server.js

require("dotenv").config();
const express = require("express");
const crypto = require("crypto");
const cors = require("cors");
const helmet = require("helmet");

const app = express();
app.use(express.json());
app.use(cors());
app.use(helmet());

const keyDatabase = {};

// Generate key
function generateKey() {
    const raw = crypto.randomBytes(5).toString("hex").toUpperCase();
    return `HCYB-${raw}`;
}

// Telegram hook placeholder
app.post("/webhook", (req, res) => {
    const key = generateKey();

    keyDatabase[key] = {
        deviceId: null,
        expiresAt: Date.now() + 30 * 60 * 1000
    };

    console.log("KEY GENERATED:", key);

    res.sendStatus(200);
});

// Verify + bind device
app.post("/api/verify-key", (req, res) => {
    const { key, deviceId } = req.body;

    const record = keyDatabase[key];

    if (!record) return res.json({ valid: false });

    if (Date.now() > record.expiresAt)
        return res.json({ valid: false, msg: "expired" });

    if (!record.deviceId) {
        record.deviceId = deviceId;
        return res.json({ valid: true, msg: "bound" });
    }

    if (record.deviceId !== deviceId)
        return res.json({ valid: false, msg: "device mismatch" });

    return res.json({ valid: true });
});

// version endpoint
app.get("/api/version", (req, res) => {
    res.json({ version: "1.0.0" });
});

const PORT = 3000;
app.listen(PORT, () => console.log("Server running"));