const express = require("express");
const cors = require("cors");
const helmet = require("helmet"); 
const morgan = require("morgan");
const swaggerUi = require("swagger-ui-express");
const swaggerJsdoc = require("swagger-jsdoc");
const routes = require("./app/routes/routes");
const db = require("./app/models");
const path = require("path");
const cookieParser = require("cookie-parser");
const sanitizeInput = require("./app/utils/sanitizeInput");
require("dotenv").config();
 
const app = express();

// GLOBAL MIDDLEWARE (body parsing)
app.use(express.json());
app.use(cookieParser());
app.use(
  helmet({
    contentSecurityPolicy: false,
  })
);
// prevent framing (clickjacking protection)
app.use(
  helmet.frameguard({
    action: "deny",
  })
);

// Add HSTS explicitly (fixes scanner warning)
if (process.env.NODE_ENV === "production") {
  app.use(
    helmet.hsts({
      maxAge: 31536000,          // 1 year
      includeSubDomains: true,
      preload: true,
    })
  );
}
app.use(morgan("dev"));
app.use(sanitizeInput);

// app.use(cors());
// const allowedOrigins = [
//   "http://localhost:5173",     //local
//   "http://13.201.47.205:5173", //dev
//   "http://13.201.47.205:5175",  //uat
//   "https://ipi.venbait.in/api"  // backend
// ];
const allowedOrigins = process.env.ALLOWED_ORIGINS
  ? process.env.ALLOWED_ORIGINS.split(",").map(origin => origin.trim())
  : [];
app.use(cors({
  origin: allowedOrigins,
  credentials: true
}));

console.log("is production = " + process.env.NODE_ENV === "production");
console.log("allowedOrigins = " + allowedOrigins);

app.use((req, res, next) => {
  console.log("Origin from header = " + req.headers.origin);
  if (allowedOrigins.includes(req.headers.origin)) {
    console.log("Origin set = " + req.headers.origin);
    res.header("Access-Control-Allow-Origin", req.headers.origin);
  }
  res.header("Access-Control-Allow-Credentials", "true");
  res.header(
    "Access-Control-Allow-Headers",
    "Content-Type, Authorization, APP_SIGNATURE, x-app-signature"
  );
  res.header(
    "Access-Control-Allow-Methods",
    "GET, POST, PUT, PATCH, DELETE, OPTIONS"
  );

  if (req.method === "OPTIONS") {
    return res.sendStatus(200);
  }
  next();
});



// // Swagger setup
// const swaggerOptions = {
//   definition: {
//     openapi: "3.0.0",
//     info: {
//       title: "FCSC IPI Survey",
//       version: "1.0.0",
//       description: "Federal Competitiveness and Statistics Centre (FCSC) - Industrial Production Index (IPI)",
//     },
//     components: {
//       securitySchemes: {
//         bearerAuth: {
//           type: "http",
//           scheme: "bearer",
//           bearerFormat: "JWT",
//         },
//       },
//     },
//     security: [
//       {
//         bearerAuth: [],
//       },
//     ],
//   },
//   apis: ["./app/routes/*.js"],
// };
// const swaggerDocs = swaggerJsdoc(swaggerOptions);
// app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerDocs));
// Swagger setup
const swaggerOptions = {
  definition: {
    openapi: "3.0.0",
    info: {
      title: "FCSC IPI Survey",
      version: "1.0.0",
      description: "Federal Competitiveness and Statistics Centre (FCSC) - Industrial Production Index (IPI)",
    },
    components: {
      securitySchemes: {
        // Optional: Still support Bearer for Swagger-only testing
        bearerAuth: {
          type: "http",
          scheme: "bearer",
          bearerFormat: "JWT",
        },
        appSignature: {
          type: "apiKey",
          in: "header",
          name: "x-app-signature"
        }
      },
    },
  },
  apis: ["./app/routes/*.js"],
};

const swaggerDocs = swaggerJsdoc(swaggerOptions);

app.use(
  "/api-docs",
  swaggerUi.serve,
  swaggerUi.setup(swaggerDocs, {
    swaggerOptions: {
      withCredentials: true,   // 🔥 VERY IMPORTANT
    },
  })
);


// Routes
app.use("/api", routes);

 
apis: [path.join(__dirname, "app/routes/*.js")],

app.get("/api/test", (req, res) => {
  res.json({ status: "success", message: "Test API working fine 🚀" });
});

//deployment route
const deploymentController = require("./app/controllers/deployment.controller");
app.post("/deploy", deploymentController.deployment);

// Sync DB
// db.sequelize.sync({ alter: true }).then(() => {
//   console.log("✅ Database connected & synced.");
// });

// Start server
const PORT = process.env.PORT || 5000;
app.listen(PORT, () => {
  console.log(`🚀 Server running on port ${PORT}`);
});