niko
427 lines
22 KiB
C#
427 lines
22 KiB
C#
using Microsoft.AspNetCore.Mvc;
|
|
using Newtonsoft.Json;
|
|
using Campus_live_rewrite.api.server.Classes.db_class;
|
|
using Campus_live_rewrite.api.server;
|
|
using Campus_live_rewrite.api.dbs;
|
|
using System.ComponentModel.DataAnnotations;
|
|
|
|
namespace Campus_live_rewrite.Controllers
|
|
{
|
|
public class WebController : ControllerBase
|
|
{
|
|
// "/" is shared between two callers that want completely different things:
|
|
//
|
|
// - the GAME CLIENT treats "/" as the NameServer endpoint and rejects anything that
|
|
// isn't a valid NS DTO with FAILED_TO_CONNECT_CODE_LOCKER (=4, "Failed to connect
|
|
// to RecNet, error code: locker"). This is load-bearing: get it wrong and NOBODY
|
|
// can connect.
|
|
// - a BROWSER hitting gameauth.ddns.net should get the Campus website.
|
|
//
|
|
// They are told apart by the request itself: BestHTTP (the client's HTTP stack) does
|
|
// not ask for text/html. The test is deliberately biased - anything that isn't clearly
|
|
// a browser gets the NS JSON, so an unrecognised client fails safe rather than being
|
|
// handed a web page it cannot parse. /home and /site still serve the old landing page.
|
|
//
|
|
// NOTE: this is also why the site is NOT mounted with UseDefaultFiles in Program.cs.
|
|
// That would serve Website/index.html for "/" inside the static-file middleware,
|
|
// before routing ever reaches this action, and break every client.
|
|
[Route("/")]
|
|
public IActionResult NsRoot()
|
|
{
|
|
if (WantsHtml(Request))
|
|
{
|
|
var index = Path.Combine(Environment.CurrentDirectory, "Website", "index.html");
|
|
if (System.IO.File.Exists(index))
|
|
return PhysicalFile(index, "text/html");
|
|
}
|
|
|
|
return ns(Version: "20250731");
|
|
}
|
|
|
|
/// <summary>
|
|
/// True only for a request that is unambiguously a web browser asking for a page.
|
|
/// Anything else - the game client, a probe, a bare curl - is treated as the game.
|
|
/// </summary>
|
|
private static bool WantsHtml(HttpRequest req)
|
|
{
|
|
if (!HttpMethods.IsGet(req.Method)) return false;
|
|
|
|
string ua = req.Headers.UserAgent.ToString();
|
|
if (ua.Contains("BestHTTP", StringComparison.OrdinalIgnoreCase)) return false;
|
|
|
|
return req.Headers.Accept.ToString()
|
|
.Contains("text/html", StringComparison.OrdinalIgnoreCase);
|
|
}
|
|
|
|
[Route("/home")]
|
|
[Route("/site")]
|
|
public IActionResult Index()
|
|
{
|
|
var filePath = Path.Combine(Environment.CurrentDirectory, "Web", "Index.html");
|
|
|
|
if (!System.IO.File.Exists(filePath))
|
|
return NotFound();
|
|
|
|
return PhysicalFile(filePath, "text/html");
|
|
}
|
|
|
|
// ---- Clean website URLs (no .html) --------------------------------------------------
|
|
// The public site is served as static files (profile.html, room.html, …), but the links
|
|
// people see and share should be clean: /user/kyle, /room/{id}, /image/{id}, /news, etc.
|
|
// Each clean path just serves the matching HTML file; the page's JS reads the id/handle
|
|
// from location.pathname (see app.js routeParam()). The game client never requests these
|
|
// paths (they carry no NS meaning), so there is no browser-vs-game split to make here.
