import 'dotenv/config';
import express from 'express';
import cors from 'cors';
import multer from 'multer';
import bcrypt from 'bcryptjs';
import jwt from 'jsonwebtoken';
import { nanoid } from 'nanoid';
import path from 'node:path';
import fs from 'node:fs';
import { fileURLToPath } from 'node:url';
import { db, rowToArticle, rowToRiskSignal, rowToPrice } from './db.js';
import { startScraperLoop, scrapeOnce } from './scraper.js';

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const PORT = Number(process.env.PORT || 3001);
const JWT_SECRET = process.env.JWT_SECRET || 'change-me-in-production';
const PUBLIC_ORIGIN = process.env.PUBLIC_ORIGIN || `http://localhost:${PORT}`;

const uploadsDir = path.join(__dirname, 'uploads');
if (!fs.existsSync(uploadsDir)) fs.mkdirSync(uploadsDir, { recursive: true });

const storage = multer.diskStorage({
  destination: (_req, _file, cb) => cb(null, uploadsDir),
  filename: (_req, file, cb) => {
    const ext = path.extname(file.originalname).toLowerCase().slice(0, 8) || '.bin';
    cb(null, `${nanoid(12)}${ext}`);
  },
});
const upload = multer({
  storage,
  limits: { fileSize: 10 * 1024 * 1024 },
  fileFilter: (_req, file, cb) => {
    if (/^image\/(jpe?g|png|webp|gif|svg\+xml)$/.test(file.mimetype)) cb(null, true);
    else cb(new Error('Only image uploads are allowed'));
  },
});

const app = express();
app.use(cors({ origin: true, credentials: true }));
app.use(express.json({ limit: '2mb' }));
app.use('/uploads', express.static(uploadsDir, { maxAge: '7d' }));
app.use('/', express.static(path.join(__dirname, 'public')));

function authRequired(req, res, next) {
  const header = req.headers.authorization || '';
  const token = header.startsWith('Bearer ') ? header.slice(7) : null;
  if (!token) return res.status(401).json({ error: 'unauthorized' });
  try {
    req.user = jwt.verify(token, JWT_SECRET);
    next();
  } catch {
    return res.status(401).json({ error: 'invalid_token' });
  }
}

app.post('/api/auth/login', (req, res) => {
  const { username, password } = req.body || {};
  if (!username || !password) return res.status(400).json({ error: 'username_password_required' });
  const row = db.prepare('SELECT id, username, password_hash FROM users WHERE username = ?').get(username);
  if (!row) return res.status(401).json({ error: 'bad_credentials' });
  if (!bcrypt.compareSync(password, row.password_hash)) {
    return res.status(401).json({ error: 'bad_credentials' });
  }
  const token = jwt.sign({ sub: row.id, username: row.username }, JWT_SECRET, { expiresIn: '7d' });
  res.json({ token, user: { id: row.id, username: row.username } });
});

app.get('/api/auth/me', authRequired, (req, res) => {
  res.json({ user: req.user });
});

const PUBLIC_FIELDS = `
  id, title, category, type, author, author_role, author_initial,
  publish_date, pages, price, is_free, summary, body, cover_image,
  tags, featured, created_at, updated_at
`;

app.get('/api/articles', (req, res) => {
  const limit = Math.min(Number(req.query.limit) || 50, 200);
  const rows = db
    .prepare(`SELECT ${PUBLIC_FIELDS} FROM articles ORDER BY created_at DESC LIMIT ?`)
    .all(limit);
  res.json(rows.map(rowToArticle));
});

app.get('/api/articles/:id', (req, res) => {
  const row = db.prepare(`SELECT ${PUBLIC_FIELDS} FROM articles WHERE id = ?`).get(req.params.id);
  if (!row) return res.status(404).json({ error: 'not_found' });
  res.json(rowToArticle(row));
});

app.post('/api/uploads', authRequired, upload.single('file'), (req, res) => {
  if (!req.file) return res.status(400).json({ error: 'no_file' });
  const relative = `/uploads/${req.file.filename}`;
  res.json({ url: relative, absoluteUrl: `${PUBLIC_ORIGIN}${relative}` });
});

function normalizeArticleBody(b) {
  return {
    title: String(b.title || '').trim(),
    category: b.category || null,
    type: b.type || null,
    author: b.author || null,
    author_role: b.authorRole || null,
    author_initial: b.authorInitial || null,
    publish_date: b.publishDate || null,
    pages: Number(b.pages) || 0,
    price: Number(b.price) || 0,
    is_free: b.isFree ? 1 : 0,
    summary: b.summary || null,
    body: b.body || null,
    cover_image: b.coverImage || null,
    tags: JSON.stringify(Array.isArray(b.tags) ? b.tags : []),
    featured: b.featured ? 1 : 0,
  };
}

app.post('/api/articles', authRequired, (req, res) => {
  const a = normalizeArticleBody(req.body || {});
  if (!a.title) return res.status(400).json({ error: 'title_required' });
  const id = nanoid(14);
  db.prepare(`
    INSERT INTO articles (
      id, title, category, type, author, author_role, author_initial,
      publish_date, pages, price, is_free, summary, body, cover_image,
      tags, featured
    ) VALUES (
      @id, @title, @category, @type, @author, @author_role, @author_initial,
      @publish_date, @pages, @price, @is_free, @summary, @body, @cover_image,
      @tags, @featured
    )
  `).run({ id, ...a });
  const row = db.prepare(`SELECT ${PUBLIC_FIELDS} FROM articles WHERE id = ?`).get(id);
  res.status(201).json(rowToArticle(row));
});

