAX(number) FROM notes\"); num = mx.rows[0]?.[0] ? Number(mx.rows[0][0]) + 1 : 1; }\n await sqlite.execute({ sql: \"INSERT INTO notes (number,title,description,link,bin,location) VALUES (?,?,?,?,?,?)\", args: [num, b.title, b.description || null, b.link || null, b.bin || null, b.location || null] });\n // Blast email to all users\n blastUsers(\n `📝 New Note on PrivateHUB: ${b.title}`,\n noteEmailHtml({ title: b.title, description: b.description, link: b.link, bin: b.bin, location: b.location }, \"{{NAME}}\")\n );\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/notes/\") && req.method === \"PUT\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const id = path.split(\"/\")[3]; const b = await req.json();\n await sqlite.execute({ sql: \"UPDATE notes SET number=?,title=?,description=?,link=?,bin=?,location=? WHERE id=?\", args: [b.number || null, b.title, b.description || null, b.link || null, b.bin || null, b.location || null, id] });\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/notes/\") && req.method === \"DELETE\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n await sqlite.execute({ sql: \"DELETE FROM notes WHERE id=?\", args: [path.split(\"/\")[3]] }); return json({ ok: true });\n }\n\n // Comments\n if (path.startsWith(\"/api/comments/\") && req.method === \"GET\") {\n const r = await sqlite.execute({ sql: \"SELECT id,user_name,content,created_at FROM comments WHERE note_id=? ORDER BY id ASC\", args: [path.split(\"/\")[3]] });\n return json({ comments: r.rows.map((x: any[]) => ({ id: x[0], user_name: x[1], content: x[2], created_at: x[3] })) });\n }\n if (path === \"/api/comments\" && req.method === \"POST\") {\n const b = await req.json(); if (!b.content?.trim() || !b.note_id || !b.user_name) return json({ ok: false });\n await sqlite.execute({ sql: \"INSERT INTO comments (note_id,user_id,user_name,content) VALUES (?,?,?,?)\", args: [b.note_id, b.user_id || 0, b.user_name, b.content.trim()] });\n return json({ ok: true });\n }\n\n // Hitter House\n if (path === \"/api/hitter\" && req.method === \"GET\") {\n const r = await sqlite.execute(\"SELECT id,user_id,user_name,link,created_at FROM hitter_links ORDER BY id DESC LIMIT 50\");\n return json({ links: r.rows.map((x: any[]) => ({ id: x[0], user_id: x[1], user_name: x[2], link: x[3], created_at: x[4] })) });\n }\n if (path === \"/api/hitter\" && req.method === \"POST\") {\n const b = await req.json(); if (!b.link?.trim() || !b.user_name) return json({ ok: false });\n // Server-side cooldown check per user\n const uid = b.user_id || 0;\n if (uid > 0) {\n const lastPost = await sqlite.execute({ sql: \"SELECT created_at FROM hitter_links WHERE user_id=? ORDER BY id DESC LIMIT 1\", args: [uid] });\n if (lastPost.rows.length) {\n const lastTime = new Date(lastPost.rows[0][0] as string).getTime();\n if (Date.now() - lastTime < COOLDOWN_MS) return json({ ok: false, msg: \"Cooldown active. Wait 1 minute.\" });\n }\n }\n await sqlite.execute({ sql: \"INSERT INTO hitter_links (user_id,user_name,link) VALUES (?,?,?)\", args: [uid, b.user_name, b.link.trim()] });\n // Blast email to all users\n blastUsers(\n `🔥 New Checkout Link in HitterHouse — by ${b.user_name}`,\n hitterEmailHtml({ link: b.link.trim(), user_name: b.user_name }, \"{{NAME}}\")\n );\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/hitter/\") && req.method === \"DELETE\") {\n const role = req.headers.get(\"X-Role\"); const adminTk = req.headers.get(\"X-Admin-Token\");\n if (role !== \"owner\" && adminTk !== OWNER_PASSWORD) return json({ error: \"Forbidden\" }, 403);\n await sqlite.execute({ sql: \"DELETE FROM hitter_links WHERE id=?\", args: [path.split(\"/\")[3]] }); return json({ ok: true });\n }\n\n // Bins List\n if (path === \"/api/bins\" && req.method === \"GET\") {\n const r = await sqlite.execute(\"SELECT id,title,bin_data,description,created_at FROM bins_list ORDER BY id DESC\");\n return json({ bins: r.rows.map((x: any[]) => ({ id: x[0], title: x[1], bin_data: x[2], description: x[3], created_at: x[4] })) });\n }\n if (path === \"/api/bins\" && req.method === \"POST\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const b = await req.json(); if (!b.title?.trim() || !b.bin_data?.trim()) return json({ ok: false });\n await sqlite.execute({ sql: \"INSERT INTO bins_list (title,bin_data,description) VALUES (?,?,?)\", args: [b.title.trim(), b.bin_data.trim(), b.description?.trim() || null] });\n // Blast email to all users\n blastUsers(\n `💳 New Bin on PrivateHUB: ${b.title}`,\n binEmailHtml({ title: b.title, bin_data: b.bin_data, description: b.description }, \"{{NAME}}\")\n );\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/bins/\") && req.method === \"PUT\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const id = path.split(\"/\")[3]; const b = await req.json();\n await sqlite.execute({ sql: \"UPDATE bins_list SET title=?,bin_data=?,description=? WHERE id=?\", args: [b.title, b.bin_data, b.description || null, id] });\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/bins/\") && req.method === \"DELETE\") {\n const role = req.headers.get(\"X-Role\"); const adminTk = req.headers.get(\"X-Admin-Token\");\n if (role !== \"owner\" && adminTk !== OWNER_PASSWORD) return json({ error: \"Forbidden\" }, 403);\n await sqlite.execute({ sql: \"DELETE FROM bins_list WHERE id=?\", args: [path.split(\"/\")[3]] }); return json({ ok: true });\n }\n\n return new Response(HTML, { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n}\n","import { sqlite } from \"https://esm.town/v/std/sqlite@14-main/main.ts\";\nimport { email as sendEmail } from \"https://esm.town/v/std/email?v=9\";\n\n// ── Blast email to all registered users with a real email address ──\nasync function blastUsers(subject: string, htmlBody: string) {\n try {\n const r = await sqlite.execute(\"SELECT email, name FROM users WHERE email LIKE '%@%' AND email NOT LIKE '%@telegram%'\");\n for (const row of r.rows) {\n const userEmail = row[0] as string;\n const userName = row[1] as string;\n if (!userEmail.includes(\"@\") || userEmail.startsWith(\"@\")) continue;\n try {\n await sendEmail({\n to: userEmail,\n subject,\n html: htmlBody.replace(\"{{NAME}}\", userName || \"Member\"),\n });\n } catch (_) { /* skip invalid emails silently */ }\n }\n } catch (_) { /* fail silently */ }\n}\n\nfunction noteEmailHtml(note: { title: string; description?: string; link?: string; bin?: string; location?: string }, userName: string) {\n return `\n\n

