server.js

const http = require('http');
const path = require('path');
const fs = require('fs');
const crypto = require('crypto');
const express = require('express');
const bcrypt = require('bcryptjs');
const jwt = require('jsonwebtoken');
const WebSocket = require('ws');
const Busboy = require('busboy');
const { execSync } = require('child_process');

const ROOT_DIR = __dirname;
const DATA_DIR = path.join(ROOT_DIR, 'data');
const SERVER_DIR = path.join(ROOT_DIR, 'minecraft_server');
const DB_PATH = path.join(DATA_DIR, 'database.json');

const app = express();
const server = http.createServer(app);
const wss = new WebSocket.Server({ server });

let jwtSecret;
let config;

let database = {
  config: {},
  users: [],
  whitelist: [],
  blacklist: [],
  banned_players: [],
  banned_ips: [],
  ops: [],
  installed_versions: [],
  player_history: [],
  server_properties: {},
  mods: []
};

function loadDB() {
  try {
    if (fs.existsSync(DB_PATH)) {
      const raw = fs.readFileSync(DB_PATH, 'utf8');
      const loaded = JSON.parse(raw);
      database = { ...database, ...loaded };
    }
  } catch (e) { console.error('DB load error:', e.message); }
}

function saveDB() {
  try {
    fs.writeFileSync(DB_PATH, JSON.stringify(database, null, 2), 'utf8');
  } catch (e) { console.error('DB save error:', e.message); }
}

function getConfig(key, defaultValue) {
  return database.config[key] !== undefined ? database.config[key] : defaultValue;
}

function setConfig(key, value) {
  database.config[key] = String(value);
  saveDB();
}

function initConfig() {
  jwtSecret = getConfig('jwt_secret', null);
  if (!jwtSecret) {
    jwtSecret = crypto.randomBytes(32).toString('hex');
    setConfig('jwt_secret', jwtSecret);
  }
  const port = parseInt(getConfig('panel_port', '25580'), 10);
  config = {
    port,
    serverDir: getConfig('server_dir', SERVER_DIR),
    mcVersion: getConfig('mc_version', ''),
    mcType: getConfig('mc_type', 'vanilla'),
    mcLoader: getConfig('mc_loader', ''),
    serverIP: getConfig('server_ip', '0.0.0.0'),
    serverPort: parseInt(getConfig('server_port', '25565'), 10),
    maxPlayers: parseInt(getConfig('max_players', '20'), 10),
    onlineMode: getConfig('online_mode', 'true') === 'true',
    whitelistEnabled: getConfig('whitelist_enabled', 'false') === 'true'
  };
}

function initFirstRun() {
  if (database.users.length === 0) {
    const username = 'admin';
    const password = crypto.randomBytes(6).toString('hex');
    const hash = bcrypt.hashSync(password, 10);
    database.users.push({ id: 1, username, password_hash: hash, created_at: new Date().toISOString() });
    saveDB();
    console.log('');
    console.log('============================================');
    console.log('  JAB Panel - 首次运行');
    console.log('  管理员用户名: ' + username);
    console.log('  临时密码:     ' + password);
    console.log('  请尽快登录并在面板设置中修改密码！');
    console.log('============================================');
    console.log('');
    return { username, password };
  }
  return null;
}

function authMiddleware(req, res, next) {
  const pubPaths = ['/api/auth/login', '/api/auth/status', '/api/files/download', '/api/panel/logs/download', '/api/server/icon'];
  if (pubPaths.includes(req.path) || req.path.startsWith('/css/') || req.path.startsWith('/js/') || req.path === '/favicon.ico') {
    const tokQ = req.query.token;
    if (tokQ) {
      try { const p = jwt.verify(tokQ, jwtSecret); req.user = p; return next(); } catch (e) {}
    }
    return next();
  }
  if (!req.path.startsWith('/api/')) {
    const acceptJson = req.headers.accept && req.headers.accept.includes('application/json');
    if (!acceptJson) return next();
  }
  const authHeader = req.headers.authorization;
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return res.status(401).json({ error: '未授权访问' });
  }
  try {
    const payload = jwt.verify(authHeader.slice(7), jwtSecret);
    req.user = payload;
    next();
  } catch (e) {
    return res.status(401).json({ error: '令牌无效或已过期' });
  }
}

app.use(express.json({ limit: '10mb' }));
app.use(express.urlencoded({ extended: true, limit: '10mb' }));
app.use(express.static(path.join(ROOT_DIR, 'public')));
app.use(authMiddleware);

const apiRouter = express.Router();

apiRouter.post('/auth/login', (req, res) => {
  const { username, password } = req.body;
  if (!username || !password) return res.status(400).json({ error: '请输入用户名和密码' });
  const user = database.users.find(u => u.username === username);
  if (!user || !bcrypt.compareSync(password, user.password_hash)) {
    return res.status(401).json({ error: '用户名或密码错误' });
  }
  const token = jwt.sign({ id: user.id, username: user.username }, jwtSecret, { expiresIn: '24h' });
  res.json({ token, username: user.username });
});

apiRouter.get('/auth/status', (req, res) => {
  const authHeader = req.headers.authorization;
  if (!authHeader || !authHeader.startsWith('Bearer ')) return res.json({ loggedIn: false });
  try {
    const payload = jwt.verify(authHeader.slice(7), jwtSecret);
    res.json({ loggedIn: true, username: payload.username });
  } catch (e) { res.json({ loggedIn: false }); }
});

apiRouter.post('/panel/change-password', (req, res) => {
  const { oldPassword, newPassword } = req.body;
  if (!oldPassword || !newPassword) return res.status(400).json({ error: '请提供原密码和新密码' });
  const user = database.users.find(u => u.id === req.user.id);
  if (!bcrypt.compareSync(oldPassword, user.password_hash)) return res.status(400).json({ error: '原密码错误' });
  user.password_hash = bcrypt.hashSync(newPassword, 10);
  saveDB();
  res.json({ success: true });
});

