server.js

require('dotenv').config();
const express = require('express');
const cors = require('cors');
const path = require('path');
const fs = require('fs');
const jwt = require('jsonwebtoken');
const database = require('./database');
const scraper = require('./scraper');
const auditor = require('./auditor');
const aiEngine = require('./aiEngine');
const integrations = require('./integrations');

const app = express();
const PORT = process.env.PORT || 3000;
const JWT_SECRET = process.env.JWT_SECRET || 'leadforge_secure_jwt_secret_token_2026';

// Trust reverse proxy headers (Railway, Render, Koyeb all sit behind proxies)
app.set('trust proxy', 1);

// Security headers middleware
app.use((req, res, next) => {
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-Frame-Options', 'DENY');
  res.setHeader('X-XSS-Protection', '1; mode=block');
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
  if (process.env.NODE_ENV === 'production') {
    res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  }
  next();
});

// Enable CORS and JSON parsing
app.use(cors());
app.use(express.json());

// Serve static frontend files from 'public' directory
app.use(express.static(path.join(__dirname, 'public')));


/**
 * Structured File-based Error Logging
 */
function logError(message) {
  try {
    const logLine = `[${new Date().toISOString()}] ${message}\n`;
    fs.appendFileSync(path.join(__dirname, 'server.log'), logLine, 'utf8');
  } catch (e) {
    console.error('Failed writing to server.log:', e.message);
  }
}

/**
 * Custom In-Memory Rate Limiting Middleware
 */
const rateLimitMap = new Map();
const rateLimiter = (limit = 60, windowMs = 60000) => (req, res, next) => {
  const ip = req.headers['x-forwarded-for'] || req.socket.remoteAddress || 'unknown-ip';
  const now = Date.now();
  
  if (!rateLimitMap.has(ip)) {
    rateLimitMap.set(ip, []);
  }
  
  const requests = rateLimitMap.get(ip).filter(timestamp => now - timestamp < windowMs);
  requests.push(now);
  rateLimitMap.set(ip, requests);
  
  if (requests.length > limit) {
    logError(`Rate limit exceeded for IP: ${ip} on route: ${req.originalUrl}`);
    return res.status(429).json({ error: 'Too many requests. Please try again later.' });
  }
  next();
};

/**
 * Authentication Middleware using JWT
 */
const authenticate = (req, res, next) => {
  try {
    const authHeader = req.headers['authorization'];
    if (!authHeader) {
      return res.status(401).json({ error: 'Authentication required. Token missing.' });
    }
    
    let token = authHeader;
    if (authHeader.startsWith('Bearer ')) {
      token = authHeader.substring(7);
    }
    
    const decoded = jwt.verify(token, JWT_SECRET);
    const user = database.findUserById(decoded.id);
    
    if (!user) {
      return res.status(401).json({ error: 'Session has expired. Please log in again.' });
    }
    
    req.user = user;
    next();
  } catch (error) {
    logError(`[Auth Middleware Error]: ${error.message}`);
    res.status(401).json({ error: 'Invalid or expired session token. Please log in again.' });
  }
};

/**
 * Admin Authentication Middleware
 */
const requireAdmin = (req, res, next) => {
  if (req.user && req.user.role === 'admin') {
    next();
  } else {
    res.status(403).json({ error: 'Access denied. Administrator privileges required.' });
  }
};

// --- GOOGLE & GMAIL ENDPOINTS ---
const authRoutes = require('./routes/google/authRoutes')(authenticate);
const gmailRoutes = require('./routes/gmail/gmailRoutes')(authenticate);
const sdrRoutes = require('./routes/sdr/sdrRoutes')(authenticate);
const ceoRoutes = require('./routes/ceo/ceoRoutes')(authenticate);
const backupRoutes = require('./routes/admin/backupRoutes')(authenticate, requireAdmin);
app.use(authRoutes);
app.use(gmailRoutes);
app.use(sdrRoutes);
app.use(ceoRoutes);
app.use(backupRoutes);

// --- AUTHENTICATION ROUTES ---

app.post('/api/auth/register', rateLimiter(5, 60000), (req, res) => {
  const { email, password, referrerId } = req.body;
  if (!email || !password) {
    return res.status(400).json({ error: 'Email and password are required.' });
  }

  // Email validation regex check
  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  if (!emailRegex.test(email)) {
    return res.status(400).json({ error: 'Invalid email address format.' });
  }

  // Password length restriction
  if (password.length < 6 || password.length > 60) {
    return res.status(400).json({ error: 'Password must be between 6 and 60 characters.' });
  }

  try {
    const result = database.registerUser(email, password, referrerId);
    if (!result.success) {
      return res.status(400).json({ error: result.message });
    }
    
