server.js

#!/usr/bin/env node
/**
 * SnapBin — Self-hosted paste & snippet sharing
 * Usage: npx snapbin [--port 3000] [--host 0.0.0.0]
 */

const http = require('http');
const fs = require('fs');
const fsp = require('fs').promises;
const path = require('path');
const crypto = require('crypto');
const os = require('os');

// ─── CLI Args ─────────────────────────────────────────────────────────
const args = process.argv.slice(2);
function flag(name, fallback) {
  const i = args.indexOf('--' + name);
  return i !== -1 && args[i + 1] ? args[i + 1] : fallback;
}

if (args.includes('--help') || args.includes('-h')) {
  console.log(`
  📋 SnapBin — Self-hosted pastebin

  Usage:
    npx snapbin [options]
    snapbin [options]          (if installed globally)

  Options:
    --port <number>     Server port (default: 3000)
    --host <address>    Bind address (default: 0.0.0.0)
    --base-url <url>    Public URL prefix (for share links)
    --max-snaps <n>     Maximum stored snaps (default: 10000)
    --rate-limit <n>    Max creates per IP per minute (default: 10)
    --help, -h          Show this help

  Examples:
    npx snapbin
    npx snapbin --port 8080
    snapbin --port 80 --base-url https://bin.example.com

  API:
    POST /api/snaps              Create a snap {content, lang?, expiry?, password?}
    GET  /api/snaps/:id          Read a snap (?pw= for protected)
    POST /api/snaps/:id/verify   Verify password {password} → returns token
    GET  /raw/:id                Raw plain text
    GET  /api/stats              Snap count
`);
  process.exit(0);
}

// ─── Config ───────────────────────────────────────────────────────────
const PORT = parseInt(flag('port', '3000'), 10);
const HOST = flag('host', '0.0.0.0');
const BASE_URL = flag('base-url', process.env.BASE_URL || '');
const MAX_SNAPS = parseInt(flag('max-snaps', '10000'), 10);
const RATE_LIMIT = parseInt(flag('rate-limit', '10'), 10);
const DATA_DIR = path.join(os.homedir(), '.snapbin');
const DATA_FILE = path.join(DATA_DIR, 'snaps.json');
const MAX_BODY = 512 * 1024;
const DEFAULT_EXPIRE = 7 * 24 * 60 * 60 * 1000;
const SAVE_DEBOUNCE_MS = 2000;

// ─── Encryption ───────────────────────────────────────────────────────
const KEY_FILE = path.join(DATA_DIR, '.key');
let ENC_KEY;

function ensureKey() {
  fs.mkdirSync(DATA_DIR, { recursive: true });
  if (fs.existsSync(KEY_FILE)) {
    ENC_KEY = Buffer.from(fs.readFileSync(KEY_FILE, 'utf8').trim(), 'hex');
  } else {
    ENC_KEY = crypto.randomBytes(32);
    fs.writeFileSync(KEY_FILE, ENC_KEY.toString('hex'), { mode: 0o600 });
  }
}
ensureKey();

function encrypt(text) {
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', ENC_KEY, iv);
  const enc = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
  const tag = cipher.getAuthTag();
  return iv.toString('base64') + ':' + tag.toString('base64') + ':' + enc.toString('base64');
}

function decrypt(blob) {
  const parts = blob.split(':');
  if (parts.length !== 3) return blob; // legacy plaintext fallback
  const iv = Buffer.from(parts[0], 'base64');
  const tag = Buffer.from(parts[1], 'base64');
  const data = Buffer.from(parts[2], 'base64');
  const decipher = crypto.createDecipheriv('aes-256-gcm', ENC_KEY, iv);
  decipher.setAuthTag(tag);
  return decipher.update(data) + decipher.final('utf8');
}

function hashPw(pw) {
  const salt = crypto.randomBytes(16);
  const hash = crypto.scryptSync(pw, salt, 32);
  return salt.toString('base64') + ':' + hash.toString('base64');
}

function verifyPw(pw, stored) {
  if (!pw || !stored) return false;
  const [saltB64, hashB64] = stored.split(':');
  if (!saltB64 || !hashB64) return false;
  const salt = Buffer.from(saltB64, 'base64');
  const hash = Buffer.from(hashB64, 'base64');
  const test = crypto.scryptSync(pw, salt, 32);
  if (hash.length !== test.length) return false;
  return crypto.timingSafeEqual(hash, test);
}

// ─── Storage (async, debounced) ───────────────────────────────────────
let snaps = {};
let dirty = false;
let saveTimer = null;
let saving = false;

try {
  fs.mkdirSync(DATA_DIR, { recursive: true });
  const raw = JSON.parse(fs.readFileSync(DATA_FILE, 'utf8'));
  for (const [id, snap] of Object.entries(raw)) {
    try { snap.content = decrypt(snap.content); } catch { /* legacy */ }
    snaps[id] = snap;
  }
  console.log(`  ├─ Loaded ${Object.keys(snaps).length} snaps`);
} catch { /* first run */ }

function scheduleSave() {
  dirty = true;
  if (saveTimer) return;
  saveTimer = setTimeout(flushSave, SAVE_DEBOUNCE_MS);
}

async function flushSave() {
  if (saving) return;
  saveTimer = null;
  if (!dirty) return;
  saving = true;
  dirty = false;
  const out = {};
  for (const [id, snap] of Object.entries(snaps)) {
    out[id] = { ...snap, content: encrypt(snap.content) };
  }
  try {
    await fsp.writeFile(DATA_FILE, JSON.stringify(out, null, 2));
  } catch (e) {
    console.error('Save failed:', e.message);
    dirty = true; // retry on next tick
  }
  saving = false;
}

// Flush on exit — drain connections before writing
async function gracefulExit() {
  server.close(async () => {
    await flushSave();
    process.exit(0);
  });
  // Force exit if drain takes too long
  setTimeout(async () => { await flushSave(); process.exit(1); }, 5000);
}
process.on('SIGINT', gracefulExit);
process.on('SIGTERM', gracefulExit);

// Expire old snaps
setInterval(() => {
  const now = Date.now();
  let changed = false;
  for (const [id, snap] of Object.entries(snaps)) {
    if (snap.expireAt && snap.expireAt < now) { delete snaps[id]; changed = true; }
  }
  if (changed) scheduleSave();
}, 60_000);

// ─── Rate Limiter ─────────────────────────────────────────────────────
const rateBuckets = new Map(); // ip → { count, resetAt }

function checkRateLimit(ip) {
  const now = Date.now();
  let bucket = rateBuckets.get(ip);
  if (!bucket || bucket.resetAt < now) {
    bucket = { count: 0, resetAt: now + 60_000 };
    rateBuckets.set(ip, bucket);
  }
  bucket.count++;
  return bucket.count <= RATE_LIMIT;
}

// Cleanup old buckets every 5 min
setInterval(() => {
  const now = Date.now();
  for (const [ip, b] of rateBuckets) {
    if (b.resetAt < now) rateBuckets.delete(ip);
  }
}, 300_000);