apiRouter.post('/panel/change-username', (req, res) => {
  const { newUsername } = req.body;
  if (!newUsername) return res.status(400).json({ error: '请提供新用户名' });
  const existing = database.users.find(u => u.username === newUsername && u.id !== req.user.id);
  if (existing) return res.status(400).json({ error: '用户名已存在' });
  const user = database.users.find(u => u.id === req.user.id);
  user.username = newUsername;
  saveDB();
  res.json({ success: true, username: newUsername });
});

const serverManager = require('./src/server-manager');

apiRouter.get('/server/info', (req, res) => { res.json(serverManager.getServerInfo()); });
apiRouter.post('/server/start', (req, res) => { serverManager.start(); res.json({ success: true }); });
apiRouter.post('/server/stop', (req, res) => { serverManager.stop(); res.json({ success: true }); });

apiRouter.post('/server/restart', (req, res) => { serverManager.restart(); res.json({ success: true }); });

apiRouter.get('/server/console-buffer', (req, res) => {
  res.json({ buffer: serverManager.getConsoleBuffer() });
});

apiRouter.post('/server/command', (req, res) => {
  const { command } = req.body;
  if (!command || typeof command !== 'string') return res.status(400).json({ error: '无效命令' });
  const sanitized = command.replace(/[\r\n]/g, '').trim();
  if (!sanitized) return res.status(400).json({ error: '无效命令' });
  serverManager.sendCommand(sanitized);
  res.json({ success: true });
});

apiRouter.post('/files/create-file', (req, res) => {
  const { parentPath, fileName } = req.body;
  if (!fileName || /[<>:"|?*\\/]/.test(fileName)) return res.status(400).json({ error: '无效文件名' });
  const fullPath = path.join(config.serverDir, parentPath || '', fileName);
  if (!fullPath.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  fs.writeFileSync(fullPath, '', 'utf8');
  res.json({ success: true });
});

apiRouter.post('/files/copy', (req, res) => {
  const { source, dest } = req.body;
  const srcPath = path.join(config.serverDir, source || '');
  const destDir = path.join(config.serverDir, dest || '');
  if (!srcPath.startsWith(config.serverDir) || !destDir.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  if (!fs.existsSync(srcPath)) return res.status(400).json({ error: '源文件不存在' });
  const name = path.basename(srcPath);
  const destPath = path.join(destDir, name);
  if (fs.statSync(srcPath).isDirectory()) copyDirSync(srcPath, destPath);
  else fs.copyFileSync(srcPath, destPath);
  res.json({ success: true });
});

apiRouter.post('/files/move', (req, res) => {
  const { source, dest } = req.body;
  const srcPath = path.join(config.serverDir, source || '');
  const destDir = path.join(config.serverDir, dest || '');
  if (!srcPath.startsWith(config.serverDir) || !destDir.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  if (!fs.existsSync(srcPath)) return res.status(400).json({ error: '源文件不存在' });
  const name = path.basename(srcPath);
  const destPath = path.join(destDir, name);
  if (!fs.existsSync(destDir)) fs.mkdirSync(destDir, { recursive: true });
  fs.renameSync(srcPath, destPath);
  res.json({ success: true });
});

apiRouter.post('/files/compress', (req, res) => {
  const { filePath } = req.body;
  const fullPath = path.join(config.serverDir, filePath || '');
  if (!fullPath.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  if (!fs.existsSync(fullPath)) return res.status(400).json({ error: '文件不存在' });
  const name = path.basename(fullPath);
  const dest = fullPath + '.zip';
  try {
    execSync('cd "' + path.dirname(fullPath) + '" && zip -r -0 "' + dest + '" "' + name + '"', { stdio: 'pipe' });
    res.json({ success: true });
  } catch (e) { res.status(500).json({ error: '压缩失败: ' + e.message }); }
});

apiRouter.post('/files/compress-batch', (req, res) => {
  const { paths } = req.body;
  if (!paths || !paths.length) return res.status(400).json({ error: '请提供文件列表' });
  const parentDir = path.dirname(path.join(config.serverDir, paths[0]));
  const names = paths.map(p => '"' + path.basename(p) + '"').join(' ');
  const dest = path.join(parentDir, 'archive_' + Date.now() + '.zip');
  try {
    execSync('cd "' + parentDir + '" && zip -r -0 "' + dest + '" ' + names, { stdio: 'pipe' });
    res.json({ success: true });
  } catch (e) { res.status(500).json({ error: '压缩失败: ' + e.message }); }
});

apiRouter.post('/files/extract', (req, res) => {
  const { filePath } = req.body;
  const fullPath = path.join(config.serverDir, filePath || '');
  if (!fullPath.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  if (!fs.existsSync(fullPath) || !fullPath.toLowerCase().endsWith('.zip')) return res.status(400).json({ error: '非zip文件' });
  const destDir = path.dirname(fullPath);
  try {
    execSync('unzip -o "' + fullPath + '" -d "' + destDir + '"', { stdio: 'pipe' });
    res.json({ success: true });
  } catch (e) { res.status(500).json({ error: '解压失败: ' + e.message }); }
});

apiRouter.post('/files/delete-batch', (req, res) => {
  const { paths } = req.body;
  if (!paths || !paths.length) return res.status(400).json({ error: '请提供文件列表' });
  paths.forEach(p => {
    const fullPath = path.join(config.serverDir, p);
    if (!fullPath.startsWith(config.serverDir)) return;
    if (!fs.existsSync(fullPath)) return;
    const stat = fs.statSync(fullPath);
    stat.isDirectory() ? rmDirSync(fullPath) : fs.unlinkSync(fullPath);
  });
  res.json({ success: true });
});

apiRouter.get('/files/download', (req, res) => {
  const filePath = path.join(config.serverDir, req.query.path || '');
  if (!filePath.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  if (!fs.existsSync(filePath)) return res.status(404).json({ error: '文件不存在' });
  res.download(filePath);
});

