import express from "express";
import dotenv from "dotenv";
import cors from "cors";
import connectDB from "./config/db.js";
import logger from "./utils/logger.js";

// Routes
import authRoutes from "./routes/auth.routes.js";
import inviteRoutes from "./routes/invites.routes.js";
import staffAuthRoutes from "./routes/staffAuth.routes.js";
import orderRoutes from "./routes/orders.routes.js";
import productRoutes from "./routes/products.routes.js";
import categoryRoutes from "./routes/categories.routes.js";
import shippingRoutes from "./routes/shipping.routes.js";
import storeRoutes from "./routes/storefront.routes.js";
import cryptoRoutes from "./routes/crypto.routes.js";
import blockedUsersRoutes from "./routes/blockedUsers.routes.js";
import chatRoutes from "./routes/chat.routes.js";
import stockRoutes from "./routes/stock.routes.js";
import promotionRoutes from "./routes/promotion.routes.js";

import { startCryptoPriceUpdater } from "./controllers/cryptoController.js";

// Direct routes for Telegram API to bypass JWT middleware
import { protectTelegramApi } from "./middleware/telegramAuthMiddleware.js";
import { processTelegramMessage, createTelegramChat } from "./controllers/chat.controller.js";

dotenv.config();

const app = express();

connectDB();

// Add security headers and handle CORS
app.use((req, res, next) => {
  // Basic security headers
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('X-XSS-Protection', '1; mode=block');
  
  // Handle CORS
  const origin = req.headers.origin;
  const host = req.headers.host;

  // For Tor (null origin), use the .onion address if we're on the API domain
  if (!origin || origin === 'null') {
    if (host.includes('internal-api')) {
      res.setHeader('Access-Control-Allow-Origin', 'http://6n6f6krmcudhzalzuqckms5bhc4afxc7xgjngumkafvgzmjmd2tmzeid.onion');
    } else {
      res.setHeader('Access-Control-Allow-Origin', `https://${host}`);
    }
  } else {
    res.setHeader('Access-Control-Allow-Origin', origin);
  }

  // Always enable credentials since we're using specific origins
  res.setHeader('Access-Control-Allow-Credentials', 'true');
  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-Requested-With, Accept, Origin');
  res.setHeader('Access-Control-Expose-Headers', 'Content-Type, Authorization');
  res.setHeader('Access-Control-Max-Age', '86400');
  
  // Log the request for debugging
  logger.info(`Request from ${req.ip} - Origin: ${origin || 'null'} - Host: ${host}`);
  
  // Handle preflight requests
  if (req.method === 'OPTIONS') {
    res.status(204).end();
    return;
  }
  
  next();
});

// Parse JSON for all routes
app.use(express.json({ limit: "15mb" }));

// Direct routes for Telegram API to bypass JWT middleware
app.post("/telegram/message", protectTelegramApi, processTelegramMessage);
app.post("/telegram/create", protectTelegramApi, createTelegramChat);
app.get("/telegram/test-auth", protectTelegramApi, (req, res) => {
  res.status(200).json({ 
    success: true, 
    message: "Authentication successful",
    headers: {
      authHeader: req.headers.authorization ? req.headers.authorization.substring(0, 10) + "..." : "undefined",
      xApiKey: req.headers['x-api-key'] ? req.headers['x-api-key'].substring(0, 10) + "..." : "undefined"
    }
  });
});

// Register API routes
app.use("/api/products", productRoutes);
app.use("/api/chats", chatRoutes);
app.use("/api/auth", authRoutes);
app.use("/api/staff/auth", staffAuthRoutes);
app.use("/api/invite", inviteRoutes);
app.use("/api/orders", orderRoutes);
app.use("/api/categories", categoryRoutes);
app.use("/api/shipping-options", shippingRoutes);
app.use("/api/storefront", storeRoutes);
app.use("/api/crypto", cryptoRoutes);
app.use("/api/blocked-users", blockedUsersRoutes);
app.use("/api/stock", stockRoutes);
app.use("/api/promotions", promotionRoutes);

startCryptoPriceUpdater(60);

const PORT = process.env.PORT || 3001;
app.listen(PORT, () => {
  logger.info(`Server running on port ${PORT}`);
});