|
|
private IActionResult SitePage(string file)
|
|
{
|
|
var path = Path.Combine(Environment.CurrentDirectory, "Website", file);
|
|
if (!System.IO.File.Exists(path)) return NotFound();
|
|
|
|
// These pages are served at a CLEAN path (/user/kyle, /room/{id}, …). Their asset refs
|
|
// (app.js, style.css, assets/…) are RELATIVE, so at /user/kyle the browser would look
|
|
// for /user/app.js and 404 - the page couldn't even load its own JS. Inject
|
|
// <base href="/"> right after <head> so every relative URL resolves from the site root,
|
|
// regardless of the clean path's depth. (Static /profile.html serving is untouched.)
|
|
var html = System.IO.File.ReadAllText(path);
|
|
if (html.IndexOf("<base ", StringComparison.OrdinalIgnoreCase) < 0)
|
|
{
|
|
int i = html.IndexOf("<head>", StringComparison.OrdinalIgnoreCase);
|
|
if (i >= 0) html = html.Insert(i + "<head>".Length, "\n <base href=\"/\">");
|
|
}
|
|
return Content(html, "text/html; charset=utf-8");
|
|
}
|
|
|
|
// True when the request carries a valid website session cookie (campus_site). Mirrors
|
|
// SiteContentController.CurrentUser - a lightweight decode, no DB hit.
|
|
private bool IsSignedIn()
|
|
{
|
|
string token = Request.Cookies["campus_site"] ?? "";
|
|
if (string.IsNullOrEmpty(token)) return false;
|
|
// Require the "website" surface (the site cookie is minted with it). Without this the
|
|
// default DecodeToken now refuses website tokens, so /profile and /settings would
|
|
// redirect to /login even when the visitor is signed in.
|
|
string data = ClientSecurity.DecodeToken(token, requireSurface: "website");
|
|
if (string.IsNullOrEmpty(data) || data.StartsWith("error_")) return false;
|
|
try { var u = JsonConvert.DeserializeObject<player_info>(data); return u != null && u.Id != 0; }
|
|
catch { return false; }
|
|
}
|
|
|
|
private const string SiteBase = "https://gameauth.ddns.net";
|
|
|
|
// Serve a site page with resource-specific OpenGraph/Twitter-card meta injected, so pasting
|
|
// the link in Discord/social embeds the image/profile/room. Reads the page, drops any
|
|
// existing og:/twitter: meta (so ours win - a duplicate og:image confuses crawlers), and
|
|
// injects title/description/image + a <base href="/"> for the clean path. Humans still get
|
|
// the full SPA; crawlers (which don't run JS) read the injected meta.
|
|
private IActionResult SitePageOg(string file, string title, string? description, string? imageAbsUrl, string urlPath, bool largeImage)
|
|
{
|
|
var path = Path.Combine(Environment.CurrentDirectory, "Website", file);
|
|
if (!System.IO.File.Exists(path)) return NotFound();
|
|
var html = System.IO.File.ReadAllText(path);
|
|
|
|
if (html.IndexOf("<base ", StringComparison.OrdinalIgnoreCase) < 0)
|
|
{
|
|
int b = html.IndexOf("<head>", StringComparison.OrdinalIgnoreCase);
|
|
if (b >= 0) html = html.Insert(b + "<head>".Length, "\n <base href=\"/\">");
|
|
}
|
|
|
|
html = System.Text.RegularExpressions.Regex.Replace(
|
|
html,
|
|
"\\s*<meta[^>]*(property=\"og:[^\"]*\"|name=\"twitter:[^\"]*\")[^>]*>",
|
|
"",
|
|
System.Text.RegularExpressions.RegexOptions.IgnoreCase);
|
|
|
|
string Esc(string? s) => System.Net.WebUtility.HtmlEncode(s ?? "");
|
|
var sb = new System.Text.StringBuilder();
|
|
sb.Append("\n <meta property=\"og:site_name\" content=\"Campus\">");
|
|
sb.Append($"\n <meta property=\"og:title\" content=\"{Esc(title)}\">");
