index.js

const express = require('express');
const session = require('express-session');
const cors = require('cors');
const path = require('path');
const app = express();
const fetch = require('node-fetch');
const mysql = require('mysql2');
const cookieParser = require('cookie-parser');
const rateLimit = require('express-rate-limit');
require('dotenv').config();
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
const nodemailer = require('nodemailer');
const MySQLStore = require('express-mysql-session')(session);
const db = mysql.createPool({
    host: process.env.MYSQL_HOST,
    user: process.env.MYSQL_USER,
    password: process.env.MYSQL_PASS,
    database: process.env.MYSQL_DATABASE
});
var dbPromise = db.promise();
const transporter = nodemailer.createTransport({
    host: process.env.MAIL_HOST,
    port: 587,
    secure: false,
    auth: {
        user: process.env.MAIL_USER,
        pass: process.env.MAIL_PASS,
    },
    tls: {
        rejectUnauthorized: false,
    },
});
const sessionStore = new MySQLStore({
    host: process.env.MYSQL_HOST,
    port: 3306,
    user: process.env.MYSQL_USER,
    password: process.env.MYSQL_PASS,
    database: process.env.MYSQL_DATABASE
});
const port = 3000;

app.engine('.ejs', require('ejs').renderFile);
app.set('view engine', 'ejs');
app.set('views', path.join(__dirname, 'frontend/pages'));
app.use(express.static(__dirname + '/frontend/public'));
app.use(express.urlencoded({ extended: true }));
app.use('/stripe', express.raw({ type: 'application/json' }));
app.use(express.json());
app.use(cors());
app.use(session({
    name: 'sessionid',
    secret: 'a7057203-fcf2-5fa4-9a83-c29a65f51d8c',
    store: sessionStore,
    resave: false,
    saveUninitialized: false,
    cookie: { maxAge: 86400000 }
}));
app.set('trust proxy', true);
app.use(cookieParser());
app.use(rateLimit({
    windowMs: 60 * 1000,
    max: 15,
    skip: (req, res) => {
        return req.ip !== undefined;
    },
    message: "Too many requests from this IP, please try again in a minute."
}));
app.use(async (req, res, next) => {
    if (!(await cmsdata()).ok) {
        res.status(500).render('error', { error: 'error connecting to CMS; CMS connection failed' });
        return;
    };
    next();
});

function cmsdata() {
    return fetch(`https://cms.dangoweb.com/:${process.env.SITE}/api/gql`, {
        method: 'POST',
        headers: {
            'Content-Type': 'application/json',
            'Accept': 'application/json',
            'Authorization': process.env.CMS_API_KEY,
        },
        body: JSON.stringify({
            query: `{
                siteDetails: content(model: "siteDetails")
                home: content(model: "home")
                menu: content(model: "menu")
            }`
        }),
    })
};

async function startApp() {
    try {
        var cms = JSON.parse(JSON.stringify((await cmsdata().then(res => res.json())).data).replaceAll('.spaces', 'clients'));
    } catch { };

    // Defaults & Environment Variables

    var defaults = {
        environment: process.env.NODE_ENV || 'development',
        domain: process.env.NODE_ENV === 'production' ? cms.siteDetails[0]['domain-production'] : process.env.NODE_ENV === 'development' ? cms.siteDetails[0]['domain-development'] : '../../../../..',
        asset_prefix: process.env.CMS_ASSET_PREFIX,
        asset_url: process.env.CMS_ASSET_URL,
        slugify: function (string) {
            return string.toLowerCase().replace(/ /g, '-').replace(/[^\w-]+/g, '');
        },
        products: [],
    };

    await refreshProducts();

    // Functions

    async function allRoutes(req, res) {
        cms = (await cmsdata().then(res => res.json())).data;
        // req.session.user = {
        //     id: 1,
        //     created_at: "2026-04-15 00:53:09",
        //     name: 'Alfie Leek',
        //     username: 'alfieinspired',
        //     email: 'me@alfieleek.com',
        //     discord: '1171566611279401031',
        //     roblox: '12577343',
        //     staff: 1,
        //     access: [
        //         'admin',
        //         'staff',
        //         'users',
        //         'products',
        //         'licenses',
        //         'whitelisting',
        //         'orders'
        //     ],
        //     purchases: [
        //         '8fc05b9c-b576-40e7-b7b9-dc007b50391b',
        //         '4895a23b-84c1-407e-8b48-8abb6c5a9f62',
        //         'c1d24234-9403-48ca-9910-6007d95f0906',
        //         '7ade9e7d-12b0-4696-8cb5-2b376d2fe968',
        //         '398f7765-a402-42e6-8e52-8381dd642744',
        //         'a733c579-879d-4dff-b79d-90d3576637f1'
        //     ]
        // }
        // req.session.user = {
        //     "id": 27,
        //     "created_at": "2026-04-15 00:53:09",
        //     "name": "faisaltest3",
        //     "discord": null,
        //     "staff": 1,
        //     "username": "faisaltest3",
        //     "email": "contact@faisaln.com",
        //     "roblox": "8057452755",
        //     "purchases": [],
        //     "access": ["admin", "products", "staff", "users", "licenses", "whitelisting"]
        // };
        // if (defaults.environment === 'development') req.session.user = {
        //     "id": 27,
        //     "created_at": "2026-04-15 00:53:09",
        //     "name": "faisaltest3",
        //     "discord": "905990944858451988",
        //     "staff": 1,
        //     "username": "faisaltest3",
        //     "email": "contact@faisaln.com",
        //     "roblox": "8057452755",
        //     "purchases": [],
        //     "access": ["admin", "products", "staff", "users", "licenses", "whitelisting"]
        // };
        // if (defaults.environment === 'development') req.session.user = {
        //     "id": 28,
        //     "created_at": "2026-04-15 00:53:09",
        //     "name": "test user",
        //     "discord": null,
        //     "staff": 1,
        //     "username": "test",
        //     "email": null,
        //     "roblox": null,
        //     "purchases": [],
        //     "access": ["staff"]
        // };
        defaults.req = req;
        dbPromise = db.promise();
        if (req.session.user) {
            const [rows, fields] = await dbPromise.query(`SELECT * FROM accounts WHERE id = '${req.session.user.id}' LIMIT 1`);
            req.session.user = rows[0];
            if (req.session.user) {
                req.session.user.staff = req.session.user.staff.readUInt8(0);
                req.session.user.purchases = await refreshPurchases();
                req.session.user.access = JSON.parse(req.session.user.access);
                req.session.save();
            };
        };
    };