    // Auto-login: Generate JWT token immediately on registration
    const user = result.user;
    const token = jwt.sign({ id: user.id, email: user.email, role: user.role }, JWT_SECRET, { expiresIn: '24h' });
    
    res.status(201).json({ 
      message: 'User registered and logged in successfully.',
      token,
      user: {
        id: user.id,
        email: user.email,
        role: user.role,
        isPaid: user.isPaid,
        credits: user.credits
      }
    });
  } catch (error) {
    logError(`[Registration Error] ${error.message}`);
    res.status(500).json({ error: 'Registration failed due to server error.' });
  }
});

app.post('/api/auth/login', rateLimiter(10, 60000), (req, res) => {
  const { email, password } = req.body;
  if (!email || !password) {
    return res.status(400).json({ error: 'Email and password are required.' });
  }
  try {
    const user = database.findUserByEmail(email);
    if (!user || !database.verifyPassword(password, user.password)) {
      return res.status(401).json({ error: 'Invalid email or password.' });
    }
    
    // Generate JWT token
    const token = jwt.sign({ id: user.id, email: user.email, role: user.role }, JWT_SECRET, { expiresIn: '24h' });
    
    res.json({
      message: 'Login successful.',
      token,
      user: {
        id: user.id,
        email: user.email,
        role: user.role,
        isPaid: user.isPaid,
        credits: user.credits
      }
    });
  } catch (error) {
    logError(`[Login Error] ${error.message}`);
    res.status(500).json({ error: 'Login failed due to server error.' });
  }
});

app.get('/api/auth/me', authenticate, (req, res) => {
  res.json({
    user: {
      id: req.user.id,
      email: req.user.email,
      role: req.user.role,
      isPaid: req.user.isPaid,
      credits: req.user.credits
    }
  });
});

app.post('/api/auth/password/reset', authenticate, (req, res) => {
  const { currentPass, newPass } = req.body;
  if (!currentPass || !newPass) {
    return res.status(400).json({ error: 'Current password and new password are required.' });
  }

  if (newPass.length < 6 || newPass.length > 60) {
    return res.status(400).json({ error: 'Password must be between 6 and 60 characters.' });
  }

  try {
    const user = database.findUserById(req.user.id);
    if (!user || !database.verifyPassword(currentPass, user.password)) {
      return res.status(401).json({ error: 'Incorrect current password.' });
    }

    database.updateUserPassword(req.user.id, newPass);
    database.writeAuditLog(req.user.id, 'PASSWORD_RESET', 'success', {});

    res.json({ success: true, message: 'Password updated successfully.' });
  } catch (error) {
    res.status(500).json({ error: 'Failed to reset password.' });
  }
});

// --- LEADS & AUDITING ROUTES ---

// In-memory query caching layer (1 hour lifetime)
const searchCache = new Map();

app.post('/api/leads/search', authenticate, async (req, res) => {
  const { query } = req.body;
  if (!query) {
    return res.status(400).json({ error: 'Search query is required.' });
  }
  
  const cacheKey = query.trim().toLowerCase();
  const now = Date.now();
  
  try {
    // Reset and increment daily searches count
    database.checkAndResetDailySearches(req.user.id);
    database.incrementUserStat(req.user.id, 'searchesTodayCount', 1);

    // Check cache
    if (searchCache.has(cacheKey)) {
      const cached = searchCache.get(cacheKey);
      if (now - cached.timestamp < 3600000) { // 1 hour window
        return res.json({ query, leads: cached.leads, cached: true });
      }
    }

    const leads = await scraper.scrapeLeads(query);

    // Update cache
    if (leads.length > 0) {
      searchCache.set(cacheKey, { leads, timestamp: now });
    }

    // Increment leads found stats
    if (leads.length > 0) {
      database.incrementUserStat(req.user.id, 'leadsFoundCount', leads.length);
    }

    res.json({ query, leads });
  } catch (error) {
    logError(`[Search Route Error]: ${error.message}`);
    res.status(500).json({ error: 'Failed to search leads due to a scraping error.' });
  }
});

app.post('/api/leads/audit', authenticate, async (req, res) => {
  const { url, title } = req.body;
  if (!url) {
    return res.status(400).json({ error: 'Website URL is required for audit.' });
  }

  try {
    const user = req.user;
    
    // Check if user has credits
    if (!user.isPaid && user.credits <= 0) {
      return res.status(403).json({ 
        error: 'Out of free credits. Please upgrade to premium for unlimited website audits.',
        code: 'OUT_OF_CREDITS'
      });
    }

