Documentation

// ╔══════════════════════════════════════════════════════════════╗
// ║           GloxAuth SDK  —  C# Integration                    ║
// ║  NuGet: Install-Package Newtonsoft.Json                      ║
// ╚══════════════════════════════════════════════════════════════╝
using System;
using System.IO;
using System.Linq;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using Microsoft.Win32;
using Newtonsoft.Json;
using Newtonsoft.Json.Linq;

public static class GloxAuth
{
    private const string APP_NAME   = "YOUR_APP_NAME";       
    private const string APP_SECRET = "YOUR_APP_SECRET";    
    private const string API_URL = "https://wdwlvfbvatpacucozmhc.supabase.co/functions/v1/v1-auth";

    public static string GetHWID()
    {
        string hwid = "UNKNOWN";
        try {
            using (var key = Registry.LocalMachine.OpenSubKey(@"SOFTWARE\Microsoft\Cryptography")) {
                if (key != null) hwid = key.GetValue("MachineGuid")?.ToString() ?? "UNKNOWN";
            }
        } catch { }

        if (hwid == "UNKNOWN") hwid = Environment.MachineName + Environment.UserName;
        hwid = hwid.Replace("-", "").ToUpper();

        using (SHA256 sha = SHA256.Create()) {
            byte[] hash = sha.ComputeHash(Encoding.UTF8.GetBytes(hwid));
            return BitConverter.ToString(hash).Replace("-", "").ToUpper();
        }
    }

    public static async Task<bool> Login(string licenseKey)
    {
        try
        {
            string hwid = GetHWID();
            Console.WriteLine("[GloxAuth] Üretilen Bilgisayar Kimliği (HWID): " + hwid);
            
            string requestId = Guid.NewGuid().ToString("N").Substring(0, 16);
            string timestamp = DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString();

            var payload = new { type = "license", key = licenseKey, hwid = hwid, timestamp = timestamp };
            string payloadJson = JsonConvert.SerializeObject(payload);
            
            string encryptedPayload = Encrypt(payloadJson, APP_SECRET);
            string hmacSignature = SignHMAC(encryptedPayload, requestId, APP_SECRET);

            var requestBody = new {
                app_name = APP_NAME,
                payload = encryptedPayload,
                hmac = hmacSignature,
                request_id = requestId
            };

            using (var http = new HttpClient() { Timeout = TimeSpan.FromSeconds(10) })
            {
                var content = new StringContent(JsonConvert.SerializeObject(requestBody), Encoding.UTF8, "application/json");
                var response = await http.PostAsync(API_URL, content);
                string raw = await response.Content.ReadAsStringAsync();
                
                var json = JObject.Parse(raw);
                if (json["error"] != null) {
                    Console.WriteLine("[GloxAuth] Server Rejection: " + json["error"].ToString());
                    return false;
                }

                string serverHmac = SignHMAC(json["data"].ToString(), requestId, APP_SECRET);
                if (serverHmac != json["hmac"].ToString().ToLower()) {
                    Console.WriteLine("[GloxAuth] Server Spoofing Detected!");
                    return false;
                }

                string decryptedText = Decrypt(json["data"].ToString(), APP_SECRET);
                var responseData = JObject.Parse(decryptedText);

                bool success = responseData["success"]?.Value<bool>() ?? false;
                if (!success) {
                    Console.WriteLine("[GloxAuth] License Error: " + responseData["status"]?.ToString());
                }
                return success;
            }
        }
        catch (Exception ex)
        {
            Console.WriteLine("[GloxAuth] Connection Error: " + ex.Message);
            return false;
        }
    }

    private static string Encrypt(string text, string secret)
    {
        byte[] key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(secret));
        byte[] iv = new byte[16];
        using (var rng = new RNGCryptoServiceProvider()) rng.GetBytes(iv);
        using (Aes aes = Aes.Create())
        {
            aes.Key = key; aes.IV = iv; aes.Mode = CipherMode.CBC;
            using (var ms = new MemoryStream())
            {
                ms.Write(iv, 0, iv.Length);
                using (var cs = new CryptoStream(ms, aes.CreateEncryptor(), CryptoStreamMode.Write))
                {
                    byte[] bytes = Encoding.UTF8.GetBytes(text);
                    cs.Write(bytes, 0, bytes.Length);
                }
                return Convert.ToBase64String(ms.ToArray());
            }
        }
    }

