feat(uploader): add ryzencdn local-disk uploader (POST multipart + GET serve)

Shirokami-API source uploads to Ryzumi S3 (s3.ryzumi.vip) which is DNS-dead from this VPS. Implemented a local-disk uploader keeping the source's response shape {success, url, fileName, size}: - POST /uploader/ryzencdn (multipart 'file' field, magic-byte ext detection) - GET /uploader/file/{name} (path-traversal safe, MIME by extension) Files stored under /var/lib/scraper/uploads (owned by scraper user).
feat(stalk): add mobile-legends, free-fire, genshin, twitter, tiktok, instagram
2026-09-01 20:39:09 +07:00 · 2026-09-01 20:32:10 +07:00
11 changed files with 744 additions and 0 deletions
@@ -8,4 +8,5 @@ pub mod proxy;
 pub mod search;
 pub mod stalk;
 pub mod tools;
+pub mod uploader;
 pub mod weebs;
@@ -17,3 +17,45 @@ pub async fn youtube(username: &str) -> Result<Value, ScrapingError> {
        .await
        .map_err(ScrapingError::Http)
 }
+
+/// Mobile Legends player stalk.
+pub async fn mobile_legends(user_id: &str, zone_id: &str) -> Result<Value, ScrapingError> {
+    Repo::fetch_ml_stalk(user_id, zone_id)
+        .await
+        .map_err(ScrapingError::Http)
+}
+
+/// Free Fire player stalk.
+pub async fn free_fire(user_id: &str) -> Result<Value, ScrapingError> {
+    Repo::fetch_ff_stalk(user_id)
+        .await
+        .map_err(ScrapingError::Http)
+}
+
+/// Genshin Impact player stalk.
+pub async fn genshin(user_id: &str) -> Result<Value, ScrapingError> {
+    Repo::fetch_genshin_stalk(user_id)
+        .await
+        .map_err(ScrapingError::Http)
+}
+
+/// Twitter/X user stalk.
+pub async fn twitter(username: &str) -> Result<Value, ScrapingError> {
+    Repo::fetch_twitter_stalk(username)
+        .await
+        .map_err(ScrapingError::Http)
+}
+
+/// TikTok user stalk.
+pub async fn tiktok(username: &str) -> Result<Value, ScrapingError> {
+    Repo::fetch_tiktok_stalk(username)
+        .await
+        .map_err(ScrapingError::Http)
+}
+
+/// Instagram user stalk.
+pub async fn instagram(username: &str) -> Result<Value, ScrapingError> {
+    Repo::fetch_instagram_stalk(username)
+        .await
+        .map_err(ScrapingError::Http)
+}
@@ -0,0 +1,13 @@
+//! Application use-cases for the uploader.
+
+use crate::domain::error::ScrapingError;
+use crate::infrastructure::repository::uploader as Repo;
+use serde_json::Value;
+
+pub fn upload(buffer: &[u8], file_name: &str) -> Result<Value, ScrapingError> {
+    Repo::save_file(buffer, file_name).map_err(ScrapingError::Http)
+}
+
+pub fn serve(file_name: &str) -> Result<(Vec<u8>, String), ScrapingError> {
+    Repo::read_file(file_name).map_err(ScrapingError::Http)
+}
@@ -9,6 +9,7 @@ pub mod proxy;
 pub mod search;
 pub mod stalk;
 pub mod tools;
+pub mod uploader;
 pub mod weebs;

 pub use alqanime::AlqanimeRepository;
@@ -416,3 +416,359 @@ fn video_from_grid_video(gv: &Value) -> Value {
    }
    v
 }
+
+// ---------------------------------------------------------------------------
+// Mobile Legends — gempaytopup.com stalk (CSRF token + POST)
+// ---------------------------------------------------------------------------
+
+pub async fn fetch_ml_stalk(user_id: &str, zone_id: &str) -> Result<Value, String> {
+    // 1. GET to obtain CSRF token + cookies
+    let resp = http_client()
+        .client()
+        .get("https://www.gempaytopup.com")
+        .header(
+            USER_AGENT,
+            "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0 Safari/537.36",
+        )
+        .send()
+        .await
+        .map_err(|e| format!("HTTP: {}", e))?;
