server.js

/* Terp Notes Server - UMD Resource Sharing Platform */
process.stdin.setEncoding("utf8");

/* MongoDB Connections */
const path = require("path");
require("dotenv").config({ path: path.resolve(__dirname, './.env') });

// Check for required environment variables
const requiredEnvVars = [
    'MONGO_CONNECTION_STRING',
    'MONGO_DB_NAME',
    'MONGO_FILECOLLECTION',
    'MONGO_USERCOLLECTION',
    'AWS_ACCESS_KEY_ID',
    'AWS_SECRET_ACCESS_KEY',
    'AWS_REGION',
    'AWS_S3_BUCKET'
];

const missingVars = requiredEnvVars.filter(varName => !process.env[varName]);
if (missingVars.length > 0) {
    console.error('Missing required environment variables:', missingVars.join(', '));
    console.error('Please set these variables in your .env file');
}

const uri = process.env.MONGO_CONNECTION_STRING;
const fileCollection = { db: process.env.MONGO_DB_NAME, collection: process.env.MONGO_FILECOLLECTION };
const userCollection = { db: process.env.MONGO_DB_NAME, collection: process.env.MONGO_USERCOLLECTION };
const { MongoClient, ServerApiVersion, ObjectId } = require('mongodb');
const client = new MongoClient(uri, { serverApi: ServerApiVersion.v1 });

// Dashboard Configuration (removed - using inline config)

// Helper function to safely connect to MongoDB
async function ensureConnection() {
    try {
        // Check if client is already connected
        if (client.topology && client.topology.isConnected()) {
            return;
        }

        // If not connected, establish connection
        await client.connect();
    } catch (error) {
        // If connection fails, try to create a new client
        if (error.message.includes('Topology is closed') || error.message.includes('topology')) {
            try {
                // Close the old client first
                if (client && typeof client.close === 'function') {
                    await client.close().catch(() => {}); // Ignore close errors
                }

                // Create a completely new client instance
                const newClient = new MongoClient(uri, { serverApi: ServerApiVersion.v1 });
                await newClient.connect();

                // Replace the global client reference
                Object.setPrototypeOf(client, Object.getPrototypeOf(newClient));
                Object.assign(client, newClient);

            } catch (newConnectionError) {
                console.error('Failed to create new MongoDB connection:', newConnectionError);
                throw newConnectionError;
            }
        } else {
            throw error;
        }
    }
}

/* AWS Connection */
const AWS = require('aws-sdk');
if (process.env.NODE_ENV !== 'production') {
    process.removeAllListeners('warning');
}
const s3 = new AWS.S3({
    accessKeyId: process.env.AWS_ACCESS_KEY_ID,
    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY,
    region: process.env.AWS_REGION
});
const AWS_BUCKET = process.env.AWS_S3_BUCKET;

/* VirusTotal Configuration */
const VIRUSTOTAL_API_KEY = process.env.VIRUSTOTAL_API_KEY;
const VIRUSTOTAL_ENABLED = !!VIRUSTOTAL_API_KEY;
if (VIRUSTOTAL_ENABLED) {
    console.log('VirusTotal integration enabled');
} else {
    console.log('VirusTotal integration disabled (no API key found)');
}

/* UMD.io API Configuration */
const UMD_API_BASE = 'https://api.umd.io/v1';
const UMD_API_ENABLED = true; // Public API, always available

// Helper: Fetch UMD.io data with caching & fallback
async function fetchUMDData(endpoint, cacheKey, cacheDuration = 24 * 60 * 60 * 1000) {
    try {
        const cacheClient = new MongoClient(uri, { serverApi: ServerApiVersion.v1 });
        await cacheClient.connect();

        // Check cache first
        const cached = await cacheClient
            .db(fileCollection.db)
            .collection('api_cache')
            .findOne({ key: cacheKey });

        const now = new Date();
        if (cached && (now - new Date(cached.timestamp)) < cacheDuration) {
            await cacheClient.close();
            return cached.data;
        }

        // Fetch from API
        const response = await fetch(`${UMD_API_BASE}${endpoint}`);
        if (!response.ok) throw new Error(`API returned ${response.status}`);

        const data = await response.json();

        // Update cache
        await cacheClient
            .db(fileCollection.db)
            .collection('api_cache')
            .updateOne(
                { key: cacheKey },
                { $set: { key: cacheKey, data: data, timestamp: now } },
                { upsert: true }
            );

        await cacheClient.close();
        return data;
    } catch (error) {
        console.error(`UMD.io API error (${endpoint}):`, error.message);

        // Fallback to stale cache if available
        try {
            const fallbackClient = new MongoClient(uri, { serverApi: ServerApiVersion.v1 });
            await fallbackClient.connect();
            const staleCache = await fallbackClient
                .db(fileCollection.db)
                .collection('api_cache')
                .findOne({ key: cacheKey });
            await fallbackClient.close();

            if (staleCache) {
                return staleCache.data;
            }
        } catch (fallbackError) {
            console.error('Fallback cache error:', fallbackError);
        }

        return null;
    }
}

/* Port Configuration */
const portNumber = process.env.PORT || 3000;

/* Express Setup */
const express = require("express");
const { Resend } = require('resend');
const cookieParser = require('cookie-parser');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const fetch = require('node-fetch');
const FormData = require('form-data');
const emailTemplates = require('./emails/templates');
const { validatePassword, getPasswordRequirements } = require('./utils/passwordValidator');
const { sessionTimeout } = require('./middleware/sessionTimeout');

// Integration classes
const NotionIntegration = require('./integrations/notion');
const OneNoteIntegration = require('./integrations/onenote');
const GoogleDocsIntegration = require('./integrations/google-docs');
const ObsidianIntegration = require('./integrations/obsidian');
const OAuthManager = require('./integrations/oauth-manager');
const UserIntegrationsModel = require('./models/user-integrations');

const app = express();

// Dashboard configuration endpoint (removed - no longer needed)

// Trust proxy - required for Vercel/behind reverse proxy
app.set('trust proxy', 1);

// Security headers
app.use(helmet({
    contentSecurityPolicy: false // Allow inline scripts for EJS
}));

// Rate limiters
const loginLimiter = rateLimit({
    windowMs: 2 * 60 * 1000, // 2 minutes
    max: 5, // 5 login attempts
    message: 'Too many login attempts. Please try again in 5 minutes.',
    standardHeaders: true,
    legacyHeaders: false,
});

const registerLimiter = rateLimit({
    windowMs: 60 * 60 * 1000, // 1 hour
    max: 1000, // Generous limit for testing/mistakes FINDABLE
    message: 'Too many registration attempts. Please try again in an hour.',
});

const uploadLimiter = rateLimit({
    windowMs: 60 * 60 * 1000, // 1 hour
    max: 20, // 20 upload sessions per hour
    message: 'Upload limit reached. Please try again in an hour.',
});

const apiLimiter = rateLimit({
    windowMs: 15 * 60 * 1000, // 15 minutes
    max: 100, // 100 API requests
    message: 'Too many requests. Please slow down.',
});

// Per-user daily limits (uploads and reports)
async function getStartOfTodayUtc() {
    const now = new Date();
    return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate(), 0, 0, 0, 0));
}

// Account History Logging
async function logAccountHistory(userId, action, details, adminId = null, metadata = {}) {
    try {
        await ensureConnection();

        const historyEntry = {
            userId: userId,
            action: action, // 'UPLOAD', 'DOWNLOAD', 'REPORT', 'BAN', 'UNBAN', 'ROLE_CHANGE', 'LOGIN', 'LOGOUT', etc.
            details: details, // Human-readable description
            adminId: adminId, // Who performed the action (if admin action)
            metadata: metadata, // Additional data (IP, file info, etc.)
            timestamp: new Date(),
            createdAt: new Date()
        };

        await client
            .db(fileCollection.db)
            .collection('account_history')
            .insertOne(historyEntry);

        console.log(`📝 Account history logged: ${userId} - ${action} - ${details}`);
    } catch (error) {
        console.error('Failed to log account history:', error);
        // Don't throw - history logging shouldn't break main functionality
    }
}

async function countUserUploadsToday(userid) {
    const startOfToday = await getStartOfTodayUtc();
    return client
        .db(fileCollection.db)
        .collection(fileCollection.collection)
        .countDocuments({ uploadedBy: userid, uploadDate: { $gte: startOfToday } });
}

async function countUserReportsToday(userid) {
    const startOfToday = await getStartOfTodayUtc();
    return client
        .db(fileCollection.db)
        .collection('reports')
        .countDocuments({ reportedBy: userid, reportedAt: { $gte: startOfToday } });
}

// configurable caps
const DAILY_UPLOAD_CAP = 100; // admins/managers bypass
const DAILY_REPORT_CAP = 10; // per user per day

// Content filtering - load comprehensive profanity list
let PROFANITY_LIST = [];

// Whitelist of legitimate words that contain profanity substrings
const LEGITIMATE_WORDS = new Set([
    // Names
    'harshit', 'assad', 'dickinson', 'cockburn', 'butt', 'christopher', 'helen',
    'dickens', 'assassin', 'classic', 'massive', 'passionate', 'assistance',
    'assessment', 'assertion', 'assignment', 'assumption', 'assurance',
    // Places
    'dickinson', 'cockburn', 'assam', 'christchurch', 'helena',
    // Common words
    'classic', 'massive', 'passionate', 'assistance', 'assessment', 'assertion',
    'assignment', 'assumption', 'assurance', 'assassin', 'assembly', 'assert',
    'assess', 'assign', 'assist', 'assume', 'assure', 'asset', 'assets',
]);