    // Run the audit
    const auditResults = await auditor.auditWebsite(url);

    // Deduct credit for non-paid users
    if (!user.isPaid) {
      database.deductCredit(user.id);
    }

    // Increment audits completed and emails stats
    database.incrementUserStat(user.id, 'auditsCompletedCount', 1);
    if (user.isPaid) {
      database.incrementUserStat(user.id, 'emailsGeneratedCount', 3); // 3 templates generated
    }

    // Refresh user state to return updated credits
    const updatedUser = database.findUserById(user.id);

    // If user is FREE, obscure contact and custom script
    let processedAudit = JSON.parse(JSON.stringify(auditResults));
    
    // Extract clean domain for message strings
    const domain = url.replace(/https?:\/\/(www\.)?/, '').replace(/\/$/, '');
    
    // Generate AI Insights
    const aiInsights = await aiEngine.generateInsights(auditResults, title || 'Business Owner');
    
    if (!updatedUser.isPaid) {
      // Obscure emails
      if (processedAudit.contacts && processedAudit.contacts.emails) {
        processedAudit.contacts.emails = processedAudit.contacts.emails.map(email => {
          const parts = email.split('@');
          if (parts.length === 2) {
            const name = parts[0];
            return name.substring(0, 2) + '***@' + parts[1];
          }
          return '***@email.com';
        });
      }
      
      // Obscure phone numbers
      if (processedAudit.contacts && processedAudit.contacts.phones) {
        processedAudit.contacts.phones = processedAudit.contacts.phones.map(phone => {
          return phone.substring(0, 4) + '******' + phone.substring(phone.length - 2);
        });
      }

      // Generate locked AI Insights
      processedAudit.ai = {
        locked: true,
        wellDone: aiInsights.wellDone,
        improvements: aiInsights.improvements.map(imp => ({
          item: imp.item,
          desc: imp.desc,
          impact: 'Upgrade to Premium to view impact analysis'
        })),
        estimatedImpact: 'Upgrade to Premium to view AI Estimated Impact analysis',
        suggestedServices: ['Upgrade to view suggested service packages'],
        salesAngle: 'Upgrade to view targeted sales hooks',
        estimatedProjectValueInr: 0,
        coldEmail: `Unlock Premium to view the custom B2B outreach email pitch for ${domain}!`,
        linkedinMessage: `Unlock Premium to view the LinkedIn message hook for ${domain}!`,
        followUpEmail: `Unlock Premium to view the follow-up outreach email copy!`,
        objections: []
      };
      processedAudit.pitch = processedAudit.ai.coldEmail;
    } else {
      processedAudit.ai = aiInsights;
      processedAudit.pitch = aiInsights.coldEmail;
    }

    // Save history
    database.saveSearchResult(user.id, url, [processedAudit]);

    res.json({
      audit: processedAudit,
      user: {
        id: updatedUser.id,
        isPaid: updatedUser.isPaid,
        credits: updatedUser.credits
      }
    });

  } catch (error) {
    res.status(500).json({ error: 'Failed to process website audit.' });
  }
});

app.get('/api/leads/history', authenticate, (req, res) => {
  try {
    const history = database.getUserSearches(req.user.id);
    res.json({ history });
  } catch (error) {
    res.status(500).json({ error: 'Failed to fetch search history.' });
  }
});

app.get('/api/leads/history/:id', authenticate, (req, res) => {
  try {
    const searchResult = database.getSearchResult(req.params.id);
    if (!searchResult) {
      return res.status(404).json({ error: 'Search history record not found.' });
    }
    // Verify ownership
    if (searchResult.userId !== req.user.id && req.user.role !== 'admin') {
      return res.status(403).json({ error: 'Access denied to this audit log.' });
    }
    res.json({ audit: searchResult.leads[0] });
  } catch (error) {
    res.status(500).json({ error: 'Failed to fetch search details.' });
  }
});

// --- DASHBOARD & CRM ROUTES ---

app.get('/api/dashboard/stats', authenticate, (req, res) => {
  try {
    const user = database.findUserById(req.user.id);
    const crmLeads = database.getCrmLeads(user.id);
    const savedCount = crmLeads.length;
    const favoriteCount = crmLeads.filter(l => l.isFavorite).length;
    const searchesToday = database.checkAndResetDailySearches(user.id);
    const recentSearches = database.getUserSearches(user.id).slice(0, 5);

    const totalPipelineValue = crmLeads.reduce((sum, l) => sum + (l.projectValue || 0), 0);
    const wonPipelineValue = crmLeads.filter(l => l.status === 'Won').reduce((sum, l) => sum + (l.projectValue || 0), 0);