+    let cookies = resp
+        .headers()
+        .get_all("set-cookie")
+        .iter()
+        .map(|v| {
+            v.to_str()
+                .unwrap_or("")
+                .split(';')
+                .next()
+                .unwrap_or("")
+                .to_string()
+        })
+        .collect::<Vec<_>>()
+        .join("; ");
+    let body = resp.text().await.map_err(|e| format!("Body: {}", e))?;
+
+    let csrf_re = Regex::new(r#"<meta name="csrf-token" content="(.*?)">"#).unwrap();
+    let csrf = csrf_re
+        .captures(&body)
+        .and_then(|c| c.get(1))
+        .map(|m| m.as_str().to_string());
+
+    let (csrf, cookies) = match (csrf, cookies.is_empty()) {
+        (Some(c), false) => (c, cookies),
+        _ => return Ok(json!({"error": "Gagal mendapatkan CSRF token atau cookie."})),
+    };
+
+    // 2. POST stalk-ml
+    let payload = json!({"uid": user_id, "zone": zone_id});
+    let resp = http_client()
+        .client()
+        .post("https://www.gempaytopup.com/stalk-ml")
+        .header("X-CSRF-Token", &csrf)
+        .header("Content-Type", "application/json")
+        .header("Cookie", &cookies)
+        .json(&payload)
+        .send()
+        .await
+        .map_err(|e| format!("HTTP: {}", e))?;
+    let data: Value = resp.json().await.map_err(|e| format!("JSON: {}", e))?;
+    Ok(data)
+}
+
+// ---------------------------------------------------------------------------
+// Free Fire — freefirecommunity API
+// ---------------------------------------------------------------------------
+
+pub async fn fetch_ff_stalk(user_id: &str) -> Result<Value, String> {
+    let url = format!(
+        "https://discordbot.freefirecommunity.com/player_info_api?uid={}&region=id",
+        user_id
+    );
+    let resp = http_client()
+        .client()
+        .get(&url)
+        .header("Origin", "https://www.freefirecommunity.com")
+        .header(
+            "Referer",
+            "https://www.freefirecommunity.com/ff-account-info/",
+        )
+        .header(USER_AGENT, "Mozilla/5.0 (Linux; Android 10; K)")
+        .header("Accept", "/")
+        .send()
+        .await
+        .map_err(|e| format!("HTTP: {}", e))?;
+    if !resp.status().is_success() {
+        return Err(format!("HTTP {}", resp.status()));
+    }
+    let data: Value = resp.json().await.map_err(|e| format!("JSON: {}", e))?;
+
+    let safe = |v: &Value| -> Value {
+        if v.is_null() {
+            Value::String("N/A".into())
+        } else {
+            v.clone()
+        }
+    };
+    let arr_join = |v: &Value| -> Value {
+        v.as_array()
+            .map(|a| {
+                Value::String(
+                    a.iter()
+                        .filter_map(|x| x.as_str())
+                        .collect::<Vec<_>>()
+                        .join(", "),
+                )
+            })
+            .unwrap_or(Value::String("-".into()))
+    };
+    let fmt_time = |v: &Value| -> Value {
+        // unix timestamp -> YYYY-MM-DD (approx via chrono)
+        v.as_i64()
+            .map(|ts| {
+                use chrono::{TimeZone, Utc};
+                match Utc.timestamp_opt(ts, 0) {
+                    chrono::LocalResult::Single(dt) => {
+                        Value::String(dt.format("%Y-%m-%d %H:%M:%S").to_string())
+                    }
+                    _ => Value::String("N/A".into()),
+                }
+            })
+            .unwrap_or(Value::String("N/A".into()))
+    };
+
+    let d = &data["player_info"];