apiRouter.get('/server/settings', (req, res) => {
  res.json({
    version: config.mcVersion || null,
    type: config.mcType,
    loader: config.mcLoader || null,
    ip: config.serverIP,
    port: config.serverPort,
    maxPlayers: config.maxPlayers,
    onlineMode: config.onlineMode,
    running: serverManager.isRunning(),
    ...database.server_properties
  });
});

apiRouter.post('/server/settings', (req, res) => {
  const { ip, port, maxPlayers, onlineMode, ...otherProps } = req.body;
  if (ip !== undefined) { config.serverIP = String(ip); setConfig('server_ip', config.serverIP); }
  if (port !== undefined) {
    const p = parseInt(port, 10);
    if (p >= 1 && p <= 65535) { config.serverPort = p; setConfig('server_port', String(p)); }
  }
  if (maxPlayers !== undefined) {
    const mp = parseInt(maxPlayers, 10);
    if (mp >= 1 && mp <= 99999) { config.maxPlayers = mp; setConfig('max_players', String(mp)); }
  }
  if (onlineMode !== undefined) { config.onlineMode = Boolean(onlineMode); setConfig('online_mode', String(config.onlineMode)); }
  Object.keys(otherProps).forEach(k => { database.server_properties[k] = String(otherProps[k]); });
  saveDB();
  serverManager.updateServerProperties();
  res.json({ success: true });
});

apiRouter.get('/players/list', (req, res) => {
  const online = serverManager.getOnlinePlayers();
  const ops = database.ops.map(o => o.player_name);
  const bans = database.banned_players.map(b => b.player_name);
  res.json({
    online,
    history: database.player_history.sort((a, b) => (b.last_joined || '').localeCompare(a.last_joined || '')),
    ops, bans,
    banIps: database.banned_ips
  });
});

apiRouter.get('/players/whitelist', (req, res) => {
  res.json({ enabled: config.whitelistEnabled, list: database.whitelist });
});

apiRouter.post('/players/whitelist/toggle', (req, res) => {
  config.whitelistEnabled = !config.whitelistEnabled;
  setConfig('whitelist_enabled', String(config.whitelistEnabled));
  serverManager.sendCommand(config.whitelistEnabled ? 'whitelist on' : 'whitelist off');
  res.json({ enabled: config.whitelistEnabled });
});

apiRouter.post('/players/whitelist/add', (req, res) => {
  const { playerName } = req.body;
  if (!playerName) return res.status(400).json({ error: '请提供玩家名' });
  if (database.whitelist.find(w => w.player_name === playerName)) return res.status(400).json({ error: '该玩家已在白名单中' });
  database.whitelist.push({ id: Date.now(), player_name: playerName });
  saveDB();
  serverManager.sendCommand('whitelist add ' + playerName);
  res.json({ success: true });
});

apiRouter.post('/players/whitelist/remove', (req, res) => {
  const { playerName } = req.body;
  database.whitelist = database.whitelist.filter(w => w.player_name !== playerName);
  saveDB();
  serverManager.sendCommand('whitelist remove ' + playerName);
  res.json({ success: true });
});

apiRouter.get('/players/blacklist', (req, res) => { res.json({ list: database.blacklist }); });

apiRouter.post('/players/blacklist/add', (req, res) => {
  const { target, type } = req.body;
  if (!target) return res.status(400).json({ error: '请提供目标' });
  if (database.blacklist.find(b => b.target === target)) return res.status(400).json({ error: '该目标已在黑名单中' });
  database.blacklist.push({ id: Date.now(), target, type: type || 'player' });
  saveDB();
  res.json({ success: true });
});

apiRouter.post('/players/blacklist/remove', (req, res) => {
  database.blacklist = database.blacklist.filter(b => b.target !== req.body.target);
  saveDB();
  res.json({ success: true });
});

apiRouter.post('/players/ban', (req, res) => {
  const { playerName, reason } = req.body;
  if (!playerName) return res.status(400).json({ error: '请提供玩家名' });
  if (!database.banned_players.find(b => b.player_name === playerName)) {
    database.banned_players.push({ id: Date.now(), player_name: playerName, reason: reason || '' });
    saveDB();
  }
  serverManager.sendCommand('ban ' + playerName + (reason ? ' ' + reason : ''));
  res.json({ success: true });
});

apiRouter.post('/players/ban-ip', (req, res) => {
  const { playerName, reason } = req.body;
  if (!playerName) return res.status(400).json({ error: '请提供玩家名' });
  serverManager.sendCommand('ban-ip ' + playerName + (reason ? ' ' + reason : ''));
  res.json({ success: true });
});

apiRouter.post('/players/unban', (req, res) => {
  database.banned_players = database.banned_players.filter(b => b.player_name !== req.body.playerName);
  saveDB();
  serverManager.sendCommand('pardon ' + req.body.playerName);
  res.json({ success: true });
});

apiRouter.post('/players/op', (req, res) => {
  const { playerName } = req.body;
  if (!playerName) return res.status(400).json({ error: '请提供玩家名' });
  if (!database.ops.find(o => o.player_name === playerName)) {
    database.ops.push({ id: Date.now(), player_name: playerName });
    saveDB();
  }
  serverManager.sendCommand('op ' + playerName);
  res.json({ success: true });
});

apiRouter.post('/players/deop', (req, res) => {
  database.ops = database.ops.filter(o => o.player_name !== req.body.playerName);
  saveDB();
  serverManager.sendCommand('deop ' + req.body.playerName);
  res.json({ success: true });
});

apiRouter.post('/players/give-all', (req, res) => {
  const { item, amount } = req.body;
  if (!item) return res.status(400).json({ error: '请提供物品' });
  serverManager.getOnlinePlayers().forEach(p => {
    serverManager.sendCommand('give ' + p + ' ' + item + ' ' + (amount || 1));
  });
  res.json({ success: true });
});