    async function dashboard(req, res, next) {
        await allRoutes(req, res);
        if (!req.session.user) {
            console.log('Redirecting unauthenticated admin user:', req.session);
            return res.status(401).redirect('/dashboard/login');
        };
        if (!req.session.user.staff) return res.status(401).redirect('/');
        next();
    };

    async function refreshProducts() {
        var vaultProductsRaw = await fetch('https://developers.vaultroblox.com/api/vault/products', {
            method: 'GET',
            headers: {
                "Authorization": `Bearer ${process.env.VAULT_API_KEY}`,
                "Content-Type": "application/json"
            }
        });
        var vaultProductsJSON = await vaultProductsRaw.json();
        if (vaultProductsJSON && !vaultProductsJSON.error) {
            var products = vaultProductsJSON.data;
            defaults.products = products;
        } else {
            console.error(vaultProductsJSON.message);
            return defaults.products;
        };
        await dbPromise.query(`SELECT * FROM productDetails`).then(([rows, fields]) => {
            rows.forEach(product => {
                var index = defaults.products.findIndex(p => p.productUUID === product.id);
                if (index !== -1) {
                    defaults.products[index].price = product.price;
                    defaults.products[index].link = product.link;
                };
            });
        });
        return defaults.products;
    };

    async function refreshPurchases(robloxId = null, discordId = null) {
        var purchased = [];
        var userLicensesRaw = await fetch('https://developers.vaultroblox.com/api/profile', {
            method: 'POST',
            headers: {
                "Authorization": `Bearer ${process.env.VAULT_API_KEY}`,
                "Content-Type": "application/json"
            },
            body: JSON.stringify((robloxId || (!robloxId && !discordId)) ? {
                robloxID: robloxId || defaults.req.session.user.roblox,
            } : {
                discordID: discordId,
            })
        });
        var userLicensesJSON = await userLicensesRaw.json();
        if (userLicensesJSON && !userLicensesJSON.error) {
            purchased = (userLicensesJSON?.data?.products || []).filter(product => product).map(product => product.productUUID);
        } else {
            console.error(userLicensesJSON.message);
        };
        return purchased;
    };

    async function whitelistProduct(user, productId) {
        await fetch('https://developers.vaultroblox.com/api/licenses/add', {
            method: 'POST',
            headers: {
                "Authorization": `Bearer ${process.env.VAULT_API_KEY}`,
                "Content-Type": "application/json"
            },
            body: JSON.stringify(user.roblox ? {
                robloxID: user.roblox,
                productUUID: productId,
            } : {
                discordID: user.discord,
                productUUID: productId,
            })
        });
        var dbUser = await dbPromise.query(`SELECT * FROM accounts WHERE ${user.roblox ? `roblox = '${user.roblox}'` : `discord = '${user.discord}'`} LIMIT 1`).then(([rows, fields]) => rows[0]);
        if (dbUser) await dbPromise.query(`UPDATE orders SET whitelisted = 1 WHERE user = ? AND product = ?`, [dbUser.id, productId]);
    };

    async function revokeProduct(user, productId) {
        await fetch('https://developers.vaultroblox.com/api/licenses/delete', {
            method: 'DELETE',
            headers: {
                "Authorization": `Bearer ${process.env.VAULT_API_KEY}`,
                "Content-Type": "application/json"
            },
            body: JSON.stringify(user.roblox ? {
                robloxID: user.roblox,
                productUUID: productId,
            } : {
                discordID: user.discord,
                productUUID: productId,
            })
        });
        var dbUser = await dbPromise.query(`SELECT * FROM accounts WHERE ${user.roblox ? `roblox = '${user.roblox}'` : `discord = '${user.discord}'`} LIMIT 1`).then(([rows, fields]) => rows[0]);
        if (dbUser) await dbPromise.query(`UPDATE orders SET whitelisted = 0 WHERE user = ? AND product = ?`, [dbUser.id, productId]);
    };