+    let b = &d["basicInfo"];
+    let c = &d["creditScoreInfo"];
+    let p = &d["petInfo"];
+    let prof = &d["profileInfo"];
+    let s = &d["socialInfo"];
+
+    // battle tags
+    let tags = s["battleTag"].as_array().cloned().unwrap_or_default();
+    let tag_counts = s["battleTagCount"].as_array().cloned().unwrap_or_default();
+    let battle_tags = if tags.is_empty() {
+        Value::String("N/A".into())
+    } else {
+        Value::String(
+            tags.iter()
+                .enumerate()
+                .map(|(i, t)| {
+                    let count = tag_counts.get(i).and_then(|v| v.as_i64()).unwrap_or(0);
+                    format!("{} ({}x)", t.as_str().unwrap_or(""), count)
+                })
+                .collect::<Vec<_>>()
+                .join("\n"),
+        )
+    };
+
+    Ok(json!({
+        "nickname": safe(&b["nickname"]),
+        "accountId": safe(&b["accountId"]),
+        "region": safe(&b["region"]),
+        "level": safe(&b["level"]),
+        "liked": safe(&b["liked"]),
+        "rank": safe(&b["rank"]),
+        "maxRank": safe(&b["maxRank"]),
+        "csRank": safe(&b["csRank"]),
+        "exp": safe(&b["exp"]),
+        "createAt": fmt_time(&b["createAt"]),
+        "lastLoginAt": fmt_time(&b["lastLoginAt"]),
+        "rankingPoints": safe(&b["rankingPoints"]),
+        "releaseVersion": safe(&b["releaseVersion"]),
+        "seasonId": safe(&b["seasonId"]),
+        "primeLevel": b["primeLevel"]["level"].is_null().then(|| Value::String("-".into())).unwrap_or_else(|| safe(&b["primeLevel"]["level"])),
+        "diamondCost": safe(&d["diamondCostRes"]["diamondCost"]),
+        "petName": safe(&p["name"]),
+        "petLevel": safe(&p["level"]),
+        "petExp": safe(&p["exp"]),
+        "petSkinId": safe(&p["skinId"]),
+        "petSkillId": safe(&p["selectedSkillId"]),
+        "avatarId": safe(&prof["avatarId"]),
+        "clothes": arr_join(&prof["clothes"]),
+        "equipedSkills": arr_join(&prof["equipedSkills"]),
+        "battleTags": battle_tags,
+        "language": safe(&s["language"]),
+        "rankShow": safe(&s["rankShow"]),
+        "signature": safe(&s["signature"]),
+        "creditScore": safe(&c["creditScore"]),
+        "rewardState": safe(&c["rewardState"]),
+        "bannerImage": format!("https://discordbot.freefirecommunity.com/banner_image_api?uid={}&region=id", user_id),
+        "outfitImage": format!("https://discordbot.freefirecommunity.com/outfit_image_api?uid={}&region=id", user_id),
+    }))
+}
+
+// ---------------------------------------------------------------------------
+// Genshin Impact — enka.network public API
+// ---------------------------------------------------------------------------
+
+pub async fn fetch_genshin_stalk(user_id: &str) -> Result<Value, String> {
+    let url = format!("https://enka.network/u/{}/__data.json", user_id);
+    let resp = http_client()
+        .client()
+        .get(&url)
+        .header(
+            USER_AGENT,
+            "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0 Safari/537.36",
+        )
+        .send()
+        .await
+        .map_err(|e| format!("HTTP: {}", e))?;
+    if resp.status() == reqwest::StatusCode::NOT_FOUND {
+        return Err("User tidak ditemukan".into());
+    }
+    if !resp.status().is_success() {
+        return Err(format!("HTTP {}", resp.status()));
+    }
+    let data: Value = resp.json().await.map_err(|e| format!("JSON: {}", e))?;
+    // Pass through the raw JSON (Enka __data.json is already structured).