apiRouter.post('/players/effect-all', (req, res) => {
  const { effect, duration, amplifier } = req.body;
  if (!effect) return res.status(400).json({ error: '请提供效果' });
  serverManager.getOnlinePlayers().forEach(p => {
    serverManager.sendCommand('effect give ' + p + ' ' + effect + ' ' + (duration || 30) + ' ' + (amplifier || 0));
  });
  res.json({ success: true });
});

apiRouter.post('/players/:name/give', (req, res) => {
  const { item, amount } = req.body;
  serverManager.sendCommand('give ' + req.params.name + ' ' + item + ' ' + (amount || 1));
  res.json({ success: true });
});

apiRouter.post('/players/:name/effect', (req, res) => {
  const { effect, duration, amplifier } = req.body;
  if (!effect) return res.status(400).json({ error: '请提供效果' });
  serverManager.sendCommand('effect give ' + req.params.name + ' ' + effect + ' ' + (duration || 30) + ' ' + (amplifier || 0));
  res.json({ success: true });
});

apiRouter.post('/players/:name/clear-effect', (req, res) => {
  const { effect } = req.body;
  serverManager.sendCommand(effect ? 'effect clear ' + req.params.name + ' ' + effect : 'effect clear ' + req.params.name);
  res.json({ success: true });
});

apiRouter.post('/players/:name/clear-inventory', (req, res) => {
  serverManager.sendCommand('clear ' + req.params.name);
  res.json({ success: true });
});

apiRouter.post('/players/:name/kick', (req, res) => {
  serverManager.sendCommand('kick ' + req.params.name);
  res.json({ success: true });
});

apiRouter.get('/players/:name/inventory', (req, res) => {
  serverManager.sendCommandAndWait('data get entity ' + req.params.name + ' Inventory')
    .then(out => res.json({ result: out }))
    .catch(() => res.json({ result: '查询失败' }));
});

apiRouter.get('/players/:name/uuid', (req, res) => {
  serverManager.sendCommandAndWait('data get entity ' + req.params.name)
    .then(out => {
      const uuidMatch = out.match(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i);
      res.json({ result: out, uuid: uuidMatch ? uuidMatch[0] : null });
    })
    .catch(() => res.json({ result: '查询失败' }));
});

apiRouter.post('/players/:name/clear-data', (req, res) => {
  serverManager.sendCommand('advancement revoke ' + req.params.name + ' everything');
  serverManager.sendCommand('effect clear ' + req.params.name);
  serverManager.sendCommand('clear ' + req.params.name);
  res.json({ success: true });
});

apiRouter.get('/world/gamerules', (req, res) => {
  res.json({
    disableElytraMovementCheck: getConfig('grule_disableElytraMovementCheck', 'false') !== 'false',
    doImmediateRespawn: getConfig('grule_doImmediateRespawn', 'false') !== 'false',
    doLimitedCrafting: getConfig('grule_doLimitedCrafting', 'false') !== 'false',
    drowningDamage: getConfig('grule_drowningDamage', 'true') !== 'false',
    fallDamage: getConfig('grule_fallDamage', 'true') !== 'false',
    fireDamage: getConfig('grule_fireDamage', 'true') !== 'false',
    freezeDamage: getConfig('grule_freezeDamage', 'true') !== 'false',
    naturalRegeneration: getConfig('grule_naturalRegeneration', 'true') !== 'false',
    keepInventory: getConfig('grule_keepInventory', 'false') !== 'false',
    playersSleepingPercentage: parseInt(getConfig('grule_playersSleepingPercentage', '100'), 10),
    spawnRadius: parseInt(getConfig('grule_spawnRadius', '10'), 10),
    spectatorsGenerateChunks: getConfig('grule_spectatorsGenerateChunks', 'true') !== 'false',
    disableRaids: getConfig('grule_disableRaids', 'false') !== 'false',
    forgiveDeadPlayers: getConfig('grule_forgiveDeadPlayers', 'true') !== 'false',
    maxEntityCramming: parseInt(getConfig('grule_maxEntityCramming', '24'), 10),
    mobGriefing: getConfig('grule_mobGriefing', 'true') !== 'false',
    universalAnger: getConfig('grule_universalAnger', 'false') !== 'false',
    doInsomnia: getConfig('grule_doInsomnia', 'true') !== 'false',
    doMobSpawning: getConfig('grule_doMobSpawning', 'true') !== 'false',
    doPatrolSpawning: getConfig('grule_doPatrolSpawning', 'true') !== 'false',
    doTraderSpawning: getConfig('grule_doTraderSpawning', 'true') !== 'false',
    doWardenSpawning: getConfig('grule_doWardenSpawning', 'true') !== 'false',
    blockExplosionDropDecay: getConfig('grule_blockExplosionDropDecay', 'true') !== 'false',
    doMobLoot: getConfig('grule_doMobLoot', 'true') !== 'false',
    doTileDrops: getConfig('grule_doTileDrops', 'true') !== 'false',
    mobExplosionDropDecay: getConfig('grule_mobExplosionDropDecay', 'true') !== 'false',
    tntExplosionDropDecay: getConfig('grule_tntExplosionDropDecay', 'false') !== 'false',
    doDaylightCycle: getConfig('grule_doDaylightCycle', 'true') !== 'false',
    doFireTick: getConfig('grule_doFireTick', 'true') !== 'false',
    doVinesSpread: getConfig('grule_doVinesSpread', 'true') !== 'false',
    doWeatherCycle: getConfig('grule_doWeatherCycle', 'true') !== 'false',
    lavaSourceConversion: getConfig('grule_lavaSourceConversion', 'false') !== 'false',
    randomTickSpeed: parseInt(getConfig('grule_randomTickSpeed', '3'), 10),
    snowAccumulationHeight: parseInt(getConfig('grule_snowAccumulationHeight', '1'), 10),
    waterSourceConversion: getConfig('grule_waterSourceConversion', 'true') !== 'false',
    announceAdvancements: getConfig('grule_announceAdvancements', 'true') !== 'false',
    commandBlockOutput: getConfig('grule_commandBlockOutput', 'true') !== 'false',
    logAdminCommands: getConfig('grule_logAdminCommands', 'true') !== 'false',
    sendCommandFeedback: getConfig('grule_sendCommandFeedback', 'true') !== 'false',
    showDeathMessages: getConfig('grule_showDeathMessages', 'true') !== 'false',
    maxCommandChainLength: parseInt(getConfig('grule_maxCommandChainLength', '65536'), 10),
    globalSoundEvents: getConfig('grule_globalSoundEvents', 'true') !== 'false',
    maxCommandForkCount: parseInt(getConfig('grule_maxCommandForkCount', '65536'), 10),
    reducedDebugInfo: getConfig('grule_reducedDebugInfo', 'false') !== 'false'
  });
});