    // Routes

    app.get('/', async (req, res) => {
        await allRoutes(req, res);
        if (cms.home[0]._state != 0) {
            return res.render('index', { vars: defaults, title: '', cms });
        } else {
            return res.render('404', { vars: defaults, title: '404', cms });
        };
    });

    app.get('/products', async (req, res) => {
        await allRoutes(req, res);
        return res.render('products', { vars: defaults, title: '', cms });
    });

    app.get('/products/:product', async (req, res, next) => {
        await allRoutes(req, res);
        var product = defaults.products.find(product => defaults.slugify(product.name) === req.params.product);
        if (product) return res.render('product', { vars: defaults, title: product.name, cms, product });
        next();
    });

    app.get('/login', async (req, res) => {
        await allRoutes(req, res);
        if (req.session.user?.roblox) return res.redirect('/');
        if (!req.query.code) return res.redirect(`https://apis.roblox.com/oauth/v1/authorize?client_id=${process.env.ROBLOX_CLIENT_ID}&redirect_uri=${process.env.ROBLOX_OAUTH_URL}&scope=openid profile&response_type=code`);
        try {
            encodedParams = new URLSearchParams();
            encodedParams.set('client_id', process.env.ROBLOX_CLIENT_ID);
            encodedParams.set('client_secret', process.env.ROBLOX_CLIENT_SECRET);
            encodedParams.set('grant_type', 'authorization_code');
            encodedParams.set('code', req.query.code);
            await fetch('https://apis.roblox.com/oauth/v1/token', {
                method: 'POST',
                headers: {
                    'Content-Type': "application/x-www-form-urlencoded",
                    'Authorization': Buffer.from(`${process.env.ROBLOX_CLIENT_ID}:${process.env.ROBLOX_CLIENT_SECRET}`).toString('base64')
                },
                body: encodedParams
            })
                .then(response => response.json())
                .then(async token => {
                    await fetch('https://apis.roblox.com/oauth/v1/userinfo', {
                        headers: {
                            'Authorization': `${token.token_type} ${token.access_token}`
                        }
                    })
                        .then(response => response.json())
                        .then(async roblox => {
                            if (!roblox.sub) return res.redirect(`https://apis.roblox.com/oauth/v1/authorize?client_id=${process.env.ROBLOX_CLIENT_ID}&redirect_uri=${process.env.ROBLOX_OAUTH_URL}&scope=openid profile&response_type=code`);
                            db.query(`SELECT * FROM accounts WHERE roblox = '${roblox.sub}'`, async (err, results) => {
                                if (err) throw err;
                                if (results.length === 0) await dbPromise.query(`INSERT INTO accounts (name, roblox, username) VALUES (?, ?, ?)`, [roblox.nickname || roblox.name, roblox.sub, roblox.preferred_username]);
                                const [rows, fields] = await dbPromise.query(`SELECT * FROM accounts WHERE roblox = '${roblox.sub}' LIMIT 1`);
                                req.session.user = rows[0];
                                req.session.user.staff = req.session.user.staff.readUInt8(0);
                                req.session.user.purchases = await refreshPurchases();
                                req.session.user.access = JSON.parse(req.session.user.access);
                                req.session.save();
                                return res.redirect('/');
                            });
                        });
                });
        } catch (err) {
            console.error(err);
            return res.redirect(`https://apis.roblox.com/oauth/v1/authorize?client_id=${process.env.ROBLOX_CLIENT_ID}&redirect_uri=${process.env.ROBLOX_OAUTH_URL}&scope=openid profile&response_type=code`);
        };
    });

    app.get('/logout', async (req, res) => {
        await allRoutes(req, res);
        delete req.session.user;
        req.session.save();
        return res.redirect('/');
    });