// Content filtering - rule-based only
// Comprehensive profanity list for rule-based filtering
PROFANITY_LIST = [
    {
        id: 'comprehensive-filter',
        match: '1 man 1 jar|1m1j|1man1jar|2 girls 1 cup|2g1c|2girls1cup|acrotomophile|acrotomophilia|alabama hot pocket|alabama tuna melt|alaskan pipeline|algophile|algophilia|anal|anal assassin|anal astronaut|anilingus|anus|ape shit|ape-shit|apeshit|apotemnophile|apotemnophilia|arse|arse bandit|arsehole|ass|ass bandit|asshole|auto erotic|autoerotic|babeland|baby batter|baby gravy|baby juice|ball batter|ball gag|ball gravy|ball kicking|ball licking|ball sack|ball sucking|ball-gag|ball-kicking|ball-licking|ball-sucking|ballcuzi|ballgag|bang bros|bang bus|bangbros|bangbus|bareback|barely legal|bastard|bastinado|batty boi|batty boy|battyboi|battyboy|bdsm|bean flicker|bean queen|bean-flicker|beaner|beaners|beanflicker|beastiality|beaver cleaver|beaver lips|beestiality|bellend|bellesa|bestiality|bicon|big boobs|big breasts|big cock|big knockers|big tits|birdlock|bitch|bitches|black cock|bloody|blow job|blow your load|blow-job|blowjob|blue waffle|bluewaffle|blumpkin|bollocks|bone smuggler|bone-smuggler|boner|bonesmuggler|boob|booty buffer|booty call|booty-buffer|boston george|breasts|brown piper|brown shower|brown showers|brown-piper|brownie king|brownie queen|brownpiper|buddha head|buddha-head|buddhahead|bufter|bufty|bugger|bukkake|bull shit|bull-shit|bulldyke|bullet vibe|bullet vibrator|bullshit|bum boy|bum chum|bum driller|bum pilot|bum pirate|bum rider|bum robber|bum rustler|bum-boy|bum-chum|bum-driller|bum-pirate|bum-robber|bumboy|bumchum|bumdriller|bumhole engineer|bumrider|bumrobber|butt boy|butt pilot|butt pirate|butt rider|butt robber|butt rustler|butt-boy|butt-pirate|butt-robber|buttboy|butthole engineer|buttrider|buttrobber|camel jockey|camel jockies|camel toe|cameljockey|cameljockies|canadian porch swing|carpet muncher|carpetmuncher|cheese eating surrender monkey|cheese-eating surrender monkey|chi chi man|chi-chi man|chicken queen|china man|china men|chinaman|chinamen|ching chong|ching-chong|chink|chinks|chinky|chocolate rosebud|chocolate rosebuds|cholerophile|cholerophilia|christ|cialis|circle-jerk|circlejerk|cishet|cissie|cissy|claustrophile|claustrophilia|cleveland accordion|cleveland hot waffle|cleveland steamer|clit|clitoris|clover clamp|clover clamps|clunge|cluster fuck|cluster-fuck|clusterfuck|cock|cockpipe cosmonaut|cockstruction worker|coimetrophile|coimetrophilia|collared|collaring|coon|coons|coprolagnia|coprophile|coprophilia|cornhole|crafty butcher|crap|cream-pie|creampie|cum|cum shot|cum shots|cumming|cumshot|cumshots|cunnilingus|cunt|cunt boy|cunt-boy|cuntboy|cunts|curry muncher|curry-muncher|currymuncher|damn|darkey|darkie|darkies|darky|date rape|daterape|ddlg|deep throat|deep-throat|deepthroat|dendrophile|dendrophilia|dick|dick girl|dick-girl|dickgirl|dildo|dildos|dingleberries|dingleberry|dipsea|dirty pillows|dirty sanchez|dishabiliophile|dishabiliophilia|dog shit|dog style|dog-shit|doggie style|doggie-style|doggiestyle|doggy style|doggy-style|doggystyle|dogshit|dolcett|domination|dominatrix|domme|dommes|donkey punch|donut muncher|donut puncher|doon coon|dooncoon|double penetration|dp action|dry hump|dune coon|dune-coon|dutch rudder|dyke|dystychiphile|dystychiphilia|edge play|edgeplay|ejaculate|ejaculated|ejaculating|ejaculation|electro-play|electroplay|emetophile|emetophilia|enby|eskimo trebuchet|eye-tie|eyetie|fag|fag bomb|fag-bomb|fagbomb|faggot|fagot|felch|felching|fellating|fellatio|female squirting|figging|finger bang|fingerbang|fingerbanging|fingered|fingering|finocchio|finoccio|finochio|fisted|fisting|foot job|foot-job|footjob|french rudder|frog eater|frog-eater|frogeater|frolic me|frolicme|frottage|frotting|fuck|fuck-wit|fucken|fucker|fuckers|fuckhead|fuckheads|fuckin|fucking|fucks|fucktard|fucktards|fuckwad|fuckwads|fuckwhit|fuckwit|fuckwits|fudge packer|fudge-packer|fudgepacker|futanari|g-spot|gang bang|gangbang|gay sex|gaysian|genitals|genitorture|gerontophile|gerontophilia|giant cock|gin jockey|gin jocky|girl on top|go-kun|goatcx|goatse|god damn|god damned|god-damn|god-damned|goddamn|goddamned|gokkun|golden shower|golden showers|golliwog|gollywog|gook|gook-eye|gookie|gooks|gooky|goregasm|gray queen|greaseball|grey queen|grope|group sex|gym bunny|gymbunny|hadji|haji|hajji|hand job|hand-job|handjob|heimie|hell|hermie|hickory switch|hippophile|hippophilia|homoerotic|honkey|honkeys|honkies|honky|horny|horse shit|horse-shit|horseshit|hot carl|hot richard|huge cock|humping|hymie|impact play|impact-play|incest|intercourse|jack off|jack-off|jail bait|jailbait|jap|jelly donut|jerk mate|jerk off|jerk-off|jerkmate|jesus|jesus christ|jigaboo|jiggerboo|jizz|juggs|jungle bunny|junglebunny|kennebunkport surprise|kentucky klondike|kentucky tractor puller|kike|kinbaku|kitty puncher|kitty-puncher|kittypuncher|knobbing|kraut|krauts|kunt|kunts|kynophile|kynophilia|lady boy|lady-boy|ladyboy|leather restraint|leather straight jacket|lemon party|lemonparty|leningrad steamer|lesbo|leso|lezzie|lezzies|light in the fedora|light in the loafers|light in the pants|limp wristed|limp-wristed|literotica|lovemaking|male squirting|male-squirting|massive cock|masterb8|masterbate|masturb8|masturbate|masturbating|masturbation|mayonnaise monkey|mayonnaise monkies|mdlb|meat masseuse|meat spin|meatspin|menage a trois|menage-a-trois|menages a trois|menages-a-trois|menophile|menophilia|mexican pancake|milwaukee blizzard|missionary position|mississippi birdbath|mound of venus|mr hands|mr. hands|mrhands|muff diver|muff diver|muff diving|muff-diver|muffdiver|muffdiver|muffdiving|muscle mary|mvtube|nambla|necrophile|necrophilia|negro|neo nazi|neo-nazi|neonazi|nig nog|nigerian hurricane|nigga|nigger|niggs|nignog|nimpho|nimphomania|nimphomaniac|nipple|nipple clamp|nipple clamps|nipples|nude|nudity|nutten|nympho|nymphomania|nymphomaniac|octopussy|oklahomo|omorashi|one cup two girls|one jar one man|one man one jar|only fans|onlyfans|orgasm|orgasmic|orgasms|paedo bear|paedobear|paedophile|paedophilia|pain slut|painslut|paki|panamanian petting zoo|pansy|panties|parthenophile|parthenophilia|pedo bear|pedobear|pedophile|pedophilia|pegging|penis|peter puffer|peter-puffer|peterpuffer|petrol sniffer|petrol-sniffer|petrolsniffer|phagophile|phagophilia|piece of shit|pieces of shit|pikey|pikeys|piss off|piss pig|piss pig|pissed off|pissing|pisspig|pisspig|playboy|pleasure chest|pnigerophile|pnigerophilia|pnigophile|pnigophilia|poinephile|poinephilia|pony boy|pony girl|pony-boy|pony-girl|pony-play|ponyboy|ponygirl|ponyplay|poof|poon|poontang|poop chute|poopchute|porn|porn hub|pornhub|porno|pornographic|pornography|pornos|potato queen|prince albert piercing|proctophile|proctophilia|pubes|punani|punany|pussy|pussy puncher|pussy-puncher|pussypuncher|queaf|queef|quim|rag head|rag heads|raghead|ragheads|raging boner|ramen yarmulke|rape|raping|rapist|rectum|retard|retarded|reverse cowgirl|rhabdophile|rhabdophilia|rhypophile|rhypophilia|rice queen|rimjob|rimming|ring raider|ringraider|rusty trombone|sand nigger|sand-nigger|sandnigger|santorum|scatophile|scatophilia|schlong|scissoring|semen|seplophile|seplophilia|sex|shaved beaver|shaved pussy|she male|she-male|sheep shagger|sheepshagger|shemale|shibari|shit|shit head|shithead|shitty|shlong|shota|shrimping|sissy|skeet|skittle harvest|skittles harvest|slant eye|slant-eye|slanteye|snatch|snowballing|sod off|sodding|sodomise|sodomist|sodomize|sodomy|spastic|spearchucker|spic|spick|spicks|spics|spicy gringo|splooge|splooge moose|spooge|spunk|strap on|strap-on|strap-on|strapon|strappado|suastika|svastika|swamp guinea|swamp-guinea|swastika|switch hitter|t-girl|taphephile|taphephilia|tea bagged|tea bagging|tea-bagged|tea-bagging|tgirl|thanatophile|thanatophilia|threesome|throating|throbbing boner|throbbing cock|thumbzilla|timber nigger|timber-nigger|timbernigger|tits|titties|titty|topless|tosser|towel head|towel-head|towelhead|trannie|tranny|transbian|traumatophile|traumatophilia|tribadism|tribbing|tub girl|tubgirl|twat|twink|two girls one cup|urethra play|urophile|urophilia|vagina|venus mound|viagra|vibrator|violet wand|vorarephile|vorarephilia|voyeurweb|wagon burner|wagon-burner|wank|wanker|wax play|wax-play|wet back|wet dream|wet-back|wetback|whigger|white power|white-power|whitepower|whore|wigga|wigger|wiitwd|wog|wogs|wolfbagging|worldsex|wrapping men|wrinkled starfish|xhamster|xnxx|xtube|xvideos|xxx|xyrophile|xyrophilia|yellow shower|yellow showers|zipper head|zipper-head|zipperhead|zippo cat|zippo-cat|zippocat|zoophile|zoophilia',
        tags: ['comprehensive'],
        severity: 3
    }
];

// Content filtering functions - rule-based only
async function containsOffensiveContent(text) {
    if (!text || typeof text !== 'string') return { found: false, entry: null };

    const lowerText = text.toLowerCase()
        .replace(/[^\w\s]/g, '') // Remove punctuation for better matching
        .replace(/\s+/g, ' ');   // Normalize whitespace

    // Check if the entire text is in the legitimate words whitelist
    if (LEGITIMATE_WORDS.has(lowerText.trim())) {
        return { found: false, entry: null };
    }

    // Rule-based detection
    const ruleBasedResult = ruleBasedDetection(text);
    if (ruleBasedResult.found) {
        return ruleBasedResult;
    }

    return { found: false, entry: null };
}

// Rule-based detection (existing system)
function ruleBasedDetection(text) {
    const lowerText = text.toLowerCase()
        .replace(/[^\w\s]/g, '') // Remove punctuation for better matching
        .replace(/\s+/g, ' ');   // Normalize whitespace

    // Check each profanity entry
    for (const entry of PROFANITY_LIST) {
        const matches = entry.match.split('|');

        for (const match of matches) {
            // Convert wildcard pattern to regex pattern
            // * means "one or more repeating characters" in this context
            let regexPattern = match.toLowerCase();

            // Handle wildcard matching: convert * to regex for repeating characters
            // First escape special characters, then convert * to +
            regexPattern = regexPattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');
            regexPattern = regexPattern.replace(/\\\*/g, '+');

            // Check if this match has exceptions and text matches an exception
            if (entry.exceptions && entry.exceptions.length > 0) {
                let hasException = false;
                for (const exception of entry.exceptions) {
                    // Exception format: * is placeholder for the matched word
                    // e.g., "*o" means "matched_word + o"
                    const baseMatch = match.toLowerCase().replace(/\*/g, '');
                    let exceptionPattern = exception.replace(/\*/g, baseMatch);

                    // Escape special regex characters
                    exceptionPattern = exceptionPattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&');

                    try {
                        const exceptionRegex = new RegExp(exceptionPattern, 'i');
                        if (exceptionRegex.test(lowerText)) {
                            hasException = true;
                            break;
                        }
                    } catch (e) {
                        // Skip invalid regex patterns
                        continue;
                    }
                }
                if (hasException) continue;
            }

            // Check for matches using the regex pattern
            try {
                // Use STRICT word boundary matching to avoid false positives
                const wordRegex = new RegExp(`\\b${regexPattern}\\b`, 'i');
                if (wordRegex.test(lowerText)) {
                    // Double-check: if this is a partial match in a legitimate word, skip it
                    const words = lowerText.split(/\s+/);
                    let isLegitimate = false;

                    for (const word of words) {
                        if (LEGITIMATE_WORDS.has(word)) {
                            isLegitimate = true;
                            break;
                        }
                    }

                    if (!isLegitimate) {
                        return { found: true, entry };
                    }
                }
            } catch (e) {
                // Skip invalid regex patterns
                continue;
            }
        }
    }

    return { found: false, entry: null };
}

async function validateContent(content, fieldName) {
    const result = await containsOffensiveContent(content);
    if (result.found) {
        const severity = result.entry.severity;
        const tags = result.entry.tags.join(', ');
        const method = result.method || 'rule-based';
        throw new Error(`${fieldName} contains inappropriate content (severity: ${severity}, tags: ${tags}, detected by: ${method}). Please use appropriate language.`);
    }
}

// Increased body size limits for file uploads
app.use(express.urlencoded({ extended: false, limit: '50mb' }));
app.use(express.json({ limit: '50mb' }));
app.use(cookieParser());
app.set("views", path.resolve(__dirname, "views"));
app.set("view engine", "ejs");

// Serve static files
app.use("/styles", express.static(path.join(__dirname, "styles")));
app.use(express.static(path.join(__dirname, "public"))); // Serve logo, favicon, etc.

/* Session Handling - JWT-based */
const session = require("express-session");
const jwt = require('jsonwebtoken');

// Configure session store for Vercel compatibility
const MongoStore = require('connect-mongo');

app.use(session({
    secret: process.env.SECRET_KEY,
    resave: false,
    saveUninitialized: false,
    rolling: true,
    name: 'terpnotes.sid',
    store: MongoStore.create({
        mongoUrl: process.env.MONGO_CONNECTION_STRING,
        touchAfter: 24 * 3600, // lazy session update
        ttl: 24 * 60 * 60 // 24 hours
    }),
    cookie: {
        // Secure flag: true for HTTPS (Vercel always uses HTTPS), false for HTTP (localhost)
        // Vercel sets VERCEL env var, or we can check if BASE_URL is HTTPS
        // Note: On Vercel preview domains, cookies MUST use secure=true because they're HTTPS
        secure: process.env.VERCEL === '1' ||
                (process.env.BASE_URL && process.env.BASE_URL.startsWith('https')) ||
                process.env.NODE_ENV === 'production' ||
                false,
        httpOnly: true,
        maxAge: 24 * 60 * 60 * 1000, // 24 hours
        sameSite: 'lax',
        path: '/'
        // Don't set domain - let it default to the request host
        // This ensures cookies work on both preview and production Vercel domains
    },
    // Force new session for each login to prevent conflicts
    genid: function(req) {
        return require('crypto').randomBytes(16).toString('hex');
    }
}));

/* CRON ENDPOINTS - Must be before session middleware */
// Cron endpoint for Vercel: Scan pending files
app.get('/api/cron/scan-pending-files', async (req, res) => {
    // Verify request is from Vercel Cron (required for security)
    const authHeader = req.get('Authorization');
    if (!process.env.CRON_SECRET) {
        return res.status(500).json({ error: 'CRON_SECRET not configured' });
    }
    if (authHeader !== `Bearer ${process.env.CRON_SECRET}`) {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    if (!VIRUSTOTAL_ENABLED) {
        return res.json({ message: 'VirusTotal disabled' });
    }

    try {
        await ensureConnection();

        // Find files pending scan (uploaded more than 1 minute ago to avoid race conditions)
        const oneMinuteAgo = new Date();
        oneMinuteAgo.setMinutes(oneMinuteAgo.getMinutes() - 1);

        const pendingFiles = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .find({
                virusScanStatus: 'pending',
                uploadDate: { $lt: oneMinuteAgo }
            })
            .limit(5) // Process max 5 files per cron run (avoid timeout)
            .toArray();

        if (pendingFiles.length === 0) {
            return res.json({ message: 'No pending scans', scanned: 0 });
        }

        console.log(`🔄 Cron: Processing ${pendingFiles.length} pending scan(s)...`);

        // Trigger scans (they run asynchronously)
        for (const file of pendingFiles) {
            try {
                const s3Key = file.filename;
                const s3Data = await s3.getObject({ Bucket: AWS_BUCKET, Key: s3Key }).promise();

                // Don't await - let it run in background
                scanFileWithVirusTotal(file._id, s3Data.Body, file.originalName).catch(err => {
                    console.error('Cron scan error:', err);
                });
            } catch (s3Error) {
                console.error('Error fetching file for scan:', s3Error);
            }
        }

        res.json({
            message: `Triggered ${pendingFiles.length} virus scan(s)`,
            scanned: pendingFiles.length
        });

    } catch (error) {
        console.error('Cron endpoint error:', error);
        res.status(500).json({ error: 'Internal server error' });
    }
});

// Session timeout middleware - MUST come after session initialization
app.use(sessionTimeout);
app.use(mobileRedirect);