// ─── Verify Tokens (short-lived, for password-protected snaps) ───────
const verifyTokens = new Map(); // token → { id, expireAt }

function issueToken(id) {
  const token = crypto.randomBytes(24).toString('base64url');
  verifyTokens.set(token, { id, expireAt: Date.now() + 30 * 60_000 }); // 30 min
  return token;
}

function checkToken(token, id) {
  const entry = verifyTokens.get(token);
  if (!entry) return false;
  if (entry.expireAt < Date.now()) { verifyTokens.delete(token); return false; }
  return entry.id === id;
}

// Cleanup tokens every 5 min
setInterval(() => {
  const now = Date.now();
  for (const [t, e] of verifyTokens) {
    if (e.expireAt < now) verifyTokens.delete(t);
  }
}, 300_000);

// ─── Helpers ──────────────────────────────────────────────────────────
function genId(len = 8) {
  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
  let id = '';
  const bytes = crypto.randomBytes(len);
  for (let i = 0; i < len; i++) id += chars[bytes[i] % chars.length];
  return id;
}

function getClientIp(req) {
  return req.headers['x-forwarded-for']?.split(',')[0]?.trim() || req.socket.remoteAddress || 'unknown';
}

function parseBody(req) {
  return new Promise((resolve, reject) => {
    const chunks = [];
    let size = 0;
    let destroyed = false;
    req.on('data', chunk => {
      if (destroyed) return;
      size += chunk.length;
      if (size > MAX_BODY) {
        destroyed = true;
        req.destroy();
        reject(new Error('Too large'));
        return;
      }
      chunks.push(chunk);
    });
    req.on('end', () => { if (!destroyed) resolve(Buffer.concat(chunks).toString('utf8')); });
    req.on('error', err => { if (!destroyed) { destroyed = true; reject(err); } });
  });
}

function json(res, code, data) {
  res.writeHead(code, { 'Content-Type': 'application/json; charset=utf-8' });
  res.end(JSON.stringify(data));
}

function getBaseUrl(req) {
  if (BASE_URL) return BASE_URL.replace(/\/$/, '');
  const proto = req.headers['x-forwarded-proto'] || 'http';
  const host = req.headers['host'] || `${HOST}:${PORT}`;
  return `${proto}://${host}`;
}

function parseExpiry(str) {
  if (str === 'never') return null;
  if (!str) return DEFAULT_EXPIRE; // missing/undefined → default
  const m = /^(\d+)(s|m|h|d|w)$/i.exec(str);
  if (!m) return DEFAULT_EXPIRE;
  const n = parseInt(m[1], 10);
  const mult = { s: 1000, m: 60000, h: 3600000, d: 86400000, w: 604800000 };
  return n * (mult[m[2].toLowerCase()] || DEFAULT_EXPIRE);
}

function detectLang(text, hint) {
  if (hint) return hint;
  const t = text.trim();
  if (/^(\{[\s\S]*\}|\[[\s\S]*\])$/.test(t)) return 'json';
  if (/^(import |from |def |class |print\(|async )/m.test(t)) return 'python';
  if (/^(const |let |var |function |import |export |=>)/m.test(t)) return 'javascript';
  if (/<[a-z][\s\S]*>/i.test(t) && /<\/[a-z]/i.test(t)) return 'html';
  if (/^(SELECT|INSERT|UPDATE|DELETE|CREATE|ALTER)\s/i.test(t)) return 'sql';
  if (/^(#|---|\*\*\*|\[)/m.test(t) && /\n/.test(t)) return 'markdown';
  if (/^(FROM|RUN|CMD|EXPOSE|ENTRYPOINT)\s/m.test(t)) return 'dockerfile';
  if (/^(server|location|upstream|http)\s*\{/m.test(t)) return 'nginx';
  if (/^(\s*#.*\n)*[a-z_]+=/m.test(t) && !/\s{4,}/.test(t)) return 'bash';
  return 'plaintext';
}

function escapeHtml(s) {
  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
}

