server.js

/*
Copyright (c) 2026 Azzar Budiyanto / LilyOpenCMS.
All rights reserved.

Contact: azzar.mr.zs@gmail.com for inquiries.
*/
const express = require("express");
const { spawn, execFile } = require("child_process");
const dns = require("dns").promises;
const fs = require("fs");
const http = require("http");
const https = require("https");
const net = require("net");
const os = require("os");
const path = require("path");

const app = express();
const PORT = process.env.PORT || 3300;
const COOKIES_FILE = path.join(__dirname, "cookies.txt");
const SUPPORTED_HOSTS = [
  "youtube.com",
  "youtu.be",
  "facebook.com",
  "fb.watch",
  "fb.com",
  "instagram.com",
  "instagr.am",
  "tiktok.com",
  "x.com",
  "twitter.com",
  "threads.net",
  "threads.com",
  "reddit.com",
  "redd.it",
];

app.disable("x-powered-by");
app.set("trust proxy", process.env.TRUST_PROXY === "1" ? 1 : false);
app.use((req, res, next) => {
  res.setHeader("X-Content-Type-Options", "nosniff");
  res.setHeader("X-Frame-Options", "DENY");
  res.setHeader("Referrer-Policy", "no-referrer");
  res.setHeader(
    "Permissions-Policy",
    "camera=(), microphone=(), geolocation=()",
  );
  next();
});
app.use(express.json({ limit: "16kb", strict: true }));
app.use(express.urlencoded({ limit: "16kb", extended: false }));

const PUBLIC_FILES = new Map([
  ["/", "index.html"],
  ["/index.html", "index.html"],
  ["/sw.js", "sw.js"],
  ["/manifest.json", "manifest.json"],
  ["/favicon.png", "favicon.png"],
  ["/icon-192.png", "icon-192.png"],
  ["/icon-512.png", "icon-512.png"],
]);

for (const [route, file] of PUBLIC_FILES) {
  app.get(route, (req, res) => res.sendFile(path.join(__dirname, file)));
}

function getCookieArgs() {
  try {
    const content = fs.readFileSync(COOKIES_FILE, "utf8");
    const hasValid = content
      .split("\n")
      .some(
        (line) => line.trim() && !line.startsWith("#") && line.includes("\t"),
      );
    return hasValid ? ["--cookies", COOKIES_FILE] : [];
  } catch {
    return [];
  }
}

function ytDlpArgs() {
  return [
    path.join(__dirname, "venv", "bin", "yt-dlp"),
    "--js-runtimes",
    "node",
    "--remote-components",
    "ejs:github",
    "--no-playlist",
    ...getCookieArgs(),
  ];
}

function sanitizeFilename(name) {
  return String(name)
    .replace(/[<>:"/\\|?*]/g, "_")
    .replace(/[\x00-\x1f\x7f]/g, "")
    .substring(0, 200)
    .trim();
}

function contentDisposition(filename, fallbackExt) {
  const safe = sanitizeFilename(filename) || `download${fallbackExt}`;
  const ascii = safe.replace(/[^\x20-\x7e]/g, "_");
  const encoded = encodeURIComponent(safe).replace(
    /[!'()*]/g,
    (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`,
  );
  return `attachment; filename="${ascii}"; filename*=UTF-8''${encoded}`;
}

function hostMatches(hostname, allowedHost) {
  return hostname === allowedHost || hostname.endsWith(`.${allowedHost}`);
}

function parseMediaUrl(value) {
  if (typeof value !== "string" || value.length > 4096) return false;
  try {
    const parsed = new URL(value);
    if (
      !["http:", "https:"].includes(parsed.protocol) ||
      parsed.username ||
      parsed.password
    )
      return false;
    const hostname = parsed.hostname.toLowerCase();
    return SUPPORTED_HOSTS.some((host) => hostMatches(hostname, host))
      ? parsed
      : false;
  } catch {
    return false;
  }
}

function isThreads(value) {
  const parsed = parseMediaUrl(value);
  return Boolean(
    parsed &&
      (hostMatches(parsed.hostname, "threads.com") ||
        hostMatches(parsed.hostname, "threads.net")),
  );
}