/* UMD.io Data Cache Helper */
async function getCachedData(filename) {
    try {
        const fs = require('fs').promises;
        const path = require('path');
        const dataPath = path.join(__dirname, 'data', filename);
        const data = await fs.readFile(dataPath, 'utf8');
        return JSON.parse(data);
    } catch (error) {
        console.warn(`⚠️  Cache file ${filename} not found or invalid:`, error.message);
        return null;
    }
}

async function isCacheStale(cacheData, maxAgeHours = 168) { // 1 week default
    if (!cacheData || !cacheData.timestamp) return true;

    const cacheTime = new Date(cacheData.timestamp);
    const now = new Date();
    const ageHours = (now - cacheTime) / (1000 * 60 * 60);


    return ageHours > maxAgeHours;
}

/* DEPRECATED UMD.io API endpoints - using cache system only
app.get('/api/umd/search', async (req, res) => {
    try {
        const { professor, course, semester, year } = req.query;

        // Get cached data
        const cachedProfessors = await getCachedData('professors-cache.json');
        const cachedCourses = await getCachedData('courses-cache.json');

        if (!cachedProfessors || !cachedCourses ||
            (await isCacheStale(cachedProfessors, 168)) ||
            (await isCacheStale(cachedCourses, 168))) {
            return res.status(503).json({ error: 'Cache unavailable, please try again later' });
        }

        let results = {
            professors: [],
            courses: [],
            semesters: [],
            years: []
        };

        // Filter professors based on criteria
        if (professor) {
            results.professors = cachedProfessors.professors.filter(prof =>
                prof.name.toLowerCase().includes(professor.toLowerCase())
            );
        } else {
            // If no professor filter, return all professors
            results.professors = cachedProfessors.professors;
        }

        // Filter courses based on criteria
        if (course) {
            results.courses = cachedCourses.courses.filter(c =>
                c.course_id.toLowerCase().includes(course.toLowerCase()) ||
                (c.name && c.name.toLowerCase().includes(course.toLowerCase()))
            );
        } else {
            // If no course filter, return all courses
            results.courses = cachedCourses.courses;
        }

        // If we have a specific course, get its professors
        if (course && !professor) {
            const courseId = course.toUpperCase();
            results.professors = cachedProfessors.professors.filter(prof =>
                prof.semesters.some(sem => sem.course_id === courseId)
            );
        }

        // If we have a specific professor, get their courses
        if (professor && !course) {
            const prof = cachedProfessors.professors.find(p =>
                p.name.toLowerCase().includes(professor.toLowerCase())
            );
            if (prof) {
                results.courses = prof.semesters.map(sem => ({
                    course_id: sem.course_id,
                    semester: sem.semester,
                    year: sem.year
                }));
            }
        }

        // Get available semesters and years from filtered data
        const allSemesters = new Set();
        const allYears = new Set();

        if (results.professors.length > 0) {
            results.professors.forEach(prof => {
                prof.semesters.forEach(sem => {
                    allSemesters.add(sem.semester);
                    allYears.add(sem.year);
                });
            });
        }

        results.semesters = Array.from(allSemesters).sort();
        results.years = Array.from(allYears).sort((a, b) => b - a); // Most recent first

        res.json(results);
    } catch (error) {
        console.error('[FLEXIBLE SEARCH API] Error:', error);
        res.status(500).json({ error: 'Failed to perform flexible search' });
    }
});

/* UMD.io Professors API - Must be before session validation middleware */
app.get('/api/umd/professors', async (req, res) => {
    try {
        const { name, course_id, filter_semester, filter_year } = req.query;

        if (course_id) {
            // Fetch professors for a specific course with filtering
            const courseId = course_id.toUpperCase();
            const currentYear = new Date().getFullYear();

            // Try to use cached professors first
            const cachedProfessors = await getCachedData('professors-cache.json');

            if (cachedProfessors && !(await isCacheStale(cachedProfessors, 168))) { // 1 week cache
                console.log('👨‍🏫 Using cached professors data');

                // Filter professors who taught the specific course
                const courseProfessors = cachedProfessors.professors.filter(prof =>
                    prof.semesters.some(sem => sem.course_id === courseId)
                );

                // Apply semester/year filters if provided
                let filteredProfessors = courseProfessors;

                if (filter_semester || filter_year) {
                    filteredProfessors = courseProfessors.map(prof => {
                        const filteredSemesters = prof.semesters.filter(sem => {
                            if (filter_semester && sem.semester !== filter_semester) return false;
                            if (filter_year && sem.year !== parseInt(filter_year)) return false;
                            return true;
                        });

                        return {
                            name: prof.name,
                            semesters: filteredSemesters
                        };
                    }).filter(prof => prof.semesters.length > 0);
                }

                return res.json(filteredProfessors);
            }

            // Fallback to live API
            console.log('🌐 Using live API for professors');

            // Determine which semesters to fetch based on filters (same logic as course API)
            let semestersToCheck = [];

            if (filter_semester && filter_year) {
                // Specific semester and year
                const semesterMap = { 'Spring': '01', 'Summer': '05', 'Fall': '08', 'Winter': '12' };
                const semesterId = `${filter_year}${semesterMap[filter_semester] || '01'}`;
                semestersToCheck = [semesterId];
            } else if (filter_semester) {
                // All years for this semester
                const semesterMap = { 'Spring': '01', 'Summer': '05', 'Fall': '08', 'Winter': '12' };
                const semesterNum = semesterMap[filter_semester] || '01';
                for (let year = 2020; year <= currentYear; year++) {
                    semestersToCheck.push(`${year}${semesterNum}`);
                }
            } else if (filter_year) {
                // All semesters for this year
                semestersToCheck = [`${filter_year}01`, `${filter_year}05`, `${filter_year}08`, `${filter_year}12`];
            } else {
                // Default: 1 year lookback for initial course search (faster)
                const now = new Date();
                const currentYear = now.getFullYear();

                // Get semesters from 1 year ago to now for initial search
                for (let year = currentYear - 1; year <= currentYear; year++) {
                    semestersToCheck.push(`${year}01`, `${year}05`, `${year}08`, `${year}12`);
                }
            }

            // Fetch professor data for all required semesters
            const professorData = new Map(); // name -> {name, semesters: [{semester, year, semesterId}]}

            for (const semesterId of semestersToCheck) {
                try {
                    const sectionsData = await fetchUMDData(
                        `/courses/sections?course_id=${courseId}&semester=${semesterId}&per_page=100`,
                        `sections_${courseId}_${semesterId}`,
                        7 * 24 * 60 * 60 * 1000
                    );

                    if (sectionsData && sectionsData.length > 0) {
                        const professors = [...new Set(
                            sectionsData
                                .map(section => section.instructors)
                                .flat()
                                .filter(prof => prof && prof !== 'Instructor: TBA')
                        )];

                        if (professors.length > 0) {
                            // Convert semester ID to readable format
                            const year = semesterId.substring(0, 4);
                            const semesterNum = semesterId.substring(4, 6);
                            const semesterName = {
                                '01': 'Spring', '05': 'Summer', '08': 'Fall', '12': 'Winter'
                            }[semesterNum];

                            // Add professors to our data structure
                            professors.forEach(profName => {
                                if (!professorData.has(profName)) {
                                    professorData.set(profName, {
                                        name: profName,
                                        semesters: []
                                    });
                                }

                                professorData.get(profName).semesters.push({
                                    semester: semesterName,
                                    year: parseInt(year),
                                    semesterId: semesterId
                                });
                            });
                        }
                    }
                } catch (error) {
                    // Silently continue if this semester fails
                }
            }

            // Convert Map to array and sort by name
            const result = Array.from(professorData.values()).sort((a, b) => a.name.localeCompare(b.name));

            return res.json(result);

        } else if (name) {
            // Search professors by name - use the optimized UMD.io API with semester data
            try {
                const professors = await fetchUMDData(`/professors?name=${encodeURIComponent(name)}`, `professors_name_${name}`);

                if (professors && professors.length > 0) {
                    const currentYear = new Date().getFullYear();
                    const fourYearsAgo = currentYear - 4;

                    const result = professors.map(prof => {
                        // Filter taught courses to only include last 4 years
                        const recentCourses = prof.taught ? prof.taught.filter(course => {
                            const semesterYear = parseInt(course.semester.substring(0, 4));
                            return semesterYear >= fourYearsAgo;
                        }) : [];

                        // Convert semester data to our format
                        const semesters = recentCourses.map(course => {
                            const semesterId = course.semester;
                            const year = parseInt(semesterId.substring(0, 4));
                            const semesterNum = semesterId.substring(4, 6);
                            const semesterName = {
                                '01': 'Spring', '05': 'Summer', '08': 'Fall', '12': 'Winter'
                            }[semesterNum];

                            return {
                                semester: semesterName,
                                year: year,
                                semesterId: semesterId,
                                course_id: course.course_id
                            };
                        });

                        return {
                            name: prof.name,
                            semesters: semesters
                        };
                    }).filter(p => p.name && p.name.trim());

                    return res.json(result);
                } else {
                    return res.json([]);
                }
            } catch (error) {
                console.error('Error fetching professor data:', error);
                return res.json([]);
            }
        } else {
            // No specific search - return all professors from recent semesters

            // Fetch professors from last 2 years (current and previous year)
            const currentYear = new Date().getFullYear();
            const semestersToCheck = [];

            // Add current and previous year semesters
            for (let year = currentYear - 1; year <= currentYear; year++) {
                semestersToCheck.push(`${year}01`, `${year}05`, `${year}08`, `${year}12`);
            }


            // Fetch professor data for recent semesters
            const professorData = new Map(); // name -> {name, semesters: [{semester, year, semesterId}]}

            for (const semesterId of semestersToCheck) {
                try {
                    const sectionsData = await fetchUMDData(
                        `/courses/sections?semester=${semesterId}&per_page=100`,
                        `sections_${semesterId}`,
                        7 * 24 * 60 * 60 * 1000
                    );

                    if (sectionsData && sectionsData.length > 0) {
                        const professors = [...new Set(
                            sectionsData
                                .map(section => section.instructors)
                                .flat()
                                .filter(prof => prof && prof !== 'Instructor: TBA')
                        )];

                        if (professors.length > 0) {
                            // Convert semester ID to readable format
                            const year = semesterId.substring(0, 4);
                            const semesterNum = semesterId.substring(4, 6);
                            const semesterName = {
                                '01': 'Spring', '05': 'Summer', '08': 'Fall', '12': 'Winter'
                            }[semesterNum];

                            // Add professors to our data structure
                            professors.forEach(profName => {
                                if (!professorData.has(profName)) {
                                    professorData.set(profName, {
                                        name: profName,
                                        semesters: []
                                    });
                                }

                                professorData.get(profName).semesters.push({
                                    semester: semesterName,
                                    year: parseInt(year),
                                    semesterId: semesterId
                                });
                            });
                        }
                    }
                } catch (error) {
                }
            }

            // Convert Map to array and sort by name
            const result = Array.from(professorData.values()).sort((a, b) => a.name.localeCompare(b.name));

            return res.json(result);
        }
    } catch (error) {
        console.error('[PROF API] Error:', error);
        res.status(500).json({ error: 'Failed to fetch professors' });
    }
});

// API: Get courses taught by a specific professor
app.get('/api/umd/professor-courses', async (req, res) => {
    try {
        const { professor_name, filter_semester, filter_year } = req.query;

        if (!professor_name || !professor_name.trim()) {
            return res.json([]);
        }

        const professorName = professor_name.trim();

        // Determine which semesters to fetch based on filters (same logic as other APIs)
        let semestersToCheck = [];

        if (filter_semester && filter_year) {
            // Specific semester and year
            const semesterMap = { 'Spring': '01', 'Summer': '05', 'Fall': '08', 'Winter': '12' };
            const semesterId = `${filter_year}${semesterMap[filter_semester] || '01'}`;
            semestersToCheck = [semesterId];
        } else if (filter_semester) {
            // All years for this semester
            const semesterMap = { 'Spring': '01', 'Summer': '05', 'Fall': '08', 'Winter': '12' };
            const semesterNum = semesterMap[filter_semester] || '01';
            for (let year = 2020; year <= currentYear; year++) {
                semestersToCheck.push(`${year}${semesterNum}`);
            }
        } else if (filter_year) {
            // All semesters for this year
            semestersToCheck = [`${filter_year}01`, `${filter_year}05`, `${filter_year}08`, `${filter_year}12`];
        } else {
            // Default: current semester only
            const now = new Date();
            const currentYear = now.getFullYear();
            const currentMonth = now.getMonth() + 1;

            let currentSemester;
            if (currentMonth >= 1 && currentMonth <= 5) currentSemester = 'Spring';
            else if (currentMonth >= 6 && currentMonth <= 7) currentSemester = 'Summer';
            else if (currentMonth >= 8 && currentMonth <= 12) currentSemester = 'Fall';

            const semesterMap = { 'Spring': '01', 'Summer': '05', 'Fall': '08', 'Winter': '12' };
            const currentSemesterId = `${currentYear}${semesterMap[currentSemester] || '01'}`;
            semestersToCheck = [currentSemesterId];
        }

        // Fetch course data for all required semesters
        const courseData = new Map(); // course_id -> {course_id, name, semesters: [{semester, year, semesterId}]}


        for (const semesterId of semestersToCheck) {
            try {
                const sectionsData = await fetchUMDData(
                    `/courses/sections?semester=${semesterId}&per_page=100`,
                    `sections_${semesterId}`,
                    7 * 24 * 60 * 60 * 1000
                );

                if (sectionsData && sectionsData.length > 0) {
                    // Filter sections taught by this professor
                    const professorSections = sectionsData.filter(section => {
                        return section.instructors && section.instructors.some(instructor =>
                            instructor && instructor.toLowerCase().includes(professorName.toLowerCase())
                        );
                    });

                    if (professorSections.length > 0) {
                        // Convert semester ID to readable format
                        const year = semesterId.substring(0, 4);
                        const semesterNum = semesterId.substring(4, 6);
                        const semesterName = {
                            '01': 'Spring', '05': 'Summer', '08': 'Fall', '12': 'Winter'
                        }[semesterNum];