// ─── Frontend ──────────────────────────────────────────────────────────
function indexHtml() {
  return `<!DOCTYPE html>
<html lang="en" data-theme="dark">
<head>
<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>SnapBin</title>
<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>📋</text></svg>">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/themes/prism-tomorrow.min.css">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/line-numbers/prism-line-numbers.min.css">
<style>
*{margin:0;padding:0;box-sizing:border-box}
:root{--bg:#0d1117;--bg2:#161b22;--bg3:#21262d;--border:#30363d;--text:#e6edf3;--text2:#8b949e;--accent:#58a6ff;--accent2:#3fb950;--red:#f85149;--orange:#d29922}
html{font-size:15px}
body{background:var(--bg);color:var(--text);font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;min-height:100vh;display:flex;flex-direction:column}
a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}
.header{background:var(--bg2);border-bottom:1px solid var(--border);padding:.8rem 1.5rem;display:flex;align-items:center;justify-content:space-between;gap:1rem}
.logo{display:flex;align-items:center;gap:.6rem;font-weight:700;font-size:1.2rem;color:var(--text)}
.logo svg{width:28px;height:28px}
.nav{display:flex;gap:.6rem;align-items:center}
.nav a,.nav button{color:var(--text2);font-size:.85rem;padding:.3rem .6rem;border-radius:6px;transition:.15s;background:none;border:1px solid transparent;cursor:pointer}
.nav a:hover,.nav button:hover{background:var(--bg3);color:var(--text);text-decoration:none}
.nav button.active{border-color:var(--accent);color:var(--accent)}
.main{flex:1;max-width:960px;width:100%;margin:0 auto;padding:2rem 1.5rem}
.hero{text-align:center;margin-bottom:2.5rem}
.hero h1{font-size:2rem;margin-bottom:.5rem;background:linear-gradient(135deg,var(--accent),var(--accent2));-webkit-background-clip:text;-webkit-text-fill-color:transparent;background-clip:text}
.hero p{color:var(--text2);font-size:1rem}
.card{background:var(--bg2);border:1px solid var(--border);border-radius:12px;overflow:hidden}
.card-header{display:flex;align-items:center;justify-content:space-between;padding:.8rem 1rem;border-bottom:1px solid var(--border);gap:.8rem;flex-wrap:wrap}
.card-header .left{display:flex;align-items:center;gap:.8rem}
.card-header select,.card-header input{background:var(--bg3);color:var(--text);border:1px solid var(--border);border-radius:6px;padding:.35rem .6rem;font-size:.85rem;outline:none}
.card-header select:focus,.card-header input:focus{border-color:var(--accent)}
.card-header label{color:var(--text2);font-size:.85rem;display:flex;align-items:center;gap:.3rem}
textarea{width:100%;min-height:360px;background:transparent;color:var(--text);border:none;padding:1rem 1.2rem;font-family:'JetBrains Mono',Fira Code,'SF Mono',Consolas,monospace;font-size:.9rem;line-height:1.6;resize:vertical;outline:none;tab-size:2}
textarea::placeholder{color:var(--text2);opacity:.6}
.card-footer{display:flex;align-items:center;justify-content:space-between;padding:.8rem 1rem;border-top:1px solid var(--border);gap:1rem;flex-wrap:wrap}
.card-footer .info{color:var(--text2);font-size:.8rem}
.btn{background:var(--accent);color:#fff;border:none;border-radius:8px;padding:.55rem 1.4rem;font-size:.9rem;font-weight:600;cursor:pointer;transition:.15s;display:inline-flex;align-items:center;gap:.4rem}
.btn:hover{opacity:.85;transform:translateY(-1px)}.btn:active{transform:translateY(0)}.btn:disabled{opacity:.5;cursor:not-allowed;transform:none}
.btn.secondary{background:var(--bg3);color:var(--text)}
.btn.copy{background:var(--accent2)}
.result{margin-top:1.5rem;display:none}.result.show{display:block}
.result .url-box{display:flex;align-items:center;gap:.5rem;background:var(--bg3);border:1px solid var(--border);border-radius:8px;padding:.6rem 1rem}
.result .url-box input{flex:1;background:transparent;border:none;color:var(--accent);font-size:1rem;font-family:monospace;outline:none}
.result .actions{display:flex;gap:.5rem;margin-top:.8rem;flex-wrap:wrap}
.stats{display:flex;gap:1rem;margin-top:2rem;flex-wrap:wrap;justify-content:center}
.stat{background:var(--bg2);border:1px solid var(--border);border-radius:10px;padding:1rem 1.5rem;text-align:center;min-width:140px}
.stat .num{font-size:1.6rem;font-weight:700;color:var(--accent)}
.stat .label{color:var(--text2);font-size:.8rem;margin-top:.3rem}
.toast{position:fixed;bottom:2rem;right:2rem;background:var(--accent2);color:#fff;padding:.6rem 1.2rem;border-radius:8px;font-size:.9rem;font-weight:500;opacity:0;transform:translateY(20px);transition:.3s;z-index:200;pointer-events:none}
.toast.show{opacity:1;transform:translateY(0)}
@media(max-width:600px){.hero h1{font-size:1.5rem}textarea{min-height:260px;font-size:.85rem}.card-header{flex-direction:column;align-items:flex-start}}
::-webkit-scrollbar{width:8px;height:8px}::-webkit-scrollbar-track{background:var(--bg)}::-webkit-scrollbar-thumb{background:var(--bg3);border-radius:4px}::-webkit-scrollbar-thumb:hover{background:var(--border)}
</style>
</head>
<body>
<div class="header">
  <a href="/" class="logo">
    <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="8" y="2" width="8" height="4" rx="1"/><path d="M16 4h2a2 2 0 012 2v14a2 2 0 01-2 2H6a2 2 0 01-2-2V6a2 2 0 012-2h2"/><line x1="9" y1="12" x2="15" y2="12"/><line x1="9" y1="16" x2="13" y2="16"/></svg>
    SnapBin
  </a>
  <div class="nav">
    <a href="/" data-i18n="nav_new">New</a>
    <a href="/about" data-i18n="nav_about">About</a>
    <button onclick="setLang('zh')" id="btnZh">中</button>
    <button onclick="setLang('en')" id="btnEn">EN</button>
  </div>
</div>
<div class="main" id="createView">
  <div class="hero">
    <h1 data-i18n="hero_title">Paste. Share. Done.</h1>
    <p data-i18n="hero_sub">Self-hosted snippet sharing — no accounts, no tracking, just fast.</p>
  </div>
  <div class="card">
    <div class="card-header">
      <div class="left">
        <select id="lang">
          <option value="">Auto-detect</option>
          <option value="javascript">JavaScript</option><option value="python">Python</option>
          <option value="typescript">TypeScript</option><option value="json">JSON</option>
          <option value="html">HTML</option><option value="css">CSS</option>
          <option value="bash">Bash</option><option value="sql">SQL</option>
          <option value="go">Go</option><option value="rust">Rust</option>
          <option value="java">Java</option><option value="c">C</option>
          <option value="cpp">C++</option><option value="markdown">Markdown</option>
          <option value="yaml">YAML</option><option value="dockerfile">Dockerfile</option>
          <option value="nginx">Nginx</option><option value="plaintext">Plain Text</option>
        </select>
        <select id="expiry">
          <option value="1h" data-i18n="exp_1h">1 Hour</option>
          <option value="1d" data-i18n="exp_1d">1 Day</option>
          <option value="1w" selected data-i18n="exp_1w">1 Week</option>
          <option value="30d" data-i18n="exp_30d">30 Days</option>
          <option value="never" data-i18n="exp_never">Never</option>
        </select>
      </div>
      <label>🔒 <input type="password" id="password" data-i18n-placeholder="ph_password" placeholder="Password (optional)" style="width:150px"></label>
    </div>
    <textarea id="content" data-i18n-placeholder="ph_content" placeholder="Paste your code, config, logs, or any text here…&#10;&#10;Tip: Tab inserts spaces. Ctrl+Enter to submit." spellcheck="false"></textarea>
    <div class="card-footer">
      <span class="info" id="charCount" data-i18n="char_count">0 characters · 0 lines</span>
      <button class="btn" id="submitBtn" onclick="createSnap()">
        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M22 2L11 13"/><polygon points="22 2 15 22 11 13 2 9"/></svg>
        <span data-i18n="btn_create">Create Snap</span>
      </button>
    </div>
  </div>
  <div class="result" id="result">
    <div class="url-box">
      <input type="text" id="snapUrl" readonly>
      <button class="btn copy" onclick="copyUrl()" data-i18n="btn_copy">Copy</button>
    </div>
    <div class="actions">
      <a class="btn secondary" id="viewLink" href="#" target="_blank" data-i18n="btn_view">View</a>
      <a class="btn secondary" id="rawLink" href="#" target="_blank">Raw</a>
      <button class="btn secondary" onclick="resetEditor()" data-i18n="btn_new">New Snap</button>
    </div>
  </div>
  <div class="stats" id="stats"></div>
</div>
<div class="toast" id="toast"></div>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/prism.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/line-numbers/prism-line-numbers.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-python.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-typescript.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-go.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-rust.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-java.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-c.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-cpp.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-sql.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-bash.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-yaml.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-docker.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-nginx.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-markdown.min.js"></script>
<script>
var I18N={
  en:{
    nav_new:'New',nav_about:'About',
    hero_title:'Paste. Share. Done.',hero_sub:'Self-hosted snippet sharing — no accounts, no tracking, just fast.',
    ph_password:'Password (optional)',
    ph_content:'Paste your code, config, logs, or any text here…\\n\\nTip: Tab inserts spaces. Ctrl+Enter to submit.',
    exp_1h:'1 Hour',exp_1d:'1 Day',exp_1w:'1 Week',exp_30d:'30 Days',exp_never:'Never',
    char_count:'{n} characters · {l} lines',
    btn_create:'Create Snap',btn_copy:'Copy',btn_view:'View',btn_new:'New Snap',
    toast_empty:'Nothing to paste!',toast_created:'Snap created!',toast_copied:'Copied!',
    toast_copy_fail:'Copy failed — select and Ctrl+C',toast_creating:'Creating…',
    stat_total:'Total Snaps',stat_today:'Today'
  },
  zh:{
    nav_new:'新建',nav_about:'关于',
    hero_title:'粘贴。分享。搞定。',hero_sub:'自托管代码片段分享 —— 无需注册，无追踪，就是快。',
    ph_password:'密码（可选）',
    ph_content:'在此粘贴代码、配置、日志或任何文本…\\n\\n提示：Tab 插入空格，Ctrl+Enter 提交。',
    exp_1h:'1 小时',exp_1d:'1 天',exp_1w:'1 周',exp_30d:'30 天',exp_never:'永不过期',
    char_count:'{n} 个字符 · {l} 行',
    btn_create:'创建片段',btn_copy:'复制',btn_view:'查看',btn_new:'新建片段',
    toast_empty:'内容不能为空！',toast_created:'片段已创建！',toast_copied:'已复制！',
    toast_copy_fail:'复制失败 —— 请手动选择后 Ctrl+C',toast_creating:'创建中…',
    stat_total:'总片段数',stat_today:'今日'
  }
};
var CUR_LANG=localStorage.getItem('snapbin_lang')||((navigator.language||'').startsWith('zh')?'zh':'en');
function t(k){return(I18N[CUR_LANG]||I18N.en)[k]||(I18N.en[k]||k)}
function setLang(l){
  CUR_LANG=l;localStorage.setItem('snapbin_lang',l);
  document.getElementById('btnZh').className=l==='zh'?'active':'';
  document.getElementById('btnEn').className=l==='en'?'active':'';
  document.querySelectorAll('[data-i18n]').forEach(function(el){
    var k=el.getAttribute('data-i18n');
    if(k==='char_count'){el.textContent=t(k).replace('{n}','0').replace('{l}','0')}
    else{el.textContent=t(k)}
  });
  document.querySelectorAll('[data-i18n-placeholder]').forEach(function(el){
    el.placeholder=t(el.getAttribute('data-i18n-placeholder'));
  });
  loadStats();
}
setLang(CUR_LANG);