|
|
sb.Append($"\n <meta property=\"og:url\" content=\"{Esc(SiteBase + urlPath)}\">");
|
|
sb.Append("\n <meta property=\"og:type\" content=\"website\">");
|
|
if (!string.IsNullOrWhiteSpace(description))
|
|
sb.Append($"\n <meta property=\"og:description\" content=\"{Esc(description)}\">");
|
|
if (!string.IsNullOrWhiteSpace(imageAbsUrl))
|
|
{
|
|
sb.Append($"\n <meta property=\"og:image\" content=\"{Esc(imageAbsUrl)}\">");
|
|
sb.Append($"\n <meta name=\"twitter:image\" content=\"{Esc(imageAbsUrl)}\">");
|
|
}
|
|
sb.Append($"\n <meta name=\"twitter:card\" content=\"{(largeImage ? "summary_large_image" : "summary")}\">");
|
|
sb.Append($"\n <meta name=\"twitter:title\" content=\"{Esc(title)}\">");
|
|
if (!string.IsNullOrWhiteSpace(description))
|
|
sb.Append($"\n <meta name=\"twitter:description\" content=\"{Esc(description)}\">");
|
|
|
|
int i = html.IndexOf("<head>", StringComparison.OrdinalIgnoreCase);
|
|
if (i >= 0) html = html.Insert(i + "<head>".Length, sb.ToString());
|
|
return Content(html, "text/html; charset=utf-8");
|
|
}
|
|
|
|
private static string? ImgAbs(string? name) =>
|
|
string.IsNullOrWhiteSpace(name) || name == "DefaultPFP.png"
|
|
? null
|
|
: SiteBase + "/img/" + name;
|
|
|
|
// A small styled "X does not exist" page (404) for a slug that resolves to nothing.
|
|
private IActionResult DoesNotExist(string entity)
|
|
{
|
|
string e = System.Net.WebUtility.HtmlEncode(entity);
|
|
string html =
|
|
"<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">" +
|
|
"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">" +
|
|
$"<title>{e} not found - Campus</title>" +
|
|
$"<meta property=\"og:title\" content=\"{e} does not exist\">" +
|
|
"<meta property=\"og:site_name\" content=\"Campus\">" +
|
|
"<style>body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;" +
|
|
"background:#14121a;color:#eee;font-family:Inter,system-ui,sans-serif;text-align:center}" +
|
|
".c{padding:40px}h1{font-size:28px;margin:0 0 8px}p{opacity:.75;margin:0 0 20px}" +
|
|
"a{color:#ff5a3c;text-decoration:none;font-weight:600}</style></head>" +
|
|
$"<body><div class=\"c\"><h1>{e} does not exist</h1>" +
|
|
$"<p>We couldn't find that {e.ToLower()} on Campus.</p>" +
|
|
"<a href=\"/\">← Back to home</a></div></body></html>";
|
|
return new ContentResult { Content = html, ContentType = "text/html; charset=utf-8", StatusCode = 404 };
|
|
}
|
|
|
|
// Profile URLs are by USERNAME, never the account id:
|
|
// - a real username -> the profile (with OG embed);
|
|
// - a bare account id -> 302 REDIRECT to that account's /user/<username>, so the URL
|
|
// bar shows the name, not the id;
|
|
// - anything else -> "Player does not exist".
|
|
[HttpGet("/user/{handle}")]
|
|
public IActionResult UserPage(string handle)
|
|
{
|
|
var full = PlayerDB.GetFullAccountByName(handle);
|
|
if (full?.player != null)
|
|
{
|
|
string title = $"{full.player.DisplayName} (@{full.player.Username})";
|
|
string? bio = full.player_Extra?.Bio;
|
|
string desc = string.IsNullOrWhiteSpace(bio) ? "View this player's Campus profile." : bio!;
|
|
string img = ImgAbs(full.player.profileImage) ?? (SiteBase + "/img/DefaultProfileImage.jpg");
|
|
return SitePageOg("profile.html", title, desc, img, "/user/" + Uri.EscapeDataString(handle), largeImage: false);
|
|
}
|
|
|
|
// Not a username. If it's a real account id, send them to the canonical @name URL.