PrivateHUB

NEW NOTE ADDED

📝 New Note

${note.title}

\n ${note.description ? `

${note.description}

` : \"\"}\n ${note.bin ? `🗑️ ${note.bin}` : \"\"}\n ${note.location ? `📍 ${note.location}` : \"\"}\n ${note.link ? `

🚀 Open Link

` : \"\"}\n

Hi {{NAME}} — you're receiving this because you're a member of PrivateHUB.
Visit: PrivateHUB

`.replace(\"{{NAME}}\", userName);\n}\n\nfunction binEmailHtml(bin: { title: string; bin_data: string; description?: string }, userName: string) {\n return `\n\n

PrivateHUB

NEW BIN ADDED

💳 New Bin

${bin.title}

${bin.bin_data}

\n ${bin.description ? `

${bin.description}

` : \"\"}\n

Hi {{NAME}} — you're receiving this because you're a member of PrivateHUB.
Visit: PrivateHUB

`.replace(\"{{NAME}}\", userName);\n}\n\nfunction hitterEmailHtml(link: { link: string; user_name: string }, userName: string) {\n return `\n\n

🔥 HitterHouse

NEW CHECKOUT LINK DROPPED

🚀 Checkout Link

Dropped by: ${link.user_name}

${link.link}

\n 🔥 Open & Hit\n

Hi {{NAME}} — you're receiving this because you're a member of PrivateHUB.
Visit: PrivateHUB