    // Phase 2: CRM & Campaign Analytics
    const drafts = database.getDrafts ? database.getDrafts(user.id) : [];
    const emailsSent = drafts.filter(d => d.status === 'Sent' || d.status === 'Published' || d.status === 'Approved').length;
    const repliesReceived = drafts.filter(d => d.status === 'Replied' || d.status === 'Opened').length;
    const conversionRate = savedCount > 0 
      ? Math.round((crmLeads.filter(l => l.status === 'Won').length / savedCount) * 100) 
      : 0;

    const industryCounts = {};
    crmLeads.forEach(l => {
      const ind = l.industry || 'Local Business';
      industryCounts[ind] = (industryCounts[ind] || 0) + 1;
    });
    const topIndustries = Object.entries(industryCounts)
      .sort((a, b) => b[1] - a[1])
      .slice(0, 3)
      .map(entry => entry[0])
      .join(', ') || 'None';

    res.json({
      stats: {
        searchesToday,
        creditsRemaining: user.isPaid ? 'Unlimited' : user.credits,
        leadsFound: user.leadsFoundCount || savedCount,
        auditsCompleted: user.auditsCompletedCount || savedCount,
        emailsGenerated: user.emailsGeneratedCount || drafts.length,
        emailsSent,
        repliesReceived,
        conversionRate,
        topIndustries,
        savedLeads: savedCount,
        favoriteLeads: favoriteCount,
        totalPipelineValue,
        wonPipelineValue
      },
      recentActivity: recentSearches
    });
  } catch (error) {
    res.status(500).json({ error: 'Failed to fetch dashboard stats.' });
  }
});

app.get('/api/crm/leads', authenticate, (req, res) => {
  try {
    const leads = database.getCrmLeads(req.user.id);
    res.json({ leads });
  } catch (error) {
    res.status(500).json({ error: 'Failed to fetch CRM leads.' });
  }
});

app.post('/api/crm/leads', authenticate, (req, res) => {
  try {
    const result = database.saveCrmLead(req.user.id, req.body);
    if (!result.success) {
      return res.status(400).json({ error: result.message });
    }
    // Increment stats count
    database.incrementUserStat(req.user.id, 'leadsFoundCount', 1);
    res.status(201).json({ message: 'Lead saved to CRM pipeline successfully.', lead: result.lead });
  } catch (error) {
    res.status(500).json({ error: 'Failed to save lead to CRM.' });
  }
});

app.patch('/api/crm/leads/:id', authenticate, (req, res) => {
  const leadId = req.params.id;
  try {
    const result = database.updateCrmLead(req.user.id, leadId, req.body);
    if (!result.success) {
      return res.status(400).json({ error: result.message });
    }
    res.json({ message: 'Lead updated successfully.', lead: result.lead });
  } catch (error) {
    res.status(500).json({ error: 'Failed to update CRM lead.' });
  }
});

app.delete('/api/crm/leads/:id', authenticate, (req, res) => {
  const leadId = req.params.id;
  try {
    const result = database.deleteCrmLead(req.user.id, leadId);
    if (!result.success) {
      return res.status(400).json({ error: result.message });
    }
    res.json({ message: 'Lead removed from CRM pipeline.' });
  } catch (error) {
    res.status(500).json({ error: 'Failed to delete CRM lead.' });
  }
});


// --- PAYMENT TRANSACTIONS ROUTES ---

app.post('/api/pay/submit', authenticate, (req, res) => {
  const { utr, amount, plan } = req.body;
  if (!utr || !amount || !plan) {
    return res.status(400).json({ error: 'UTR (Transaction ID), amount, and plan selection are required.' });
  }
  try {
    const result = database.submitTransaction(req.user.id, utr, amount, plan);
    if (!result.success) {
      return res.status(400).json({ error: result.message });
    }
    res.status(201).json({ message: 'Transaction submitted successfully for verification.', transaction: result.transaction });
  } catch (error) {
    res.status(500).json({ error: 'Failed to submit payment transaction details.' });
  }
});

app.get('/api/pay/history', authenticate, (req, res) => {
  try {
    const txs = database.getAllTransactions().filter(t => t.userId === req.user.id);
    res.json({ transactions: txs });
  } catch (error) {
    res.status(500).json({ error: 'Failed to fetch transaction logs.' });
  }
});

app.post('/api/pay/coupon', authenticate, (req, res) => {
  const { code } = req.body;
  if (!code) {
    return res.status(400).json({ error: 'Coupon code is required.' });
  }
  try {
    const result = database.applyCoupon(req.user.id, code);
    if (!result.success) {
      return res.status(400).json({ error: result.message });
    }
    res.json({ message: result.message, user: result.user });
  } catch (error) {
    logError(`[Coupon Error]: ${error.message}`);
    res.status(500).json({ error: 'Failed to process coupon.' });
  }
});

