fcsc_ipi_backend/app/controllers/establishment.controller.js

const db = require("../models");
const bcrypt = require("bcryptjs");
const Establishment = db.Establishment;
const EstablishmentUser = db.EstablishmentUser;
const EstablishmentPasswordResetRequest = db.EstablishmentPasswordResetRequest;
const { sendEmail } = require("../services/emailHelper"); // custom helper
const logger = require("../services/logger");
// Create Establishment + linked user
exports.createEstablishment = async (req, res) => {
    try {
      
      const { establishment_code, factory_name, email, permanent_factory_code, industry_code,  license_number,  isic_code, emirate, emirati_male,emirati_female,non_emirati_male,non_emirati_female,total_emirati,total_employees, establishment_user,  } = req.body;
  
      // if ( !establishment_code || !factory_name || !email || !establishment_user?.name || !establishment_user?.email || !establishment_user?.password ) 
      // {
      //   res.status(400).send({'status':"failed",'message':"Missing required fields",'data': "" }); 
      // }
  
      // Create Establishment
      const establishment = await Establishment.create({
        establishment_code,
        factory_name,
        email,
        permanent_factory_code,
        industry_code,
        license_number,
        isic_code,
        emirate,
        emirati_male,emirati_female,non_emirati_male,non_emirati_female,total_emirati,total_employees,
      });
  
      // Hash password for user
      // const hashedPassword = await bcrypt.hash(establishment_user.password, 10);
  
      // Create related Establishment User
      // const user = await EstablishmentUser.create({
      //   establishment_id: establishment.id,
      //   name: establishment_user.name,
      //   email: establishment_user.email,
      //   password: hashedPassword,
      // });

      
      return res.status(201).send({'status':"success",'message':"Establishment and linked user created successfully",'data': { establishment } }); 
     
    } catch (err) {
      return res.status(500).send({'status':"failed",'message':err.message });
    }
  };
  

// Get all establishments (with user details)
exports.getAllEstablishments = async (req, res) => {
  try {

    const data = await Establishment.findAll({
      include: [
        {
          model: EstablishmentUser,
          as: "users",
          attributes: ["id", "name", "email", "is_active"],
        },
      ],
    });

    return res.status(200).send({'status':"success",'message':"Fetched successfully",'data': data }); 

  } catch (err) {
    return res.status(500).send({'status':"failed",'message':err.message });
  }
};

// Get one establishment
exports.getEstablishmentById = async (req, res) => {
  try {

    const data = await Establishment.findByPk(req.params.id, {
      include: [{ model: EstablishmentUser, as: "users" }],
    });

    if (!data) return res.status(404).send({'status':"failed",'message':"Record Not found",'data': "" }); 
   
    return res.status(200).send({'status':"success",'message':"Fetched successfully",'data': data }); 

  } catch (err) {
    return res.status(500).send({'status':"failed",'message':err.message });
  }
};

// Update establishment
exports.updateEstablishment = async (req, res) => {
  try {

    const [updated] = await Establishment.update(req.body, {
      where: { id: req.params.id },
    });

    if (!updated){ return res.status(404).send({'status':"failed",'message':"Record Not found",'data': "" }); }
    
    return res.status(200).send({'status':"success",'message':"Updated successfully",'data': "" }); 

  } catch (err) {
    return res.status(500).send({'status':"failed",'message':err.message });
  }
};

// Delete establishment
exports.deleteEstablishment = async (req, res) => {
  try {

    const deleted = await Establishment.destroy({ where: { id: req.params.id } });

    if (!deleted) return res.status(404).send({'status':"failed",'message':"Record Not found",'data': "" }); 
    
    return res.status(200).send({'status':"success",'message':"Deleted successfully",'data': "" }); 

  } catch (err) {
    return res.status(500).send({'status':"failed",'message':err.message });
  }
};





// GET ALL RESET REQUESTS
exports.getAllRequests = async (req, res) => {
  try {
    const requests = await EstablishmentPasswordResetRequest.findAll({
      order: [["created_at", "DESC"]],
    });

    res.status(200).json({
      status: "success",
      data: requests,
    });
  } catch (err) {
    res.status(500).json({ status: "failed", message: err.message });
  }
};

//  CREATE RESET REQUEST
exports.createRequest = async (req, res) => {
  try {
    const {
      establishment_name,
      establishment_code,
      registered_email,
      contact_person_name,
      contact_phone,
      additional_notes,
    } = req.body;

    // Validate input
    if (!establishment_name || !establishment_code || !registered_email) {
      return res.status(400).json({
        status: "failed",
        message: "establishment_name, establishment_code, and registered_email are required",
      });
    }