apiRouter.post('/world/gamerules', (req, res) => {
  const propsGamerules = ['playersSleepingPercentage', 'spawnRadius', 'maxEntityCramming', 'randomTickSpeed', 'snowAccumulationHeight', 'maxCommandChainLength', 'maxCommandForkCount'];
  Object.keys(req.body).forEach(k => {
    const val = req.body[k];
    setConfig('grule_' + k, String(val));
    if (propsGamerules.includes(k)) {
      const propMap = {
        playersSleepingPercentage: 'player-sleeping-percentage',
        spawnRadius: 'spawn-protection',
        maxEntityCramming: 'max-entity-cramming',
        randomTickSpeed: 'random-tick-speed',
        snowAccumulationHeight: 'snow-accumulation-height',
        maxCommandChainLength: 'max-command-chain-length',
        maxCommandForkCount: 'max-command-fork-count'
      };
      const propPath = path.join(config.serverDir, 'server.properties');
      if (fs.existsSync(propPath)) {
        let content = fs.readFileSync(propPath, 'utf8');
        const key = propMap[k] || k;
        const re = new RegExp('^' + key + '=.*$', 'm');
        if (re.test(content)) content = content.replace(re, key + '=' + val);
        else content += '\n' + key + '=' + val;
        fs.writeFileSync(propPath, content, 'utf8');
      }
    } else {
      const mcKey = k.replace(/([A-Z])/g, '_$1').toLowerCase().replace(/^_/, '');
      serverManager.sendCommand('gamerule ' + mcKey + ' ' + (typeof val === 'boolean' ? val : val));
    }
  });
  res.json({ success: true, restartRequired: propsGamerules.some(k => req.body[k] !== undefined) });
});

apiRouter.post('/world/weather', (req, res) => {
  const { weather } = req.body;
  if (!['clear', 'rain', 'thunder'].includes(weather)) return res.status(400).json({ error: '无效天气类型' });
  serverManager.sendCommand('weather ' + weather);
  res.json({ success: true });
});

apiRouter.post('/world/time', (req, res) => {
  const { time } = req.body;
  if (time === 'day') serverManager.sendCommand('time set day');
  else if (time === 'night') serverManager.sendCommand('time set night');
  else if (time === 'noon') serverManager.sendCommand('time set noon');
  else if (time === 'midnight') serverManager.sendCommand('time set midnight');
  else if (!isNaN(parseInt(time))) serverManager.sendCommand('time set ' + parseInt(time));
  else return res.status(400).json({ error: '无效时间' });
  res.json({ success: true });
});

apiRouter.post('/world/import', (req, res) => {
  const { worldName } = req.body;
  const srcDir = path.join(config.serverDir, worldName || 'world');
  if (!fs.existsSync(srcDir)) return res.status(400).json({ error: '世界目录不存在' });
  const destDir = path.join(config.serverDir, (worldName || 'world') + '_imported_' + Date.now());
  copyDirSync(srcDir, destDir);
  res.json({ success: true, path: destDir });
});

apiRouter.post('/world/backup', (req, res) => {
  const { worldName, dimension } = req.body;
  const dimMap = { overworld: '', nether: 'DIM-1', end: 'DIM1' };
  const srcName = worldName || 'world';
  const dimPath = dimension ? dimMap[dimension] || '' : '';
  const srcDir = dimPath ? path.join(config.serverDir, srcName, dimPath) : path.join(config.serverDir, srcName);
  if (!fs.existsSync(srcDir)) return res.status(400).json({ error: '目录不存在' });
  const backupDir = path.join(ROOT_DIR, 'backups', srcName + '_' + (dimension || 'full') + '_' + Date.now());
  fs.mkdirSync(backupDir, { recursive: true });
  copyDirSync(srcDir, backupDir);
  res.json({ success: true, path: backupDir });
});

apiRouter.post('/world/delete', (req, res) => {
  const { worldName, dimension } = req.body;
  const dimMap = { overworld: '', nether: 'DIM-1', end: 'DIM1' };
  const srcName = worldName || 'world';
  const dimPath = dimension ? dimMap[dimension] || '' : '';
  const targetDir = dimPath ? path.join(config.serverDir, srcName, dimPath) : path.join(config.serverDir, srcName);
  if (!fs.existsSync(targetDir)) return res.status(400).json({ error: '目录不存在' });
  if (!targetDir.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  serverManager.sendCommand('save-all');
  setTimeout(() => { rmDirSync(targetDir); res.json({ success: true }); }, 2000);
});

apiRouter.get('/mods', (req, res) => {
  const modsDir = path.join(config.serverDir, 'mods');
  let files = [];
  if (fs.existsSync(modsDir)) files = fs.readdirSync(modsDir).filter(f => f.endsWith('.jar'));
  res.json({ mods: database.mods, files, canMod: config.mcLoader === 'forge' || config.mcLoader === 'fabric' });
});

apiRouter.post('/mods/enable', (req, res) => {
  const modsDir = path.join(config.serverDir, 'mods');
  const srcPath = path.join(modsDir, req.body.filename);
  const disabledPath = path.join(modsDir, req.body.filename + '.disabled');
  if (fs.existsSync(disabledPath)) fs.renameSync(disabledPath, srcPath);
  const mod = database.mods.find(m => m.filename === req.body.filename);
  if (mod) { mod.enabled = 1; saveDB(); }
  res.json({ success: true });
});