var ta=document.getElementById('content'),cc=document.getElementById('charCount');
ta.addEventListener('input',uc);
ta.addEventListener('keydown',function(e){if(e.key==='Tab'){e.preventDefault();var s=ta.selectionStart,end=ta.selectionEnd;ta.value=ta.value.substring(0,s)+'  '+ta.value.substring(end);ta.selectionStart=ta.selectionEnd=s+2;uc()}if(e.ctrlKey&&e.key==='Enter')createSnap()});
function uc(){var v=ta.value,l=v?v.split('\\n').length:0;cc.textContent=t('char_count').replace('{n}',v.length.toLocaleString()).replace('{l}',l)}
async function createSnap(){
  var c=ta.value.trim();if(!c){toast(t('toast_empty'),'var(--red)');return}
  var b=document.getElementById('submitBtn');b.disabled=true;b.querySelector('[data-i18n]').textContent=t('toast_creating');
  try{
    var r=await fetch('/api/snaps',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({content:c,lang:document.getElementById('lang').value||undefined,expiry:document.getElementById('expiry').value,password:document.getElementById('password').value||undefined})});
    var d=await r.json();if(!r.ok)throw new Error(d.error);
    document.getElementById('snapUrl').value=location.origin+'/'+d.id;
    document.getElementById('viewLink').href='/'+d.id;
    document.getElementById('rawLink').href='/raw/'+d.id;
    document.getElementById('result').classList.add('show');
    document.getElementById('snapUrl').select();toast(t('toast_created'));loadStats();
  }catch(e){toast(e.message,'var(--red)')}
  finally{b.disabled=false;b.querySelector('[data-i18n]').textContent=t('btn_create')}
}
function copyText(s,cb){
  try{
    if(navigator.clipboard&&window.isSecureContext){
      navigator.clipboard.writeText(s).then(cb||function(){toast(t('toast_copied'))}).catch(function(){legacyCopy(s,cb)})
    }else{legacyCopy(s,cb)}
  }catch(e){legacyCopy(s,cb)}
}
function legacyCopy(s,cb){
  var el=document.createElement('textarea');el.value=s;el.setAttribute('readonly','');
  el.style.cssText='position:fixed;left:-9999px;top:-9999px;opacity:0';
  document.body.appendChild(el);
  if(navigator.userAgent.match(/iphone|ipad|ipod/i)){el.style.fontSize='16px';el.focus();el.setSelectionRange(0,el.value.length)}
  else{el.select()}
  var ok=false;try{ok=document.execCommand('copy')}catch(e){}
  document.body.removeChild(el);
  if(cb){cb(ok)}else if(ok){toast(t('toast_copied'))}else{toast(t('toast_copy_fail'),'var(--orange)')}
}
function copyUrl(){copyText(document.getElementById('snapUrl').value)}
function resetEditor(){ta.value='';document.getElementById('result').classList.remove('show');uc();ta.focus()}
async function loadStats(){try{var r=await fetch('/api/stats');var d=await r.json();document.getElementById('stats').innerHTML='<div class="stat"><div class="num">'+d.total+'</div><div class="label">'+t('stat_total')+'</div></div><div class="stat"><div class="num">'+d.today+'</div><div class="label">'+t('stat_today')+'</div></div>'}catch{}}
loadStats();
function toast(m,bg){var el=document.getElementById('toast');el.textContent=m;if(bg)el.style.background=bg;else el.style.background='var(--accent2)';el.classList.add('show');setTimeout(function(){el.classList.remove('show')},2500)}
</script>
</body>
</html>`;
}

function viewHtml(snap, id) {
  const lang = snap.lang || 'plaintext';
  const created = new Date(snap.createdAt).toLocaleString();
  const size = (snap.content.length / 1024).toFixed(1);
  const lines = snap.content.split('\n').length;
  const expires = snap.expireAt ? new Date(snap.expireAt).toLocaleString() : 'Never';
  const isProtected = !!snap.password;