    app.get('/dashboard/login', async (req, res) => {
        await allRoutes(req, res);
        if ((req.session.user && !req.session.user?.staff) || (req.session.user && req.session.user?.staff && req.session.user?.discord)) return res.redirect(req.session.user?.staff ? '/dashboard' : '/');
        if (!req.query.code) return res.redirect(`https://discord.com/api/oauth2/authorize?client_id=${process.env.DISCORD_CLIENT_ID}&redirect_uri=${process.env.DISCORD_OAUTH_URL}&response_type=code&scope=identify%20email%20guilds%20guilds.join`);
        encodedParams = new URLSearchParams();
        encodedParams.set('client_id', process.env.DISCORD_CLIENT_ID);
        encodedParams.set('client_secret', process.env.DISCORD_CLIENT_SECRET);
        encodedParams.set('grant_type', 'authorization_code');
        encodedParams.set('code', req.query.code);
        encodedParams.set('redirect_uri', `${decodeURIComponent(process.env.DISCORD_OAUTH_URL).replace(/%3A/g, ":").replace(/%2F/g, "/")}`);
        await fetch(`https://discord.com/api/oauth2/token`, {
            method: 'POST',
            headers: {
                'Content-Type': "application/x-www-form-urlencoded"
            },
            body: encodedParams
        })
            .then(response => response.json())
            .then(async token => {
                await fetch('https://discord.com/api/users/@me', {
                    headers: {
                        'Authorization': `${token.token_type} ${token.access_token}`
                    }
                })
                    .then(response => response.json())
                    .then(async discord => {
                        if (!discord.id) return res.redirect(`https://discord.com/api/oauth2/authorize?client_id=${process.env.DISCORD_CLIENT_ID}&redirect_uri=${process.env.DISCORD_OAUTH_URL}&response_type=code&scope=identify%20email`);
                        db.query(`SELECT * FROM accounts WHERE discord = '${discord.id}'`, async (err, results) => {
                            if (err) throw err;
                            if (results.length === 0) {
                                await dbPromise.query(`INSERT INTO accounts (name, discord, username, email) VALUES (?, ?, ?, ?, ?)`, [discord.global_name || discord.username, discord.id, discord.username, discord.email]);
                                try {
                                    const info = await transporter.sendMail({
                                        from: `"${process.env.MAIL_NAME}" <${process.env.MAIL_USER}>`,
                                        to: discord.email,
                                        subject: "Welcome to aProtect Services",
                                        text: `Welcome to aProtect Services\n\nHello ${discord.global_name || discord.username}, welcome to aProtect Services! This is a confirmation email confirming that your new account on aProtect Services was created. No action is required.`,
                                        html: `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Welcome to aProtect Services</title><style>body{font-family:ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;margin:0;padding:0;background-color:${cms.siteDetails[0].backgroundColor};color:${cms.siteDetails[0].color};display:flex;flex-direction:column;justify-content:center;align-items:center;gap:20px}*{box-sizing:border-box;padding:0;margin:0}a{color:${cms.siteDetails[0].theme};text-decoration:none}.header{background-color:${cms.siteDetails[0].gradient1};padding:20px 10px;margin:0;display:flex;justify-content:center;align-items:center;gap:15px;font-size:20px;width:100%;margin-bottom:20px}p{width:90%;max-width:500px;text-align:center}</style></head><body><div class="header"><img src="${defaults.asset_prefix}${cms.siteDetails[0].logo.path}" alt="${cms.siteDetails[0].title}" height="25">${cms.siteDetails[0].title}</div><h2>Welcome to aProtect Services</h2><p>Hello ${discord.global_name || discord.username}, welcome to aProtect Services! This is a confirmation email confirming that your new account on <b>${cms.siteDetails[0].title}</b>. No action is required.</p>`,
                                    });
                                    console.log(`Email sent from ${info.envelope.from} to ${info.envelope.to}`);
                                } catch (err) {
                                    console.error(err);
                                };
                            } else {
                                if (!results[0].discord) await dbPromise.query(`UPDATE accounts SET discord = ? WHERE id = ?`, [discord.id, results[0].id]);
                            };
                            const [rows, fields] = await dbPromise.query(`SELECT * FROM accounts WHERE discord = '${discord.id}' LIMIT 1`);
                            req.session.user = rows[0];
                            req.session.user.staff = req.session.user.staff.readUInt8(0);
                            req.session.user.purchases = await refreshPurchases();
                            req.session.user.access = JSON.parse(req.session.user.access);
                            req.session.save();
                            return res.redirect(req.session.user.staff ? '/dashboard' : '/');
                        });
                    });
            });
    });