+    Ok(data)
+}
+
+// ---------------------------------------------------------------------------
+// Twitter — fxtwitter API
+// ---------------------------------------------------------------------------
+
+pub async fn fetch_twitter_stalk(username: &str) -> Result<Value, String> {
+    let url = format!("https://api.fxtwitter.com/{}", username);
+    let resp = http_client()
+        .client()
+        .get(&url)
+        .header(
+            USER_AGENT,
+            "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/130.0 Safari/537.36",
+        )
+        .send()
+        .await
+        .map_err(|e| format!("HTTP: {}", e))?;
+    let data: Value = resp.json().await.map_err(|e| format!("JSON: {}", e))?;
+
+    // Transform to the source's shape
+    let u = &data["user"];
+    Ok(json!({
+        "message": data.get("message").cloned().unwrap_or(Value::Null),
+        "user": {
+            "id": u.get("id").cloned().unwrap_or(Value::Null),
+            "url": u.get("url").cloned().unwrap_or(Value::Null),
+            "screen_name": u.get("screen_name").cloned().unwrap_or(Value::Null),
+            "name": u.get("name").cloned().unwrap_or(Value::Null),
+            "location": u.get("location").cloned().unwrap_or(Value::Null),
+            "description": u.get("description").cloned().unwrap_or(Value::Null),
+            "followers": u.get("followers").cloned().unwrap_or(Value::Null),
+            "following": u.get("following").cloned().unwrap_or(Value::Null),
+            "likes": u.get("likes").cloned().unwrap_or(Value::Null),
+            "banner_url": u.get("banner_url").cloned().unwrap_or(Value::Null),
+            "avatar_url": u.get("avatar_url").cloned().unwrap_or(Value::Null),
+            "joined_at": u.get("joined").cloned().unwrap_or(Value::Null),
+            "website": u.get("website").cloned().unwrap_or(Value::Null),
+        }
+    }))
+}
+
+// ---------------------------------------------------------------------------
+// TikTok — __UNIVERSAL_DATA_FOR_REHYDRATION__ JSON (V1 direct, no browser)
+// ---------------------------------------------------------------------------
+
+pub async fn fetch_tiktok_stalk(username: &str) -> Result<Value, String> {
+    let url = format!("https://www.tiktok.com/@{username}?_t=ZS-8tHANz7ieoS&_r=1");
+    let resp = http_client()
+        .client()
+        .get(&url)
+        .header(USER_AGENT, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36")
+        .send()
+        .await
+        .map_err(|e| format!("HTTP: {}", e))?;
+    let html = resp.text().await.map_err(|e| format!("Body: {}", e))?;
+
+    // Extract __UNIVERSAL_DATA_FOR_REHYDRATION__ JSON
+    let marker = r#"__UNIVERSAL_DATA_FOR_REHYDRATION__"#;
+    let start = html.find(marker).ok_or("User tidak ditemukan")?;
+    let json_start = html[start..]
+        .find('>')
+        .map(|i| start + i + 1)
+        .ok_or("User tidak ditemukan")?;
+    let json_end = html[json_start..]
+        .find("</script>")
+        .map(|i| json_start + i)
+        .ok_or("User tidak ditemukan")?;
+    let json_str = &html[json_start..json_end];
+
+    let parsed: Value = serde_json::from_str(json_str).map_err(|e| format!("JSON: {}", e))?;
+    let user_info = parsed
+        .pointer("/__DEFAULT_SCOPE__/webapp.user-detail/userInfo/user")
+        .cloned()
+        .ok_or("User tidak ditemukan")?;
+    let stats = parsed
+        .pointer("/__DEFAULT_SCOPE__/webapp.user-detail/userInfo/stats")
+        .cloned()
+        .unwrap_or(Value::Null);
+
+    Ok(json!({
+        "userInfo": {
+            "id": user_info.get("id").cloned().unwrap_or(Value::Null),
+            "username": user_info.get("uniqueId").cloned().unwrap_or(Value::Null),
+            "name": user_info.get("nickname").cloned().unwrap_or(Value::Null),
+            "avatar": user_info.get("avatarLarger").cloned().unwrap_or(Value::Null),
+            "bio": user_info.get("signature").cloned().unwrap_or(Value::Null),