// --- ADMIN ROUTES ---

app.get('/api/admin/transactions', authenticate, requireAdmin, (req, res) => {
  try {
    const txs = database.getAllTransactions();
    res.json({ transactions: txs });
  } catch (error) {
    res.status(500).json({ error: 'Failed to fetch transaction requests.' });
  }
});

app.post('/api/admin/transactions/approve', authenticate, requireAdmin, (req, res) => {
  const { txId } = req.body;
  if (!txId) {
    return res.status(400).json({ error: 'Transaction ID is required.' });
  }
  try {
    const result = database.approveTransaction(txId);
    if (!result.success) {
      return res.status(400).json({ error: result.message });
    }
    res.json({ message: 'Transaction approved. User upgraded to Premium.', transaction: result.transaction });
  } catch (error) {
    res.status(500).json({ error: 'Approval operation failed.' });
  }
});

app.post('/api/admin/transactions/reject', authenticate, requireAdmin, (req, res) => {
  const { txId } = req.body;
  if (!txId) {
    return res.status(400).json({ error: 'Transaction ID is required.' });
  }
  try {
    const result = database.rejectTransaction(txId);
    if (!result.success) {
      return res.status(400).json({ error: result.message });
    }
    res.json({ message: 'Transaction rejected successfully.', transaction: result.transaction });
  } catch (error) {
    res.status(500).json({ error: 'Rejection operation failed.' });
  }
});

// Serve frontend routing fallback
// Removed catch-all routing fallback to bypass path-to-regexp parsing errors.
// Static file server handles index.html root serving.

/**
 * Generate highly personalized cold outreach script based on audit failures
 */
function generateOutreachScript(businessName, url, audit) {
  const name = businessName === 'Business Owner' ? 'there' : businessName;
  const domain = url.replace(/https?:\/\/(www\.)?/, '').replace(/\/$/, '');

  let flawsList = [];
  if (audit.speedRating === 'Slow') {
    flawsList.push(`• Slow Load Time: The page takes ${Math.round(audit.responseTimeMs / 100) / 10}s to load. A load time over 3s causes up to 40% of mobile searchers to leave instantly.`);
  }
  if (!audit.mobile.passed) {
    flawsList.push('• Mobile Responsiveness: Your site is missing a mobile viewport config, meaning it does not adapt correctly to phone screens. Since Google is mobile-first, this directly hurts your local ranking.');
  }
  if (!audit.seo.passed) {
    flawsList.push('• Missing SEO Metadata: The page has no search description meta tags, which makes Google show random text in search results instead of a clean, click-worthy snippet.');
  }
  if (!audit.analytics.facebookPixel) {
    flawsList.push('• No Retargeting Pixel: I noticed you do not have Facebook Pixel set up. This means you are missing out on the ability to run ads specifically targeted at people who already visited your website but did not contact you.');
  }
  if (!audit.analytics.googleAnalytics) {
    flawsList.push('• Missing Analytics: Google Analytics is not tracking your visitors. Without this data, it is impossible to see what pages are working and where your leads are droping off.');
  }

  let hook = '';
  if (flawsList.length > 0) {
    hook = `I ran a quick audit on your website (${domain}) and found a few technical opportunities to get you more clients:\n\n${flawsList.join('\n')}`;
  } else {
    hook = `I checked out your website (${domain}) and it is in decent shape! However, I noticed that you don't have Facebook Pixel installed. Running targeted local ads to retarget page visitors could easily increase your booking rate by 15-20%.`;
  }

  return `Subject: Brief website feedback for ${domain}

Hi ${name},

I came across your website (${domain}) while researching local businesses in your area.

${hook}

I specialize in fixing these exact tech bottlenecks for businesses to convert web traffic into actual paying customers. 

The fixes are relatively quick to implement, and they make a night-and-day difference in customer conversions.

I have put together a detailed outline of how we can fix these. Would you be open to a quick 5-minute chat sometime this week? No pressure, just sharing some actionable insights!

