RCDT BOT — All-in-One Downloader, 35+ Document Converter & Anti-Pecah Studio

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Http;
use Symfony\Component\HttpFoundation\StreamedResponse;

class RcdtBotController extends Controller
{
    /**
     * RCDT Shield WAF: Blokir XSS, SQLi, Command Injection & Private IP SSRF
     */
    private function validateSafeUrl(string $url): bool
    {
        if (!filter_var($url, FILTER_VALIDATE_URL)) return false;
        $parsed = parse_url($url);
        $scheme = strtolower($parsed['scheme'] ?? '');
        $host   = strtolower($parsed['host'] ?? '');

        if (!in_array($scheme, ['http', 'https'], true)) return false;
        if (in_array($host, ['localhost', '127.0.0.1', '0.0.0.0', '169.254.169.254'], true)) return false;

        $ip = gethostbyname($host);
        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) === false) {
            return false;
        }
        return true;
    }

    /**
     * Sanitasi Nama File Wajib Berawalan rcdt_
     */
    private function buildRcdtFilename(string $tag, string $platform, string $ext): string
    {
        $cleanTag  = preg_replace('/[^a-zA-Z0-9_-]/', '', strtolower($tag)) ?: 'official';
        $cleanPlat = preg_replace('/[^a-zA-Z0-9]/', '', strtolower($platform)) ?: 'media';
        $cleanExt  = preg_replace('/[^a-zA-Z0-9]/', '', strtolower($ext)) ?: 'mp4';
        $uniqueId  = substr(str_shuffle('0123456789'), 0, 6);

        return "rcdt_{$cleanTag}_{$cleanPlat}_{$uniqueId}.{$cleanExt}";
    }

    /**
     * Direct Stream Download Tanpa Simpan di Disk Hosting (Zero VPS)
     */
    public function streamDownload(Request $request)
    {
        $url = trim((string) $request->query('url', ''));
        $tag = (string) $request->query('tag', 'official');
        $ext = (string) $request->query('ext', 'mp4');

        if (!$this->validateSafeUrl($url)) {
            return response()->json(['error' => 'RCDT WAF Shield: URL tidak aman atau diblokir.'], 403);
        }

        $filename = $this->buildRcdtFilename($tag, 'stream', $ext);

        return new StreamedResponse(function () use ($url) {
            $stream = fopen($url, 'rb');
            if ($stream) {
                while (!feof($stream)) {
                    echo fread($stream, 8192);
                    flush();
                }
                fclose($stream);
            }
        }, 200, [
            'Content-Type'              => 'application/octet-stream',
            'Content-Disposition'       => 'attachment; filename="' . $filename . '"',
            'X-Content-Type-Options'    => 'nosniff',
            'X-Frame-Options'           => 'DENY',
            'Cache-Control'             => 'no-store, no-cache, must-revalidate',
        ]);
    }
}