+            "verified": user_info.get("verified").cloned().unwrap_or(Value::Bool(false)),
+            "totalFollowers": stats.get("followerCount").cloned().unwrap_or(Value::from(0)),
+            "totalFollowing": stats.get("followingCount").cloned().unwrap_or(Value::from(0)),
+            "totalLikes": stats.get("heart").cloned().unwrap_or(Value::from(0)),
+            "totalVideos": stats.get("videoCount").cloned().unwrap_or(Value::from(0)),
+            "totalFriends": stats.get("friendCount").cloned().unwrap_or(Value::from(0)),
+        }
+    }))
+}
+
+// ---------------------------------------------------------------------------
+// Instagram — media.mollygram.com HTML scrape
+// ---------------------------------------------------------------------------
+
+pub async fn fetch_instagram_stalk(username: &str) -> Result<Value, String> {
+    let url = format!("https://media.mollygram.com/?url={}", urlencode(username));
+    let resp = http_client()
+        .client()
+        .get(&url)
+        .header("accept", "*/*")
+        .header("origin", "https://mollygram.com")
+        .header("referer", "https://mollygram.com/")
+        .header(USER_AGENT, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36")
+        .send()
+        .await
+        .map_err(|e| format!("HTTP: {}", e))?;
+    let body = resp.text().await.map_err(|e| format!("Body: {}", e))?;
+
+    let re = |pat: &str| -> Option<String> {
+        let rx = Regex::new(pat).ok()?;
+        rx.captures(&body)
+            .and_then(|c| c.get(1))
+            .map(|m| m.as_str().trim().to_string())
+    };
+
+    let avatar = re(r#"<img[^>]*class="[^"]*rounded-circle[^"]*"[^>]*src="([^"]+)""#)
+        .or_else(|| re(r#"<img[^>]*src="([^"]+)"[^>]*class="[^"]*rounded-circle[^"]*""#));
+    let uname = re(r#"<h4 class="mb-0">([^<]+)</h4>"#);
+    let fullname = re(r#"<p class="text-muted">([^<]+)</p>"#);
+    let bio = re(r#"<p class="text-dark"[^>]*>([^<]*)</p>"#);
+    let posts = re(r#"<span class="d-block h5 mb-0">([^<]+)</span>\s*<div[^>]*>\s*posts\s*</div>"#);
+    let followers =
+        re(r#"<span class="d-block h5 mb-0">([^<]+)</span>\s*<div[^>]*>\s*followers\s*</div>"#);
+    let following =
+        re(r#"<span class="d-block h5 mb-0">([^<]+)</span>\s*<div[^>]*>\s*following\s*</div>"#);
+
+    Ok(json!({
+        "avatar": avatar,
+        "name": fullname.unwrap_or_default(),
+        "username": uname.unwrap_or_else(|| username.to_string()),
+        "posts": posts.unwrap_or_default(),
+        "followers": followers.unwrap_or_default(),
+        "following": following.unwrap_or_default(),
+        "bio": bio.unwrap_or_default(),
+    }))
+}
+
+fn urlencode(s: &str) -> String {
+    s.replace('%', "%25")
+        .replace('&', "%26")
+        .replace('?', "%3F")
+}
@@ -0,0 +1,102 @@
+//! Infrastructure — Uploader utilities.
+//!
+//! The Shirokami-API source uploads to Ryzumi S3 (s3.ryzumi.vip) which is
+//! DNS-dead from this VPS. This implementation stores uploaded files to a
+//! local directory and serves them back, keeping the source's response shape:
+//! `{ success, url, fileName, size }`.
+
+use std::path::{Path, PathBuf};
+
+use fastrand;
+use serde_json::{json, Value};
+
+/// Directory where uploaded files are stored.
+const UPLOAD_DIR: &str = "/var/lib/scraper/uploads";
+
+/// Base URL prefix used in the returned `url` field.
+fn public_base() -> String {
+    "/uploader/file".to_string()
+}
+
+/// Save an uploaded buffer to disk with a random filename + detected extension.
+pub fn save_file(buffer: &[u8], file_name: &str) -> Result<Value, String> {
+    if buffer.is_empty() {
+        return Err("Invalid content: buffer is required".into());
+    }
+
+    let dir = PathBuf::from(UPLOAD_DIR);
+    std::fs::create_dir_all(&dir).map_err(|e| format!("mkdir: {e}"))?;
+
+    // Detect extension: prefer the provided filename, else infer from magic.