Best regards,

[Your Name]
[Your Contact Info]`;
}

// --- THIRD-PARTY OAUTH & ACCOUNT INTEGRATION API ---

app.get('/api/integrations/connect/:platform', authenticate, (req, res) => {
  const { platform } = req.params;
  try {
    const protocol = req.headers['x-forwarded-proto'] || req.protocol || 'http';
    const host = req.get('host') || 'localhost:3000';
    
    if (platform === 'reddit') {
      const customRedirectUri = process.env.REDDIT_REDIRECT_URI || `${protocol}://${host}/api/integrations/reddit/callback`;
      return res.json({ url: integrations.getRedditAuthUrl(req.user.id, customRedirectUri) });
    } else if (platform === 'email') {
      const customRedirectUri = process.env.GMAIL_REDIRECT_URI || `${protocol}://${host}/api/integrations/email/callback`;
      return res.json({ url: integrations.getEmailAuthUrl(req.user.id, customRedirectUri) });
    }
    res.status(400).json({ error: 'Invalid platform selector.' });
  } catch (err) {
    res.status(500).json({ error: 'Failed to construct redirect URL.' });
  }
});

app.get('/api/integrations/reddit/callback', async (req, res) => {
  const { code, state, error } = req.query;
  if (error) {
    return res.send(`<html><body><script>window.opener.postMessage({ type: 'oauth_error', error: '${error}' }, '*'); window.close();</script></body></html>`);
  }
  try {
    const protocol = req.headers['x-forwarded-proto'] || req.protocol || 'http';
    const host = req.get('host') || 'localhost:3000';
    const customRedirectUri = process.env.REDDIT_REDIRECT_URI || `${protocol}://${host}/api/integrations/reddit/callback`;
    
    const result = await integrations.handleRedditCallback(code, state, customRedirectUri);
    if (result.success) {
      res.send(`<html><body><script>window.opener.postMessage({ type: 'oauth_success', platform: 'reddit' }, '*'); window.close();</script></body></html>`);
    } else {
      res.send(`<html><body><script>window.opener.postMessage({ type: 'oauth_error', error: '${result.error}' }, '*'); window.close();</script></body></html>`);
    }
  } catch (err) {
    res.send(`<html><body><script>window.opener.postMessage({ type: 'oauth_error', error: '${err.message}' }, '*'); window.close();</script></body></html>`);
  }
});

app.get('/api/integrations/email/callback', async (req, res) => {
  const { code, state, error } = req.query;
  if (error) {
    return res.send(`<html><body><script>window.opener.postMessage({ type: 'oauth_error', error: '${error}' }, '*'); window.close();</script></body></html>`);
  }
  try {
    const protocol = req.headers['x-forwarded-proto'] || req.protocol || 'http';
    const host = req.get('host') || 'localhost:3000';
    const customRedirectUri = process.env.GMAIL_REDIRECT_URI || `${protocol}://${host}/api/integrations/email/callback`;
    
    const result = await integrations.handleEmailCallback(code, state, customRedirectUri);
    if (result.success) {
      res.send(`<html><body><script>window.opener.postMessage({ type: 'oauth_success', platform: 'email' }, '*'); window.close();</script></body></html>`);
    } else {
      res.send(`<html><body><script>window.opener.postMessage({ type: 'oauth_error', error: '${result.error}' }, '*'); window.close();</script></body></html>`);
    }
  } catch (err) {
    res.send(`<html><body><script>window.opener.postMessage({ type: 'oauth_error', error: '${err.message}' }, '*'); window.close();</script></body></html>`);
  }
});

app.get('/api/integrations/accounts', authenticate, (req, res) => {
  try {
    const accounts = database.getConnectedAccounts(req.user.id);
    res.json({ accounts: accounts.map(a => ({ id: a.id, platform: a.platform, username: a.username, email: a.email })) });
  } catch (err) {
    res.status(500).json({ error: 'Failed to retrieve accounts.' });
  }
});

app.delete('/api/integrations/accounts/:id', authenticate, (req, res) => {
  try {
    const result = database.deleteConnectedAccount(req.user.id, req.params.id);
    if (!result.success) return res.status(400).json({ error: result.message });
    res.json({ message: 'Account disconnected successfully.' });
  } catch (err) {
    res.status(500).json({ error: 'Failed to disconnect account.' });
  }
});