apiRouter.post('/mods/disable', (req, res) => {
  const modsDir = path.join(config.serverDir, 'mods');
  const srcPath = path.join(modsDir, req.body.filename);
  const disabledPath = path.join(modsDir, req.body.filename + '.disabled');
  if (fs.existsSync(srcPath)) fs.renameSync(srcPath, disabledPath);
  const mod = database.mods.find(m => m.filename === req.body.filename);
  if (mod) { mod.enabled = 0; saveDB(); }
  res.json({ success: true });
});

apiRouter.post('/mods/delete', (req, res) => {
  const modsDir = path.join(config.serverDir, 'mods');
  const filePath = path.join(modsDir, req.body.filename);
  if (!filePath.startsWith(modsDir)) return res.status(403).json({ error: '越权操作' });
  if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
  const dp = path.join(modsDir, req.body.filename + '.disabled');
  if (fs.existsSync(dp)) fs.unlinkSync(dp);
  database.mods = database.mods.filter(m => m.filename !== req.body.filename);
  saveDB();
  res.json({ success: true });
});

apiRouter.post('/mods/upload', (req, res) => {
  const modsDir = path.join(config.serverDir, 'mods');
  if (!fs.existsSync(modsDir)) fs.mkdirSync(modsDir, { recursive: true });
  const bb = Busboy({ headers: req.headers, limits: { fileSize: 500 * 1024 * 1024 } });
  bb.on('file', (fieldname, file, info) => {
    const fname = info.filename;
    const dest = fs.createWriteStream(path.join(modsDir, fname));
    file.pipe(dest);
    file.on('end', () => {
      if (!database.mods.find(m => m.filename === fname)) {
        database.mods.push({ id: Date.now(), filename: fname, display_name: fname, enabled: 1, added_at: new Date().toISOString() });
        saveDB();
      }
    });
  });
  bb.on('close', () => res.json({ success: true }));
  bb.on('error', (err) => res.status(400).json({ error: err.message }));
  req.pipe(bb);
});

apiRouter.get('/files', (req, res) => {
  const subPath = req.query.path || '';
  const fullPath = path.join(config.serverDir, subPath);
  if (!fullPath.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  if (!fs.existsSync(fullPath)) return res.json({ path: subPath, entries: [] });
  const entries = fs.readdirSync(fullPath, { withFileTypes: true }).map(e => {
    const stat = fs.statSync(path.join(fullPath, e.name));
    return { name: e.name, isDirectory: e.isDirectory(), size: stat.size, modified: stat.mtime };
  });
  res.json({ path: subPath, entries });
});

apiRouter.post('/files/create-dir', (req, res) => {
  const { parentPath, dirName } = req.body;
  if (!dirName || /[<>:"|?*\\/]/.test(dirName)) return res.status(400).json({ error: '无效目录名' });
  const fullPath = path.join(config.serverDir, parentPath || '', dirName);
  if (!fullPath.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  fs.mkdirSync(fullPath, { recursive: true });
  res.json({ success: true });
});

apiRouter.post('/files/delete', (req, res) => {
  const fullPath = path.join(config.serverDir, req.body.filePath || '');
  if (!fullPath.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  if (!fs.existsSync(fullPath)) return res.status(400).json({ error: '路径不存在' });
  const stat = fs.statSync(fullPath);
  stat.isDirectory() ? rmDirSync(fullPath) : fs.unlinkSync(fullPath);
  res.json({ success: true });
});

apiRouter.post('/files/rename', (req, res) => {
  const { filePath, newName } = req.body;
  if (!newName || /[<>:"|?*\\/]/.test(newName)) return res.status(400).json({ error: '无效名称' });
  const fullPath = path.join(config.serverDir, filePath || '');
  if (!fullPath.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  const newPath = path.join(path.dirname(fullPath), newName);
  if (!newPath.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  fs.renameSync(fullPath, newPath);
  res.json({ success: true });
});

apiRouter.post('/files/upload', (req, res) => {
  const reqPath = req.headers['x-upload-path'] || '';
  const uploadPath = path.join(config.serverDir, reqPath);
  if (!uploadPath.startsWith(config.serverDir)) return res.status(403).json({ error: '越权操作' });
  if (!fs.existsSync(uploadPath)) fs.mkdirSync(uploadPath, { recursive: true });
  const bb = Busboy({ headers: req.headers, limits: { fileSize: 1024 * 1024 * 1024 } });
  bb.on('file', (fieldname, file, info) => {
    const dest = fs.createWriteStream(path.join(uploadPath, info.filename));
    file.pipe(dest);
  });
  bb.on('close', () => res.json({ success: true }));
  bb.on('error', (err) => res.status(400).json({ error: err.message }));
  req.pipe(bb);
});

apiRouter.get('/install/versions', (req, res) => {
  require('./src/install').getVersions().then(v => res.json(v)).catch(() => res.json([]));
});

apiRouter.get('/install/forge-versions', (req, res) => {
  require('./src/install').getForgeVersions(req.query.mc).then(v => res.json(v)).catch(() => res.json([]));
});

apiRouter.get('/install/fabric-versions', (req, res) => {
  require('./src/install').getFabricVersions().then(v => res.json(v)).catch(() => res.json([]));
});

apiRouter.get('/install/bedrock-versions', (req, res) => {
  require('./src/install').getBedrockVersions().then(v => res.json(v)).catch(() => res.json([]));
});

apiRouter.get('/install/modpacks', (req, res) => {
  const { source, search, version, page } = req.query;
  require('./src/install').searchModpacks(source || 'modrinth', search || '', version || '', parseInt(page) || 0)
    .then(r => res.json(r)).catch(() => res.json([]));
});

apiRouter.get('/install/mods-list', (req, res) => {
  const { source, search, version, loader, page } = req.query;
  require('./src/install').searchMods(source || 'modrinth', search || '', version || '', loader || '', parseInt(page) || 0)
    .then(r => res.json(r)).catch(() => res.json([]));
});

