import express from "express";
import cors from "cors";
import morgan from "morgan";
import helmet from "helmet";
import path from "path";
import dotenv from "dotenv";
import routes from "./routes";
import cookieParser from "cookie-parser";
import { StripeController } from "./controllers/StripeController";

dotenv.config();

const app = express();
app.use(cookieParser());

// --------------------
// Allowed Origins
// --------------------
const allowedOrigins = [
  process.env.ADMINPANEL_DOMAIN,
  process.env.FRONTEND_DOMAIN,
  process.env.FRONTEND_WWW_DOMAIN,
  "http://localhost:3000",
  "http://localhost:5173",
  "http://167.86.122.254",
  "http://167.86.122.254:8080",
  "https://167.86.122.254",
  "https://staging.admin.humanizar-texto.ai",
  "https://admin.humanizar-texto.ai",
  "https://staging.humanizar-texto.ai",
  "https://humanizar-texto.ai",
  "https://admin.nytsolvers.com",
  "https://nytsolvers.com",
  "https://staging.nytsolvers.com",
].filter(Boolean);

console.log("✅ Allowed origins:", allowedOrigins);

// --------------------
// CORS CONFIG (USED)
// --------------------
const corsOptions: cors.CorsOptions = {
  origin: (origin, callback) => {
    // Allow server-to-server requests (Stripe, curl, Postman)
    if (!origin) return callback(null, true);

    if (allowedOrigins.includes(origin)) {
      return callback(null, true);
    }

    return callback(new Error(`❌ CORS blocked for origin: ${origin}`));
  },
  credentials: true,
  exposedHeaders: ["Authorization"],
};

// Apply CORS ONCE globally
app.use(cors(corsOptions));

// --------------------
// Stripe Webhook (RAW BODY)
// MUST be before express.json()
// --------------------
const stripeController = new StripeController();
app.post(
  "/api/frontend/stripe/webhook",
  express.raw({ type: "application/json" }),
  stripeController.webhook.bind(stripeController)
);

// --------------------
// Body Parsers
// --------------------
app.use(express.json());
app.use(express.urlencoded({ extended: true }));

// --------------------
// Security & Logs
// --------------------
app.use(morgan("dev"));
app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        "default-src": ["'self'"],
        "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'", "https://www.googletagmanager.com", "https://*.googletagmanager.com", "https://www.google-analytics.com", "https://*.google-analytics.com", "https://www.clarity.ms", "https://*.clarity.ms", "https://c.bing.com", "https://*.bing.com"],
        "style-src": ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com", "https://*.googleapis.com"],
        "img-src": ["'self'", "data:", "https://www.googletagmanager.com", "https://*.googletagmanager.com", "https://www.google-analytics.com", "https://*.google-analytics.com", "https://www.google.com", "https://*.google.com", "https://nytsolvers.com", "https://*.nytsolvers.com", "https://c.bing.com", "https://*.bing.com"],
        "connect-src": ["'self'", "https://api.nytsolvers.com", "https://*.nytsolvers.com", "https://api.dictionaryapi.dev", "https://api.datamuse.com", "https://*.google-analytics.com", "https://analytics.google.com", "https://*.analytics.google.com", "https://stats.g.doubleclick.net", "https://www.googletagmanager.com", "https://*.googletagmanager.com", "https://*.clarity.ms", "https://c.bing.com", "https://*.bing.com"],
        "font-src": ["'self'", "https://fonts.gstatic.com", "https://*.gstatic.com"],
        "frame-src": ["'self'", "https://www.googletagmanager.com", "https://*.googletagmanager.com"],
        "upgrade-insecure-requests": [],
      },
    },
    crossOriginEmbedderPolicy: false,
  })
);

if (process.env.NODE_ENV !== "production") {
  app.use((req, res, next) => {
    res.setHeader("X-Robots-Tag", "noindex, nofollow");
    next();
  });
}

// --------------------
// Static Images
// --------------------
app.use(
  "/images",
  express.static("/var/www/nytsolvers/images", {
    setHeaders: (res) => {
      const origin = res.req.headers.origin;
      if (origin && allowedOrigins.includes(origin)) {
        res.setHeader("Access-Control-Allow-Origin", origin);
        res.setHeader("Access-Control-Allow-Credentials", "true");
      }
    },
  })
);

// --------------------
// Static Frontend
// --------------------
app.use(
  "/",
  express.static("/var/www/nytsolvers", {
    setHeaders: (res) => {
      const origin = res.req.headers.origin;
      if (origin && allowedOrigins.includes(origin)) {
        res.setHeader("Access-Control-Allow-Origin", origin);
        res.setHeader("Access-Control-Allow-Credentials", "true");
      }
    },
  })
);

// --------------------
// Public Folder
// --------------------
app.use(express.static(path.join(__dirname, "../public")));

// --------------------
// API Routes
// --------------------
app.use("/api", routes);

// --------------------
// CORS Error Handler
// --------------------
app.use((err: any, req: any, res: any, next: any) => {
  if (err.message?.includes("CORS blocked")) {
    console.error(err.message);
    return res.status(403).json({
      success: false,
      message: err.message,
    });
  }
  next(err);
});

export default app;