  return `<!DOCTYPE html>
<html lang="en" data-theme="dark">
<head>
<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>SnapBin · ${id}</title>
<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>📋</text></svg>">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/themes/prism-tomorrow.min.css">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/line-numbers/prism-line-numbers.min.css">
<style>
*{margin:0;padding:0;box-sizing:border-box}
:root{--bg:#0d1117;--bg2:#161b22;--bg3:#21262d;--border:#30363d;--text:#e6edf3;--text2:#8b949e;--accent:#58a6ff;--accent2:#3fb950;--red:#f85149}
body{background:var(--bg);color:var(--text);font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;min-height:100vh;display:flex;flex-direction:column}
a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}
.header{background:var(--bg2);border-bottom:1px solid var(--border);padding:.8rem 1.5rem;display:flex;align-items:center;justify-content:space-between}
.logo{display:flex;align-items:center;gap:.6rem;font-weight:700;font-size:1.2rem;color:var(--text)}.logo svg{width:28px;height:28px}
.nav{display:flex;gap:.6rem;align-items:center}.nav a,.nav button{color:var(--text2);font-size:.85rem;padding:.3rem .6rem;border-radius:6px;background:none;border:1px solid transparent;cursor:pointer}.nav a:hover,.nav button:hover{background:var(--bg3);color:var(--text)}.nav button.active{border-color:var(--accent);color:var(--accent)}
.main{flex:1;max-width:960px;width:100%;margin:0 auto;padding:2rem 1.5rem}
.view-header{display:flex;align-items:center;justify-content:space-between;margin-bottom:1rem;gap:1rem;flex-wrap:wrap}
.view-header h2{font-size:1.2rem;display:flex;align-items:center;gap:.5rem}
.view-meta{display:flex;gap:1rem;color:var(--text2);font-size:.85rem;flex-wrap:wrap}
.view-meta span{display:flex;align-items:center;gap:.3rem}
.code-block{position:relative;border-radius:8px;overflow:hidden}
pre{margin:0;padding:1rem 1.2rem;max-height:80vh;overflow:auto;border-radius:8px;font-size:.9rem;line-height:1.6}
.copy-btn{position:absolute;top:.5rem;right:.5rem;background:var(--bg3);border:1px solid var(--border);color:var(--text2);border-radius:6px;padding:.3rem .6rem;font-size:.8rem;cursor:pointer;opacity:0;transition:.2s;z-index:2}
.code-block:hover .copy-btn{opacity:1}.copy-btn:hover{background:var(--accent);color:#fff;border-color:var(--accent)}
.actions{display:flex;gap:.5rem;margin-top:1rem;flex-wrap:wrap}
.raw-link{color:var(--text2);font-size:.85rem;border:1px solid var(--border);border-radius:6px;padding:.3rem .7rem}.raw-link:hover{border-color:var(--accent);color:var(--accent)}
.btn{background:var(--accent);color:#fff;border:none;border-radius:8px;padding:.5rem 1.2rem;font-size:.9rem;font-weight:600;cursor:pointer;transition:.15s;display:inline-flex;align-items:center;gap:.4rem}.btn:hover{opacity:.85}
.btn.secondary{background:var(--bg3);color:var(--text)}
.toast{position:fixed;bottom:2rem;right:2rem;background:var(--accent2);color:#fff;padding:.6rem 1.2rem;border-radius:8px;font-size:.9rem;font-weight:500;opacity:0;transform:translateY(20px);transition:.3s;z-index:200;pointer-events:none}
.toast.show{opacity:1;transform:translateY(0)}
.lock-page{display:flex;align-items:center;justify-content:center;min-height:60vh}
.lock-box{text-align:center}.lock-box .icon{font-size:3rem;margin-bottom:1rem}.lock-box h2{margin-bottom:.5rem}
.lock-box p{color:var(--text2);margin-bottom:1.5rem}
.lock-box input{background:var(--bg3);color:var(--text);border:1px solid var(--border);border-radius:8px;padding:.6rem 1rem;font-size:1rem;width:260px;outline:none;margin-bottom:1rem}
.lock-box input:focus{border-color:var(--accent)}
.lock-box .err{color:var(--red);font-size:.85rem;margin-bottom:1rem;display:none}
::-webkit-scrollbar{width:8px;height:8px}::-webkit-scrollbar-track{background:var(--bg)}::-webkit-scrollbar-thumb{background:var(--bg3);border-radius:4px}
</style>
</head>
<body>
<div class="header">
  <a href="/" class="logo"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="8" y="2" width="8" height="4" rx="1"/><path d="M16 4h2a2 2 0 012 2v14a2 2 0 01-2 2H6a2 2 0 01-2-2V6a2 2 0 012-2h2"/><line x1="9" y1="12" x2="15" y2="12"/><line x1="9" y1="16" x2="13" y2="16"/></svg>SnapBin</a>
  <div class="nav"><a href="/" data-i18n="nav_new">New</a><a href="/about" data-i18n="nav_about">About</a>
    <button onclick="setLang('zh')" id="btnZh">中</button>
    <button onclick="setLang('en')" id="btnEn">EN</button>
  </div>
</div>
<div class="main">
  <div class="view-header">
    <h2>${isProtected ? '🔒' : '📄'} ${id}</h2>
    <div class="view-meta">
      <span>📝 ${lang}</span><span>📏 ${lines} lines · ${size} KB</span>
      <span>🕐 ${created}</span><span>⏳ ${expires}</span>
    </div>
  </div>
  <div class="code-block">
    <button class="copy-btn" onclick="copyCode()" data-i18n="btn_copy">Copy</button>
    <pre class="line-numbers"><code class="language-${lang}">${escapeHtml(snap.content)}</code></pre>
  </div>
  <div class="actions">
    <a class="raw-link" id="rawLink" href="/raw/${id}" target="_blank" data-i18n="btn_raw">Raw</a>
    <button class="btn secondary" onclick="copyCode()" data-i18n="btn_copy">📋 Copy Code</button>
    <a class="btn secondary" href="/" data-i18n="btn_new_snap">+ New Snap</a>
  </div>
</div>
<div class="toast" id="toast"></div>
<script>
// Pass token/pw to Raw link — prefer token, avoid leaking password in URL
(function(){
  var p=new URLSearchParams(location.search);
  var t=p.get('token'),w=p.get('pw');
  var r=document.getElementById('rawLink');
  if(t){r.href='/raw/${id}?token='+encodeURIComponent(t)}
  else if(w){
    // Convert password to a short-lived token to avoid leaking pw in URL/browser history
    r.addEventListener('click',function(e){
      e.preventDefault();
      fetch('/api/snaps/${id}/verify',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:w})})
        .then(function(res){return res.json()})
        .then(function(d){if(d.token)window.open('/raw/${id}?token='+encodeURIComponent(d.token),'_blank');else alert('Verification failed')})
        .catch(function(){alert('Network error')});
    },false);
  }
})();
</script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/prism.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/plugins/line-numbers/prism-line-numbers.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-python.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-typescript.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-go.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-rust.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-java.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-c.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-cpp.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-sql.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-bash.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-yaml.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-docker.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-nginx.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/prism/1.29.0/components/prism-markdown.min.js"></script>
<script>
var I18N={en:{nav_new:'New',nav_about:'About',btn_copy:'Copy',btn_raw:'Raw',btn_new_snap:'+ New Snap',copied:'Copied!',copy_fail:'Select text and press Ctrl+C'},zh:{nav_new:'新建',nav_about:'关于',btn_copy:'复制',btn_raw:'原始文本',btn_new_snap:'+ 新建片段',copied:'已复制！',copy_fail:'请手动选择后 Ctrl+C'}};
var CUR_LANG=localStorage.getItem('snapbin_lang')||((navigator.language||'').startsWith('zh')?'zh':'en');
function t(k){return(I18N[CUR_LANG]||I18N.en)[k]||(I18N.en[k]||k)}
function setLang(l){CUR_LANG=l;localStorage.setItem('snapbin_lang',l);document.getElementById('btnZh').className=l==='zh'?'active':'';document.getElementById('btnEn').className=l==='en'?'active':'';document.querySelectorAll('[data-i18n]').forEach(function(el){el.textContent=t(el.getAttribute('data-i18n'))})}
setLang(CUR_LANG);
Prism.highlightAll();
function copyText(s,cb){
  try{
    if(navigator.clipboard&&window.isSecureContext){
      navigator.clipboard.writeText(s).then(cb||function(){}).catch(function(){legacyCopy(s,cb)})
    }else{legacyCopy(s,cb)}
  }catch(e){legacyCopy(s,cb)}
}
function legacyCopy(s,cb){
  var el=document.createElement('textarea');el.value=s;el.setAttribute('readonly','');
  el.style.cssText='position:fixed;left:-9999px;top:-9999px;opacity:0';
  document.body.appendChild(el);
  if(navigator.userAgent.match(/iphone|ipad|ipod/i)){el.style.fontSize='16px';el.focus();el.setSelectionRange(0,el.value.length)}
  else{el.select()}
  var ok=false;try{ok=document.execCommand('copy')}catch(e){}
  document.body.removeChild(el);
  if(cb){cb(ok)}
}
function copyCode(){var c=document.querySelector('code').textContent;copyText(c,function(ok){showToast(ok!==false)})}
function showToast(ok){var el=document.getElementById('toast');el.textContent=ok?t('copied'):t('copy_fail');el.style.background=ok?'var(--accent2)':'var(--orange)';el.classList.add('show');setTimeout(function(){el.classList.remove('show')},2000)}
</script>
</body>
</html>`;
}