apiRouter.post('/install/download', (req, res) => {
  const installModule = require('./src/install');
  const { type, url, version, loader, filename } = req.body;
  installModule.downloadAndInstall({ type, url, version, loader, filename }, config.serverDir, (progress) => {
    wss.clients.forEach(client => {
      if (client.readyState === WebSocket.OPEN) client.send(JSON.stringify({ type: 'install_progress', ...progress }));
    });
  }).then(result => {
    if (type === 'minecraft') {
      if (loader === 'bedrock') {
        installModule.configureServer(config.serverDir, version, 'bedrock', config.serverPort || 19132, config.maxPlayers, config.onlineMode, config.serverIP);
        setConfig('mc_version', version);
        setConfig('mc_type', 'bedrock');
        setConfig('mc_loader', 'bedrock');
        config.mcVersion = version;
        config.mcType = 'bedrock';
        config.mcLoader = 'bedrock';
      } else {
        installModule.configureServer(config.serverDir, version, loader, config.serverPort || 25565, config.maxPlayers, config.onlineMode, config.serverIP);
        setConfig('mc_version', version);
        setConfig('mc_type', loader ? 'modded' : 'vanilla');
        setConfig('mc_loader', loader || '');
        config.mcVersion = version;
        config.mcType = loader ? 'modded' : 'vanilla';
        config.mcLoader = loader || '';
      }
      database.installed_versions.push({
        id: Date.now(),
        version: version,
        type: loader === 'bedrock' ? 'bedrock' : (loader ? 'modded' : 'vanilla'),
        loader: loader || null,
        path: config.serverDir,
        installed_at: new Date().toISOString()
      });
      saveDB();
    }
    if (type === 'mod') {
      const modsDir = path.join(config.serverDir, 'mods');
      if (!fs.existsSync(modsDir)) fs.mkdirSync(modsDir, { recursive: true });
      database.mods.push({ id: Date.now(), filename: filename || 'mod.jar', display_name: filename || 'mod.jar', enabled: 1, added_at: new Date().toISOString() });
      saveDB();
    }
    res.json(result);
  }).catch(err => res.status(500).json({ error: err.message }));
});

apiRouter.get('/install/installed', (req, res) => {
  res.json(database.installed_versions.sort((a, b) => (b.installed_at || '').localeCompare(a.installed_at || '')));
});

apiRouter.get('/panel/logs', (req, res) => {
  const { period } = req.query;
  const logsDir = path.join(ROOT_DIR, 'logs');
  const now = Date.now();
  let startTime = 0;
  switch (period) {
    case 'today': startTime = now - 86400000; break;
    case 'yesterday': startTime = now - 172800000; break;
    case '3days': startTime = now - 259200000; break;
    case '7days': startTime = now - 604800000; break;
    case '30days': startTime = now - 2592000000; break;
  }
  const logs = [];
  if (fs.existsSync(logsDir)) {
    fs.readdirSync(logsDir).forEach(f => {
      const fPath = path.join(logsDir, f);
      const stat = fs.statSync(fPath);
      if (!startTime || stat.mtimeMs >= startTime) logs.push({ name: f, size: stat.size, modified: stat.mtime });
    });
  }
  const panelLogPath = path.join(DATA_DIR, 'panel.log');
  if (fs.existsSync(panelLogPath)) {
    const stat = fs.statSync(panelLogPath);
    if (!startTime || stat.mtimeMs >= startTime) logs.push({ name: 'panel.log', size: stat.size, modified: stat.mtime, path: panelLogPath });
  }
  res.json({ logs });
});

apiRouter.get('/panel/logs/download', (req, res) => {
  const logsDir = path.join(ROOT_DIR, 'logs');
  let filePath = path.join(logsDir, req.query.name);
  if (!fs.existsSync(filePath)) filePath = path.join(DATA_DIR, req.query.name);
  if (!fs.existsSync(filePath) || !filePath.startsWith(ROOT_DIR)) return res.status(404).json({ error: '日志文件不存在' });
  res.download(filePath);
});

apiRouter.post('/panel/logs/delete', (req, res) => {
  const logsDir = path.join(ROOT_DIR, 'logs');
  (req.body.names || []).forEach(name => {
    const fPath = path.join(logsDir, name);
    if (fs.existsSync(fPath) && fPath.startsWith(logsDir)) fs.unlinkSync(fPath);
  });
  res.json({ success: true });
});

apiRouter.post('/world/dimension', (req, res) => {
  const { dimension, type } = req.body;
  if (!['default', 'flat'].includes(type)) return res.status(400).json({ error: '无效类型' });
  const levelType = type === 'flat' ? 'FLAT' : 'DEFAULT';
  const propPath = path.join(config.serverDir, 'server.properties');
  if (fs.existsSync(propPath)) {
    let content = fs.readFileSync(propPath, 'utf8');
    const re = /^level-type=.*$/m;
    if (re.test(content)) content = content.replace(re, 'level-type=' + levelType);
    else content += '\nlevel-type=' + levelType;
    fs.writeFileSync(propPath, content, 'utf8');
    serverManager.sendCommand('save-all');
    res.json({ success: true, message: '需重启服务器后生效' });
  } else {
    res.status(400).json({ error: 'server.properties 不存在' });
  }
});

apiRouter.post('/server/icon', (req, res) => {
  const bb = Busboy({ headers: req.headers, limits: { fileSize: 1024 * 1024 } });
  bb.on('file', (fieldname, file, info) => {
    const dest = fs.createWriteStream(path.join(config.serverDir, 'server-icon.png'));
    file.pipe(dest);
  });
  bb.on('close', () => res.json({ success: true }));
  bb.on('error', (err) => res.status(400).json({ error: err.message }));
  req.pipe(bb);
});

apiRouter.get('/server/icon', (req, res) => {
  const iconPath = path.join(config.serverDir, 'server-icon.png');
  if (fs.existsSync(iconPath)) res.sendFile(iconPath);
  else res.status(404).json({ error: '无图标' });
});