|
|
if (ulong.TryParse(handle, out var byId))
|
|
{
|
|
var acc = PlayerDB.GetFullAccount(byId);
|
|
if (!string.IsNullOrEmpty(acc?.player?.Username))
|
|
return Redirect("/user/" + Uri.EscapeDataString(acc.player.Username));
|
|
}
|
|
|
|
return DoesNotExist("Player");
|
|
}
|
|
|
|
// Your OWN profile requires a session - signed out it would only show placeholder
|
|
// ("Username" / "@handle"), so send it to the login page instead.
|
|
[HttpGet("/profile")]
|
|
public IActionResult ProfilePage() => IsSignedIn() ? SitePage("profile.html") : Redirect("/login");
|
|
|
|
// Room URLs are by NAME, never the room id:
|
|
// - a real room name -> the room page (with OG embed);
|
|
// - a bare room id -> 302 REDIRECT to that room's /room/<name>, so the URL shows the name;
|
|
// - anything else -> "Room does not exist".
|
|
[HttpGet("/room/{id}")]
|
|
public IActionResult RoomPage(string id)
|
|
{
|
|
var room = RoomDB.GetRoomByName(id);
|
|
if (room != null && room.IsDorm) return DoesNotExist("Room"); // dorms are never web pages
|
|
if (room != null)
|
|
{
|
|
string title = (room.Name ?? "Room").TrimStart('^');
|
|
return SitePageOg("room.html", title, room.Description, ImgAbs(room.ImageName),
|
|
"/room/" + Uri.EscapeDataString(id), largeImage: true);
|
|
}
|
|
|
|
if (ulong.TryParse(id, out var rid))
|
|
{
|
|
var byId = RoomDB.GetRoom(rid);
|
|
if (byId != null && byId.IsDorm) return DoesNotExist("Room");
|
|
if (!string.IsNullOrEmpty(byId?.Name))
|
|
return Redirect("/room/" + Uri.EscapeDataString(byId.Name.TrimStart('^')));
|
|
}
|
|
|
|
return DoesNotExist("Room");
|
|
}
|
|
|
|
[HttpGet("/image/{id}")]
|
|
public IActionResult ImagePage(string id)
|
|
{
|
|
string title = "Campus Photo";
|
|
string? desc = null, img = null;
|
|
// ids can be a bare number or an old "user__id" compound - take the numeric tail.
|
|
var tail = id.Contains("__") ? id.Substring(id.LastIndexOf("__") + 2) : id;
|
|
if (int.TryParse(tail, out int imageId))
|
|
{
|
|
var meta = ImageMetadataDB.GetImagesByIds(new List<int> { imageId })?.FirstOrDefault();
|
|
if (meta != null)
|
|
{
|
|
img = ImgAbs(meta.ImageName);
|
|
desc = meta.Description;
|
|
var author = PlayerDB.GetAccountById(meta.PlayerId);
|
|
if (author != null) title = $"Photo by @{author.Username}";
|
|
}
|
|
}
|
|
return SitePageOg("image.html", title, desc, img, "/image/" + Uri.EscapeDataString(id), largeImage: true);
|
|
}
|
|
|
|
[HttpGet("/news")]
|
|
public IActionResult NewsPage() => SitePage("news.html");
|
|
|
|
[HttpGet("/rooms")]
|
|
public IActionResult RoomsPage() => SitePage("rooms.html");
|
|
|
|
[HttpGet("/patch-notes")]
|
|
public IActionResult PatchNotesPage() => SitePage("patch-notes.html");
|
|
|
|
// Support replaced the old Weekly page. /weekly redirects so any old link still lands here.
|
|
// Deep links (/support/ticket/{id}, /support/logs) all serve the same page; support.html's
|
|
// JS reads the path and opens the right ticket / the staff logs view.
|
|
[HttpGet("/support")]
|
|
[HttpGet("/support/ticket/{id:int}")]
|
|
[HttpGet("/support/logs")]
|
|
public IActionResult SupportPage() => SitePage("support.html");
|
|
|
|
[HttpGet("/weekly")]
|
|
public IActionResult WeeklyPage() => Redirect("/support");
|
|
|
|
// Settings is entirely your-account controls - useless signed out, so gate it too.