                        // Add courses to our data structure
                        professorSections.forEach(section => {
                            const courseId = section.course_id;
                            if (!courseData.has(courseId)) {
                                courseData.set(courseId, {
                                    course_id: courseId,
                                    name: section.course_name || courseId,
                                    semesters: []
                                });
                            }

                            courseData.get(courseId).semesters.push({
                                semester: semesterName,
                                year: parseInt(year),
                                semesterId: semesterId
                            });
                        });

                    }
                }
            } catch (error) {
            }
        }

        // Convert Map to array and sort by course_id
        const result = Array.from(courseData.values()).sort((a, b) => a.course_id.localeCompare(b.course_id));

        return res.json(result);

    } catch (error) {
        console.error('[PROF-COURSES API] Error:', error);
        res.status(500).json({ error: 'Failed to fetch professor courses' });
    }
});

// New endpoint for getting specific professor data with 4-year lookback
app.get('/api/umd/professor-details', async (req, res) => {
    try {
        const { name } = req.query;

        if (!name) {
            return res.status(400).json({ error: 'Professor name is required' });
        }

        // Use the optimized /professors endpoint with name parameter (API is case-sensitive)
        const professors = await fetchUMDData(`/professors?name=${encodeURIComponent(name)}`, `professor_details_${name}`);

        if (professors && professors.length > 0) {
            const currentYear = new Date().getFullYear();
            const fourYearsAgo = currentYear - 4;

            const result = professors.map(prof => {
                // Filter taught courses to only include last 4 years
                const recentCourses = prof.taught ? prof.taught.filter(course => {
                    const semesterYear = parseInt(course.semester.substring(0, 4));
                    return semesterYear >= fourYearsAgo;
                }) : [];

                // Convert semester data to our format
                const semesters = recentCourses.map(course => {
                    const semesterId = course.semester;
                    const year = parseInt(semesterId.substring(0, 4));
                    const semesterNum = semesterId.substring(4, 6);
                    const semesterName = {
                        '01': 'Spring', '05': 'Summer', '08': 'Fall', '12': 'Winter'
                    }[semesterNum];

                    return {
                        semester: semesterName,
                        year: year,
                        semesterId: semesterId,
                        course_id: course.course_id
                    };
                });

                return {
                    name: prof.name,
                    semesters: semesters
                };
            }).filter(p => p.name && p.name.trim());

            return res.json(result[0] || null); // Return first match or null
        } else {
            // No exact match found - API is case sensitive
            console.log(`No professor found for exact name: "${name}"`);
            return res.json(null);
        }
    } catch (error) {
        console.error('Error fetching professor details:', error);
        res.status(500).json({ error: 'Failed to fetch professor details' });
    }
});

// JWT helper functions
function createToken(user) {
    return jwt.sign(user, process.env.SECRET_KEY, { expiresIn: '24h' });
}

function verifyToken(token) {
    try {
        return jwt.verify(token, process.env.SECRET_KEY);
    } catch (err) {
        return null;
    }
}

// Filename sanitization helper function
function sanitizeForHeader(filename) {
    return filename
        .replace(/[^\x20-\x7E]/g, '')
        .replace(/[\r\n\t]/g, ' ')
        .replace(/"/g, "'")
        .trim();
}

// Session validation middleware
app.use(async (req, res, next) => {
    const publicRoutes = ['/', '/login', '/register', '/loginSubmit', '/registerSubmit', '/forgot-password', '/resend-verification', '/privacy', '/terms', '/contact', '/contact/submit', '/api/umd/professors', '/api/umd/courses', '/api/umd/professor-courses', '/api/professor-cache', '/api/course-cache', '/api/semester-year-cache', '/api/optimized-cache'];
    const publicRoutesRegex = /^\/(verify|reset-password)\/.+/; // Match /verify/:token and /reset-password/:token

    const isPublicRoute = publicRoutes.includes(req.path) || publicRoutesRegex.test(req.path);
    const isApiRoute = req.path.startsWith('/api/');

    // Check if user is authenticated via session
    const sessionUser = req.session.user;

    // Public routes don't require authentication
    if (isPublicRoute) {
        return next();
    }

    // Protected routes require authentication
    if (!sessionUser && req.path !== '/logout') {
        // For API routes, return JSON error instead of redirecting
        if (isApiRoute) {
            console.log('🔧 API route without session:', req.path);
            console.log('🔧 Session data:', req.session);
            console.log('🔧 Cookies:', req.headers.cookie);
            console.log('🔧 Session user:', req.session.user);
            return res.status(401).json({ error: 'Unauthorized' });
        }
        return res.redirect('/login');
    }

    // Check if user is banned (for authenticated users)
    if (sessionUser) {
        try {
            await ensureConnection();
            const user = await client
                .db(userCollection.db)
                .collection(userCollection.collection)
                .findOne({ userid: sessionUser.userid });

            if (user && user.banStatus && user.banStatus.isBanned) {
                // Check if timed ban has expired
                if (user.banStatus.banType === 'timed' && user.banStatus.banExpiry && new Date() > user.banStatus.banExpiry) {
                    // Ban expired, revert to viewer
                    await client
                        .db(userCollection.db)
                        .collection(userCollection.collection)
                        .updateOne(
                            { userid: req.session.user.userid },
                            {
                                $set: {
                                    role: 'viewer',
                                    'banStatus.isBanned': false,
                                    'banStatus.banType': null,
                                    'banStatus.banReason': null,
                                    'banStatus.bannedAt': null,
                                    'banStatus.bannedBy': null,
                                    'banStatus.banExpiry': null
                                },
                                $push: {
                                    'banStatus.banHistory': {
                                        action: 'expired_auto_unban',
                                        timestamp: new Date(),
                                        reason: 'Timed ban expired, automatically reverted to viewer'
                                    }
                                }
                            }
                        );

                    // Update session
                    req.session.user.role = 'viewer';

                    // Send automatic unban notification email
                    try {
                        const { accountUnbannedEmail } = require('./emails/templates');
                        const emailContent = accountUnbannedEmail(user.first_name || 'User');

                        // Send email asynchronously (don't await to avoid blocking the request)
                        sendEmail(
                            user.email,
                            'Account Restored - Terp Notes',
                            emailContent
                        ).catch((err) => console.error('Failed to send automatic unban email:', err.message));
                    } catch (emailError) {
                        console.error('Error sending automatic unban notification email:', emailError);
                        // Don't fail the unban if email fails
                    }
                } else if (user.banStatus.isBanned) {
                    // User is still banned, destroy session and redirect
                    req.session.destroy();
                    res.clearCookie('authToken');
                    return res.render('error', {
                        title: "Account Banned",
                        message: `Your account has been banned. Reason: ${user.banStatus.banReason || 'Not specified'}. ${user.banStatus.banType === 'timed' && user.banStatus.banExpiry ? `Ban expires: ${new Date(user.banStatus.banExpiry).toLocaleString()}` : 'This is a permanent ban.'}`,
                        link: "/contact",
                        linkText: "Contact Support"
                    });
                }
            }
        } catch (error) {
            console.error('Error checking ban status:', error);
            // Continue if there's an error checking ban status
        }
    }

    next();
});

/* Email Handling - Resend Only */
const resend = process.env.RESEND_API_KEY ? new Resend(process.env.RESEND_API_KEY) : null;
const archiver = require('archiver');

// Test email configuration on startup

if (resend) {
    console.log('Resend email service initialized');
} else {
    console.error('Resend API key missing - email functionality will not work');
}

/**
 * Send email using Resend
 * @param {string} to - Recipient email address
 * @param {string} subject - Email subject
 * @param {string} html - HTML email content
 * @param {Array} attachments - Optional array of attachments
 * @returns {Promise} Resend response
 */
async function sendEmail(to, subject, html, attachments = []) {
    if (!resend) {
        console.error('Cannot send email: Resend not initialized');
        throw new Error('Email service not configured');
    }

    try {
        if (attachments.length > 0) {
        }

        const emailData = {
            from: 'Terp Notes <noreply@terp-notes.org>',
            to: to,
            subject: subject,
            html: html
        };

        // Add attachments if provided
        if (attachments.length > 0) {
            emailData.attachments = attachments;
        }

        const result = await resend.emails.send(emailData);

        console.log('Email ID:', result.data?.id);
        return result;

    } catch (error) {
        console.error('Failed to send email via Resend:');
        console.error('Error:', error.message);
        throw error;
    }
}

/**
 * Download file from S3 and return as buffer
 * @param {string} filename - S3 key/filename
 * @returns {Buffer} File content as buffer
 */
async function downloadFileFromS3(filename) {
    try {
        const params = {
            Bucket: AWS_BUCKET,
            Key: filename
        };

        const data = await s3.getObject(params).promise();
        return data.Body;
    } catch (error) {
        console.error(`Failed to download file from S3: ${filename}`, error);
        throw error;
    }
}

/**
 * Create zip file from multiple files
 * @param {Array} files - Array of {name, buffer} objects
 * @returns {Buffer} Zip file as buffer
 */
async function createZipFromFiles(files) {
    return new Promise((resolve, reject) => {
        const archive = archiver('zip', { zlib: { level: 9 } });
        const chunks = [];

        archive.on('data', (chunk) => chunks.push(chunk));
        archive.on('end', () => resolve(Buffer.concat(chunks)));
        archive.on('error', reject);

        files.forEach(file => {
            archive.append(file.buffer, { name: file.name });
        });

        archive.finalize();
    });
}


/* Password Hashing */
const bcrypt = require('bcrypt');

/* File Hashing for Deduplication */
const crypto = require('crypto');

// No default accounts created
// All users register as contributors
console.log('No default accounts - manually set admin via MongoDB');

// Create database indexes for performance
async function createDatabaseIndexes() {
    const indexClient = new MongoClient(uri, { serverApi: ServerApiVersion.v1 });
    try {
        await indexClient.connect();

        // Users collection indexes
        await indexClient
            .db(userCollection.db)
            .collection(userCollection.collection)
            .createIndex({ userid: 1 }, { unique: true });

        await indexClient
            .db(userCollection.db)
            .collection(userCollection.collection)
            .createIndex({ email: 1 }, { unique: true });

        await indexClient
            .db(userCollection.db)
            .collection(userCollection.collection)
            .createIndex({ role: 1 });

        await indexClient
            .db(userCollection.db)
            .collection(userCollection.collection)
            .createIndex({ isVerified: 1, createdAt: 1 }); // For cleanup queries

        // Files collection indexes
        await indexClient
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .createIndex({ classCode: 1 });

        await indexClient
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .createIndex({ major: 1 });

        await indexClient
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .createIndex({ uploadedBy: 1 });

        await indexClient
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .createIndex({ fileHash: 1 }); // For deduplication

        await indexClient
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .createIndex({ uploadDate: -1 }); // For sorting by newest

        await indexClient
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .createIndex({ virusScanStatus: 1 }); // For filtering scanned files

        // Reports collection indexes
        await indexClient
            .db(fileCollection.db)
            .collection('reports')
            .createIndex({ status: 1, reportedAt: -1 }); // For admin dashboard

        await indexClient
            .db(fileCollection.db)
            .collection('reports')
            .createIndex({ filename: 1 }); // For cascading deletes

        // Per-user/day indexes
        await indexClient
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .createIndex({ uploadedBy: 1, uploadDate: -1 });

        await indexClient
            .db(fileCollection.db)
            .collection('reports')
            .createIndex({ reportedBy: 1, reportedAt: -1 });

        // Announcements collection indexes
        await indexClient
            .db(fileCollection.db)
            .collection('announcements')
            .createIndex({ isActive: 1, createdAt: -1 }); // For dashboard queries

        console.log('Database indexes created successfully');
    } catch (error) {
        // Indexes may already exist, that's fine
        if (error.code !== 85 && error.code !== 86) {
            console.error('Error creating indexes:', error.message);
        }
    } finally {
        await indexClient.close();
    }
}

// Cleanup function: Delete unverified accounts older than 7 days
async function cleanupUnverifiedAccounts() {
    const cleanupClient = new MongoClient(uri, { serverApi: ServerApiVersion.v1 });
    try {
        await cleanupClient.connect();

        const sevenDaysAgo = new Date();
        sevenDaysAgo.setDate(sevenDaysAgo.getDate() - 7);

        const result = await cleanupClient
            .db(userCollection.db)
            .collection(userCollection.collection)
            .deleteMany({
                isVerified: false,
                createdAt: { $lt: sevenDaysAgo }
            });

        if (result.deletedCount > 0) {
            console.log(`🧹 Cleaned up ${result.deletedCount} unverified account(s) older than 7 days`);
        }
    } catch (error) {
        console.error('Error cleaning up unverified accounts:', error);
    } finally {
        await cleanupClient.close();
    }
}

// Retry failed/stuck virus scans on startup
async function retryStuckScans() {
    if (!VIRUSTOTAL_ENABLED) {
        return;
    }

    const scanRetryClient = new MongoClient(uri, { serverApi: ServerApiVersion.v1 });
    try {
        await scanRetryClient.connect();