    private static string Decrypt(string encrypted64, string secret)
    {
        byte[] data = Convert.FromBase64String(encrypted64);
        byte[] iv = data.Take(16).ToArray();
        byte[] ct = data.Skip(16).ToArray();
        byte[] key = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(secret));
        using (Aes aes = Aes.Create())
        {
            aes.Key = key; aes.IV = iv; aes.Mode = CipherMode.CBC;
            using (var dec = aes.CreateDecryptor())
            {
                byte[] res = dec.TransformFinalBlock(ct, 0, ct.Length);
                return Encoding.UTF8.GetString(res);
            }
        }
    }

    private static string SignHMAC(string data, string requestId, string secret)
    {
        using (var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret)))
        {
            byte[] hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(data + requestId));
            return BitConverter.ToString(hash).Replace("-", "").ToLower();
        }
    }
}

import os
import json
import uuid
import time
import hmac
import hashlib
import requests
import base64
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import padding

class GloxAuth:
    def __init__(self):
        self.app_name = "YOUR_APP_NAME"
        self.app_secret = "YOUR_APP_SECRET"
        self.api_url = "https://wdwlvfbvatpacucozmhc.supabase.co/functions/v1/v1-auth"

    def encrypt(self, plain_text):
        key = hashlib.sha256(self.app_secret.encode()).digest()
        iv = os.urandom(16)
        padder = padding.PKCS7(128).padder()
        padded_data = padder.update(plain_text.encode()) + padder.finalize()
        cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
        encryptor = cipher.encryptor()
        cipher_text = encryptor.update(padded_data) + encryptor.finalize()
        return base64.b64encode(iv + cipher_text).decode('utf-8')

    def decrypt(self, encrypted_data):
        data = base64.b64decode(encrypted_data)
        iv = data[:16]
        ct = data[16:]
        key = hashlib.sha256(self.app_secret.encode()).digest()
        cipher = Cipher(algorithms.AES(key), modes.CBC(iv), backend=default_backend())
        decryptor = cipher.decryptor()
        padded_data = decryptor.update(ct) + decryptor.finalize()
        unpadder = padding.PKCS7(128).unpadder()
        return (unpadder.update(padded_data) + unpadder.finalize()).decode('utf-8')

    def sign_hmac(self, data, req_id):
        raw = (data + req_id).encode('utf-8')
        return hmac.new(self.app_secret.encode('utf-8'), raw, hashlib.sha256).hexdigest()

    def login(self, license_key, hwid):
        req_id = uuid.uuid4().hex[:16]
        payload = json.dumps({"type": "license", "key": license_key, "hwid": hwid, "timestamp": str(int(time.time()))})
        
        enc_payload = self.encrypt(payload)
        signature = self.sign_hmac(enc_payload, req_id)

        try:
            req_data = {
                "app_name": self.app_name,
                "payload": enc_payload,
                "hmac": signature,
                "request_id": req_id
            }
            res = requests.post(self.api_url, json=req_data, timeout=10)
            res_json = res.json()
            
            if "error" in res_json:
                print(f"[GloxAuth] Server Rejection: {res_json['error']}")
                return False
                
            server_hmac = self.sign_hmac(res_json["data"], req_id)
            if server_hmac != res_json["hmac"].lower():
                print("[GloxAuth] Server Spoofing Detected!")
                return False
                
            dec_text = self.decrypt(res_json["data"])
            dec_data = json.loads(dec_text)
            
            if not dec_data.get("success"):
                print(f"[GloxAuth] License Error: {dec_data.get('status')}")
                return False
                
            print(f"[GloxAuth] Login Successful! Status: {dec_data.get('status')} | Level: {dec_data.get('level')}")
            return True
        except Exception as e:
            print(f"[GloxAuth] Connection Error: {str(e)}")
            return False