+    let extension = if file_name.contains('.') {
+        file_name.split('.').last().unwrap_or("").to_lowercase()
+    } else {
+        infer_extension(buffer).to_string()
+    };
+
+    if extension.is_empty() {
+        return Err("Unable to determine file extension".into());
+    }
+
+    let random = hex::encode(&fastrand::u64(..).to_le_bytes());
+    let key = format!("{random}.{extension}");
+    let path = dir.join(&key);
+
+    std::fs::write(&path, buffer).map_err(|e| format!("write: {e}"))?;
+
+    let url = format!("{}/{}", public_base(), key);
+    Ok(json!({
+        "success": true,
+        "url": url,
+        "fileName": key,
+        "size": buffer.len(),
+    }))
+}
+
+/// Serve the file bytes for a given filename.
+pub fn read_file(file_name: &str) -> Result<(Vec<u8>, String), String> {
+    // Prevent path traversal.
+    let safe = Path::new(file_name)
+        .file_name()
+        .and_then(|s| s.to_str())
+        .ok_or("invalid filename")?;
+    let path = PathBuf::from(UPLOAD_DIR).join(safe);
+    let bytes = std::fs::read(&path).map_err(|e| format!("read: {e}"))?;
+    let mime = infer_mime(safe).to_string();
+    Ok((bytes, mime))
+}
+
+fn infer_extension(buf: &[u8]) -> &'static str {
+    if buf.starts_with(b"\x89PNG\r\n\x1a\n") {
+        "png"
+    } else if buf.starts_with(b"\xff\xd8\xff") {
+        "jpg"
+    } else if buf.starts_with(b"GIF87a") || buf.starts_with(b"GIF89a") {
+        "gif"
+    } else if buf.starts_with(b"RIFF") && &buf[8..12] == b"WEBP" {
+        "webp"
+    } else if buf.starts_with(b"%PDF") {
+        "pdf"
+    } else if buf.starts_with(b"PK\x03\x04") {
+        "zip"
+    } else {
+        "bin"
+    }
+}
+
+fn infer_mime(name: &str) -> &'static str {
+    let ext = name.rsplit('.').next().unwrap_or("");
+    match ext {
+        "png" => "image/png",
+        "jpg" | "jpeg" => "image/jpeg",
+        "gif" => "image/gif",
+        "webp" => "image/webp",
+        "pdf" => "application/pdf",
+        "zip" => "application/zip",
+        "txt" => "text/plain",
+        "mp4" => "video/mp4",
+        "webm" => "video/webm",
+        "mp3" => "audio/mpeg",
+        _ => "application/octet-stream",
+    }
+}
@@ -9,4 +9,5 @@ pub mod proxy;
 pub mod search;
 pub mod stalk;
 pub mod tools;
+pub mod uploader;
 pub mod weebs;
@@ -42,3 +42,76 @@ pub async fn youtube_handler(
    let result = use_cases::youtube(&username).await?;
    Ok((StatusCode::OK, Json(result)))
 }
+
+/// GET /stalk/mobile-legends?user_id=...&zone_id=... (aliases: userid, zoneid)
+pub async fn mobile_legends_handler(
+    Query(params): Query<StalkParams>,
+) -> Result<(StatusCode, Json<Value>), AppError> {
+    let user_id = params
+        .user_id
+        .or(params.userid)
+        .ok_or_else(|| AppError::BadRequest("Missing 'user_id' parameter".to_string()))?;
+    let zone_id = params
+        .zone_id
+        .or(params.zoneid)
+        .ok_or_else(|| AppError::BadRequest("Missing 'zone_id' parameter".to_string()))?;
+    let result = use_cases::mobile_legends(&user_id, &zone_id).await?;
+    Ok((StatusCode::OK, Json(result)))
+}
+
+/// GET /stalk/free-fire?user_id=... (alias: userid)
+pub async fn free_fire_handler(
+    Query(params): Query<StalkParams>,
+) -> Result<(StatusCode, Json<Value>), AppError> {
+    let user_id = params
+        .user_id
+        .or(params.userid)
+        .ok_or_else(|| AppError::BadRequest("Missing 'user_id' parameter".to_string()))?;
+    let result = use_cases::free_fire(&user_id).await?;
+    Ok((StatusCode::OK, Json(result)))
+}
+
+/// GET /stalk/genshin-impact?user_id=... (alias: userid)
+pub async fn genshin_handler(
+    Query(params): Query<StalkParams>,
+) -> Result<(StatusCode, Json<Value>), AppError> {
+    let user_id = params
+        .user_id
+        .or(params.userid)
+        .ok_or_else(|| AppError::BadRequest("Missing 'user_id' parameter".to_string()))?;
+    let result = use_cases::genshin(&user_id).await?;
+    Ok((StatusCode::OK, Json(result)))
+}
+
+/// GET /stalk/twitter?username=...