function isPrivateIp(address) {
  if (net.isIPv4(address)) {
    const [a, b] = address.split(".").map(Number);
    return (
      a === 0 ||
      a === 10 ||
      a === 127 ||
      (a === 100 && b >= 64 && b <= 127) ||
      (a === 169 && b === 254) ||
      (a === 172 && b >= 16 && b <= 31) ||
      (a === 192 && (b === 0 || b === 168)) ||
      (a === 198 && (b === 18 || b === 19 || b === 51)) ||
      (a === 203 && b === 0) ||
      a >= 224
    );
  }
  if (net.isIPv6(address)) {
    const value = address.toLowerCase().split("%")[0];
    if (value.startsWith("::ffff:")) return isPrivateIp(value.slice(7));
    return !/^[23][0-9a-f]{3}:/.test(value);
  }
  return true;
}

async function resolvePublicHttpUrl(value) {
  const parsed = new URL(value);
  if (
    !["http:", "https:"].includes(parsed.protocol) ||
    parsed.username ||
    parsed.password
  ) {
    throw new Error("Unsafe media URL");
  }
  const addresses = await dns.lookup(parsed.hostname, { all: true });
  if (
    !addresses.length ||
    addresses.some(({ address }) => isPrivateIp(address))
  ) {
    throw new Error("Unsafe media host");
  }
  return { parsed, addresses };
}

async function requestPublicMedia(url, signal, timeoutMs = 120000) {
  const requests = new Set();
  const responses = new Set();
  let current = url;
  const cancel = () => {
    for (const request of requests)
      request.destroy(new Error("Media request cancelled"));
    for (const response of responses)
      response.destroy(new Error("Media response cancelled"));
  };
  if (signal) {
    if (signal.aborted) cancel();
    else signal.addEventListener("abort", cancel, { once: true });
  }

  for (let redirects = 0; redirects <= 3; redirects += 1) {
    const { parsed, addresses } = await resolvePublicHttpUrl(current);
    const selected = addresses[0];
    const transport = parsed.protocol === "https:" ? https : http;
    const response = await new Promise((resolve, reject) => {
      const request = transport.get(
        parsed,
        {
          lookup: (hostname, options, callback) =>
            options?.all
              ? callback(null, [selected])
              : callback(null, selected.address, selected.family),
          servername: parsed.hostname,
          timeout: timeoutMs,
          headers: { "user-agent": "MediaDownloader/1.0" },
        },
        (response) => {
          responses.add(response);
          response.once("close", () => responses.delete(response));
          resolve(response);
        },
      );
      requests.add(request);
      request.once("close", () => requests.delete(request));
      request.once("timeout", () =>
        request.destroy(new Error("Media request timed out")),
      );
      request.once("error", reject);
    });
    if (response.statusCode < 300 || response.statusCode >= 400)
      return { response, cancel };
    const location = response.headers.location;
    response.resume();
    if (!location || redirects === 3)
      throw new Error("Too many media redirects");
    current = new URL(location, current).href;
  }
}

async function threadsFetchInfo(url, signal) {
  const response = await fetch("https://lovethreads.net/api/ajaxSearch", {
    method: "POST",
    signal: signal
      ? AbortSignal.any([signal, AbortSignal.timeout(20000)])
      : AbortSignal.timeout(20000),
    headers: {
      "content-type": "application/x-www-form-urlencoded; charset=UTF-8",
      origin: "https://lovethreads.net",
      referer: "https://lovethreads.net/en",
      "x-requested-with": "XMLHttpRequest",
      "user-agent":
        "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
    },
    body: new URLSearchParams({ q: url, t: "media", lang: "en" }),
  });
  if (!response.ok) throw new Error(`Threads API returned ${response.status}`);
  const data = await response.json();
  if (data.status !== "ok")
    throw new Error("Failed to retrieve media from Threads");
  return data;
}

function decodeHtmlAttribute(value) {
  return value
    .replace(/&amp;/gi, "&")
    .replace(/&#x2f;/gi, "/")
    .replace(/&#47;/g, "/");
}

function parseThreadsHtml(html) {
  const videos = [];
  const liRegex = /<li>.*?<\/li>/gis;
  let liMatch;
  while ((liMatch = liRegex.exec(html)) !== null) {
    const li = liMatch[0];
    if (!/icon-dlvideo/i.test(li)) continue;
    const thumbMatch = li.match(/<img[^>]*src="([^"]+)"/i);
    const urlMatch =
      li.match(/<a[^>]*href="([^"]+)"[^>]*title="Download Video"/i) ||
      li.match(/<a[^>]*title="Download Video"[^>]*href="([^"]+)"/i);
    if (urlMatch) {
      videos.push({
        thumbnail: thumbMatch ? decodeHtmlAttribute(thumbMatch[1]) : "",
        url: decodeHtmlAttribute(urlMatch[1]),
      });
    }
  }
  return videos;
}