        // Find files stuck in "pending" or "error" status for more than 10 minutes
        const tenMinutesAgo = new Date();
        tenMinutesAgo.setMinutes(tenMinutesAgo.getMinutes() - 10);

        const stuckFiles = await scanRetryClient
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .find({
                virusScanStatus: { $in: ['pending', 'error'] },
                uploadDate: { $lt: tenMinutesAgo },
                $or: [
                    { scanAttempts: { $exists: false } }, // Legacy files without scanAttempts field
                    { scanAttempts: { $lt: 5 } } // Files with less than 5 attempts
                ],
                // Exclude files with permanent error codes
                $nor: [
                    { "virusScanDetails.error": { $regex: /413|400|422|QuotaExceeded|FileTooBig/ } }
                ]
            })
            .toArray();

        if (stuckFiles.length > 0) {
            console.log(`🔄 Retrying ${stuckFiles.length} stuck virus scan(s)...`);

            for (const file of stuckFiles) {
                // Re-download file from S3 and scan
                try {
                    const s3Data = await s3.getObject({
                        Bucket: AWS_BUCKET,
                        Key: file.filename
                    }).promise();

                    scanFileWithVirusTotal(file._id, s3Data.Body, file.originalName).catch(err => {
                        console.error('Retry scan error:', err);
                    });
                } catch (s3Error) {
                    console.error('Error fetching file for retry scan:', s3Error);
                }
            }
        }
    } catch (error) {
        console.error('Error retrying stuck scans:', error);
    } finally {
        await scanRetryClient.close();
    }
}

// Run on server startup (non-blocking for Vercel serverless)
// These run in the background and won't block requests
if (process.env.NODE_ENV !== 'production') {
    // Only run these in development - Vercel Cron handles them in production
    createDatabaseIndexes().catch(err => console.error('Index creation failed:', err));
    cleanupUnverifiedAccounts().catch(err => console.error('Cleanup failed:', err));
    retryStuckScans().catch(err => console.error('Retry scans failed:', err));

    // Run cleanup every 24 hours (dev only)
    setInterval(() => {
        cleanupUnverifiedAccounts().catch(err => console.error('Cleanup failed:', err));
    }, 24 * 60 * 60 * 1000);
}

/* VirusTotal Scanning Function */
async function scanFileWithVirusTotal(fileId, fileBuffer, filename) {
    if (!VIRUSTOTAL_ENABLED) {
        console.log('VirusTotal disabled, skipping scan for:', filename);
        return;
    }

    // Check if file has already failed too many times or has permanent error codes
    try {
        await ensureConnection();
        const fileDoc = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .findOne({ _id: fileId });

        if (fileDoc) {
            const scanAttempts = fileDoc.scanAttempts || 0;
            const maxAttempts = 5;

            // Check for permanent error codes in scan details
            const hasPermanentError = fileDoc.virusScanDetails?.error &&
                (fileDoc.virusScanDetails.error.includes('413') || // File too large
                 fileDoc.virusScanDetails.error.includes('400') || // Bad request
                 fileDoc.virusScanDetails.error.includes('422') || // Unprocessable entity
                 fileDoc.virusScanDetails.error.includes('QuotaExceeded') ||
                 fileDoc.virusScanDetails.error.includes('FileTooBig'));

            if (scanAttempts >= maxAttempts || hasPermanentError) {
                console.log(`Skipping scan for ${filename}: ${hasPermanentError ? 'permanent error detected' : 'max attempts reached'} (${scanAttempts}/${maxAttempts})`);

                // Mark as permanently failed
                await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .updateOne(
                        { _id: fileId },
                        {
                            $set: {
                                virusScanStatus: 'permanently_failed',
                                virusScanDate: new Date(),
                                virusScanDetails: {
                                    ...fileDoc.virusScanDetails,
                                    reason: hasPermanentError ? 'permanent_error' : 'max_attempts_reached',
                                    attempts: scanAttempts
                                }
                            }
                        }
                    );
                return;
            }
        }
    } catch (checkError) {
        console.error('Error checking scan attempts:', checkError);
    }

    try {
        console.log(`Starting virus scan for: ${filename}`);

        // Step 1: Upload file to VirusTotal
        const formData = new FormData();
        formData.append('file', fileBuffer, filename);

        const uploadResponse = await fetch('https://www.virustotal.com/api/v3/files', {
            method: 'POST',
            headers: {
                'x-apikey': VIRUSTOTAL_API_KEY
            },
            body: formData
        });

        if (!uploadResponse.ok) {
            throw new Error(`VirusTotal upload failed: ${uploadResponse.status}`);
        }

        const uploadData = await uploadResponse.json();
        const analysisId = uploadData.data.id;

        console.log(` File uploaded to VirusTotal. Analysis ID: ${analysisId}`);

        // Step 2: Wait and check scan results (with retries)
        let scanComplete = false;
        let retries = 0;
        const maxRetries = 10;
        const retryDelay = 15000; // 15 seconds

        while (!scanComplete && retries < maxRetries) {
            await new Promise(resolve => setTimeout(resolve, retryDelay));

            const analysisResponse = await fetch(`https://www.virustotal.com/api/v3/analyses/${analysisId}`, {
                headers: {
                    'x-apikey': VIRUSTOTAL_API_KEY
                }
            });

            if (!analysisResponse.ok) {
                throw new Error(`VirusTotal analysis check failed: ${analysisResponse.status}`);
            }

            const analysisData = await analysisResponse.json();
            const status = analysisData.data.attributes.status;

            if (status === 'completed') {
                scanComplete = true;
                const stats = analysisData.data.attributes.stats;
                const malicious = stats.malicious || 0;
                const suspicious = stats.suspicious || 0;
                const totalEngines = Object.values(stats).reduce((a, b) => a + b, 0);

                console.log(`Scan complete for ${filename}: ${malicious} malicious, ${suspicious} suspicious out of ${totalEngines} engines`);

                // Update file metadata
                await ensureConnection();

                if (malicious > 0 || suspicious > 2) {
                    // File is infected - mark and delete
                    await client
                        .db(fileCollection.db)
                        .collection(fileCollection.collection)
                        .updateOne(
                            { _id: fileId },
                            {
                                $set: {
                                    virusScanStatus: 'infected',
                                    virusScanDate: new Date(),
                                    virusScanDetails: {
                                        malicious,
                                        suspicious,
                                        totalEngines,
                                        analysisId
                                    }
                                }
                            }
                        );

                    // Get file info to delete from S3
                    const fileDoc = await client
                        .db(fileCollection.db)
                        .collection(fileCollection.collection)
                        .findOne({ _id: fileId });

                    if (fileDoc) {
                        // Delete from S3
                        try {
                            await s3.deleteObject({ Bucket: AWS_BUCKET, Key: fileDoc.filename }).promise();
                            console.log(`Deleted infected file from S3: ${filename}`);
                        } catch (s3Error) {
                            console.error('Error deleting infected file from S3:', s3Error);
                        }

                        // Delete metadata
                        await client
                            .db(fileCollection.db)
                            .collection(fileCollection.collection)
                            .deleteOne({ _id: fileId });

                        console.log(`INFECTED FILE REMOVED: ${filename} (${malicious} detections)`);
                    }
                } else {
                    // File is clean
                    await client
                        .db(fileCollection.db)
                        .collection(fileCollection.collection)
                        .updateOne(
                            { _id: fileId },
                            {
                                $set: {
                                    virusScanStatus: 'clean',
                                    virusScanDate: new Date(),
                                    virusScanDetails: {
                                        malicious,
                                        suspicious,
                                        totalEngines,
                                        analysisId
                                    }
                                }
                            }
                        );

                    console.log(`File marked as clean: ${filename}`);
                }
            } else {
                retries++;
                console.log(` Scan in progress (${retries}/${maxRetries})...`);
            }
        }

        if (!scanComplete) {
            console.log(`Scan timeout for ${filename}, will remain as pending`);

            // Increment scan attempts on timeout
            try {
                await ensureConnection();
                await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .updateOne(
                        { _id: fileId },
                        {
                            $set: {
                                virusScanStatus: 'timeout',
                                virusScanDate: new Date(),
                                virusScanDetails: { error: 'Scan timeout after maximum retries' }
                            },
                            $inc: { scanAttempts: 1 }
                        }
                    );
                console.log(`Incremented scan attempts for timeout: ${filename}`);
            } catch (dbError) {
                console.error('Error updating timeout status:', dbError);
            }
        }

    } catch (error) {
        console.error(`VirusTotal scan error for ${filename}:`, error.message);

        // On error, increment scan attempts and leave file as 'pending' - don't delete
        try {
            await ensureConnection();
            await client
                .db(fileCollection.db)
                .collection(fileCollection.collection)
                .updateOne(
                    { _id: fileId },
                    {
                        $set: {
                            virusScanStatus: 'error',
                            virusScanDate: new Date(),
                            virusScanDetails: { error: error.message }
                        },
                        $inc: { scanAttempts: 1 }
                    }
                );

            console.log(`Incremented scan attempts for ${filename}`);
        } catch (dbError) {
            console.error('Error updating scan status:', dbError);
        }
    }
}

/* Upload */
const multer = require("multer");
const storage = multer.memoryStorage();

// Whitelist of safe academic file types
const ALLOWED_FILE_TYPES = {
    // Documents
    'application/pdf': ['.pdf'],
    'application/vnd.openxmlformats-officedocument.wordprocessingml.document': ['.docx'],
    'application/vnd.openxmlformats-officedocument.presentationml.presentation': ['.pptx'],
    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet': ['.xlsx'],
    'application/msword': ['.doc'],
    'application/vnd.ms-powerpoint': ['.ppt'],
    'application/vnd.ms-excel': ['.xls'],
    'text/plain': ['.txt'],
    'text/markdown': ['.md'],

    // Images
    'image/jpeg': ['.jpg', '.jpeg'],
    'image/png': ['.png'],
    'image/gif': ['.gif'],
    'image/svg+xml': ['.svg'],
    'image/webp': ['.webp'],

    // Code files (common for CS courses)
    'text/x-python': ['.py'],
    'text/x-java-source': ['.java'],
    'text/x-c': ['.c'],
    'text/x-c++': ['.cpp', '.cc', '.cxx'],
    'text/javascript': ['.js'],
    'text/html': ['.html', '.htm'],
    'text/css': ['.css'],
    'application/json': ['.json'],
    'text/x-python-script': ['.py'],
    'application/x-python-code': ['.py'],

    // Archives (only .zip for now)
    'application/zip': ['.zip'],
    'application/x-zip-compressed': ['.zip']
};

const upload = multer({
    storage: storage,
    limits: {
        fileSize: 100 * 1024 * 1024 // 100MB limit
    },
    fileFilter: (req, file, cb) => {
        const ext = '.' + file.originalname.split('.').pop().toLowerCase();
        const mimeType = file.mimetype.toLowerCase();

        // Check if file type is in whitelist
        const allowedExtensions = ALLOWED_FILE_TYPES[mimeType];

        if (allowedExtensions && allowedExtensions.includes(ext)) {
            cb(null, true);
        } else {
            // Also check by extension only (some browsers send incorrect MIME types)
            const isExtensionAllowed = Object.values(ALLOWED_FILE_TYPES)
                .flat()
                .includes(ext);

            if (isExtensionAllowed) {
                cb(null, true);
            } else {
                cb(new Error(`File type not allowed: ${ext}. Only documents, images, code files, and .zip archives are supported.`), false);
            }
        }
    }
});

/* MOBILE DETECTION MIDDLEWARE */
function isMobileDevice(req) {
    const userAgent = req.headers['user-agent'] || '';
    return /Android|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini|Mobile|mobile|CriOS/i.test(userAgent);
}

// Mobile redirect middleware
function mobileRedirect(req, res, next) {
    // Skip mobile redirect for API routes, static files, mobile routes, auth routes, and download routes
    if (req.path.startsWith('/api/') ||
        req.path.startsWith('/mobile/') ||
        req.path.startsWith('/static/') ||
        req.path.startsWith('/download/') ||
        req.path.startsWith('/bulk-download') ||
        req.path.startsWith('/login') ||
        req.path.startsWith('/register') ||
        req.path.startsWith('/logout') ||
        req.path.startsWith('/forgot-password') ||
        req.path.startsWith('/reset-password') ||
        req.path.startsWith('/verify/') ||
        req.path.includes('.')) {
        return next();
    }

    // Check if user is on mobile and not already on mobile route
    if (isMobileDevice(req)) {
        // Only redirect main pages, not auth pages or root
        // Add a small delay to prevent rapid redirects that might interfere with navigation
        if (req.path === '/dashboard' || req.path === '/admin' || req.path === '/profile') {
            // Check if this is a direct navigation (not a redirect from another page)
            if (!req.headers.referer || !req.headers.referer.includes('/mobile')) {
                return res.redirect('/mobile' + req.path);
            }
        }
    }

    next();
}

/* ROUTES */

app.get('/', function (req, res) {
    // Debug logging

    // If this is a logout redirect, force session regeneration to clear any cached data
    if (req.query.loggedout === 'true') {
        req.session.regenerate((err) => {
            if (err) {
                console.error('Session regeneration error:', err);
            } else {
            }

            // Now check again after regeneration
            if (req.session.user) {
                return res.redirect('/dashboard');
            }

            res.render('index', {
                title: "Terp Notes - Built for Terps, by Terps",
                loggedout: true
            });
        });
        return;
    }

    // Check if user is already logged in
    if (req.session.user) {
        // User is already logged in, redirect to dashboard
        return res.redirect('/dashboard');
    }

    res.render('index', {
        title: "Terp Notes - Built for Terps, by Terps",
        loggedout: req.query.loggedout === 'true'
    });
});

// Icon Test Page (for development/verification)
app.get('/icon-test', function (req, res) {
    res.render('icon-test', { title: "Icon Test - Terp Notes" });
});

// Legal Pages (accessible both logged in and logged out)
app.get('/privacy', function (req, res) {
    res.render('privacy', {
        title: "Privacy Policy - Terp Notes",
        user: req.session.user || null
    });
});

app.get('/terms', function (req, res) {
    res.render('terms', {
        title: "Terms of Service - Terp Notes",
        user: req.session.user || null
    });
});

app.get('/contact', function (req, res) {
    res.render('contact', {
        title: "Contact & Support - Terp Notes",
        user: req.session.user || null
    });
});