+pub async fn twitter_handler(
+    Query(params): Query<StalkParams>,
+) -> Result<(StatusCode, Json<Value>), AppError> {
+    let username = params
+        .username
+        .ok_or_else(|| AppError::BadRequest("Missing 'username' parameter".to_string()))?;
+    let result = use_cases::twitter(&username).await?;
+    Ok((StatusCode::OK, Json(result)))
+}
+
+/// GET /stalk/tiktok?username=...
+pub async fn tiktok_handler(
+    Query(params): Query<StalkParams>,
+) -> Result<(StatusCode, Json<Value>), AppError> {
+    let username = params
+        .username
+        .ok_or_else(|| AppError::BadRequest("Missing 'username' parameter".to_string()))?;
+    let result = use_cases::tiktok(&username).await?;
+    Ok((StatusCode::OK, Json(result)))
+}
+
+/// GET /stalk/instagram?username=...
+pub async fn instagram_handler(
+    Query(params): Query<StalkParams>,
+) -> Result<(StatusCode, Json<Value>), AppError> {
+    let username = params
+        .username
+        .ok_or_else(|| AppError::BadRequest("Missing 'username' parameter".to_string()))?;
+    let result = use_cases::instagram(&username).await?;
+    Ok((StatusCode::OK, Json(result)))
+}
@@ -0,0 +1,58 @@
+//! Axum handlers for the uploader.
+//!
+//! POST /uploader/ryzencdn — multipart file upload, saved to local disk.
+//! GET  /uploader/file/:name — serve an uploaded file.
+
+use axum::body::Body;
+use axum::extract::{Multipart, Path};
+use axum::http::{header, StatusCode};
+use axum::response::Response;
+use axum::Json;
+use serde_json::Value;
+
+use crate::application::uploader as use_cases;
+use crate::presentation::error::AppError;
+
+/// POST /uploader/ryzencdn — accept a multipart file upload.
+pub async fn ryzencdn_handler(mut multipart: Multipart) -> Result<Json<Value>, AppError> {
+    // Read the first file field.
+    let mut file_name = String::from("");
+    let mut data: Vec<u8> = Vec::new();
+
+    while let Some(field) = multipart
+        .next_field()
+        .await
+        .map_err(|e| AppError::BadRequest(format!("multipart: {e}")))?
+    {
+        let name = field.name().unwrap_or("file").to_string();
+        if name == "file" {
+            file_name = field.file_name().unwrap_or("").to_string();
+            let content = field
+                .bytes()
+                .await
+                .map_err(|e| AppError::BadRequest(format!("bytes: {e}")))?;
+            data = content.to_vec();
+            break;
+        }
+    }
+
+    if data.is_empty() {
+        return Err(AppError::BadRequest(
+            "No file field named 'file' in multipart body".into(),
+        ));
+    }
+
+    let result = use_cases::upload(&data, &file_name)?;
+    Ok(Json(result))
+}
+
+/// GET /uploader/file/:name — serve an uploaded file.