apiRouter.post('/server/motd', (req, res) => {
  const { motd } = req.body;
  if (!motd) return res.status(400).json({ error: '请提供MOTD' });
  const propPath = path.join(config.serverDir, 'server.properties');
  if (fs.existsSync(propPath)) {
    let content = fs.readFileSync(propPath, 'utf8');
    const re = /^motd=.*$/m;
    if (re.test(content)) content = content.replace(re, 'motd=' + motd);
    else content += '\nmotd=' + motd;
    fs.writeFileSync(propPath, content, 'utf8');
    serverManager.updateServerProperties();
    res.json({ success: true });
  } else {
    res.status(400).json({ error: 'server.properties 不存在' });
  }
});

apiRouter.post('/players/:name/gamemode', (req, res) => {
  const { gamemode } = req.body;
  if (!['survival', 'creative', 'adventure', 'spectator'].includes(gamemode)) return res.status(400).json({ error: '无效模式' });
  serverManager.sendCommand('gamemode ' + gamemode + ' ' + req.params.name);
  res.json({ success: true });
});

apiRouter.post('/players/gamemode-all', (req, res) => {
  const { gamemode } = req.body;
  if (!['survival', 'creative', 'adventure', 'spectator'].includes(gamemode)) return res.status(400).json({ error: '无效模式' });
  serverManager.sendCommand('defaultgamemode ' + gamemode);
  serverManager.getOnlinePlayers().forEach(p => {
    serverManager.sendCommand('gamemode ' + gamemode + ' ' + p);
  });
  res.json({ success: true });
});

apiRouter.get('/panel/backups', (req, res) => {
  const backupDir = getConfig('backup_dir', path.join(ROOT_DIR, 'backups'));
  if (!fs.existsSync(backupDir)) { res.json({ backups: [], dir: backupDir }); return; }
  const entries = fs.readdirSync(backupDir).filter(f => f.endsWith('.zip') || fs.statSync(path.join(backupDir, f)).isDirectory());
  res.json({ backups: entries.map(e => ({ name: e, modified: fs.statSync(path.join(backupDir, e)).mtime })), dir: backupDir });
});

apiRouter.post('/panel/backups/create', (req, res) => {
  const backupDir = getConfig('backup_dir', path.join(ROOT_DIR, 'backups'));
  if (!fs.existsSync(backupDir)) fs.mkdirSync(backupDir, { recursive: true });
  serverManager.sendCommand('save-all');
  setTimeout(() => {
    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
    const dest = path.join(backupDir, 'backup_' + stamp + '.zip');
    try {
      execSync('cd "' + config.serverDir + '" && zip -r -0 "' + dest + '" . -x "*.zip"', { stdio: 'pipe' });
      const allBackups = fs.readdirSync(backupDir).filter(f => f.startsWith('backup_') && f.endsWith('.zip')).sort().reverse();
      if (allBackups.length > 3) {
        allBackups.slice(3).forEach(f => {
          try { fs.unlinkSync(path.join(backupDir, f)); } catch (e) {}
        });
      }
      res.json({ success: true, path: dest });
    } catch (e) {
      res.status(500).json({ error: '备份失败: ' + e.message });
    }
  }, 2000);
});

apiRouter.post('/panel/backups/config', (req, res) => {
  const { dir } = req.body;
  if (!dir) return res.status(400).json({ error: '请提供目录' });
  setConfig('backup_dir', dir);
  res.json({ success: true });
});

apiRouter.get('/panel/stats', (req, res) => {
  const cpus = require('os').cpus();
  let totalIdle = 0, totalTick = 0;
  cpus.forEach(cpu => { for (let t in cpu.times) totalTick += cpu.times[t]; totalIdle += cpu.times.idle; });
  const cpuUsage = ((1 - totalIdle / totalTick) * 100).toFixed(1);
  const totalMem = require('os').totalmem();
  const freeMem = require('os').freemem();
  res.json({
    cpu: cpuUsage,
    memory: { used: totalMem - freeMem, total: totalMem, free: freeMem, percentage: ((totalMem - freeMem) / totalMem * 100).toFixed(1) }
  });
});

function copyDirSync(src, dest) {
  fs.mkdirSync(dest, { recursive: true });
  fs.readdirSync(src).forEach(item => {
    const sp = path.join(src, item);
    const dp = path.join(dest, item);
    fs.statSync(sp).isDirectory() ? copyDirSync(sp, dp) : fs.copyFileSync(sp, dp);
  });
}

function rmDirSync(dir) {
  if (!fs.existsSync(dir)) return;
  fs.readdirSync(dir).forEach(item => {
    const p = path.join(dir, item);
    fs.statSync(p).isDirectory() ? rmDirSync(p) : fs.unlinkSync(p);
  });
  fs.rmdirSync(dir);
}

app.use('/api', apiRouter);

app.get('*', (req, res) => {
  if (req.path.startsWith('/api/')) return res.status(404).json({ error: 'Not Found' });
  res.sendFile(path.join(ROOT_DIR, 'public', 'index.html'));
});

function start() {
  if (!fs.existsSync(DATA_DIR)) fs.mkdirSync(DATA_DIR, { recursive: true });
  if (!fs.existsSync(SERVER_DIR)) fs.mkdirSync(SERVER_DIR, { recursive: true });
  if (!fs.existsSync(path.join(ROOT_DIR, 'logs'))) fs.mkdirSync(path.join(ROOT_DIR, 'logs'), { recursive: true });
  if (!fs.existsSync(path.join(ROOT_DIR, 'backups'))) fs.mkdirSync(path.join(ROOT_DIR, 'backups'), { recursive: true });

  loadDB();
  initConfig();
  initFirstRun();
  serverManager.init(config, wss, path.join(ROOT_DIR, 'logs'), database, saveDB);

  server.listen(config.port, () => {
    console.log('JAB Panel 已启动，端口: ' + config.port);
    console.log('访问地址: http://localhost:' + config.port);
  });
}

start();