// Contact Form Submission

// Optimized cache endpoint
app.get('/api/optimized-cache', async (req, res) => {
    try {
        const fs = require('fs').promises;
        const cachePath = path.join(__dirname, 'data', 'optimized-cache.json');
        const cacheData = await fs.readFile(cachePath, 'utf8');
        const cache = JSON.parse(cacheData);

        // Check if cache is stale (7 days)
        const cacheAge = Date.now() - new Date(cache.metadata.generated).getTime();
        const isStale = cacheAge > (7 * 24 * 60 * 60 * 1000);

        if (isStale) {
            console.log('⚠️ Optimized cache is stale, consider updating');
        }

        console.log('✅ Serving optimized cache successfully');
        res.json(cache);
    } catch (error) {
        console.error('❌ Error serving optimized cache:', error);
        res.status(500).json({ error: 'Failed to load optimized cache' });
    }
});

// API: Get UMD courses for autocomplete
app.get('/api/umd/courses', async (req, res) => {
    try {
        const { q } = req.query;

        // Try to use cached courses first
        const cachedCourses = await getCachedData('courses-cache.json');

        if (cachedCourses && !(await isCacheStale(cachedCourses, 168))) { // 1 week cache
            console.log('📚 Using cached courses data');

            if (q && q.length >= 2) {
                // Filter courses by search query
                const filteredCourses = cachedCourses.courses.filter(course =>
                    course.course_id.toLowerCase().includes(q.toLowerCase()) ||
                    (course.name && course.name.toLowerCase().includes(q.toLowerCase()))
                );
                return res.json(filteredCourses);
            } else {
                // Return all courses if no search query
                return res.json(cachedCourses.courses);
            }
        }

        // Fallback to live API
        console.log('🌐 Using live API for courses');
        const semester = req.query.semester || '202501'; // Default to Spring 2025
        const courses = await fetchUMDData(`/courses/list?semester=${semester}&per_page=100`, `courses_${semester}`);

        if (!courses) {
            // Fallback to existing class codes from DB if API fails
            await client.connect();
            const existingCodes = await client
                .db(fileCollection.db)
                .collection(fileCollection.collection)
                .distinct('classCode');

            return res.json(existingCodes.map(code => ({ course_id: code, name: code })));
        }

        res.json(courses);
    } catch (error) {
        console.error('Error fetching courses:', error);
        res.status(500).json({ error: 'Failed to fetch courses' });
    }
});

// API: Get course details with comprehensive historical data from UMD.io
app.get('/api/umd/course/:courseId', async (req, res) => {
    try {
        const courseId = req.params.courseId.toUpperCase();

        // Get query parameters for filtering
        const querySemester = req.query.filter_semester;
        const queryYear = req.query.filter_year;

        // Determine which semesters to fetch based on filters
        let semestersToCheck = [];

        if (querySemester && queryYear) {
            // Specific semester and year
            const semesterMap = { 'Spring': '01', 'Summer': '05', 'Fall': '08', 'Winter': '12' };
            const semesterId = `${queryYear}${semesterMap[querySemester] || '01'}`;
            semestersToCheck = [semesterId];
        } else if (querySemester) {
            // All years for this semester
            const semesterMap = { 'Spring': '01', 'Summer': '05', 'Fall': '08', 'Winter': '12' };
            const semesterNum = semesterMap[querySemester] || '01';
            for (let year = 2020; year <= currentYear; year++) {
                semestersToCheck.push(`${year}${semesterNum}`);
            }
        } else if (queryYear) {
            // All semesters for this year
            semestersToCheck = [`${queryYear}01`, `${queryYear}05`, `${queryYear}08`, `${queryYear}12`];
        } else {
            // Default: current semester only (fast and efficient)
            const now = new Date();
            const currentYear = now.getFullYear();
            const currentMonth = now.getMonth() + 1; // 1-12

            // Determine current semester
            let currentSemester;
            if (currentMonth >= 1 && currentMonth <= 5) currentSemester = 'Spring';
            else if (currentMonth >= 6 && currentMonth <= 7) currentSemester = 'Summer';
            else if (currentMonth >= 8 && currentMonth <= 12) currentSemester = 'Fall';

            const semesterMap = { 'Spring': '01', 'Summer': '05', 'Fall': '08', 'Winter': '12' };
            const currentSemesterId = `${currentYear}${semesterMap[currentSemester] || '01'}`;

            semestersToCheck = [currentSemesterId];
        }

        // Fetch course info from first semester to get basic course data
        const firstSemester = semestersToCheck[0];
        const courseData = await fetchUMDData(
            `/courses/${courseId}?semester=${firstSemester}`,
            `course_${courseId}_${firstSemester}`,
            7 * 24 * 60 * 60 * 1000
        );

        if (!courseData || courseData.length === 0) {
            return res.status(404).json({ error: 'Course not found' });
        }

        const course = courseData[0];

        // Fetch professor data for all required semesters
        const historicalData = {};
        const allProfessors = new Set();
        const allSemesters = new Set();
        const allYears = new Set();


        for (const semester of semestersToCheck) {
            try {
                const sectionsData = await fetchUMDData(
                    `/courses/sections?course_id=${courseId}&semester=${semester}&per_page=100`,
                    `sections_${courseId}_${semester}`,
                    7 * 24 * 60 * 60 * 1000
                );

                if (sectionsData && sectionsData.length > 0) {
                    const professors = [...new Set(
                        sectionsData
                            .map(section => section.instructors)
                            .flat()
                            .filter(prof => prof && prof !== 'Instructor: TBA')
                    )];

                    if (professors.length > 0) {
                        // Convert semester ID to readable format
                        const year = semester.substring(0, 4);
                        const semesterNum = semester.substring(4, 6);
                        const semesterName = {
                            '01': 'Spring', '05': 'Summer', '08': 'Fall', '12': 'Winter'
                        }[semesterNum];

                        const key = `${semesterName}_${year}`;
                        historicalData[key] = professors; // Send as array, not Set

                        professors.forEach(prof => allProfessors.add(prof));
                        allSemesters.add(semesterName);
                        allYears.add(year);

                    } else {
                    }
                } else {
                }
            } catch (error) {
            }
        }

        // Convert Sets to Arrays and sort
        const professorList = [...allProfessors].sort();
        const semesterList = [...allSemesters].sort();
        const yearList = [...allYears].sort((a, b) => b - a);


        // Determine current semester for response
        const now = new Date();
        const currentYear = now.getFullYear();
        const currentMonth = now.getMonth() + 1;
        let currentSemester;
        if (currentMonth >= 1 && currentMonth <= 5) currentSemester = 'Spring';
        else if (currentMonth >= 6 && currentMonth <= 7) currentSemester = 'Summer';
        else if (currentMonth >= 8 && currentMonth <= 12) currentSemester = 'Fall';

        res.json({
            course_id: course.course_id || courseId,
            name: course.name || courseId,
            all_professors: professorList,
            filtered_professors: professorList, // Same as all_professors since we filter on server
            historical_semesters: semesterList,
            historical_years: yearList,
            historical_data: historicalData,
            current_semester: currentSemester,
            current_year: currentYear.toString(),
            description: course.description || '',
            source: 'umd_api_historical'
        });
    } catch (error) {
        console.error('[API] Error fetching course details:', error);
        res.status(500).json({ error: 'Failed to fetch course details' });
    }
});

// API: Get all UMD majors
app.get('/api/umd/majors', async (req, res) => {
    try {
        const majors = await fetchUMDData('/majors/list', 'majors_list', 30 * 24 * 60 * 60 * 1000); // Cache 30 days

        if (!majors) {
            // Fallback to existing majors from DB
            await client.connect();
            const existingMajors = await client
                .db(fileCollection.db)
                .collection(fileCollection.collection)
                .distinct('major');

            return res.json(existingMajors.map(m => ({ major_id: m, name: m })));
        }

        res.json(majors);
    } catch (error) {
        console.error('Error fetching majors:', error);
        res.status(500).json({ error: 'Failed to fetch majors' });
    }
});

// Generate presigned URL for direct S3 upload
app.post('/api/get-upload-url', async (req, res) => {
    if (!req.session.user) {
        return res.status(401).json({ error: 'Not authenticated' });
    }

    // Check if user is viewer
    if (req.session.user.role === 'viewer') {
        return res.status(403).json({ error: 'No upload permission' });
    }

    const { filename, filetype } = req.body;

    if (!filename || !filetype) {
        return res.status(400).json({ error: 'Filename and filetype required' });
    }

    // Generate unique S3 key
    const s3Key = `${Date.now()}_${Math.random().toString(36).substring(7)}_${filename}`;

    // Generate presigned URL (expires in 5 minutes)
    const presignedUrl = s3.getSignedUrl('putObject', {
        Bucket: AWS_BUCKET,
        Key: s3Key,
        ContentType: filetype,
        Expires: 300, // 5 minutes
        ACL: 'private'
    });

    res.json({
        uploadUrl: presignedUrl,
        s3Key: s3Key,
        s3Url: `https://${AWS_BUCKET}.s3.${process.env.AWS_REGION}.amazonaws.com/${s3Key}`
    });
});

// Confirm upload and save metadata after direct S3 upload
app.post('/api/confirm-upload', async (req, res) => {
    if (!req.session.user) {
        return res.status(401).json({ error: 'Not authenticated' });
    }

    // Per-user daily upload cap (admins/managers bypass)
    try {
        const user = req.session.user;
        if (user && user.role !== 'admin' && user.role !== 'manager') {
            const uploadedCount = await countUserUploadsToday(user.userid);

            console.log(`🔍 Upload cap check: User ${user.userid}, Already uploaded: ${uploadedCount}, Trying to upload: 1, Limit: ${DAILY_UPLOAD_CAP}`);

            if (uploadedCount >= DAILY_UPLOAD_CAP) {
                return res.status(429).json({
                    error: `Upload limit reached! You have uploaded ${uploadedCount} files today. Your daily limit is ${DAILY_UPLOAD_CAP} files. Please try again tomorrow.`
                });
            }
        }
    } catch (limitErr) {
        console.warn('Upload cap check failed, continuing:', limitErr?.message);
    }

    const {
        s3Key,
        s3Url,
        filename,
        filetype,
        filesize,
        fileHash,
        classCode,
        major,
        professor,
        semester,
        year,
        category,
        description
    } = req.body;


    if (!s3Key || !s3Url || !filename || !classCode || !fileHash) {
        return res.status(400).json({ error: 'Missing required fields' });
    }

    try {
        await ensureConnection();

        // Check for contextual duplicates (same content AND same context)
        const normalizedClassCode = classCode.trim().toUpperCase();
        const normalizedSemester = semester ? semester.trim() : '';
        const normalizedYear = year ? year.trim() : '';
        const normalizedProfessor = professor ? professor.trim() : '';

        const existingFile = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .findOne({
                fileHash: fileHash,
                classCode: normalizedClassCode,
                semester: normalizedSemester,
                year: normalizedYear,
                professor: normalizedProfessor
            });

        if (existingFile) {
            // Delete newly uploaded file from S3 (it's a contextual duplicate)
            await s3.deleteObject({ Bucket: AWS_BUCKET, Key: s3Key }).promise();

            return res.json({
                success: true,
                duplicate: true,
                message: 'File already exists in this context',
                existingFile: existingFile
            });
        }

        // Check if file exists in different context (same content, different metadata)
        const existingFileDifferentContext = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .findOne({ fileHash: fileHash });

        if (existingFileDifferentContext) {
            // File exists but in different context - reuse S3 file, create new metadata entry
        }

        // Determine S3 file to use and whether to delete the new upload
        let finalS3Key = s3Key;
        let finalS3Url = s3Url;
        let shouldDeleteNewS3File = false;

        if (existingFileDifferentContext) {
            // Reuse existing S3 file from different context
            finalS3Key = existingFileDifferentContext.filename;
            finalS3Url = existingFileDifferentContext.s3Url;
            shouldDeleteNewS3File = true;
        }

        // Save file metadata
        const fileMeta = {
            filename: finalS3Key,
            originalName: filename,
            s3Url: finalS3Url,
            mimetype: filetype,
            size: filesize,
            fileHash: fileHash,
            uploadDate: new Date(),
            uploadedBy: req.session.user.userid,
            description: description || "",
            classCode: normalizedClassCode,
            major: major || normalizedClassCode.replace(/[0-9]/g, '').trim(),
            semester: normalizedSemester,
            year: normalizedYear,
            professor: normalizedProfessor,
            category: category || "Other",
            virusScanStatus: existingFileDifferentContext ? existingFileDifferentContext.virusScanStatus : 'pending',
            virusScanDate: existingFileDifferentContext ? existingFileDifferentContext.virusScanDate : null,
            virusScanDetails: existingFileDifferentContext ? existingFileDifferentContext.virusScanDetails : null,
            scanAttempts: existingFileDifferentContext ? (existingFileDifferentContext.scanAttempts || 0) : 0
        };

        const insertResult = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .insertOne(fileMeta);

        // Delete the newly uploaded S3 file if we're reusing an existing one
        if (shouldDeleteNewS3File) {
            try {
                await s3.deleteObject({ Bucket: AWS_BUCKET, Key: s3Key }).promise();
            } catch (s3DeleteError) {
                console.error(`Error deleting duplicate S3 file ${s3Key}:`, s3DeleteError);
            }
        }

        // Trigger background virus scan only for new files (not reused ones)
        if (VIRUSTOTAL_ENABLED && !existingFileDifferentContext) {
            s3.getObject({ Bucket: AWS_BUCKET, Key: finalS3Key }).promise()
                .then(s3Data => {
                    scanFileWithVirusTotal(insertResult.insertedId, s3Data.Body, filename).catch(err => {
                        console.error('Background virus scan error:', err);
                    });
                })
                .catch(err => console.error('Error fetching file for scan:', err));
        }

        res.json({
            success: true,
            duplicate: false,
            fileId: insertResult.insertedId,
            message: existingFileDifferentContext ? 'File uploaded successfully (reused from different context)' : 'File uploaded successfully',
            reusedFromDifferentContext: !!existingFileDifferentContext
        });
    } catch (error) {
        console.error('Confirm upload error:', error);
        res.status(500).json({ error: 'Failed to save file metadata' });
    }
});

app.post('/contact/submit', async function (req, res) {
    try {
        const { name, email, subject, message } = req.body;

        if (!name || !email || !subject || !message) {
            return res.render('error', {
                title: "Missing Information",
                message: "Please fill out all required fields.",
                link: "/contact",
                linkText: "Back to Contact"
            });
        }

