server.js

const express = require("express");
const dotenv  = require("dotenv");
const helmet  = require("helmet");
const cors    = require("cors");
const path    = require("path");
const os      = require("os");

// ── Load env vars FIRST ──────────────────────────────────────────────────────
dotenv.config();

/* ─────────────────────────────────────────
   Required ENV validation
───────────────────────────────────────── */
const REQUIRED_ENV = [
  "MONGO_URI",
  "JWT_SECRET",
  "ADMIN_SECRET",
  "ADMIN_USER",
  "ADMIN_PASS",
  "ENC_KEY",
  "GEMINI_API_KEY",   // ← added: AI routes need this at boot time
];

const missingEnv = REQUIRED_ENV.filter((k) => !process.env[k]);
if (missingEnv.length) {
  console.error("❌ Missing required env variables:", missingEnv.join(", "));
  process.exit(1);
}

if (process.env.ENC_KEY.length !== 32) {
  console.error("❌ ENC_KEY must be exactly 32 characters.");
  process.exit(1);
}

/* ─────────────────────────────────────────
   Imports  (after env is validated)
───────────────────────────────────────── */
const connectDB    = require("./config/db");
const errorHandler = require("./middleware/errorHandler");
const {
  globalLimiter,
  loginLimiter,
  signupLimiter,
  joinLimiter,
} = require("./middleware/rateLimiter");

const authRoutes       = require("./routes/auth.routes");
const snippetRoutes    = require("./routes/snippet.routes");
const workspaceRoutes  = require("./routes/workspace.routes");
const githubRoutes     = require("./routes/github.routes");
const userRoutes       = require("./routes/user.routes");
const collectionRoutes = require("./routes/collection.routes");
const activityRoutes   = require("./routes/activity.routes");
const adminRoutes      = require("./routes/admin.routes");
const aiRoutes         = require("./routes/ai.routes");

/* ─────────────────────────────────────────
   App init
───────────────────────────────────────── */
const app  = express();
const PORT = Number(process.env.PORT) || 5000;

app.disable("x-powered-by");
app.set("trust proxy", 1);

/* ─────────────────────────────────────────
   Security — helmet
   CSP loosened just enough for health/ping
   endpoints to work from a browser tab
───────────────────────────────────────── */
app.use(
  helmet({
    crossOriginResourcePolicy: { policy: "cross-origin" },
    contentSecurityPolicy: false, // disable CSP for pure API server
  })
);

/* ─────────────────────────────────────────
   Body parsers
   2 mb for AI routes (code can be large)
───────────────────────────────────────── */
app.use(express.json({ limit: "2mb" }));
app.use(express.urlencoded({ extended: true, limit: "2mb" }));

/* ─────────────────────────────────────────
   CORS
───────────────────────────────────────── */
const ALLOWED_ORIGINS = [
  "http://localhost:5173",
  "http://localhost:3000",
  ...(process.env.CLIENT_URL
    ? process.env.CLIENT_URL.split(",").map((u) => u.trim())
    : []),
].filter(Boolean);

const corsOptions = {
  origin(origin, callback) {
    // Allow server-to-server / curl / Postman (no origin header)
    if (!origin) return callback(null, true);
    if (ALLOWED_ORIGINS.includes(origin)) return callback(null, true);
    return callback(
      Object.assign(new Error(`CORS: origin "${origin}" is not allowed`), { status: 403 })
    );
  },
  methods : ["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS"],
  allowedHeaders: ["Content-Type", "Authorization", "x-admin-key"],
  credentials        : true,
  optionsSuccessStatus: 204,
};

// Preflight must come BEFORE globalLimiter so OPTIONS never hits the rate limiter
app.options("*", cors(corsOptions));
app.use(cors(corsOptions));

/* ─────────────────────────────────────────
   Global rate limiter  (after CORS / preflight)
───────────────────────────────────────── */
app.use(globalLimiter);

/* ─────────────────────────────────────────
   Route-specific limiters  (before routes)
───────────────────────────────────────── */
app.use("/api/auth/login",      loginLimiter);
app.use("/api/auth/signup",     signupLimiter);
app.use("/api/workspaces/join", joinLimiter);