function lockPageHtml(id) {
  return `<!DOCTYPE html>
<html lang="en" data-theme="dark">
<head>
<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>SnapBin · Locked</title>
<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>📋</text></svg>">
<style>
*{margin:0;padding:0;box-sizing:border-box}
:root{--bg:#0d1117;--bg2:#161b22;--bg3:#21262d;--border:#30363d;--text:#e6edf3;--text2:#8b949e;--accent:#58a6ff;--accent2:#3fb950;--red:#f85149}
body{background:var(--bg);color:var(--text);font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;min-height:100vh;display:flex;flex-direction:column}
a{color:var(--accent);text-decoration:none}.header{background:var(--bg2);border-bottom:1px solid var(--border);padding:.8rem 1.5rem;display:flex;align-items:center;justify-content:space-between}
.logo{display:flex;align-items:center;gap:.6rem;font-weight:700;font-size:1.2rem;color:var(--text)}.logo svg{width:28px;height:28px}
.nav{display:flex;gap:.6rem;align-items:center}.nav a,.nav button{color:var(--text2);font-size:.85rem;padding:.3rem .6rem;border-radius:6px;background:none;border:1px solid transparent;cursor:pointer}.nav a:hover,.nav button:hover{background:var(--bg3);color:var(--text)}.nav button.active{border-color:var(--accent);color:var(--accent)}
.main{flex:1;display:flex;align-items:center;justify-content:center}
.lock-box{text-align:center}.lock-box .icon{font-size:3rem;margin-bottom:1rem}.lock-box h2{margin-bottom:.5rem}
.lock-box p{color:var(--text2);margin-bottom:1.5rem}
.lock-box input{background:var(--bg3);color:var(--text);border:1px solid var(--border);border-radius:8px;padding:.6rem 1rem;font-size:1rem;width:260px;outline:none;display:block;margin:0 auto .8rem}
.lock-box input:focus{border-color:var(--accent)}
.lock-box .err{color:var(--red);font-size:.85rem;margin-bottom:.8rem;display:none}
.btn{background:var(--accent);color:#fff;border:none;border-radius:8px;padding:.5rem 1.5rem;font-size:1rem;cursor:pointer;transition:.15s}.btn:hover{opacity:.85}
</style>
</head>
<body>
<div class="header">
  <a href="/" class="logo"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="8" y="2" width="8" height="4" rx="1"/><path d="M16 4h2a2 2 0 012 2v14a2 2 0 01-2 2H6a2 2 0 01-2-2V6a2 2 0 012-2h2"/><line x1="9" y1="12" x2="15" y2="12"/><line x1="9" y1="16" x2="13" y2="16"/></svg>SnapBin</a>
  <div class="nav"><a href="/" data-i18n="nav_new">New</a><a href="/about" data-i18n="nav_about">About</a>
    <button onclick="setLang('zh')" id="btnZh">中</button>
    <button onclick="setLang('en')" id="btnEn">EN</button>
  </div>
</div>
<div class="main">
  <div class="lock-box">
    <div class="icon">🔒</div>
    <h2 data-i18n="lock_title">Password Protected</h2>
    <p data-i18n="lock_desc">This snap requires a password to view.</p>
    <div class="err" id="err" data-i18n="lock_err">Wrong password</div>
    <input id="pw" type="password" data-i18n-placeholder="lock_ph" placeholder="Enter password" autofocus>
    <br><button class="btn" onclick="unlock()" data-i18n="lock_btn">Unlock</button>
  </div>
</div>
<script>
var I18N={en:{nav_new:'New',nav_about:'About',lock_title:'Password Protected',lock_desc:'This snap requires a password to view.',lock_err:'Wrong password',lock_ph:'Enter password',lock_btn:'Unlock',lock_network:'Network error'},zh:{nav_new:'新建',nav_about:'关于',lock_title:'密码保护',lock_desc:'此片段需要密码才能查看。',lock_err:'密码错误',lock_ph:'输入密码',lock_btn:'解锁',lock_network:'网络错误'}};
var CUR_LANG=localStorage.getItem('snapbin_lang')||((navigator.language||'').startsWith('zh')?'zh':'en');
function t(k){return(I18N[CUR_LANG]||I18N.en)[k]||(I18N.en[k]||k)}
function setLang(l){CUR_LANG=l;localStorage.setItem('snapbin_lang',l);document.getElementById('btnZh').className=l==='zh'?'active':'';document.getElementById('btnEn').className=l==='en'?'active':'';document.querySelectorAll('[data-i18n]').forEach(function(el){el.textContent=t(el.getAttribute('data-i18n'))});document.querySelectorAll('[data-i18n-placeholder]').forEach(function(el){el.placeholder=t(el.getAttribute('data-i18n-placeholder'))})}
setLang(CUR_LANG);
const id='${id}';
async function unlock(){
  const pw=document.getElementById('pw').value;
  if(!pw)return;
  try{
    const r=await fetch('/api/snaps/'+id+'/verify',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:pw})});
    const d=await r.json();
    if(!r.ok){document.getElementById('err').textContent=d.error||t('lock_err');document.getElementById('err').style.display='block';return}
    window.location.href='/'+id+'?token='+d.token;
  }catch(e){document.getElementById('err').textContent=t('lock_network');document.getElementById('err').style.display='block'}
}
document.getElementById('pw').addEventListener('keydown',e=>{if(e.key==='Enter')unlock()});
</script>
</body>
</html>`;
}