    app.get('/dashboard', dashboard, async (req, res) => {
        var users = (await dbPromise.query(`SELECT * FROM accounts`))[0];
        users.forEach(user => {
            user.staff = user.staff.readUInt8(0);
        });
        var orders = (await dbPromise.query(`SELECT * FROM orders`))[0];
        orders.forEach(order => {
            order.whitelisted = order.whitelisted.readUInt8(0);
            order.product = defaults.products.find(product => product.productUUID === order.product) || { name: 'Unknown Product' };
            order.user = users.find(user => user.id === order.user) || { name: 'Unknown User' };
        });
        if (!req.query.action) return res.render('dashboard', { vars: defaults, title: 'Dashboard', cms, orders, users });
        switch (req.query.action) {
            case 'delete':
                return res.render('confirmDelete', { vars: defaults, title: 'Confirm Deletion', cms });
            case 'confirm':
                await dbPromise.query(`DELETE FROM accounts WHERE id = ?`, [req.session.user.id]);
                delete req.session.user;
                req.session.save();
                return res.redirect('/');
            case 'check':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('licenses')) return res.redirect('/dashboard');
                if (!req.query.user || !req.query.userType) return res.redirect('/dashboard?tab=manageLicenses');
                var roblox = (req.query.userType === 'roblox') ? req.query.user : null;
                var discord = (req.query.userType === 'discord') ? req.query.user : null;
                if (req.query.userType === 'database') {
                    var dbUser = await dbPromise.query(`SELECT * FROM accounts WHERE username = '${req.query.user}' LIMIT 1`).then(([rows, fields]) => rows[0]);
                    if (!dbUser) return res.redirect('/dashboard?tab=manageLicenses');
                    roblox = dbUser.roblox;
                    discord = dbUser.discord;
                };
                return res.render('dashboard', { vars: defaults, title: 'Dashboard', cms, orders, users, licenses: await refreshPurchases(roblox, discord) });
            case 'revoke':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('orders')) return res.redirect('/dashboard');
                if (!req.query.product || !req.query.user || !req.query.userType) return res.redirect('/dashboard?tab=manageLicenses');
                var roblox = (req.query.userType === 'roblox') ? req.query.user : null;
                var discord = (req.query.userType === 'discord') ? req.query.user : null;
                if (req.query.userType === 'database') {
                    var dbUser = await dbPromise.query(`SELECT * FROM accounts WHERE username = '${req.query.user}' LIMIT 1`).then(([rows, fields]) => rows[0]);
                    if (!dbUser) return res.redirect('/dashboard?tab=manageLicenses');
                    roblox = dbUser.roblox;
                    discord = dbUser.discord;
                };
                await revokeProduct({ roblox, discord }, req.query.product);
                users = (await dbPromise.query(`SELECT * FROM accounts`))[0];
                users.forEach(user => {
                    user.staff = user.staff.readUInt8(0);
                });
                orders = (await dbPromise.query(`SELECT * FROM orders`))[0];
                orders.forEach(order => {
                    order.whitelisted = order.whitelisted.readUInt8(0);
                    order.product = defaults.products.find(product => product.productUUID === order.product) || { name: 'Unknown Product' };
                    order.user = users.find(user => user.id === order.user) || { name: 'Unknown User' };
                }); 7
                return res.render('dashboard', { vars: defaults, title: 'Dashboard', cms, orders, users, licenses: await refreshPurchases(roblox, discord) });
            case 'whitelist':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('whitelisting')) return res.redirect('/dashboard');
                if (!req.query.product || !req.query.user || !req.query.userType) return res.redirect('/dashboard?tab=manageLicenses');
                var roblox = (req.query.userType === 'roblox') ? req.query.user : null;
                var discord = (req.query.userType === 'discord') ? req.query.user : null;
                if (req.query.userType === 'database') {
                    var dbUser = await dbPromise.query(`SELECT * FROM accounts WHERE username = '${req.query.user}' LIMIT 1`).then(([rows, fields]) => rows[0]);
                    if (!dbUser) return res.redirect('/dashboard?tab=manageLicenses');
                    roblox = dbUser.roblox;
                    discord = dbUser.discord;
                };
                await whitelistProduct({ roblox, discord }, req.query.product);
                users = (await dbPromise.query(`SELECT * FROM accounts`))[0];
                users.forEach(user => {
                    user.staff = user.staff.readUInt8(0);
                });
                orders = (await dbPromise.query(`SELECT * FROM orders`))[0];
                orders.forEach(order => {
                    order.whitelisted = order.whitelisted.readUInt8(0);
                    order.product = defaults.products.find(product => product.productUUID === order.product) || { name: 'Unknown Product' };
                    order.user = users.find(user => user.id === order.user) || { name: 'Unknown User' };
                });
                return res.render('dashboard', { vars: defaults, title: 'Dashboard', cms, orders, users, licenses: await refreshPurchases(roblox, discord) });
            case 'user':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('staff')) return res.redirect('/dashboard');
                if (!req.query.user) return res.redirect('/dashboard?tab=manageUsers');
                await dbPromise.query(`UPDATE accounts SET staff = 0 WHERE username = ?`, [req.query.user]);
                users = (await dbPromise.query(`SELECT * FROM accounts`))[0];
                users.forEach(user => {
                    user.staff = user.staff.readUInt8(0);
                });
                orders = (await dbPromise.query(`SELECT * FROM orders`))[0];
                orders.forEach(order => {
                    order.whitelisted = order.whitelisted.readUInt8(0);
                    order.product = defaults.products.find(product => product.productUUID === order.product) || { name: 'Unknown Product' };
                    order.user = users.find(user => user.id === order.user) || { name: 'Unknown User' };
                });
                return res.redirect(`/dashboard?tab=user-${req.query.user}`);
            case 'staff':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('staff')) return res.redirect('/dashboard');
                if (!req.query.user) return res.redirect('/dashboard?tab=manageUsers');
                await dbPromise.query(`UPDATE accounts SET staff = 1 WHERE username = ?`, [req.query.user]);
                users = (await dbPromise.query(`SELECT * FROM accounts`))[0];
                users.forEach(user => {
                    user.staff = user.staff.readUInt8(0);
                });
                orders = (await dbPromise.query(`SELECT * FROM orders`))[0];
                orders.forEach(order => {
                    order.whitelisted = order.whitelisted.readUInt8(0);
                    order.product = defaults.products.find(product => product.productUUID === order.product) || { name: 'Unknown Product' };
                    order.user = users.find(user => user.id === order.user) || { name: 'Unknown User' };
                });
                return res.redirect(`/dashboard?tab=user-${req.query.user}`);
            default:
                return res.redirect('/dashboard');
        };
    });