\n\n\n

PrivateHUB

Secure Notes Vault

📧 Email

🔒 Password

\n \n

📱 Telegram Login:
Register with your Telegram @username as email + any password.
👉 Join @PrivateHub4Bins

\n \n

\n\n\n

PrivateHUB

\n \n \n \n \n

\n\n \n

📝 Notes

🔥 HitterHouse

💳 Bins List

\n\n

\n \n

Notes

Links

Bins

Hits

Bin Cards

\n\n \n

\n \n

ADD NEW NOTE

📌 Title

#️⃣ Number

📝 Description

🔗 Link / URL

🗑️ Bin

📍 Location

\n \n \n

📭

📢 JOIN OUR CHANNEL

⚡ PrivateHub4Bins

\n \n \n JOIN CHANNEL\n \n

\n\n \n

🔥 HitterHouse

Drop your checkout link • 1 minute cooldown per user

LIVE

\n\n

\n \n \n

\n ⏳ Cooldown — wait before dropping again\n 60s\n

\n\n

🎯

\n\n \n

💳 Bins List

Click any bin to copy instantly

0 Bins

\n \n

\n\n

ADD NEW BIN

📌 Title / Name

💳 Bin Data

📝 Description (optional)

\n \n \n

\n\n \n\n

💳

\n\n\n

\n \n

\n\n\n

\n \n

\n\n\n

\n \n

\n\n

\n\n\n\n`;\n\n// Admin Panel HTML (compact)\nconst ADMIN_HTML = `PrivateHUB Admin\n

ADMIN PANEL

PRIVATEHUB CONTROL

🔑 Admin Password

#	Name	Email	Joined	Del
Loading...

User	Link	Posted	Del
Loading...

User	Note	Comment	Del
Loading...

Title	Bin Data	Desc	Del
Loading...