/* ─────────────────────────────────────────
   Health / diagnostic endpoints
───────────────────────────────────────── */
app.get("/ping", (_req, res) => res.send("pong"));

app.get("/health", (_req, res) => {
  res.status(200).json({
    status    : "ok",
    uptime    : Math.floor(process.uptime()),
    env       : process.env.NODE_ENV || "development",
    time      : new Date().toISOString(),
    node      : process.version,
    platform  : `${os.type()} ${os.release()}`,
    memoryMB  : Math.round(process.memoryUsage().rss / 1024 / 1024),
  });
});

app.get("/cors-test", (_req, res) => {
  res.json({ message: "✅ CORS is working correctly" });
});

// ── Route map (dev only) ─────────────────────────────────────────────────────
// Hit GET /routes in development to see every registered route
if (process.env.NODE_ENV !== "production") {
  app.get("/routes", (_req, res) => {
    const routes = [];
    app._router.stack.forEach((layer) => {
      if (layer.route) {
        routes.push({
          path   : layer.route.path,
          methods: Object.keys(layer.route.methods).join(", ").toUpperCase(),
        });
      } else if (layer.name === "router" && layer.handle.stack) {
        layer.handle.stack.forEach((sub) => {
          if (sub.route) {
            routes.push({
              path   : layer.regexp.source + sub.route.path,
              methods: Object.keys(sub.route.methods).join(", ").toUpperCase(),
            });
          }
        });
      }
    });
    res.json({ count: routes.length, routes });
  });
}

/* ─────────────────────────────────────────
   API Routes
   Order matters: more specific paths first
───────────────────────────────────────── */
app.use("/api/auth",        authRoutes);
app.use("/api/snippets",    snippetRoutes);
app.use("/api/workspaces",  workspaceRoutes);
app.use("/api/user",        githubRoutes);
app.use("/api/users",       userRoutes);
app.use("/api/collections", collectionRoutes);
app.use("/api/activity",    activityRoutes);
app.use("/api/admin",       adminRoutes);
app.use("/api/ai",          aiRoutes);   // ✅ /api/ai/snippets/:id/review etc.

/* ─────────────────────────────────────────
   404 — must be AFTER all routes
───────────────────────────────────────── */
app.use((req, res) => {
  res.status(404).json({
    error : "Route not found",
    method: req.method,
    path  : req.path,
  });
});

/* ─────────────────────────────────────────
   Global error handler — must be LAST
   (4-argument signature is required by Express)
───────────────────────────────────────── */
app.use(errorHandler);

/* ─────────────────────────────────────────
   Server bootstrap
───────────────────────────────────────── */
let server;

async function startServer() {
  try {
    await connectDB();

    server = app.listen(PORT, () => {
      const divider = "─".repeat(42);
      console.log(divider);
      console.log(`🚀  Server      : http://localhost:${PORT}`);
      console.log(`🌍  Environment : ${process.env.NODE_ENV || "development"}`);
      console.log(
        `🔗  Origins     : ${
          ALLOWED_ORIGINS.length ? ALLOWED_ORIGINS.join(", ") : "none configured"
        }`
      );
      console.log(`🤖  AI routes   : /api/ai/snippets/:id/{review|explain|suggest-tags|fix|convert}`);
      if (process.env.NODE_ENV !== "production") {
        console.log(`🗺️   Route map   : http://localhost:${PORT}/routes`);
      }
      console.log(divider);
    });

    // Increase keep-alive for Render / Railway deployments
    server.keepAliveTimeout    = 65_000;
    server.headersTimeout      = 70_000;

  } catch (error) {
    console.error("❌ Failed to start server:", error.message);
    process.exit(1);
  }
}

/* ─────────────────────────────────────────
   Graceful shutdown
───────────────────────────────────────── */
function shutdown(signal) {
  console.log(`\n⚠️  ${signal} received — shutting down gracefully…`);

  if (!server) return process.exit(0);

  // Stop accepting new connections
  server.close((err) => {
    if (err) {
      console.error("❌ Error closing server:", err.message);
      return process.exit(1);
    }
    console.log("✅ Server closed cleanly");
    process.exit(0);
  });

  // Force-kill after 10 s if something hangs
  setTimeout(() => {
    console.error("❌ Force shutdown after 10 s timeout");
    process.exit(1);
  }, 10_000).unref();
}

process.on("SIGINT",  () => shutdown("SIGINT"));
process.on("SIGTERM", () => shutdown("SIGTERM"));

process.on("unhandledRejection", (reason) => {
  console.error("❌ Unhandled Promise Rejection:", reason);
});

process.on("uncaughtException", (error) => {
  console.error("❌ Uncaught Exception:", error);
  process.exit(1);
});

/* ─────────────────────────────────────────
   Boot
───────────────────────────────────────── */
startServer();

module.exports = app;