    app.post('/dashboard', dashboard, async (req, res) => {
        var users = (await dbPromise.query(`SELECT * FROM accounts`))[0];
        users.forEach(user => {
            user.staff = user.staff.readUInt8(0);
        });
        var orders = (await dbPromise.query(`SELECT * FROM orders`))[0];
        orders.forEach(order => {
            order.whitelisted = order.whitelisted.readUInt8(0);
            order.product = defaults.products.find(product => product.productUUID === order.product) || { name: 'Unknown Product' };
            order.user = users.find(user => user.id === order.user) || { name: 'Unknown User' };
        });
        if (!req.query.action) return res.render('dashboard', { vars: defaults, title: 'Dashboard', cms, orders, users });
        switch (req.query.action) {
            case 'save':
                if (!req.body.name && !req.body.email) return res.redirect('/dashboard?tab=account');
                await dbPromise.query(`UPDATE accounts SET name = ?, email = ? WHERE id = ?`, [req.body.name, req.body.email, req.session.user.id]);
                req.session.user.name = req.body.name;
                req.session.user.email = req.body.email;
                req.session.save();
                return res.redirect('/dashboard?tab=account');
            case 'check':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('licenses')) return res.redirect('/dashboard');
                if (!req.query.user || !req.query.userType) return res.redirect('/dashboard?tab=manageLicenses');
                var roblox = (req.query.userType === 'roblox') ? req.query.user : null;
                var discord = (req.query.userType === 'discord') ? req.query.user : null;
                if (req.query.userType === 'database') {
                    var dbUser = await dbPromise.query(`SELECT * FROM accounts WHERE username = '${req.query.user}' LIMIT 1`).then(([rows, fields]) => rows[0]);
                    if (!dbUser) return res.redirect('/dashboard?tab=manageLicenses');
                    roblox = dbUser.roblox;
                    discord = dbUser.discord;
                };
                return res.render('dashboard', { vars: defaults, title: 'Dashboard', cms, orders, users, licenses: await refreshPurchases(roblox, discord) });
            case 'whitelist':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('whitelisting')) return res.redirect('/dashboard');
                if (!req.query.product || !req.query.user || !req.query.userType) return res.redirect('/dashboard?tab=manageWhitelisting');
                var roblox = (req.query.userType === 'roblox') ? req.query.user : null;
                var discord = (req.query.userType === 'discord') ? req.query.user : null;
                if (req.query.userType === 'database') {
                    var dbUser = await dbPromise.query(`SELECT * FROM accounts WHERE username = '${req.query.user}' LIMIT 1`).then(([rows, fields]) => rows[0]);
                    if (!dbUser) return res.redirect('/dashboard?tab=manageLicenses');
                    roblox = dbUser.roblox;
                    discord = dbUser.discord;
                };
                await whitelistProduct({ roblox, discord }, req.query.product);
                users = (await dbPromise.query(`SELECT * FROM accounts`))[0];
                users.forEach(user => {
                    user.staff = user.staff.readUInt8(0);
                });
                orders = (await dbPromise.query(`SELECT * FROM orders`))[0];
                orders.forEach(order => {
                    order.whitelisted = order.whitelisted.readUInt8(0);
                    order.product = defaults.products.find(product => product.productUUID === order.product) || { name: 'Unknown Product' };
                    order.user = users.find(user => user.id === order.user) || { name: 'Unknown User' };
                });
                return res.redirect(`/dashboard?tab=manageLicenses&action=check&user=${req.query.user}&userType=${req.query.userType}`);
            case 'transfer':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('licenses')) return res.redirect('/dashboard');
                if (!req.query.product || !req.query.fromUser || !req.query.fromUserType || !req.query.toUser || !req.query.toUserType) return res.redirect('/dashboard?tab=manageTransfers');
                await revokeProduct({
                    roblox: (req.query.fromUserType === 'roblox') ? req.query.fromUser : null,
                    discord: (req.query.fromUserType === 'discord') ? req.query.fromUser : null,
                }, req.query.product);
                await whitelistProduct({
                    roblox: (req.query.toUserType === 'roblox') ? req.query.toUser : null,
                    discord: (req.query.toUserType === 'discord') ? req.query.toUser : null,
                }, req.query.product);
                return res.redirect(`/dashboard?tab=manageLicenses&action=check&user=${req.query.toUser}&userType=${req.query.toUserType}`);
            case 'details':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('products')) return res.redirect('/dashboard');
                if (!req.body.product) return res.redirect('/dashboard?tab=manageProducts');
                await dbPromise.query(`INSERT INTO productDetails (id, price, link) VALUES(?, ?, ?) ON DUPLICATE KEY UPDATE price = COALESCE(?, price), link = COALESCE(?, link)`, [req.body.product, req.body.price, req.body.link, req.body.price, req.body.link]);
                await refreshProducts();
                return res.redirect('/dashboard?tab=manageProducts');
            case 'permissions':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('staff')) return res.redirect('/dashboard');
                if (!req.query.user) return res.redirect('/dashboard?tab=manageUsers');
                var dbUser = await dbPromise.query(`SELECT * FROM accounts WHERE username = '${req.query.user}' LIMIT 1`).then(([rows, fields]) => rows[0]);
                if (!dbUser) return res.redirect('/dashboard?tab=manageUsers');
                if (req.session.user.id === dbUser.id) return res.redirect('/dashboard');
                if (!dbUser.staff.readUInt8(0)) return res.redirect('/dashboard');
                if (req.session.user.access.includes('admin') ? false : dbUser.access.includes('admin')) return res.redirect('/dashboard');
                if (req.session.user.access.includes('admin') ? false : dbUser.access.includes('staff')) return res.redirect('/dashboard');
                var newAccess = [];
                if (dbUser.access.includes('admin') && !req.session.user.access.includes('admin')) newAccess.push('admin');
                if (dbUser.access.includes('staff') && !req.session.user.access.includes('admin')) newAccess.push('staff');
                Object.values(req.body).forEach(value => {
                    if (value) newAccess.push(value);
                });
                await dbPromise.query(`UPDATE accounts SET access = ? WHERE id = ?`, [JSON.stringify(newAccess), dbUser.id]);
                return res.redirect(`/dashboard?tab=user-${req.query.user}`);
            case 'add':
                if (!req.session.user.access.includes('admin') && !req.session.user.access.includes('staff')) return res.redirect('/dashboard');
                if (!req.body.username) return res.redirect('/dashboard?tab=manageStaff');
                await dbPromise.query(`INSERT INTO accounts (name, username, discord, roblox, staff) VALUES (?, ?, ?, ?, 1)`, [req.body.name || req.body.username, req.body.username, req.body.discord || null, req.body.roblox || null]);
                return res.redirect('/dashboard?tab=manageStaff');
            default:
                return res.redirect('/dashboard');
        };
    });