// --- CAMPAIGNS & DRAFTS MANAGEMENT ---

app.get('/api/campaigns', authenticate, (req, res) => {
  try {
    const campaigns = database.getCampaigns(req.user.id);
    res.json({ campaigns });
  } catch (err) {
    res.status(500).json({ error: 'Failed to retrieve campaigns.' });
  }
});

app.post('/api/campaigns', authenticate, (req, res) => {
  try {
    const campaign = database.saveCampaign(req.user.id, req.body);
    res.status(201).json({ message: 'Campaign saved successfully.', campaign });
  } catch (err) {
    res.status(500).json({ error: 'Failed to save campaign.' });
  }
});

app.get('/api/drafts', authenticate, (req, res) => {
  try {
    const drafts = database.getDrafts(req.user.id);
    res.json({ drafts });
  } catch (err) {
    res.status(500).json({ error: 'Failed to retrieve drafts.' });
  }
});

app.post('/api/drafts', authenticate, (req, res) => {
  try {
    const draft = database.saveDraft(req.user.id, req.body);
    res.status(201).json({ message: 'Draft saved.', draft });
  } catch (err) {
    res.status(500).json({ error: 'Failed to save draft.' });
  }
});

app.patch('/api/drafts/:id', authenticate, (req, res) => {
  try {
    const result = database.updateDraft(req.user.id, req.params.id, req.body);
    if (!result.success) return res.status(404).json({ error: result.message });
    res.json({ message: 'Draft updated successfully.', draft: result.draft });
  } catch (err) {
    res.status(500).json({ error: 'Failed to update draft.' });
  }
});

app.delete('/api/drafts/:id', authenticate, (req, res) => {
  try {
    const result = database.deleteDraft(req.user.id, req.params.id);
    if (!result.success) return res.status(404).json({ error: result.message });
    res.json({ message: 'Draft deleted.' });
  } catch (err) {
    res.status(500).json({ error: 'Failed to remove draft.' });
  }
});

app.post('/api/drafts/:id/publish', authenticate, async (req, res) => {
  try {
    const drafts = database.getDrafts(req.user.id);
    const draft = drafts.find(d => d.id === req.params.id);
    if (!draft) return res.status(404).json({ error: 'Draft not found.' });

    const accounts = database.getConnectedAccounts(req.user.id);

    if (draft.platform === 'reddit') {
      const sub = draft.metadata?.subreddit || 'test';
      const acc = accounts.find(a => a.platform === 'reddit');
      if (!acc) return res.status(400).json({ error: 'No connected Reddit account found. Connect OAuth first.' });

      const postResult = await integrations.submitRedditPost(acc, draft.title, draft.body, sub);
      if (!postResult.success) return res.status(400).json({ error: postResult.error });

      database.updateDraft(req.user.id, draft.id, { status: 'Sent', sentAt: new Date().toISOString() });
      return res.json({ message: 'Draft published to Reddit successfully!', data: postResult.data });
    } else if (draft.platform === 'email') {
      const recipient = draft.metadata?.to;
      if (!recipient) return res.status(400).json({ error: 'Recipient email address not defined in draft.' });
      
      const acc = accounts.find(a => a.platform === 'email');
      if (!acc) return res.status(400).json({ error: 'No connected outreach email account found. Connect OAuth first.' });

      const emailResult = await integrations.sendOutreachEmail(acc, recipient, draft.title, draft.body);
      if (!emailResult.success) return res.status(400).json({ error: emailResult.error });

      database.updateDraft(req.user.id, draft.id, { status: 'Sent', sentAt: new Date().toISOString() });
      return res.json({ message: 'Email outreach campaign draft sent successfully!' });
    } else if (draft.platform === 'indiehackers') {
      const result = await integrations.publishIndieHackersDraft(req.user.id, draft);
      database.updateDraft(req.user.id, draft.id, { status: 'Sent', sentAt: new Date().toISOString() });
      return res.json({ message: result.message, mode: result.mode });
    }
    res.status(400).json({ error: 'Unsupported integration platform.' });
  } catch (err) {
    res.status(500).json({ error: err.message });
  }
});

// --- CONTACTS DIRECTORY API ---

app.get('/api/contacts', authenticate, (req, res) => {
  try {
    const contacts = database.getContacts(req.user.id);
    res.json({ contacts });
  } catch (err) {
    res.status(500).json({ error: 'Failed to fetch contacts.' });
  }
});

app.post('/api/contacts', authenticate, (req, res) => {
  try {
    const contact = database.saveContact(req.user.id, req.body);
    res.status(201).json({ message: 'Contact saved successfully.', contact });
  } catch (err) {
    res.status(500).json({ error: 'Failed to save contact.' });
  }
});

app.delete('/api/contacts/:id', authenticate, (req, res) => {
  try {
    const result = database.deleteContact(req.user.id, req.params.id);
    if (!result.success) return res.status(404).json({ error: result.message });
    res.json({ message: 'Contact removed.' });
  } catch (err) {
    res.status(500).json({ error: 'Failed to remove contact.' });
  }
});