\n\n`;\n\nexport default async function(req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname;\n const json = (d: unknown, s = 200) => new Response(JSON.stringify(d), { status: s, headers: { \"Content-Type\": \"application/json\" } });\n\n if (path === ADMIN_SECRET_PATH || path === ADMIN_SECRET_PATH + \"/\")\n return new Response(ADMIN_HTML, { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n\n if (path === \"/api/admin-login\" && req.method === \"POST\") {\n const b = await req.json(); return json({ ok: b.password === OWNER_PASSWORD });\n }\n\n const adminToken = req.headers.get(\"X-Admin-Token\");\n const isAdmin = adminToken === OWNER_PASSWORD;\n\n if (path === \"/api/admin/stats\" && isAdmin) {\n const [u, n, c, h, b] = await Promise.all([\n sqlite.execute(\"SELECT COUNT(*) FROM users\"),\n sqlite.execute(\"SELECT COUNT(*) FROM notes\"),\n sqlite.execute(\"SELECT COUNT(*) FROM comments\"),\n sqlite.execute(\"SELECT COUNT(*) FROM hitter_links\"),\n sqlite.execute(\"SELECT COUNT(*) FROM bins_list\"),\n ]);\n return json({ users: u.rows[0][0], notes: n.rows[0][0], comments: c.rows[0][0], hits: h.rows[0][0], bins: b.rows[0][0] });\n }\n if (path === \"/api/admin/users\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,name,email,created_at FROM users ORDER BY id DESC\");\n return json({ users: r.rows.map((x: any[]) => ({ id: x[0], name: x[1], email: x[2], created_at: x[3] })) });\n }\n if (path.startsWith(\"/api/admin/users/\") && req.method === \"DELETE\" && isAdmin) {\n await sqlite.execute({ sql: \"DELETE FROM users WHERE id=?\", args: [path.split(\"/\")[4]] }); return json({ ok: true });\n }\n if (path === \"/api/admin/comments\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,note_id,user_name,content,created_at FROM comments ORDER BY id DESC LIMIT 100\");\n return json({ comments: r.rows.map((x: any[]) => ({ id: x[0], note_id: x[1], user_name: x[2], content: x[3], created_at: x[4] })) });\n }\n if (path.startsWith(\"/api/admin/comments/\") && req.method === \"DELETE\" && isAdmin) {\n await sqlite.execute({ sql: \"DELETE FROM comments WHERE id=?\", args: [path.split(\"/\")[4]] }); return json({ ok: true });\n }\n if (path === \"/api/admin/hitter\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,user_name,link,created_at FROM hitter_links ORDER BY id DESC LIMIT 100\");\n return json({ links: r.rows.map((x: any[]) => ({ id: x[0], user_name: x[1], link: x[2], created_at: x[3] })) });\n }\n if (path === \"/api/admin/bins\" && isAdmin) {\n const r = await sqlite.execute(\"SELECT id,title,bin_data,description,created_at FROM bins_list ORDER BY id DESC\");\n return json({ bins: r.rows.map((x: any[]) => ({ id: x[0], title: x[1], bin_data: x[2], description: x[3], created_at: x[4] })) });\n }\n\n // Auth\n if (path === \"/api/register\" && req.method === \"POST\") {\n const b = await req.json();\n const name = b.name?.trim(), email = b.email?.trim()?.toLowerCase(), pwd = b.password?.trim();\n if (!name || !email || !pwd) return json({ ok: false, msg: \"All fields required.\" });\n const ex = await sqlite.execute({ sql: \"SELECT id FROM users WHERE email=?\", args: [email] });\n if (ex.rows.length) return json({ ok: false, msg: \"Email already registered.\" });\n await sqlite.execute({ sql: \"INSERT INTO users (name,email,password) VALUES (?,?,?)\", args: [name, email, hashPwd(pwd)] });\n return json({ ok: true });\n }\n if (path === \"/api/user-login\" && req.method === \"POST\") {\n const b = await req.json();\n const email = b.email?.trim()?.toLowerCase(), pwd = b.password?.trim();\n if (!email || !pwd) return json({ ok: false, msg: \"Enter email and password.\" });\n if (email === \"owner@privatehub.admin\" && pwd === OWNER_PASSWORD)\n return json({ ok: true, user: { id: 0, name: \"Owner\", email, role: \"owner\" } });\n const pubRes = await sqlite.execute(\"SELECT value FROM settings WHERE key='public_password'\");\n const pubPwd = pubRes.rows[0]?.[0] as string;\n if (pubPwd && pwd === pubPwd) {\n const eu = await sqlite.execute({ sql: \"SELECT id,name,email FROM users WHERE email=?\", args: [email] });\n if (eu.rows.length) { const u = eu.rows[0]; return json({ ok: true, user: { id: u[0], name: u[1], email: u[2], role: \"user\" } }); }\n }\n const r = await sqlite.execute({ sql: \"SELECT id,name,email FROM users WHERE email=? AND password=?\", args: [email, hashPwd(pwd)] });\n if (!r.rows.length) return json({ ok: false, msg: \"Invalid email or password.