app.put('/api/articles/:id', authRequired, (req, res) => {
  const existing = db.prepare('SELECT id FROM articles WHERE id = ?').get(req.params.id);
  if (!existing) return res.status(404).json({ error: 'not_found' });
  const a = normalizeArticleBody(req.body || {});
  if (!a.title) return res.status(400).json({ error: 'title_required' });
  db.prepare(`
    UPDATE articles SET
      title = @title, category = @category, type = @type,
      author = @author, author_role = @author_role, author_initial = @author_initial,
      publish_date = @publish_date, pages = @pages, price = @price, is_free = @is_free,
      summary = @summary, body = @body, cover_image = @cover_image,
      tags = @tags, featured = @featured,
      updated_at = datetime('now')
    WHERE id = @id
  `).run({ id: req.params.id, ...a });
  const row = db.prepare(`SELECT ${PUBLIC_FIELDS} FROM articles WHERE id = ?`).get(req.params.id);
  res.json(rowToArticle(row));
});

app.delete('/api/articles/:id', authRequired, (req, res) => {
  const info = db.prepare('DELETE FROM articles WHERE id = ?').run(req.params.id);
  if (info.changes === 0) return res.status(404).json({ error: 'not_found' });
  res.status(204).end();
});

// ---------- risk signals ----------
const RISK_FIELDS = `id, quote, name, date, level, sort_order, created_at, updated_at`;

app.get('/api/risks', (req, res) => {
  const limit = Math.min(Number(req.query.limit) || 100, 500);
  const rows = db
    .prepare(`SELECT ${RISK_FIELDS} FROM risk_signals ORDER BY sort_order ASC, created_at DESC LIMIT ?`)
    .all(limit);
  res.json(rows.map(rowToRiskSignal));
});

app.get('/api/risks/:id', (req, res) => {
  const row = db.prepare(`SELECT ${RISK_FIELDS} FROM risk_signals WHERE id = ?`).get(req.params.id);
  if (!row) return res.status(404).json({ error: 'not_found' });
  res.json(rowToRiskSignal(row));
});

const ALLOWED_LEVELS = new Set(['critical', 'high', 'medium', 'low', 'opportunity']);
function normalizeRiskBody(b) {
  const level = ALLOWED_LEVELS.has(b.level) ? b.level : null;
  return {
    quote: String(b.quote || '').trim(),
    name: String(b.name || '').trim(),
    date: b.date || null,
    level,
    sort_order: Number(b.sortOrder) || 0,
  };
}

app.post('/api/risks', authRequired, (req, res) => {
  const r = normalizeRiskBody(req.body || {});
  if (!r.quote || !r.name || !r.level) return res.status(400).json({ error: 'quote_name_level_required' });
  const id = nanoid(14);
  db.prepare(`
    INSERT INTO risk_signals (id, quote, name, date, level, sort_order)
    VALUES (@id, @quote, @name, @date, @level, @sort_order)
  `).run({ id, ...r });
  const row = db.prepare(`SELECT ${RISK_FIELDS} FROM risk_signals WHERE id = ?`).get(id);
  res.status(201).json(rowToRiskSignal(row));
});

app.put('/api/risks/:id', authRequired, (req, res) => {
  const existing = db.prepare('SELECT id FROM risk_signals WHERE id = ?').get(req.params.id);
  if (!existing) return res.status(404).json({ error: 'not_found' });
  const r = normalizeRiskBody(req.body || {});
  if (!r.quote || !r.name || !r.level) return res.status(400).json({ error: 'quote_name_level_required' });
  db.prepare(`
    UPDATE risk_signals SET
      quote = @quote, name = @name, date = @date, level = @level,
      sort_order = @sort_order, updated_at = datetime('now')
    WHERE id = @id
  `).run({ id: req.params.id, ...r });
  const row = db.prepare(`SELECT ${RISK_FIELDS} FROM risk_signals WHERE id = ?`).get(req.params.id);
  res.json(rowToRiskSignal(row));
});

app.delete('/api/risks/:id', authRequired, (req, res) => {
  const info = db.prepare('DELETE FROM risk_signals WHERE id = ?').run(req.params.id);
  if (info.changes === 0) return res.status(404).json({ error: 'not_found' });
  res.status(204).end();
});

// ---------- prices (scraped from tgju.org every 2 min) ----------
app.get('/api/prices', (_req, res) => {
  const rows = db
    .prepare('SELECT symbol, name, value, unit, change_value, change_pct, source_url, fetched_at FROM prices ORDER BY name')
    .all();
  res.json(rows.map(rowToPrice));
});

app.post('/api/prices/refresh', authRequired, async (_req, res) => {
  try {
    const n = await scrapeOnce();
    res.json({ ok: true, scraped: n });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

app.get('/api/health', (_req, res) => res.json({ ok: true }));

app.listen(PORT, () => {
  console.log(`Panel running at ${PUBLIC_ORIGIN}`);
  const intervalMs = Number(process.env.SCRAPER_INTERVAL_MS) || 2 * 60 * 1000;
  if (process.env.SCRAPER_DISABLED !== '1') {
    startScraperLoop(intervalMs);
    console.log(`[scraper] tgju.org polling every ${intervalMs / 1000}s`);
  } else {
    console.log('[scraper] disabled via SCRAPER_DISABLED=1');
  }
});