function logError(context, error, extra = "") {
  console.error(
    `[${new Date().toISOString()}] [ERROR] ${context}:`,
    error?.message || error,
    extra,
  );
}

function rateLimit({ windowMs, max, maxClients = 10000 }) {
  const clients = new Map();
  const cleanupTimer = setInterval(() => {
    const now = Date.now();
    for (const [key, value] of clients) {
      if (value.resetAt <= now) clients.delete(key);
    }
  }, windowMs);
  cleanupTimer.unref();
  return (req, res, next) => {
    const now = Date.now();
    const previous = clients.get(req.ip);
    if (!previous && clients.size >= maxClients) {
      return res
        .status(503)
        .json({ error: "Server is busy. Try again shortly." });
    }
    const entry =
      !previous || previous.resetAt <= now
        ? { count: 0, resetAt: now + windowMs }
        : previous;
    entry.count += 1;
    clients.set(req.ip, entry);
    res.setHeader("RateLimit-Limit", max);
    res.setHeader("RateLimit-Remaining", Math.max(0, max - entry.count));
    res.setHeader("RateLimit-Reset", Math.ceil(entry.resetAt / 1000));
    if (entry.count > max) {
      res.setHeader(
        "Retry-After",
        Math.max(1, Math.ceil((entry.resetAt - now) / 1000)),
      );
      return res
        .status(429)
        .json({ error: "Too many requests. Try again later." });
    }
    next();
  };
}

function concurrencyLimit(max) {
  let active = 0;
  return (req, res, next) => {
    if (active >= max)
      return res
        .status(503)
        .json({ error: "Server is busy. Try again shortly." });
    active += 1;
    let released = false;
    const release = () => {
      if (released) return;
      released = true;
      active -= 1;
    };
    res.once("finish", release);
    res.once("close", release);
    next();
  };
}

app.get("/health", (req, res) => res.json({ status: "ok" }));
app.use("/api/", rateLimit({ windowMs: 10 * 60 * 1000, max: 30 }));
app.use(
  "/api/download",
  concurrencyLimit(Number(process.env.MAX_CONCURRENT_DOWNLOADS) || 3),
);

app.post("/api/info", async (req, res) => {
  const { url } = req.body;
  if (!url) return res.status(400).json({ error: "URL is required" });
  if (!parseMediaUrl(url))
    return res.status(400).json({ error: "Unsupported media URL" });

  if (isThreads(url)) {
    const controller = new AbortController();
    res.once("close", () => {
      if (!res.writableEnded) controller.abort();
    });
    try {
      const result = await threadsFetchInfo(url, controller.signal);
      const html = typeof result.data === "string" ? result.data : "";
      const videos = parseThreadsHtml(html);
      if (!videos.length)
        throw new Error("No downloadable Threads video found");
      const titleMatch = html.match(/<title[^>]*>([^<]+)<\/title>/i);
      return res.json({
        title:
          titleMatch?.[1]?.trim() ||
          (typeof result.title === "string" ? result.title : "Threads Video"),
        thumbnail: videos[0].thumbnail,
        duration: null,
        resolution: null,
        ext: "mp4",
        formats: videos.map((video, index) => ({
          format_id: `video_${index}`,
          ext: "mp4",
          resolution: `Video ${index + 1}`,
          filesize: 0,
        })),
      });
    } catch (error) {
      logError("Threads info fetch", error, url);
      const message =
        error.name === "AbortError" ? "Threads API timed out" : error.message;
      return res.status(400).json({ error: message });
    }
  }