|
|
[HttpGet("/settings")]
|
|
public IActionResult SettingsPage() => IsSignedIn() ? SitePage("settings.html") : Redirect("/login");
|
|
|
|
// Stats is the signed-in creator's own numbers - signed out there is nothing to show.
|
|
[HttpGet("/stats")]
|
|
public IActionResult StatsPage() => IsSignedIn() ? SitePage("stats.html") : Redirect("/login");
|
|
|
|
[HttpGet("/login")]
|
|
public IActionResult LoginPage() => SitePage("login.html");
|
|
|
|
[HttpGet("/download")]
|
|
public IActionResult DownloadPage() => SitePage("download.html");
|
|
|
|
[HttpGet("/accessibility")]
|
|
public IActionResult AccessibilityPage() => SitePage("accessibility.html");
|
|
|
|
[HttpGet("/signup")]
|
|
public IActionResult SignupPage() => IsSignedIn() ? Redirect("/profile") : SitePage("signup.html");
|
|
|
|
// The old ".html" addresses stay reachable but bounce to the clean path, so a shared
|
|
// /signup.html link lands on /signup and the bar never shows a file name.
|
|
private static readonly Dictionary<string, string> CleanPaths = new(StringComparer.OrdinalIgnoreCase)
|
|
{
|
|
["index.html"] = "/", ["signup.html"] = "/signup", ["login.html"] = "/login",
|
|
["download.html"] = "/download", ["news.html"] = "/news", ["patch-notes.html"] = "/patch-notes", ["rooms.html"] = "/rooms",
|
|
["accessibility.html"] = "/accessibility", ["support.html"] = "/support", ["weekly.html"] = "/weekly",
|
|
["settings.html"] = "/settings", ["profile.html"] = "/profile", ["stats.html"] = "/stats",
|
|
};
|
|
|
|
[HttpGet("/{page}.html")]
|
|
public IActionResult HtmlRedirect(string page)
|
|
{
|
|
if (!CleanPaths.TryGetValue(page + ".html", out var clean)) return NotFound();
|
|
// profile.html?u=kyle -> /user/kyle ; keep any other query string / fragment as-is
|
|
if (clean == "/profile" && !string.IsNullOrEmpty(Request.Query["u"]))
|
|
return RedirectPermanent("/user/" + Uri.EscapeDataString(Request.Query["u"].ToString()));
|
|
return RedirectPermanent(clean + Request.QueryString.Value);
|
|
}
|
|
|
|
// The Windows launcher download: https://gameauth.ddns.net/campus.exe
|
|
// Drop the built launcher on the server at Data/Downloads/campus.exe (preferred) or
|
|
// Website/campus.exe and it is served here as a file download. enableRangeProcessing lets
|
|
// browsers resume/segment the download of a large exe.
|
|
[HttpGet("/campus.exe")]
|
|
public IActionResult CampusExe()
|
|
{
|
|
foreach (var p in new[]
|
|
{
|
|
Path.Combine(Environment.CurrentDirectory, "Data", "Downloads", "campus.exe"),
|
|
Path.Combine(Environment.CurrentDirectory, "Website", "campus.exe"),
|
|
})
|
|
{
|
|
if (System.IO.File.Exists(p))
|
|
return PhysicalFile(p, "application/octet-stream", "campus.exe", enableRangeProcessing: true);
|
|
}
|
|
return NotFound("Launcher not uploaded yet - place campus.exe in Data/Downloads/ on the server.");
|
|
}
|
|
|
|
[Route("/robots.txt")]
|
|
public IActionResult Robots()
|
|
{
|
|
var content = string.Join(Environment.NewLine, new[]
|
|
{
|
|
"User-agent: *",
|
|
"Disallow: /admin/v4/login",
|
|
"Disallow: /admin/v4/home",
|
|
"Disallow: /admin/v5/login",
|
|
"Disallow: /admin/v5/home"
|
|
});
|
|
|
|
return Content(content, "text/plain");
|
|
}
|
|
|
|
[HttpGet("/favicon.ico")]
|
|
public IActionResult Favicon()
|
|
{
|
|
// Serve the Campus AnimatedIcon as the browser-tab icon for gameauth.ddns.net.