        // Content filtering for contact form inputs
        try {
            await validateContent(name, 'Name');
            await validateContent(subject, 'Subject');
            await validateContent(message, 'Message');
            // Note: Email validation skipped as it's for contact purposes
        } catch (contentError) {
            return res.render('contact', {
                title: 'Contact Us',
                error: contentError.message,
                name: name,
                email: email,
                subject: subject,
                message: message
            });
        }

        // Send email to admin using template
        const adminEmail = process.env.ADMIN_EMAIL || 'paramraj15@gmail.com'; // fallback to your email

        sendEmail(
            adminEmail,
            `[Terp Notes Support] ${subject}`,
            emailTemplates.contactFormEmail(name, email, subject, message)
        ).catch((err) => console.error("Failed to send contact form email:", err.message));

        res.render('success', {
            title: "Message Sent",
            message: "Thank you for contacting us! We'll get back to you within 24-48 hours.",
            link: "/",
            linkText: "Back to Home"
        });
    } catch (error) {
        console.error('Contact form error:', error);
        res.render('error', {
            title: "Submission Error",
            message: "Failed to send message. Please try again later.",
            link: "/contact",
            linkText: "Back to Contact"
        });
    }
});

app.get('/register', function (req, res) {
    // Check if user is already logged in
    if (req.session.user) {
        // User is already logged in, redirect to dashboard
        return res.redirect('/dashboard');
    }

    res.render('register', { title: "Register - Terp Notes" });
});

app.get('/login', function (req, res) {
    // Debug logging

    // Check if user is already logged in
    if (req.session.user) {
        // User is already logged in, redirect to dashboard
        return res.redirect('/dashboard');
    }

    res.render('login', { title: "Login - Terp Notes" });
});

// Mobile Login
app.get('/mobile/login', function (req, res) {
    if (req.session.user) {
        return res.redirect('/mobile/dashboard');
    }
    res.render('mobile/login', { title: "Login - Terp Notes Mobile" });
});

// Mobile Register
app.get('/mobile/register', function (req, res) {
    if (req.session.user) {
        return res.redirect('/mobile/dashboard');
    }
    res.render('mobile/register', { title: "Register - Terp Notes Mobile" });
});

// Mobile Index
app.get('/mobile/', function (req, res) {
    if (req.session.user) {
        return res.redirect('/mobile/dashboard');
    }
    res.render('mobile/index', { title: "Terp Notes Mobile" });
});

// Mobile Upload
app.get('/mobile/upload', function (req, res) {
    if (!req.session.user) {
        return res.redirect('/mobile/login');
    }
    res.render('mobile/upload', { title: "Upload - Terp Notes Mobile" });
});

// Mobile Profile
app.get('/mobile/profile', function (req, res) {
    if (!req.session.user) {
        return res.redirect('/mobile/login');
    }
    res.render('mobile/profile', {
        title: "Profile - Terp Notes Mobile",
        user: req.session.user
    });
});

// Mobile Admin
app.get('/mobile/admin', async (req, res) => {
    if (!req.session.user) {
        return res.redirect('/mobile/login');
    }

    if (req.session.user.role !== 'admin') {
        return res.status(403).render('error', {
            title: "Access Restricted",
            message: "You don't have permission to access the admin panel.",
            link: "/mobile/dashboard",
            linkText: "Go to Dashboard"
        });
    }

    try {
        await ensureConnection();

        // Get basic admin stats for mobile
        const totalUsers = await client.db(fileCollection.db).collection('users').countDocuments();
        const totalFiles = await client.db(fileCollection.db).collection('files').countDocuments();
        const activeReports = await client.db(fileCollection.db).collection('reports').countDocuments({ status: 'pending' });

        // Get recent users (limited for mobile performance)
        const recentUsers = await client.db(fileCollection.db).collection('users')
            .find({})
            .sort({ createdAt: -1 })
            .limit(20)
            .toArray();

        // Get active announcements
        const announcements = await client.db(fileCollection.db).collection('announcements')
            .find({ isActive: true })
            .sort({ createdAt: -1 })
            .toArray();

        res.render('mobile/admin', {
            firstname: req.session.user.firstname,
            user: req.session.user,
            totalUsers,
            totalFiles,
            activeReports,
            users: recentUsers,
            announcements
        });
    } catch (e) {
        console.error(e);
        res.status(500).send("Failed to load mobile admin panel.");
    }
});

// API endpoint to check session status
app.get('/api/session-status', function (req, res) {
    try {
        if (req.session.user) {
            res.json({
                loggedIn: true,
                user: {
                    userid: req.session.user.userid,
                    firstname: req.session.user.firstname,
                    role: req.session.user.role
                }
            });
        } else {
            res.json({
                loggedIn: false
            });
        }
    } catch (error) {
        console.error('Session status error:', error);
        res.status(500).json({
            loggedIn: false,
            error: 'Session check failed'
        });
    }
});

// Admin API endpoint to check for missing files
app.get('/api/admin/check-missing-files', async (req, res) => {
    if (!req.session.user || req.session.user.role !== 'admin') {
        return res.status(403).json({ error: 'Unauthorized' });
    }

    try {
        await ensureConnection();

        // Get all files from database
        const files = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .find({})
            .limit(100) // Check first 100 files
            .toArray();

        const missingFiles = [];

        for (const file of files) {
            try {
                // Try to get file from S3
                await s3.getObject({ Bucket: AWS_BUCKET, Key: file.filename }).promise();
            } catch (s3Error) {
                if (s3Error.code === 'NoSuchKey') {
                    missingFiles.push({
                        filename: file.filename,
                        originalName: file.originalName,
                        uploadDate: file.uploadDate,
                        uploader: file.uploader
                    });

                    // Mark as missing in database
                    await client
                        .db(fileCollection.db)
                        .collection(fileCollection.collection)
                        .updateOne(
                            { filename: file.filename },
                            { $set: { s3Missing: true, lastChecked: new Date() } }
                        );
                }
            }
        }

        res.json({
            totalChecked: files.length,
            missingFiles: missingFiles,
            message: `Checked ${files.length} files, found ${missingFiles.length} missing from S3`
        });
    } catch (error) {
        console.error('Error checking missing files:', error);
        res.status(500).json({ error: 'Failed to check files' });
    }
});




// Python ML endpoints removed - using Python ML server directly

app.get('/forgot-password', function (req, res) {
    res.render('forgot-password', { title: "Forgot Password - Terp Notes" });
});

app.post('/forgot-password', async (req, res) => {
    try {
        await ensureConnection();

        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ email: req.body.email.toLowerCase() });

        if (!user) {
            // Don't reveal if email exists for security
            return res.render('success', {
                title: "Check Your Email",
                message: "If an account exists with that email, a password reset link has been sent.",
                link: "/login",
                linkText: "Back to Login"
            });
        }

        // Generate reset token
        const resetToken = crypto.randomBytes(32).toString('hex');
        const resetTokenExpiry = new Date(Date.now() + 3600000); // 1 hour

        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .updateOne(
                { email: req.body.email.toLowerCase() },
                {
                    $set: {
                        resetToken: resetToken,
                        resetTokenExpiry: resetTokenExpiry
                    }
                }
            );

        // Send reset email
        // Fix protocol detection for Vercel (always HTTPS in production)
        const protocol = process.env.NODE_ENV === 'production' ? 'https' : req.protocol;
        const host = process.env.NODE_ENV === 'production' ? process.env.VERCEL_URL : req.get('host');
        const resetLink = `${protocol}://${host}/reset-password/${resetToken}`;


        // Send email asynchronously using template
        sendEmail(
            req.body.email,
            "Reset Your Terp Notes Password",
            emailTemplates.passwordResetEmail(user.firstname, resetLink)
        ).catch((err) => console.error("Failed to send reset email:", err.message));

        res.render('success', {
            title: "Check Your Email",
            message: "If an account exists with that email, a password reset link has been sent. Please check your inbox and spam folder.",
            link: "/login",
            linkText: "Back to Login"
        });
    } catch (error) {
        console.error('Forgot password error:', error);
        res.render('error', {
            title: "Error",
            message: "An error occurred. Please try again.",
            link: "/forgot-password",
            linkText: "Try Again"
        });
    }
});

app.get('/reset-password/:token', async (req, res) => {
    const token = req.params.token;

    try {
        await ensureConnection();

        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({
                resetToken: token,
                resetTokenExpiry: { $gt: new Date() }
            });

        if (!user) {
            return res.render('error', {
                title: "Invalid or Expired Link",
                message: "This password reset link is invalid or has expired. Please request a new one.",
                link: "/forgot-password",
                linkText: "Request New Link"
            });
        }

        res.render('reset-password', {
            title: "Reset Password - Terp Notes",
            token: token
        });
    } catch (error) {
        console.error('Reset password page error:', error);
        res.render('error', {
            title: "Error",
            message: "An error occurred. Please try again.",
            link: "/forgot-password",
            linkText: "Back to Forgot Password"
        });
    }
});

app.post('/reset-password/:token', async (req, res) => {
    const token = req.params.token;

    try {
        await ensureConnection();

        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({
                resetToken: token,
                resetTokenExpiry: { $gt: new Date() }
            });

        if (!user) {
            return res.render('error', {
                title: "Invalid or Expired Link",
                message: "This password reset link is invalid or has expired.",
                link: "/forgot-password",
                linkText: "Request New Link"
            });
        }

        if (req.body.password !== req.body.confirm_password) {
            return res.render('error', {
                title: "Password Mismatch",
                message: "The passwords do not match.",
                link: `/reset-password/${token}`,
                linkText: "Try Again"
            });
        }

        // Password strength validation
        const passwordValidation = validatePassword(req.body.password);
        if (!passwordValidation.isValid) {
            return res.render('error', {
                title: "Weak Password",
                message: "Your password does not meet security requirements:\n\n" + passwordValidation.errors.join('\n'),
                link: `/reset-password/${token}`,
                linkText: "Try Again"
            });
        }

        // Hash new password
        const hashedPassword = await bcrypt.hash(req.body.password, 10);

        // Update password and remove reset token
        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .updateOne(
                { resetToken: token },
                {
                    $set: { pass: hashedPassword },
                    $unset: { resetToken: "", resetTokenExpiry: "" }
                }
            );

        // Send confirmation email using template
        sendEmail(
            user.email,
            "Password Reset Successful - Terp Notes",
            emailTemplates.passwordResetSuccessEmail(user.firstname)
        ).catch((err) => console.error("Failed to send password reset confirmation:", err.message));

        res.render('success', {
            title: "Password Reset Successful",
            message: "Your password has been reset successfully. You can now login with your new password.",
            link: "/login",
            linkText: "Go to Login"
        });
    } catch (error) {
        console.error('Reset password error:', error);
        res.render('error', {
            title: "Error",
            message: "Failed to reset password. Please try again.",
            link: "/forgot-password",
            linkText: "Back to Forgot Password"
        });
    }
});

// Email verification route
app.get('/verify/:token', async (req, res) => {
    const token = req.params.token;

    try {
        await ensureConnection();

        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ verificationToken: token });

        if (!user) {
            return res.render('error', {
                title: "Invalid Verification Link",
                message: "This verification link is invalid or has expired. Please register again or request a new verification email.",
                link: "/register",
                linkText: "Back to Registration"
            });
        }

        if (user.isVerified) {
            return res.render('success', {
                title: "Already Verified",
                message: "Your account is already verified. You can login now!",
                link: "/login",
                linkText: "Go to Login"
            });
        }

        // Mark user as verified
        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .updateOne(
                { verificationToken: token },
                {
                    $set: { isVerified: true },
                    $unset: { verificationToken: "" }
                }
            );

        res.render('success', {
            title: "Email Verified! 🎉",
            message: `Welcome to Terp Notes, ${user.firstname}! Your account is now active.`,
            link: "/login",
            linkText: "Login Now"
        });
    } catch (error) {
        console.error('Verification error:', error);
        res.render('error', {
            title: "Verification Failed",
            message: "An error occurred during verification. Please try again.",
            link: "/register",
            linkText: "Back to Registration"
        });
    }
});

// Resend verification email
app.post('/resend-verification', async (req, res) => {
    try {
        await ensureConnection();

        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ email: req.body.email.toLowerCase() });

        if (!user) {
            return res.render('error', {
                title: "Email Not Found",
                message: "No account found with this email address.",
                link: "/login",
                linkText: "Back to Login"
            });
        }

        if (user.isVerified) {
            return res.render('success', {
                title: "Already Verified",
                message: "This account is already verified. You can login!",
                link: "/login",
                linkText: "Go to Login"
            });
        }

        // Generate new verification token
        const verificationToken = crypto.randomBytes(32).toString('hex');

        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .updateOne(
                { email: req.body.email.toLowerCase() },
                { $set: { verificationToken: verificationToken } }
            );

        // Send verification email
        // Fix protocol detection for Vercel (always HTTPS in production)
        const protocol = process.env.NODE_ENV === 'production' ? 'https' : req.protocol;
        const host = process.env.NODE_ENV === 'production' ? process.env.VERCEL_URL : req.get('host');
        const verificationLink = `${protocol}://${host}/verify/${verificationToken}`;