function aboutHtml() {
  return `<!DOCTYPE html>
<html lang="en" data-theme="dark">
<head>
<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>SnapBin · About</title>
<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>📋</text></svg>">
<style>
*{margin:0;padding:0;box-sizing:border-box}
:root{--bg:#0d1117;--bg2:#161b22;--bg3:#21262d;--border:#30363d;--text:#e6edf3;--text2:#8b949e;--accent:#58a6ff;--accent2:#3fb950}
body{background:var(--bg);color:var(--text);font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Helvetica,Arial,sans-serif;min-height:100vh;display:flex;flex-direction:column}
a{color:var(--accent);text-decoration:none}a:hover{text-decoration:underline}
.header{background:var(--bg2);border-bottom:1px solid var(--border);padding:.8rem 1.5rem;display:flex;align-items:center;justify-content:space-between}
.logo{display:flex;align-items:center;gap:.6rem;font-weight:700;font-size:1.2rem;color:var(--text)}.logo svg{width:28px;height:28px}
.nav{display:flex;gap:.6rem;align-items:center}.nav a,.nav button{color:var(--text2);font-size:.85rem;padding:.3rem .6rem;border-radius:6px;background:none;border:1px solid transparent;cursor:pointer}.nav a:hover,.nav button:hover{background:var(--bg3);color:var(--text)}.nav button.active{border-color:var(--accent);color:var(--accent)}
.main{flex:1;max-width:700px;width:100%;margin:0 auto;padding:2rem 1.5rem}
h1{font-size:1.6rem;margin-bottom:1rem}h2{font-size:1.2rem;margin:1.5rem 0 .5rem;color:var(--accent)}
p{color:var(--text2);line-height:1.7;margin-bottom:.8rem}
code{background:var(--bg3);padding:.15rem .4rem;border-radius:4px;font-size:.9rem}
ul{margin-left:1.5rem;margin-bottom:1rem}li{color:var(--text2);line-height:1.7}
.tag{display:inline-block;background:var(--bg3);border:1px solid var(--border);border-radius:20px;padding:.2rem .7rem;font-size:.8rem;color:var(--text2);margin:.2rem}
</style>
</head>
<body>
<div class="header">
  <a href="/" class="logo"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><rect x="8" y="2" width="8" height="4" rx="1"/><path d="M16 4h2a2 2 0 012 2v14a2 2 0 01-2 2H6a2 2 0 01-2-2V6a2 2 0 012-2h2"/><line x1="9" y1="12" x2="15" y2="12"/><line x1="9" y1="16" x2="13" y2="16"/></svg>SnapBin</a>
  <div class="nav"><a href="/" data-i18n="nav_new">New</a><a href="/about" class="active" data-i18n="nav_about">About</a>
    <button onclick="setLang('zh')" id="btnZh">中</button>
    <button onclick="setLang('en')" id="btnEn">EN</button>
  </div>
</div>
<div class="main">
  <h1 data-i18n="about_title">About SnapBin</h1>
  <p data-i18n="about_desc">A self-hosted pastebin for developers. Share code snippets, config files, logs, and any text with a simple link.</p>
  <h2 data-i18n="about_sec">Security</h2>
  <ul>
    <li data-i18n="about_sec_1"><strong>AES-256-GCM</strong> — all content encrypted at rest</li>
    <li data-i18n="about_sec_2"><strong>scrypt</strong> — passwords are hashed, never stored in plaintext</li>
    <li data-i18n="about_sec_3"><strong>Short-lived tokens</strong> — password verification uses POST + token, not URL params</li>
    <li data-i18n="about_sec_4"><strong>Rate limiting</strong> — per-IP throttling on create endpoints</li>
  </ul>
  <h2 data-i18n="about_feat">Features</h2>
  <ul>
    <li data-i18n="about_feat_1"><strong>No accounts</strong> — just paste and share</li>
    <li data-i18n="about_feat_2"><strong>Syntax highlighting</strong> — auto-detects 18+ languages</li>
    <li data-i18n="about_feat_3"><strong>Password protection</strong> — optional password for sensitive snippets</li>
    <li data-i18n="about_feat_4"><strong>Auto-expiry</strong> — set expiration from 1 hour to never</li>
    <li data-i18n="about_feat_5"><strong>Raw access</strong> — get plain text via <code>/raw/{id}</code></li>
    <li data-i18n="about_feat_6"><strong>Keyboard shortcuts</strong> — Tab for spaces, Ctrl+Enter to submit</li>
  </ul>
  <h2 data-i18n="about_api">API</h2>
  <p><code>POST /api/snaps</code> — Create {content, lang?, expiry?, password?}</p>
  <p><code>GET /api/snaps/:id</code> — Read (?pw= or ?token= for protected)</p>
  <p><code>POST /api/snaps/:id/verify</code> — Verify password → {token}</p>
  <p><code>GET /raw/:id</code> — Raw text (?pw= or ?token=)</p>
  <p><code>GET /api/stats</code> — Snap count</p>
  <h2 data-i18n="about_tech">Tech Stack</h2>
  <div style="display:flex;flex-wrap:wrap;gap:.4rem;margin-top:.5rem">
    <span class="tag">Node.js</span><span class="tag">AES-256-GCM</span><span class="tag">scrypt</span>
    <span class="tag">Async I/O</span><span class="tag">Rate Limiting</span><span class="tag">Prism.js</span>
  </div>
</div>
<script>
var I18N={en:{nav_new:'New',nav_about:'About',about_title:'About SnapBin',about_desc:'A self-hosted pastebin for developers. Share code snippets, config files, logs, and any text with a simple link.',about_sec:'Security',about_sec_1:'AES-256-GCM — all content encrypted at rest',about_sec_2:'scrypt — passwords are hashed, never stored in plaintext',about_sec_3:'Short-lived tokens — password verification uses POST + token, not URL params',about_sec_4:'Rate limiting — per-IP throttling on create endpoints',about_feat:'Features',about_feat_1:'No accounts — just paste and share',about_feat_2:'Syntax highlighting — auto-detects 18+ languages',about_feat_3:'Password protection — optional password for sensitive snippets',about_feat_4:'Auto-expiry — set expiration from 1 hour to never',about_feat_5:'Raw access — get plain text via /raw/{id}',about_feat_6:'Keyboard shortcuts — Tab for spaces, Ctrl+Enter to submit',about_api:'API',about_tech:'Tech Stack'},zh:{nav_new:'新建',nav_about:'关于',about_title:'关于 SnapBin',about_desc:'面向开发者的自托管粘贴板。通过链接分享代码片段、配置文件、日志及任何文本。',about_sec:'安全性',about_sec_1:'AES-256-GCM — 所有内容静态加密',about_sec_2:'scrypt — 密码哈希存储，永不保存明文',about_sec_3:'短期令牌 — 密码验证使用 POST + 令牌，不通过 URL 参数',about_sec_4:'频率限制 — 按 IP 对创建接口进行节流',about_feat:'功能特性',about_feat_1:'无需注册 — 直接粘贴分享',about_feat_2:'语法高亮 — 自动识别 18+ 种语言',about_feat_3:'密码保护 — 可选密码保护敏感片段',about_feat_4:'自动过期 — 过期时间从 1 小时到永不',about_feat_5:'原始访问 — 通过 /raw/{id} 获取纯文本',about_feat_6:'快捷键 — Tab 插入空格，Ctrl+Enter 提交',about_api:'API 接口',about_tech:'技术栈'}};
var CUR_LANG=localStorage.getItem('snapbin_lang')||((navigator.language||'').startsWith('zh')?'zh':'en');
function t(k){return(I18N[CUR_LANG]||I18N.en)[k]||(I18N.en[k]||k)}
function setLang(l){CUR_LANG=l;localStorage.setItem('snapbin_lang',l);document.getElementById('btnZh').className=l==='zh'?'active':'';document.getElementById('btnEn').className=l==='en'?'active':'';document.querySelectorAll('[data-i18n]').forEach(function(el){el.textContent=t(el.getAttribute('data-i18n'))})}
setLang(CUR_LANG);
</script>
</body>
</html>`;
}