|
|
// Falls back to Web/favicon.png if the admin-assets file isn't shipped for some reason.
|
|
var animated = Path.Combine(Environment.CurrentDirectory, "AdminPanel", "Assets", "AnimatedIcon.png");
|
|
if (System.IO.File.Exists(animated))
|
|
return PhysicalFile(animated, "image/png");
|
|
|
|
var legacy = Path.Combine(Environment.CurrentDirectory, "Web", "favicon.png");
|
|
if (System.IO.File.Exists(legacy))
|
|
return PhysicalFile(legacy, "image/png");
|
|
|
|
return NotFound();
|
|
}
|
|
|
|
[HttpGet("/ns")]
|
|
public IActionResult ns([FromQuery(Name = "v")] string? Version = null)
|
|
{
|
|
// Reference server only served for "20250731" (July 31 2025 build). We serve the same
|
|
// body for any/no version so older + newer client builds don't 400 here.
|
|
{
|
|
return Ok(new
|
|
{
|
|
Accounts = "https://gameauth.ddns.net/Accounts",
|
|
API = "https://gameauth.ddns.net",
|
|
AI = "https://gameauth.ddns.net/Ai",
|
|
Auth = "https://gameauth.ddns.net/Auth",
|
|
BugReporting = "https://gameauth.ddns.net",
|
|
Cards = "https://gameauth.ddns.net",
|
|
// Was `https://cdn.rec.net` (a leftover in the E12354 base that pointed at
|
|
// real Rec Room's CDN to "save on our own bandwidth"). The July 19 2025
|
|
// client's `summer` NS-validation gate checks every URL's host and fails
|
|
// when they don't all resolve back to us - mate's working server puts CDN
|
|
// on his host, so we do the same. 2026-08-13.
|
|
CDN = "https://gameauth.ddns.net/cdn",
|
|
Chat = "https://gameauth.ddns.net/chat",
|
|
Clubs = "https://gameauth.ddns.net/clubs",
|
|
CMS = "https://gameauth.ddns.net/cms",
|
|
Commerce = "https://gameauth.ddns.net/Commerce",
|
|
Data = "https://gameauth.ddns.net",
|
|
DataCollection = "https://gameauth.ddns.net",
|
|
Discovery = "https://gameauth.ddns.net",
|
|
Econ = "https://gameauth.ddns.net",
|
|
GameLogs = "https://gameauth.ddns.net",
|
|
Geo = "https://gameauth.ddns.net",
|
|
Images = "https://gameauth.ddns.net/img/",
|
|
Leaderboard = "https://gameauth.ddns.net/server/Leaderboard",
|
|
Link = "https://gameauth.ddns.net/link",
|
|
Lists = "https://gameauth.ddns.net/lists",
|
|
Matchmaking = "https://gameauth.ddns.net/Matchmaking",
|
|
Moderation = "https://gameauth.ddns.net",
|
|
Notifications = "https://gameauth.ddns.net/Notifications",
|
|
PlatformNotifications = "https://gameauth.ddns.net/Notifications",
|
|
PlayerSettings = "https://gameauth.ddns.net/server/PlayerSettings",
|
|
RoomComments = "https://gameauth.ddns.net/RoomComments",
|
|
RoomieIntegrations = "https://gameauth.ddns.net/Roomie",
|
|
Rooms = "https://gameauth.ddns.net/Room_server",
|
|
Storage = "https://gameauth.ddns.net/server/Storage",
|
|
Strings = "https://gameauth.ddns.net/Strings",
|
|
StringsCDN = "https://gameauth.ddns.net/StringsCDN",
|
|
Studio = "https://gameauth.ddns.net/Studio",
|
|
Thorn = "https://gameauth.ddns.net/Thorn",
|
|
Videos = "https://gameauth.ddns.net/videodir",
|
|
WWW = "https://gameauth.ddns.net"
|
|
});
|
|
}
|
|
}
|
|
}
|
|
}
|