Raspy Bot Website

A secure Roblox-to-Discord verification system built with Next.js, MongoDB, and OAuth 2.0, deployed on Vercel.

---

Features

• Secure OAuth 2.0 Authentication: Uses Roblox’s official OAuth implementation.
• MongoDB Storage: Stores verification sessions and user verifications.
• Discord Bot Integration: Provides API endpoint for Discord bots to initiate the verification process.
• Single-Use Tokens: Tokens expire after 15 minutes and can be used only once.
• Vercel Deployment: Optimized for serverless deployment.

---

Setup Instructions

1. MongoDB Setup

1. Create an account at mongodb.com/cloud/atlas.
2. Create a new cluster (free tier is sufficient).
3. Create a database user with read/write permissions.
4. Obtain your MongoDB connection string (e.g., mongodb+srv://username:password@cluster.mongodb.net/).
5. Add the connection string to your environment variables.

2. Roblox OAuth Setup

1. Visit the Roblox Creator Dashboard.
2. Create a new OAuth 2.0 application.
3. Set the redirect URI to: https://your-vercel-app.vercel.app/api/auth/callback
4. Copy the Client ID and Client Secret.
5. Add them to your environment variables.

3. Vercel Deployment

1. Push the code to a GitHub repository.

2. Import the repository into Vercel.

3. Configure the following environment variables in Vercel:

   Variable	Description
   MONGODB_URI	Your MongoDB connection string
   MONGODB_DB_NAME	Name of your MongoDB database
   ROBLOX_CLIENT_ID	Roblox OAuth Client ID
   ROBLOX_CLIENT_SECRET	Roblox OAuth Client Secret
   NEXT_PUBLIC_VERCEL_URL	Your app’s Vercel domain (e.g., your-app.vercel.app)

4. Deploy the project.

4. Initialize Database

Once deployed, navigate to: https://your-app.vercel.app/api/init-db This will create the required indexes in your database.

---

API Endpoints

POST /api/discord/callback

Initiates a verification session for a Discord user.

Request Body:

{
  "discordId": "123456789012345678"
}

Response:

{
  "token": "abc123...",
  "url": "https://your-app.vercel.app/login?token=abc123..."
}

Example Usage in Discord Bot:

const response = await fetch('https://your-app.vercel.app/api/discord/callback', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ discordId: interaction.user.id })
});

const { url } = await response.json();
await interaction.user.send(`Click here to verify: ${url}`);

---

GET /api/init-db

Initializes database indexes. Call this once after deployment.

---

User Flow

1. The Discord bot calls /api/discord/callback with the user’s Discord ID.
2. The server generates a single-use verification token and returns a verification URL.
3. The bot sends the URL to the user via direct message.
4. The user visits the verification URL (/login?token=...).
5. The server validates the token and redirects the user to Roblox's OAuth consent page.
6. The user authenticates with Roblox.
7. Roblox redirects the user back to /api/auth/callback.
8. The server stores the Discord → Roblox mapping in MongoDB.
9. The user is redirected to /verify-success with a confirmation.

---

Database Schema

verification_sessions

{
  token: string;         // Unique single-use token
  discordId: string;     // Discord user ID
  createdAt: Date;       // Session creation timestamp
  expiresAt: Date;       // Expiration timestamp (15 minutes)
  used: boolean;         // Whether the token has been used
  usedAt?: Date;         // Timestamp of usage (if used)
  state?: string;        // OAuth state parameter
  nonce?: string;        // OAuth nonce parameter
}

verifications

{
  discordId: string;      // Discord user ID
  robloxId: string;       // Roblox user ID
  robloxUsername: string; // Roblox username
  createdAt: Date;        // Time of verification
}

---

Security Features

• Single-Use Tokens: Tokens are valid for 15 minutes and only once.
• OAuth State & Nonce: Protects against CSRF and replay attacks.
• HTTP-Only Cookies: Secure session management.
• TTL Indexes: Automatic cleanup of expired sessions in MongoDB.
• Server-Side Validation: Discord ID is verified server-to-server to prevent spoofing.

---

Tech Stack

Layer	Technology
Frontend	Next.js 15 with App Router
Database	MongoDB with native driver
OAuth	openid-client for Roblox OAuth 2.0
Deployment	Vercel
UI	Tailwind CSS with shadcn/ui

---

Managed By

Raspy Foundation

---

License

Licensed under CC-BY-SA-4.0 See creativecommons.org/licenses/by-sa/4.0