// ─── Router ────────────────────────────────────────────────────────────
const server = http.createServer(async (req, res) => {
  const url = new URL(req.url, `http://${req.headers.host}`);
  const p = url.pathname;
  const ip = getClientIp(req);

  try {
    // ── API: Create ──
    if (req.method === 'POST' && p === '/api/snaps') {
      if (!checkRateLimit(ip)) return json(res, 429, { error: 'Rate limit exceeded. Try again later.' });
      if (Object.keys(snaps).length >= MAX_SNAPS) return json(res, 503, { error: 'Storage full. Maximum snaps reached.' });

      const body = JSON.parse(await parseBody(req));
      const content = (body.content || '').trim();
      if (!content) return json(res, 400, { error: 'Content is required' });
      if (content.length > MAX_BODY) return json(res, 400, { error: 'Content too large (max 512KB)' });

      const id = genId();
      const expiryMs = parseExpiry(body.expiry);
      const snap = {
        id, content, lang: detectLang(content, body.lang),
        createdAt: Date.now(), expireAt: expiryMs ? Date.now() + expiryMs : null, views: 0
      };
      if (body.password) snap.password = hashPw(body.password);
      snaps[id] = snap;
      scheduleSave();
      return json(res, 201, { id, url: `${getBaseUrl(req)}/${id}`, lang: snap.lang });
    }

    // ── API: Verify password → token ──
    if (req.method === 'POST' && /^\/api\/snaps\/[^/]+\/verify$/.test(p)) {
      const id = p.split('/')[3];
      const snap = snaps[id];
      if (!snap) return json(res, 404, { error: 'Not found' });
      if (!snap.password) return json(res, 400, { error: 'This snap is not password protected' });

      const body = JSON.parse(await parseBody(req));
      if (!verifyPw(body.password || '', snap.password)) return json(res, 403, { error: 'Wrong password' });

      const token = issueToken(id);
      return json(res, 200, { token });
    }

    // ── API: Read ──
    if (req.method === 'GET' && p.startsWith('/api/snaps/')) {
      const id = p.slice('/api/snaps/'.length);
      const snap = snaps[id];
      if (!snap) return json(res, 404, { error: 'Not found' });
      if (snap.expireAt && snap.expireAt < Date.now()) { delete snaps[id]; scheduleSave(); return json(res, 404, { error: 'Expired' }); }

      const pw = url.searchParams.get('pw');
      const token = url.searchParams.get('token');
      if (snap.password) {
        const ok = (token && checkToken(token, id)) || verifyPw(pw || '', snap.password);
        if (!ok) return json(res, 403, { error: 'Password required. Use POST /api/snaps/:id/verify or ?pw=' });
      }
      snap.views++;
      scheduleSave();
      return json(res, 200, { id: snap.id, content: snap.content, lang: snap.lang, createdAt: snap.createdAt, expireAt: snap.expireAt, views: snap.views, hasPassword: !!snap.password });
    }

    // ── API: Stats ──
    if (req.method === 'GET' && p === '/api/stats') {
      const today = new Date().toDateString();
      const todayCount = Object.values(snaps).filter(s => new Date(s.createdAt).toDateString() === today).length;
      return json(res, 200, { total: Object.keys(snaps).length, today: todayCount });
    }

    // ── Raw text ──
    if (req.method === 'GET' && p.startsWith('/raw/')) {
      const id = p.slice('/raw/'.length);
      const snap = snaps[id];
      if (!snap) { res.writeHead(404); res.end('Not found'); return; }
      if (snap.expireAt && snap.expireAt < Date.now()) { delete snaps[id]; scheduleSave(); res.writeHead(404); res.end('Expired'); return; }

      const pw = url.searchParams.get('pw');
      const token = url.searchParams.get('token');
      if (snap.password) {
        const ok = (token && checkToken(token, id)) || verifyPw(pw || '', snap.password);
        if (!ok) { res.writeHead(403, { 'Content-Type': 'text/plain' }); res.end('Password required. Use ?pw= or ?token='); return; }
      }
      snap.views++;
      scheduleSave();
      res.writeHead(200, { 'Content-Type': 'text/plain; charset=utf-8' });
      res.end(snap.content);
      return;
    }

    // ── View snap page ──
    if (req.method === 'GET' && p.length > 1 && !p.includes('.')) {
      const id = p.slice(1);
      const snap = snaps[id];
      if (snap) {
        if (snap.expireAt && snap.expireAt < Date.now()) { delete snaps[id]; scheduleSave(); res.writeHead(302, { Location: '/' }); res.end(); return; }

        const pw = url.searchParams.get('pw');
        const token = url.searchParams.get('token');
        if (snap.password) {
          const ok = (token && checkToken(token, id)) || verifyPw(pw || '', snap.password);
          if (!ok) {
            // Show lock page (POST-based verification, no password in URL)
            res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
            res.end(lockPageHtml(id));
            return;
          }
        }
        snap.views++;
        scheduleSave();
        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
        res.end(viewHtml(snap, id));
        return;
      }
    }

    // ── About ──
    if (p === '/about') {
      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
      res.end(aboutHtml());
      return;
    }

    // ── Index ──
    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
    res.end(indexHtml());

  } catch (e) {
    console.error(e);
    if (!res.headersSent) json(res, 500, { error: 'Internal server error' });
  }
});

function startServer() {
  server.listen(PORT, HOST, () => {
    const url = BASE_URL || `http://${HOST === '0.0.0.0' ? 'localhost' : HOST}:${PORT}`;
    console.log(`\n  📋 SnapBin is live`);
    console.log(`  ├─ Local:   ${url}`);
    if (HOST === '0.0.0.0') {
      try {
        const nets = os.networkInterfaces();
        for (const iface of Object.values(nets)) {
          for (const n of iface) {
            if (n.family === 'IPv4' && !n.internal) { console.log(`  ├─ Network: http://${n.address}:${PORT}`); break; }
          }
        }
      } catch {}
    }
    console.log(`  ├─ Storage: ${DATA_DIR}`);
    console.log(`  ├─ Max:     ${MAX_SNAPS} snaps, ${RATE_LIMIT}/min per IP`);
    console.log(`  └─ Ctrl+C to stop\n`);
  });
}

if (require.main === module) {
  startServer();
} else {
  module.exports = { startServer, server, snaps, encrypt, decrypt, hashPw, verifyPw };
}