  const args = [...ytDlpArgs(), "--dump-json", "--no-download", "--", url];
  const useProcessGroup = process.platform !== "win32";
  let complete = false;
  const child = execFile(
    args[0],
    args.slice(1),
    {
      detached: useProcessGroup,
      maxBuffer: 10 * 1024 * 1024,
    },
    (error, stdout, stderr) => {
      complete = true;
      clearTimeout(timeout);
      clearTimeout(killTimeout);
      if (error) {
        const message =
          stderr
            .split("\n")
            .filter((line) => line.trim())
            .pop() || error.message;
        logError("yt-dlp info", error, url);
        return res
          .status(400)
          .json({ error: message.replace(/\x1b\[[0-9;]*m/g, "") });
      }
      try {
        const data = JSON.parse(stdout);
        return res.json({
          title: data.title || "Untitled",
          thumbnail: data.thumbnail || "",
          duration: data.duration || null,
          resolution:
            data.resolution || (data.height ? `${data.height}p` : null),
          ext: data.ext || "mp4",
          formats: (data.formats || [])
            .filter(
              (format) =>
                format.format_id && format.height && format.vcodec !== "none",
            )
            .map((format) => ({
              format_id: format.format_id,
              ext: format.ext,
              resolution: `${format.height}p`,
              filesize: format.filesize || format.filesize_approx || 0,
            })),
        });
      } catch (parseError) {
        logError("yt-dlp parse", parseError, stdout?.substring(0, 200));
        return res.status(500).json({ error: "Failed to parse media info." });
      }
    },
  );
  const terminate = (signal) => {
    if (child.killed || child.exitCode !== null) return;
    try {
      if (useProcessGroup && child.pid) process.kill(-child.pid, signal);
      else child.kill(signal);
    } catch (error) {
      if (error.code !== "ESRCH")
        logError("Metadata process termination", error);
    }
  };
  const timeout = setTimeout(() => terminate("SIGTERM"), 30000);
  const killTimeout = setTimeout(() => terminate("SIGKILL"), 35000);
  timeout.unref();
  killTimeout.unref();
  res.once("close", () => {
    if (!res.writableEnded && !complete) {
      terminate("SIGTERM");
      setTimeout(() => terminate("SIGKILL"), 5000).unref();
    }
  });
});

app.post("/api/download", async (req, res) => {
  const { url, type, format_id, filename } = req.body;
  if (!url) return res.status(400).json({ error: "URL is required" });
  if (!parseMediaUrl(url))
    return res.status(400).json({ error: "Unsupported media URL" });
  if (!["video", "audio"].includes(type))
    return res.status(400).json({ error: "Invalid download type" });
  if (
    format_id &&
    (typeof format_id !== "string" || !/^[\w.-]{1,100}$/.test(format_id))
  ) {
    return res.status(400).json({ error: "Invalid format selection" });
  }

  const baseName = filename ? sanitizeFilename(filename) : "download";

  if (isThreads(url)) {
    if (type === "audio")
      return res
        .status(400)
        .json({ error: "Threads audio extraction is not supported" });
    const controller = new AbortController();
    res.once("close", () => {
      if (!res.writableEnded) controller.abort();
    });
    let cancelFetch = () => {};
    try {
      const result = await threadsFetchInfo(url, controller.signal);
      const html = typeof result.data === "string" ? result.data : "";
      const videos = parseThreadsHtml(html);
      let videoUrl = videos[0]?.url;
      if (format_id) {
        const match = /^video_(\d+)$/.exec(format_id);
        const index = match ? Number(match[1]) : -1;
        if (!videos[index]) throw new Error("Invalid Threads format selection");
        videoUrl = videos[index].url;
      }
      if (!videoUrl) throw new Error("No video found");

      const fetched = await requestPublicMedia(videoUrl, controller.signal);
      const response = fetched.response;
      cancelFetch = fetched.cancel;
      if (response.statusCode < 200 || response.statusCode >= 300) {
        response.resume();
        throw new Error(`Media server returned ${response.statusCode}`);
      }

      res.setHeader(
        "Content-Disposition",
        contentDisposition(`${baseName}.mp4`, ".mp4"),
      );
      res.setHeader(
        "Content-Type",
        response.headers["content-type"] || "video/mp4",
      );
      const contentLength = response.headers["content-length"];
      if (contentLength && /^\d+$/.test(contentLength))
        res.setHeader("Content-Length", contentLength);

      const cancel = () => cancelFetch();
      res.once("close", cancel);
      res.once("finish", cancel);
      response.on("error", (error) => {
        cancel();
        logError("Threads download stream", error);
        if (!res.headersSent)
          res.status(502).json({ error: "Media stream failed" });
        else res.destroy(error);
      });
      response.pipe(res);
    } catch (error) {
      cancelFetch();
      logError("Threads download", error, url);
      const message =
        error.name === "AbortError"
          ? "Threads download timed out"
          : error.message;
      if (!res.headersSent) res.status(400).json({ error: message });
    }
    return;
  }