    app.get('/products/:product/checkout', async (req, res, next) => {
        await allRoutes(req, res);
        try {
            var product = defaults.products.find(product => defaults.slugify(product.name) === req.params.product);
            if (!product) return next();
            const productsList = await stripe.products.list({
                active: true,
            });
            var products = productsList.data.filter(p => (p.name === product.name) && p.default_price);
            var price = (products.length && products[0].default_price) ? await stripe.prices.retrieve(products[0].default_price) : null;
            if (products.length && price) {
                if (price.unit_amount_decimal !== product.price.replace('.', '')) {
                    price = await stripe.prices.create({
                        product: products[0].id,
                        unit_amount_decimal: product.price.replace('.', ''),
                        currency: 'GBP',
                    });
                    await stripe.products.update(products[0].id, {
                        default_price: price.id,
                    });
                };
                if (products[0].description !== product.description) {
                    await stripe.products.update(products[0].id, {
                        description: product.description,
                    });
                };
            } else if (products.length && !price) {
                price = await stripe.prices.create({
                    product: products[0].id,
                    unit_amount_decimal: product.price.replace('.', ''),
                    currency: 'GBP',
                });
                await stripe.products.update(products[0].id, {
                    default_price: price.id,
                });
            } else {
                var createdProduct = await stripe.products.create({
                    name: product.name,
                    description: product.description,
                });
                price = await stripe.prices.create({
                    product: createdProduct.id,
                    unit_amount_decimal: product.price.replace('.', ''),
                    currency: 'GBP',
                });
                await stripe.products.update(createdProduct.id, {
                    default_price: price.id,
                });
            };
            var checkoutObject = {
                line_items: [{
                    price: price.id,
                    quantity: 1,
                }],
                client_reference_id: req.session.user.id,
                mode: 'payment',
                success_url: `http://${req.get('host')}/success?product=${defaults.slugify(product.name)}`,
                cancel_url: `http://${req.get('host')}/cancel?product=${defaults.slugify(product.name)}`,
            };
            if (req.session.user.email) checkoutObject.customer_email = req.session.user.email;
            var checkoutSession = await stripe.checkout.sessions.create(checkoutObject);
            return res.redirect(checkoutSession.url);
        } catch (err) {
            console.error(err);
            return res.redirect('/error');
        };
    });

    app.post('/stripe', async (req, res) => {
        await allRoutes(req, res);
        try {
            const sig = req.headers['stripe-signature'];
            let event;
            try {
                event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK);
            } catch (err) {
                console.log(err.message);
                res.status(400).send(`Webhook Error: ${err.message}`);
                return;
            };
            switch (event.type) {
                case 'checkout.session.completed':
                    const checkoutSessionCompleted = event.data.object;
                    const product = defaults.products.find(product => (defaults.slugify(product.name) === (new URLSearchParams(new URL(checkoutSessionCompleted.cancel_url).search)).get('product')) || (defaults.slugify(product.name) === (new URL(checkoutSessionCompleted.cancel_url)).pathname.split('/').pop()));
                    await dbPromise.query(`INSERT INTO orders (user, product, stripe) VALUES (?, ?, ?)`, [checkoutSessionCompleted.client_reference_id, product.productUUID, checkoutSessionCompleted.id]);
                    var [rows, fields] = await dbPromise.query(`SELECT * FROM accounts WHERE id = ? LIMIT 1`, [checkoutSessionCompleted.client_reference_id]);
                    await whitelistProduct(rows[0], product.productUUID);
                    try {
                        await dbPromise.query(`UPDATE accounts SET email = ? WHERE id = ? AND email IS NULL`, [checkoutSessionCompleted.customer_email, checkoutSessionCompleted.client_reference_id]);
                        if (rows[0]) {
                            var info = await transporter.sendMail({
                                from: `"${process.env.MAIL_NAME}" <${process.env.MAIL_USER}>`,
                                to: rows[0].email || checkoutSessionCompleted.customer_email,
                                subject: "New Order",
                                text: `New Order\n\nHello ${rows[0].name}, a new order was processed under your account for ${product.name}. To access your download, visit ${cms.siteDetails[0]['domain-production']}. No action is required.`,
                                html: `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>New Order</title><style>body{font-family:ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;margin:0;padding:0;background-color:${cms.siteDetails[0].backgroundColor};color:${cms.siteDetails[0].color};display:flex;flex-direction:column;justify-content:center;align-items:center;gap:20px}*{box-sizing:border-box;padding:0;margin:0}a{color:${cms.siteDetails[0].theme};text-decoration:none}.header{background-color:${cms.siteDetails[0].gradient1};padding:20px 10px;margin:0;display:flex;justify-content:center;align-items:center;gap:15px;font-size:20px;width:100%;margin-bottom:20px}p{width:90%;max-width:500px;text-align:center}</style></head><body><div class="header"><img src="${defaults.asset_prefix}${cms.siteDetails[0].logo.path}" alt="${cms.siteDetails[0].title}" height="25">${cms.siteDetails[0].title}</div><h2>New Order</h2><p>Hello ${rows[0].name}, a new order was processed under your account for <b>${product.name}</b>. To access your download, visit <a href="${cms.siteDetails[0]['domain-production']}">our website</a>. No action is required.</p>`,
                            });
                            console.log(`Email sent from ${info.envelope.from} to ${info.envelope.to}`);
                            await fetch(process.env.DISCORD_WEBHOOK, {
                                method: 'POST',
                                headers: { 'Content-Type': 'application/json' },
                                body: JSON.stringify({
                                    embeds: [{
                                        title: "New Order",
                                        description: `A new order for **${product.name}** was just completed on **${cms.siteDetails[0].title}**.`,
                                        color: cms.siteDetails[0].themeColor.split("#")[1],
                                        fields: [
                                            {
                                                name: "Customer",
                                                value: rows[0].discord ? `<@${rows[0].discord}> (${rows[0].username})` : rows[0].username,
                                                inline: true
                                            },
                                            {
                                                name: "Price",
                                                value: `£${product.price}`,
                                                inline: true
                                            },
                                            {
                                                name: "Robux",
                                                value: `${product.robux} R$`,
                                                inline: true
                                            },
                                            {
                                                name: "Date & Time",
                                                value: new Date(checkoutSessionCompleted.created * 1000).toLocaleString(),
                                                inline: true
                                            }
                                        ],
                                        image: {
                                            url: product.images[0]
                                        },
                                        footer: {
                                            text: cms.siteDetails[0].title
                                        }
                                    }]
                                }),
                            });
                        };
                        var [rows, fields] = await dbPromise.query(`SELECT * FROM accounts WHERE staff = 1`);
                        rows.filter(staffMember => JSON.parse(staffMember.access).includes('admin')).forEach(async staffMember => {
                            var info = await transporter.sendMail({
                                from: `"${process.env.MAIL_NAME}" <${process.env.MAIL_USER}>`,
                                to: staffMember.email,
                                subject: "New Order",
                                text: `New Order\n\nHello ${staffMember.name}, a new order was processed at ${cms.siteDetails[0].title}. To access download, visit ${cms.siteDetails[0]['domain-production']}. No action is required.`,
                                html: `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>New Order</title><style>body{font-family:ui-sans-serif,system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;margin:0;padding:0;background-color:${cms.siteDetails[0].backgroundColor};color:${cms.siteDetails[0].color};display:flex;flex-direction:column;justify-content:center;align-items:center;gap:20px}*{box-sizing:border-box;padding:0;margin:0}a{color:${cms.siteDetails[0].theme};text-decoration:none}.header{background-color:${cms.siteDetails[0].gradient1};padding:20px 10px;margin:0;display:flex;justify-content:center;align-items:center;gap:15px;font-size:20px;width:100%;margin-bottom:20px}p{width:90%;max-width:500px;text-align:center}</style></head><body><div class="header"><img src="${defaults.asset_prefix}${cms.siteDetails[0].logo.path}" alt="${cms.siteDetails[0].title}" height="25">${cms.siteDetails[0].title}</div><h2>New Order</h2><p>Hello ${staffMember.name}, a new order was processed at <b>${cms.siteDetails[0].title}</b>. To access download, visit <a href="${cms.siteDetails[0]['domain-production']}">our website</a>. No action is required.</p>`,
                            });
                            console.log(`Email sent from ${info.envelope.from} to ${info.envelope.to}`);
                        });
                    } catch (err) {
                        console.error(err);
                    };
                    break;
                default:
                    console.log(`Unhandled event type ${event.type}`);
                    break;
            };
            res.send();
        } catch (err) {
            console.error(err);
            res.status(400).send(`Webhook Error: ${err.message}`);
        };
    });