app.get('/api/outreach/unsubscribe', (req, res) => {
  const { email } = req.query;
  if (!email) return res.send('<h3>Invalid unsubscribe request</h3>');
  try {
    const state = database.loadDb();
    let updated = false;
    state.contacts.forEach(c => {
      if (c.email === email.trim().toLowerCase()) {
        c.status = 'Unsubscribed';
        updated = true;
      }
    });
    if (updated) {
      database.saveDb(state);
    }
    res.send('<html><body style="font-family: sans-serif; text-align: center; padding: 40px;"><h3>You have been successfully unsubscribed.</h3><p>You will no longer receive sales outreach campaigns from this sender.</p></body></html>');
  } catch (err) {
    res.status(500).send('<h3>Error processing unsubscribe request.</h3>');
  }
});

// --- AI ASSISTANT SALES COPILOT API ---

app.post('/api/ai/assistant/prioritize', authenticate, (req, res) => {
  try {
    const result = aiEngine.scoreAndPrioritizeLead(req.body);
    res.json(result);
  } catch (err) {
    res.status(500).json({ error: 'AI scoring failed.' });
  }
});

app.post('/api/ai/assistant/email', authenticate, async (req, res) => {
  try {
    const { type, data, tone, text } = req.body;
    if (!type) {
      return res.status(400).json({ error: 'Missing type parameter.' });
    }
    const result = await aiEngine.generateAiEmail({ type, data, tone, text });
    res.json(result);
  } catch (err) {
    console.error('[AI Assistant Email API Error]:', err.message);
    res.status(500).json({ error: 'AI Assistant query execution failed.' });
  }
});

app.post('/api/ai/assistant/summarize', authenticate, (req, res) => {
  try {
    const summary = aiEngine.summarizeConversation(req.body.notes);
    res.json({ summary });
  } catch (err) {
    res.status(500).json({ error: 'AI summarization failed.' });
  }
});

app.get('/api/admin/payments/ai-check/:txId', authenticate, requireAdmin, (req, res) => {
  try {
    const txs = database.getAllTransactions();
    const targetTx = txs.find(t => t.id === req.params.txId);
    if (!targetTx) return res.status(404).json({ error: 'Transaction record not found.' });

    const checkResult = aiEngine.verifyPaymentUTR(targetTx.utr, txs, targetTx.id);
    res.json({ check: checkResult });
  } catch (err) {
    res.status(500).json({ error: 'AI Payment Verification check failed.' });
  }
});

// --- SECURE AUDIT LOGGING & REPORTS ---

app.get('/api/admin/audit-logs', authenticate, requireAdmin, (req, res) => {
  try {
    const logs = database.getAuditLogs(req.user.id);
    res.json({ logs });
  } catch (err) {
    res.status(500).json({ error: 'Failed to fetch audit logs.' });
  }
});

app.get('/api/admin/revenue-stats', authenticate, requireAdmin, (req, res) => {
  try {
    const txs = database.getAllTransactions().filter(t => t.status === 'approved');
    const totalRev = txs.reduce((sum, t) => sum + t.amount, 0);
    
    const state = database.loadDb();
    const userCount = state.users.filter(u => u.role !== 'admin').length;
    const premiumCount = state.users.filter(u => u.isPaid && u.role !== 'admin').length;

    res.json({
      totalRevenue: totalRev,
      approvedPaymentsCount: txs.length,
      activeSubscriptionsCount: premiumCount,
      freeMembersCount: userCount - premiumCount
    });
  } catch (err) {
    res.status(500).json({ error: 'Failed to compile revenue metrics.' });
  }
});

// Background Scheduler check for drafts (every 30 seconds)
const backgroundScheduler = setInterval(() => {
  try {
    const state = database.loadDb();
    const now = Date.now();
    let updated = false;

    state.drafts.forEach(d => {
      if (d.status === 'Scheduled' && d.scheduledAt) {
        const schedTime = new Date(d.scheduledAt).getTime();
        if (schedTime <= now) {
          // Flag draft as Awaiting Approval for user review (Never auto-post without confirmation)
          d.status = 'Approved - Pending Post';
          database.writeAuditLog(d.userId, 'DRAFT_SCHEDULE_TRIGGER', 'warning', { draftId: d.id, title: d.title });
          updated = true;
        }
      }
    });

    if (updated) {
      database.saveDb(state);
    }
  } catch (err) {
    console.error('[Background Scheduler Error]', err.message);
  }
}, 30000);

// Start Server
app.listen(PORT, () => {
  console.log(`LeadForge AI is actively running on port ${PORT}`);
});