    //  Find user by email
    const user = await EstablishmentUser.findOne({
      where: { email: registered_email },
    });
    if (!user)
      return res.status(404).json({ status: "failed", message: "Registered email not found" });

    //  Find establishment by code
    const establishment = await Establishment.findOne({
      where: { code: establishment_code },
    });
    if (!establishment)
      return res.status(404).json({ status: "failed", message: "Invalid establishment code" });

    //  Verify both match
    if (user.establishment_id !== establishment.id)
      return res.status(400).json({
        status: "failed",
        message: "Establishment mismatch between code and email",
      });

    // Create reset request
    const newRequest = await EstablishmentPasswordResetRequest.create({
      establishment_name,
      establishment_code,
      registered_email,
      contact_person_name,
      contact_phone,
      additional_notes,
      establishment_user_id: user.id,
      establishment_id: establishment.id,
    });

    // Trigger Email
    const subject = "Password Reset Request Received";
    const body = `
      Dear ${contact_person_name || establishment_name},

      We have received your password reset request for establishment "${establishment_name}".
      Our team will verify and get back to you shortly.

      Regards,
      Support Team
    `;
    await sendEmail(registered_email, subject, body);

    res.status(201).json({
      status: "success",
      message: "Password reset request created and email sent successfully",
      data: newRequest,
    });
  } catch (err) {
    console.error(err);
    res.status(500).json({ status: "failed", message: err.message });
  }
};






































exports.forgotPasswordRequestOTP = async (req, res) => {
  try {
    const { establishment_name, establishment_code, registered_email } = req.body;

    // Validate inputs
    if (!establishment_name || !establishment_code || !registered_email)
      return res.status(400).json({ status: "failed", message: "All fields are required" });

    // Find establishment and user
    const establishment = await Establishment.findOne({ where: { establishment_code } });
    if (!establishment)
      return res.status(404).json({ status: "failed", message: "Establishment not found" });

    const user = await EstablishmentUser.findOne({
      where: { email: registered_email, establishment_id: establishment.id },
    });
    if (!user)
      return res.status(404).json({ status: "failed", message: "User not found for this establishment" });

    // Generate 6-digit OTP
    const otp = Math.floor(100000 + Math.random() * 900000).toString();

    // Hash OTP before saving (security)
    const hashedOtp = await bcrypt.hash(otp, 10);

    // Store OTP in user record
    await user.update({
      reset_otp: hashedOtp,
      reset_otp_expires_at: new Date(Date.now() + 10 * 60 * 1000), // valid for 10 mins
    });

    // Send OTP email
    await sendEmail(
      registered_email,
      "Password Reset OTP",
      `<p>Dear ${user.name},</p><p>Your OTP for password reset is <b>${otp}</b>. It is valid for 10 minutes.</p>`
    );

    logger.info(`OTP sent to ${registered_email} for establishment_id=${establishment.id}`);

    return res.status(200).json({
      status: "success",
      message: "OTP sent successfully to registered email",
    });

  } catch (err) {
    logger.error(`Error in forgotPasswordRequestOTP: ${err.message}`);
    return res.status(500).json({ status: "failed", message: err.message });
  }
};




exports.forgotPasswordVerifyOTP = async (req, res) => {
  try {
    const { registered_email, otp, password, confirm_password } = req.body;

    if (!registered_email || !otp || !password || !confirm_password)
      return res.status(400).json({ status: "failed", message: "All fields are required" });

    if (password !== confirm_password)
      return res.status(400).json({ status: "failed", message: "Passwords do not match" });

    const user = await EstablishmentUser.findOne({ where: { email: registered_email } });
    if (!user || !user.reset_otp)
      return res.status(404).json({ status: "failed", message: "OTP not found or invalid user" });

    // Check OTP expiry
    if (new Date() > new Date(user.reset_otp_expires_at))
      return res.status(400).json({ status: "failed", message: "OTP expired" });

    // Compare OTP
    const isOtpValid = await bcrypt.compare(otp, user.reset_otp);
    if (!isOtpValid)
      return res.status(400).json({ status: "failed", message: "Invalid OTP" });

    // Update password
    const hashedPassword = await bcrypt.hash(password, 10);
    await user.update({
      password: hashedPassword,
      reset_otp: null,
      reset_otp_expires_at: null,
    });

    logger.info(`Password reset successful for user=${registered_email}`);

    return res.status(200).json({
      status: "success",
      message: "Password reset successfully",
    });

  } catch (err) {
    logger.error(`Error in forgotPasswordVerifyOTP: ${err.message}`);
    return res.status(500).json({ status: "failed", message: err.message });
  }
};