    app.get('/success', async (req, res) => {
        await allRoutes(req, res);
        var product = defaults.products.find(product => defaults.slugify(product.name) === req.query.product);
        if (!product) return res.redirect('/');
        if (req.session.user) {
            req.session.user.purchases = await refreshPurchases();
            req.session.save();
        };
        return res.render('orderSuccess', { vars: defaults, title: 'Order Success', cms, product });
    });

    app.get('/cancel', async (req, res) => {
        await allRoutes(req, res);
        var product = defaults.products.find(product => defaults.slugify(product.name) === req.query.product);
        if (!product) return res.redirect('/');
        if (req.session.user) {
            req.session.user.purchases = await refreshPurchases();
            req.session.save();
        };
        return res.render('orderCancel', { vars: defaults, title: 'Order Cancelled', cms, product });
    });

    app.get('/error', async (req, res) => {
        await allRoutes(req, res);
        if (req.session.user) {
            req.session.user.purchases = await refreshPurchases();
            req.session.save();
        };
        return res.render('orderError', { vars: defaults, title: 'Order Error', cms });
    });

    app.get('/orders/:order', dashboard, async (req, res) => {
        return res.redirect(`/dashboard?tab=order-${req.params.order}`);
    });

    app.get('/orders/:order/delete', dashboard, async (req, res) => {
        if (!req.params.order) return next();
        var order = (await dbPromise.query(`SELECT * FROM orders WHERE id = ?`, [req.params.order]))[0][0];
        var user = (await dbPromise.query(`SELECT * FROM accounts WHERE id = ?`, [order.user]))[0][0];
        await dbPromise.query(`DELETE FROM orders WHERE id = ?`, [req.params.order]);
        if (order && user) await revokeProduct(user, order.product);
        return res.redirect(`/dashboard?tab=manageOrders`);
    });

    app.use(async (req, res, next) => {
        await allRoutes(req, res);
        return res.render('404', { vars: defaults, title: '404', cms });
    });

    app.use(async (err, req, res, next) => {
        console.log(err);
        return res.render('error', { error: 'internal server error; check logs' });
    });

    app.listen(port, () => {
        try {
            console.log(`${cms.siteDetails[0].title} listening on port ${port}`);
        } catch {
            console.log(`${process.env.SITE} listening on port ${port}`);
        };
    });
};

startApp();