\" });\n const u = r.rows[0]; return json({ ok: true, user: { id: u[0], name: u[1], email: u[2], role: \"user\" } });\n }\n if (path === \"/api/verify-owner\" && req.method === \"POST\") {\n const b = await req.json(); return json({ ok: b.password?.trim() === OWNER_PASSWORD });\n }\n if (path === \"/api/get-public-password\" && req.method === \"GET\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const r = await sqlite.execute(\"SELECT value FROM settings WHERE key='public_password'\");\n return json({ password: r.rows[0]?.[0] || \"\" });\n }\n if (path === \"/api/set-public-password\" && req.method === \"POST\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const b = await req.json(); const p = b.password?.trim(); if (!p) return json({ ok: false });\n await sqlite.execute({ sql: \"INSERT OR REPLACE INTO settings (key,value) VALUES ('public_password',?)\", args: [p] });\n return json({ ok: true });\n }\n\n // Notes\n if (path === \"/api/notes\" && req.method === \"GET\") {\n const r = await sqlite.execute(\"SELECT * FROM notes ORDER BY number ASC, id DESC\");\n return json({ notes: r.rows.map((x: any[]) => ({ id: x[0], number: x[1], title: x[2], description: x[3], link: x[4], bin: x[5], location: x[6], created_at: x[7] })) });\n }\n if (path === \"/api/notes\" && req.method === \"POST\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const b = await req.json(); let num = b.number ? parseInt(b.number) : null;\n if (!num) { const mx = await sqlite.execute(\"SELECT MAX(number) FROM notes\"); num = mx.rows[0]?.[0] ? Number(mx.rows[0][0]) + 1 : 1; }\n await sqlite.execute({ sql: \"INSERT INTO notes (number,title,description,link,bin,location) VALUES (?,?,?,?,?,?)\", args: [num, b.title, b.description || null, b.link || null, b.bin || null, b.location || null] });\n // Blast email to all users\n blastUsers(\n `📝 New Note on PrivateHUB: ${b.title}`,\n noteEmailHtml({ title: b.title, description: b.description, link: b.link, bin: b.bin, location: b.location }, \"{{NAME}}\")\n );\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/notes/\") && req.method === \"PUT\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const id = path.split(\"/\")[3]; const b = await req.json();\n await sqlite.execute({ sql: \"UPDATE notes SET number=?,title=?,description=?,link=?,bin=?,location=? WHERE id=?\", args: [b.number || null, b.title, b.description || null, b.link || null, b.bin || null, b.location || null, id] });\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/notes/\") && req.method === \"DELETE\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n await sqlite.execute({ sql: \"DELETE FROM notes WHERE id=?\", args: [path.split(\"/\")[3]] }); return json({ ok: true });\n }\n\n // Comments\n if (path.startsWith(\"/api/comments/\") && req.method === \"GET\") {\n const r = await sqlite.execute({ sql: \"SELECT id,user_name,content,created_at FROM comments WHERE note_id=? ORDER BY id ASC\", args: [path.split(\"/\")[3]] });\n return json({ comments: r.rows.map((x: any[]) => ({ id: x[0], user_name: x[1], content: x[2], created_at: x[3] })) });\n }\n if (path === \"/api/comments\" && req.method === \"POST\") {\n const b = await req.json(); if (!b.content?.trim() || !b.note_id || !b.user_name) return json({ ok: false });\n await sqlite.execute({ sql: \"INSERT INTO comments (note_id,user_id,user_name,content) VALUES (?,?,?,?)\", args: [b.note_id, b.user_id || 0, b.user_name, b.content.trim()] });\n return json({ ok: true });\n }\n\n // Hitter House\n if (path === \"/api/hitter\" && req.method === \"GET\") {\n const r = await sqlite.execute(\"SELECT id,user_id,user_name,link,created_at FROM hitter_links ORDER BY id DESC LIMIT 50\");\n return json({ links: r.rows.map((x: any[]) => ({ id: x[0], user_id: x[1], user_name: x[2], link: x[3], created_at: x[4] })) });\n }\n if (path === \"/api/hitter\" && req.method === \"POST\") {\n const b = await req.json(); if (!b.link?.trim() || !b.user_name) return json({ ok: false });\n // Server-side cooldown check per user\n const uid = b.user_id || 0;\n if (uid > 0) {\n const lastPost = await sqlite.execute({ sql: \"SELECT created_at FROM hitter_links WHERE user_id=? ORDER BY id DESC LIMIT 1\", args: [uid] });\n if (lastPost.rows.length) {\n const lastTime = new Date(lastPost.rows[0][0] as string).getTime();\n if (Date.now() - lastTime < COOLDOWN_MS) return json({ ok: false, msg: \"Cooldown active. Wait 1 minute.\" });\n }\n }\n await sqlite.execute({ sql: \"INSERT INTO hitter_links (user_id,user_name,link) VALUES (?,?,?)\", args: [uid, b.user_name, b.link.trim()] });\n // Blast email to all users\n blastUsers(\n `🔥 New Checkout Link in HitterHouse — by ${b.user_name}`,\n hitterEmailHtml({ link: b.link.trim(), user_name: b.user_name }, \"{{NAME}}\")\n );\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/hitter/\") && req.method === \"DELETE\") {\n const role = req.headers.get(\"X-Role\"); const adminTk = req.headers.get(\"X-Admin-Token\");\n if (role !