  const ext = type === "audio" ? "mp3" : "mp4";
  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "media-dl-"));
  const tmpFile = path.join(tmpDir, `download.${ext}`);
  let args;
  if (type === "audio") {
    args = [
      ...ytDlpArgs(),
      "-x",
      "--audio-format",
      "mp3",
      "--audio-quality",
      "0",
      "-o",
      tmpFile,
      "--",
      url,
    ];
  } else if (format_id) {
    args = [
      ...ytDlpArgs(),
      "-f",
      `${format_id}+bestaudio/${format_id}/best`,
      "--remux-video",
      "mp4",
      "-o",
      tmpFile,
      "--",
      url,
    ];
  } else {
    args = [
      ...ytDlpArgs(),
      "-f",
      "best[ext=mp4]/best",
      "-o",
      tmpFile,
      "--",
      url,
    ];
  }

  const useProcessGroup = process.platform !== "win32";
  const child = spawn(args[0], args.slice(1), {
    stdio: ["ignore", "pipe", "pipe"],
    detached: useProcessGroup,
  });
  const timeout = setTimeout(() => terminateChild("SIGTERM"), 600000);
  const killTimeout = setTimeout(() => terminateChild("SIGKILL"), 605000);
  timeout.unref();
  killTimeout.unref();
  let stderr = "";
  let cleanedUp = false;
  let responseStarted = false;
  let errorSent = false;

  function cleanup() {
    if (cleanedUp) return;
    cleanedUp = true;
    fs.rm(tmpDir, { force: true, recursive: true }, () => {});
  }

  function respondError(status, message) {
    if (errorSent || responseStarted || res.headersSent || res.destroyed)
      return;
    errorSent = true;
    res.status(status).json({ error: message });
  }

  function terminateChild(signal) {
    if (child.killed || child.exitCode !== null) return;
    try {
      if (useProcessGroup && child.pid) process.kill(-child.pid, signal);
      else child.kill(signal);
    } catch (error) {
      if (error.code !== "ESRCH")
        logError("Download process termination", error);
    }
  }

  res.once("close", () => {
    if (res.writableEnded) return;
    terminateChild("SIGTERM");
    setTimeout(() => terminateChild("SIGKILL"), 5000).unref();
    cleanup();
  });
  child.stderr.on("data", (chunk) => {
    if (stderr.length < 64 * 1024) stderr += chunk.toString();
  });
  child.on("error", (error) => {
    clearTimeout(timeout);
    clearTimeout(killTimeout);
    cleanup();
    respondError(500, "Failed to start download process.");
  });
  child.on("close", (code) => {
    clearTimeout(timeout);
    clearTimeout(killTimeout);
    if (cleanedUp) return;
    if (code !== 0) {
      cleanup();
      const message =
        stderr
          .split("\n")
          .filter((line) => line.trim())
          .pop() || "Download failed";
      logError("yt-dlp download", message, url);
      respondError(400, message.replace(/\x1b\[[0-9;]*m/g, ""));
      return;
    }

    let fileSize;
    try {
      fileSize = fs.statSync(tmpFile).size;
    } catch (error) {
      cleanup();
      logError("Download output missing", error, tmpFile);
      respondError(500, "Download output was not created");
      return;
    }
    responseStarted = true;
    res.setHeader(
      "Content-Disposition",
      contentDisposition(`${baseName}.${ext}`, `.${ext}`),
    );
    res.setHeader(
      "Content-Type",
      type === "audio" ? "audio/mpeg" : "video/mp4",
    );
    res.setHeader("Content-Length", fileSize);
    const stream = fs.createReadStream(tmpFile);
    stream.on("error", (error) => {
      logError("Download stream read", error);
      cleanup();
      if (!res.headersSent) {
        responseStarted = false;
        respondError(500, "File read error");
      } else res.destroy(error);
    });
    stream.on("end", cleanup);
    res.on("error", cleanup);
    stream.pipe(res);
  });
});

app.use((error, req, res, next) => {
  if (error instanceof SyntaxError && error.status === 400 && "body" in error) {
    return res.status(400).json({ error: "Invalid JSON body" });
  }
  next(error);
});

if (require.main === module) {
  const server = app.listen(PORT, () => {
    const address = server.address();
    const host = address.address === "::" ? "localhost" : address.address;
    console.log(`Server running at http://${host}:${address.port}`);
  });
}

module.exports = {
  app,
  contentDisposition,
  isPrivateIp,
  parseMediaUrl,
  sanitizeFilename,
};