+pub async fn serve_file_handler(Path(name): Path<String>) -> Result<Response<Body>, AppError> {
+    let (bytes, mime) = use_cases::serve(&name)?;
+    Ok(Response::builder()
+        .status(StatusCode::OK)
+        .header(header::CONTENT_TYPE, mime)
+        .header(header::CACHE_CONTROL, "public, max-age=86400")
+        .body(Body::from(bytes))
+        .unwrap())
+}
@@ -282,6 +282,30 @@ pub fn build_router(app_state: Arc<AppState>) -> anyhow::Result<Router> {
            "/stalk/youtube",
            axum::routing::get(crate::presentation::handler::stalk::youtube_handler),
        )
+        .route(
+            "/stalk/mobile-legends",
+            axum::routing::get(crate::presentation::handler::stalk::mobile_legends_handler),
+        )
+        .route(
+            "/stalk/free-fire",
+            axum::routing::get(crate::presentation::handler::stalk::free_fire_handler),
+        )
+        .route(
+            "/stalk/genshin-impact",
+            axum::routing::get(crate::presentation::handler::stalk::genshin_handler),
+        )
+        .route(
+            "/stalk/twitter",
+            axum::routing::get(crate::presentation::handler::stalk::twitter_handler),
+        )
+        .route(
+            "/stalk/tiktok",
+            axum::routing::get(crate::presentation::handler::stalk::tiktok_handler),
+        )
+        .route(
+            "/stalk/instagram",
+            axum::routing::get(crate::presentation::handler::stalk::instagram_handler),
+        )
        // Weebs routes
        .route(
            "/weebs/anime-info",
@@ -358,6 +382,15 @@ pub fn build_router(app_state: Arc<AppState>) -> anyhow::Result<Router> {
            "/image/brat/animated",
            axum::routing::get(crate::presentation::handler::image::brat_animated_handler),
        )
+        // Uploader routes
+        .route(
+            "/uploader/ryzencdn",
+            axum::routing::post(crate::presentation::handler::uploader::ryzencdn_handler),
+        )
+        .route(
+            "/uploader/file/{name}",
+            axum::routing::get(crate::presentation::handler::uploader::serve_file_handler),
+        )
        // Health
        .route(
            "/health",
@@ -0,0 +1,64 @@
+"""Extract TikTok user-detail JSON (__UNIVERSAL_DATA_FOR_REHYDRATION__) via Playwright.
+
+The direct HTTP path gets a SlardarWAF challenge page; a real browser with JS
+executes the challenge and exposes the __UNIVERSAL_DATA_FOR_REHYDRATION__ script.
+Usage: python3 stalk_tiktok.py <username>
+"""
+import sys
+import asyncio
+import json
+import os
+
+os.environ.setdefault("PLAYWRIGHT_BROWSERS_PATH", "/usr/local/share/ms-playwright")
+
+from playwright.async_api import async_playwright
+
+
+async def main(username):
+    url = f"https://www.tiktok.com/@{username}?_t=ZS-8tHANz7ieoS&_r=1"
+    async with async_playwright() as p:
+        browser = await p.chromium.launch(
+            headless=True,
+            args=["--no-sandbox", "--disable-bypass", "--disable-blink-features=AutomationControlled"],
+        )
+        context = await browser.new_context(
+            user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+            viewport={"width": 1366, "height": 768},
+            java_script_enabled=True,
+            locale="en-US",
+        )
+        page = await context.new_page()
+        try:
+            await page.goto(url, timeout=60000, wait_until="domcontentloaded")
+        except Exception as e:
+            await browser.close()
+            print(json.dumps({"success": False, "error": f"Navigation: {e}"}))
+            return
+
+        # Wait for the rehydration script to appear (WAF challenge may take a few seconds)
+        found = None
+        for _ in range(30):
+            try:
+                found = await page.evaluate(
+                    """() => {
+                        const s = document.querySelector('script#__UNIVERSAL_DATA_FOR_REHYDRATION__');
+                        return s ? s.textContent : null;
+                    }"""
+                )
+                if found:
+                    break
+            except Exception:
+                pass
+            await page.wait_for_timeout(1000)
+
+        await browser.close()
+
+        if not found:
+            print(json.dumps({"success": False, "error": "Rehydration data not found (WAF challenge)"}))
+            return
+
+        print(json.dumps({"success": True, "data": found}))
+
+
+if __name__ == "__main__":
+    asyncio.run(main(sys.argv[1]))