== \"owner\" && adminTk !== OWNER_PASSWORD) return json({ error: \"Forbidden\" }, 403);\n await sqlite.execute({ sql: \"DELETE FROM hitter_links WHERE id=?\", args: [path.split(\"/\")[3]] }); return json({ ok: true });\n }\n\n // Bins List\n if (path === \"/api/bins\" && req.method === \"GET\") {\n const r = await sqlite.execute(\"SELECT id,title,bin_data,description,created_at FROM bins_list ORDER BY id DESC\");\n return json({ bins: r.rows.map((x: any[]) => ({ id: x[0], title: x[1], bin_data: x[2], description: x[3], created_at: x[4] })) });\n }\n if (path === \"/api/bins\" && req.method === \"POST\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const b = await req.json(); if (!b.title?.trim() || !b.bin_data?.trim()) return json({ ok: false });\n await sqlite.execute({ sql: \"INSERT INTO bins_list (title,bin_data,description) VALUES (?,?,?)\", args: [b.title.trim(), b.bin_data.trim(), b.description?.trim() || null] });\n // Blast email to all users\n blastUsers(\n `💳 New Bin on PrivateHUB: ${b.title}`,\n binEmailHtml({ title: b.title, bin_data: b.bin_data, description: b.description }, \"{{NAME}}\")\n );\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/bins/\") && req.method === \"PUT\") {\n if (req.headers.get(\"X-Role\") !== \"owner\") return json({ error: \"Forbidden\" }, 403);\n const id = path.split(\"/\")[3]; const b = await req.json();\n await sqlite.execute({ sql: \"UPDATE bins_list SET title=?,bin_data=?,description=? WHERE id=?\", args: [b.title, b.bin_data, b.description || null, id] });\n return json({ ok: true });\n }\n if (path.startsWith(\"/api/bins/\") && req.method === \"DELETE\") {\n const role = req.headers.get(\"X-Role\"); const adminTk = req.headers.get(\"X-Admin-Token\");\n if (role !== \"owner\" && adminTk !== OWNER_PASSWORD) return json({ error: \"Forbidden\" }, 403);\n await sqlite.execute({ sql: \"DELETE FROM bins_list WHERE id=?\", args: [path.split(\"/\")[3]] }); return json({ ok: true });\n }\n\n return new Response(HTML, { headers: { \"Content-Type\": \"text/html; charset=utf-8\" } });\n}\n","createdAt",["D",1771790081844],"branchVersion","branchId","b0719a72-1005-11f1-95a2-42dde27851f2","id","b0713e38-1005-11f1-95a2-42dde27851f2","PrivateHUB",["D",1771775204623],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","019c5932-1078-71ba-9040-5fb061b62e7b","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019c5932-1078-71ba-9040-6301e5becc57","tursoName","b0713e38100511f195a242dde27851f2","tursoHostname","b0713e38100511f195a242dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789532458193],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_102":101,"_109":105},"org",{"_102":101,"_103":-5,"_104":105,"_19":60,"_106":107,"_108":31},"branch",{"_13":14,"_38":92,"_49":48,"_93":50,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":51,"_100":101},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","shelbystifflerr","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zOWRQUm1ZNWJ1WHd4a3RDcmJQc1VxcHZmWHEifQ","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_49":50,"_38":51,"_44":157,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":-5,"_59":-5,"_19":60,"_61":-5,"_62":31,"_63":-5,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":72,"_73":158,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":159,"_87":160,"_89":161,"_91":31},"tree",[152],"files",[152],"counts",{"_141":66,"_142":143,"_144":66,"_145":146,"_147":148},"contents",[133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_49":134,"_38":34,"_36":37,"_135":-5,"_47":48,"_46":14,"_136":128,"_44":137,"_13":138,"_39":40,"_41":43,"_30":31,"_139":-5,"_33":140},"53f68d70-1028-11f1-a32c-42dde27851f2","parentId","latest",["D",1771790081844],11,"label",[34],"pulls","branches",1,"forks","envVars",{"_149":66,"_151":66},"connections",{"_149":66,"_150":66},"count","unfilledCount","emptyCount",{"_49":134,"_38":34,"_36":37,"_135":-5,"_47":48,"_46":14,"_136":128,"_44":153,"_13":138,"_39":40,"_41":43,"_30":31,"_139":-5,"_154":155,"_33":156},["D",1771790081844],"children",[],[34],["D",1771775204623],["D",1789532458193],{"_102":101,"_109":105},{"_102":101,"_103":-5,"_104":105,"_19":60,"_106":107,"_108":31},{"_13":14,"_38":92,"_49":48,"_93":50,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":51,"_100":101},"ctx",{"_85":-5,"_130":195,"_196":197,"_198":199,"_200":31,"_201":31,"_202":31,"_203":128,"_204":-5,"_205":-7,"_206":-7,"_207":66,"_208":31,"_209":31,"_210":-5,"_211":31,"_212":31,"_213":31,"_214":-5},"ENV",{"_166":167,"_168":169,"_170":92,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v12