        // Send email asynchronously using template
        sendEmail(
            req.body.email,
            "Verify Your Terp Notes Account",
            emailTemplates.resendVerificationEmail(user.firstname, verificationLink)
        ).catch((err) => console.error("Failed to send verification email:", err.message));

        res.render('success', {
            title: "Verification Email Sent",
            message: `A new verification link has been sent to ${req.body.email}. Please check your inbox and spam folder.`,
            link: "/login",
            linkText: "Back to Login"
        });
    } catch (error) {
        console.error('Resend verification error:', error);
        res.render('error', {
            title: "Error",
            message: "Failed to resend verification email. Please try again.",
            link: "/login",
            linkText: "Back to Login"
        });
    }
});

app.get('/integrations', (req, res) => {
    if (!req.session.user) {
        return res.redirect('/login');
    }
    res.render('integrations', {
        title: 'Integrations - Terp Notes',
        firstname: req.session.user.firstname,
        user: req.session.user,
        baseUrl: process.env.BASE_URL || 'http://localhost:3000'
    });
});

app.get('/dashboard', async (req, res) => {
    if (!req.session.user) {
        return res.redirect('/login');
    }

    try {
        await ensureConnection();

        // Load ALL files once - client-side JavaScript will handle filtering/sorting
        const allFiles = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .find({})
            .sort({ uploadDate: -1 }) // Default sort by newest
            .toArray();

        // Get unique majors and class codes for filter dropdowns
        const uniqueMajors = [...new Set(allFiles.map(f => f.major).filter(Boolean))].sort();
        const uniqueClassCodes = [...new Set(allFiles.map(f => f.classCode).filter(Boolean))].sort();

        // Get unique semesters and years for filter dropdowns
        const uniqueSemesters = [...new Set(allFiles.map(f => f.semester).filter(Boolean))];
        const uniqueYears = [...new Set(allFiles.map(f => f.year).filter(Boolean).map(year => String(year)))].sort((a, b) => b - a); // Convert to string and sort descending (newest first)

        // Sort semesters in academic order: Spring, Summer, Fall, Winter
        const semesterOrder = ['Spring', 'Summer', 'Fall', 'Winter'];
        const sortedSemesters = uniqueSemesters.sort((a, b) =>
            semesterOrder.indexOf(a) - semesterOrder.indexOf(b)
        );

        // Get active announcements
        const announcements = await client
            .db(fileCollection.db)
            .collection('announcements')
            .find({ isActive: true })
            .sort({ createdAt: -1 })
            .toArray();

        res.render('dashboard', {
            firstname: req.session.user.firstname,
            email: req.session.user.email,
            user: req.session.user,
            files: allFiles,
            majors: uniqueMajors,
            classCodes: uniqueClassCodes,
            semesters: sortedSemesters,
            years: uniqueYears,
            announcements: announcements
        });
    } catch (e) {
        console.error(e);
        res.status(500).send("Failed to load dashboard.");
    }
});

// Mobile Dashboard - Optimized for mobile devices
app.get('/mobile/dashboard', async (req, res) => {
    if (!req.session.user) {
        return res.redirect('/mobile/login');
    }

    try {
        await ensureConnection();

        // Load files with mobile-optimized query (limit to recent files for performance)
        const recentFiles = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .find({})
            .sort({ uploadDate: -1 })
            .limit(50) // Limit for mobile performance
            .toArray();

        // Get unique values for mobile filters (simplified)
        const uniqueMajors = [...new Set(recentFiles.map(f => f.major).filter(Boolean))].sort();
        const uniqueSemesters = [...new Set(recentFiles.map(f => f.semester).filter(Boolean))];

        // Get active announcements
        const announcements = await client
            .db(fileCollection.db)
            .collection('announcements')
            .find({ isActive: true })
            .sort({ createdAt: -1 })
            .toArray();

        res.render('mobile/dashboard', {
            firstname: req.session.user.firstname,
            email: req.session.user.email,
            user: req.session.user,
            files: recentFiles,
            majors: uniqueMajors,
            semesters: uniqueSemesters,
            announcements: announcements
        });
    } catch (e) {
        console.error(e);
        res.status(500).send("Failed to load mobile dashboard.");
    }
});

app.get('/profile', async (req, res) => {
    if (!req.session.user) {
        return res.redirect('/login');
    }

    try {
        await ensureConnection();
        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ userid: req.session.user.userid });

        res.render('profile', {
            title: "My Profile - Terp Notes",
            user: user
        });
    } catch (error) {
        console.error('Error loading profile:', error);
        res.render('error', {
            title: "Error",
            message: "Failed to load profile.",
            link: "/dashboard",
            linkText: "Back to Dashboard"
        });
    }
});

app.post('/update-profile', async (req, res) => {
    if (!req.session.user) {
        return res.redirect('/login');
    }

    try {
        await ensureConnection();

        // Trim user inputs to prevent spacing issues
        const firstname = req.body.firstname.trim();
        const lastname = req.body.lastname.trim();
        let email = req.body.email.trim().toLowerCase();

        // Content filtering for profile update inputs
        try {
            await validateContent(firstname, 'First name');
            await validateContent(lastname, 'Last name');
            // Note: Email validation skipped as requested (UMD verified)
        } catch (contentError) {
            return res.render('profile', {
                title: 'Profile',
                user: req.session.user,
                error: contentError.message,
                firstname: firstname,
                lastname: lastname,
                email: email
            });
        }

        // Check if email is being changed
        if (email !== req.session.user.email) {
            // Validate UMD email domain
            const validDomains = ['umd.edu', 'terpmail.umd.edu'];
            const emailDomain = email.split('@')[1];

            if (!validDomains.includes(emailDomain)) {
                return res.render('error', {
                    title: "Invalid Email Domain",
                    message: "Please use a UMD email address (@umd.edu or @terpmail.umd.edu).",
                    link: "/profile",
                    linkText: "Back to Profile"
                });
            }

            // Normalize email (same logic as registration)
            const emailUsername = email.split('@')[0];
            const normalizedEmail = `${emailUsername}@terpmail.umd.edu`;

            // Check if normalized email already exists (check both formats)
            const existingUser = await client
                .db(userCollection.db)
                .collection(userCollection.collection)
                .findOne({
                    $or: [
                        { email: normalizedEmail },
                        { email: `${emailUsername}@umd.edu` }
                    ]
                });

            if (existingUser && existingUser.userid !== req.session.user.userid) {
                return res.render('error', {
                    title: "Email Already Exists",
                    message: "This email is already registered to another account.",
                    link: "/profile",
                    linkText: "Back to Profile"
                });
            }

            // Use normalized email for update
            email = normalizedEmail;
        }

        // Update user information
        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .updateOne(
                { userid: req.session.user.userid },
                {
                    $set: {
                        firstname: firstname,
                        lastname: lastname,
                        email: email,
                        updatedAt: new Date()
                    }
                }
            );

        // Update session data
        req.session.user.firstname = firstname;
        req.session.user.lastname = lastname;
        req.session.user.email = email;

        // Send confirmation email using template
        sendEmail(
            email,
            "Profile Updated - Terp Notes",
            emailTemplates.profileUpdateEmail(firstname)
        ).catch((err) => console.error("Failed to send profile update confirmation:", err.message));

        res.render('success', {
            title: "Profile Updated",
            message: "Your profile has been successfully updated.",
            link: "/profile",
            linkText: "Back to Profile"
        });
    } catch (error) {
        console.error('Error updating profile:', error);
        res.render('error', {
            title: "Update Failed",
            message: "Failed to update profile. Please try again.",
            link: "/profile",
            linkText: "Back to Profile"
        });
    }
});

app.post('/change-password', async (req, res) => {
    if (!req.session.user) {
        return res.redirect('/login');
    }

    try {
        await ensureConnection();

        const { currentPassword, newPassword, confirmPassword } = req.body;

        // Verify current password
        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ userid: req.session.user.userid });

        const passwordMatch = await bcrypt.compare(currentPassword, user.pass);
        if (!passwordMatch) {
            return res.render('error', {
                title: "Incorrect Password",
                message: "Your current password is incorrect.",
                link: "/profile",
                linkText: "Back to Profile"
            });
        }

        // Verify new passwords match
        if (newPassword !== confirmPassword) {
            return res.render('error', {
                title: "Password Mismatch",
                message: "New passwords do not match.",
                link: "/profile",
                linkText: "Back to Profile"
            });
        }

        // Password strength validation
        const passwordValidation = validatePassword(newPassword);
        if (!passwordValidation.isValid) {
            return res.render('error', {
                title: "Weak Password",
                message: "Your new password does not meet security requirements:\n\n" + passwordValidation.errors.join('\n'),
                link: "/profile",
                linkText: "Back to Profile"
            });
        }

        // Verify new password is different from current password
        const samePassword = await bcrypt.compare(newPassword, user.pass);
        if (samePassword) {
            return res.render('error', {
                title: "Same Password",
                message: "Your new password must be different from your current password.",
                link: "/profile",
                linkText: "Back to Profile"
            });
        }

        // Hash and update new password
        const hashedPassword = await bcrypt.hash(newPassword, 10);
        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .updateOne(
                { userid: req.session.user.userid },
                {
                    $set: {
                        pass: hashedPassword,
                        updatedAt: new Date()
                    }
                }
            );

        // Send confirmation email using template
        sendEmail(
            user.email,
            "Password Changed - Terp Notes",
            emailTemplates.passwordChangeEmail(user.firstname)
        ).catch((err) => console.error("Failed to send password change confirmation:", err.message));

        res.render('success', {
            title: "Password Changed",
            message: "Your password has been successfully changed.",
            link: "/profile",
            linkText: "Back to Profile"
        });
    } catch (error) {
        console.error('Error changing password:', error);
        res.render('error', {
            title: "Password Change Failed",
            message: "Failed to change password. Please try again.",
            link: "/profile",
            linkText: "Back to Profile"
        });
    }
});

// Delete Account Endpoint
app.delete('/delete-account', async (req, res) => {
    if (!req.session.user) {
        return res.status(401).json({ error: 'Not authenticated' });
    }

    const userId = req.session.user.userid;
    const userEmail = req.session.user.email;

    try {
        await ensureConnection();

        // Check if user is protected (cannot delete protected accounts)
        const userDoc = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ userid: userId });

        if (!userDoc) {
            return res.status(404).json({ error: 'User not found' });
        }

        if (userDoc.isProtected) {
            return res.status(403).json({ error: 'Cannot delete protected system account' });
        }

        // Check if user is banned (banned users cannot delete their accounts)
        if (userDoc.banStatus && userDoc.banStatus.isBanned) {
            return res.status(403).json({
                error: 'Account is banned',
                message: `Your account is currently banned. Reason: ${userDoc.banStatus.banReason || 'Not specified'}. ${userDoc.banStatus.banType === 'timed' && userDoc.banStatus.banExpiry ? `Ban expires: ${new Date(userDoc.banStatus.banExpiry).toLocaleString()}` : 'This is a permanent ban.'}`
            });
        }

        console.log(`Deleting account for user: ${userId} (${userEmail})`);

        // Get all files uploaded by this user
        const userFiles = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .find({ uploadedBy: userId })
            .toArray();

        console.log(` Found ${userFiles.length} files to anonymize for user ${userId}`);

        // Anonymize files (keep content, remove personal attribution)
        if (userFiles.length > 0) {
            const updateResult = await client
                .db(fileCollection.db)
                .collection(fileCollection.collection)
                .updateMany(
                    { uploadedBy: userId },
                    {
                        $set: {
                            uploadedBy: 'deleted_user',
                            uploadedByName: 'Deleted User',
                            isDeletedUser: true,
                            originalUploaderId: userId, // Keep reference for admin purposes
                            userDeletedAt: new Date()
                        }
                    }
                );
            console.log(`👤 Anonymized ${updateResult.modifiedCount} files`);
        }

        // Delete user from database
        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .deleteOne({ userid: userId });

        console.log(`Deleted user account: ${userId}`);

        // Send deletion confirmation email using template
        sendEmail(
            userEmail,
            "Account Deleted - Terp Notes",
            emailTemplates.accountDeletionEmail(userDoc.firstname)
        ).catch((err) => console.error("Failed to send account deletion confirmation:", err.message));

        // Clear session and cookies
        req.session.destroy((err) => {
            if (err) {
                console.error('Session destruction error:', err);
            }
        });

        res.clearCookie('authToken');

        console.log(`Account deletion completed for user: ${userId}`);
        res.status(200).json({
            success: true,
            message: 'Account deleted successfully',
            filesDeleted: userFiles.length
        });

    } catch (error) {
        console.error('Error deleting account:', error);
        res.status(500).json({
            error: 'Failed to delete account',
            message: 'An error occurred while deleting your account. Please try again or contact support.'
        });
    }
});

app.get('/logout', (req, res) => {
    const logoutAll = req.query.all === 'true';

    if (logoutAll) {
        // Logout from all tabs - destroy session completely

        req.session.destroy(err => {
            if (err) {
                console.error('Logout error:', err);
                return res.status(500).send("Could not log out.");
            }


            // Clear any session cookies and redirect to index
            res.clearCookie('terpnotes.sid');
            res.clearCookie('terpnotes.sid', { path: '/' });
            res.clearCookie('terpnotes.sid', { path: '/', domain: 'localhost' });
            res.clearCookie('terpnotes.sid', { path: '/', domain: '.localhost' });

            // Force a cache-busting redirect
            res.redirect('/?loggedout=true&t=' + Date.now());
        });
    } else {
        // Logout from this tab only - show choice
        return res.render('logout-confirm', {
            title: "Log Out",
            user: req.session.user || { firstname: 'User' }
        });
    }
});

// Edit file route
app.post('/edit-file', async (req, res) => {
    if (!req.session.user) return res.status(401).json({ error: 'Not authenticated' });

    try {
        const { filename, classCode, professor, semester, year, category, description } = req.body;
        const user = req.session.user;

        // Validate required fields
        if (!filename || !classCode || !professor || !semester || !year || !category || !description) {
            return res.status(400).json({ error: 'All fields are required' });
        }

        // Content filtering for user inputs
        try {
            await validateContent(filename, 'Filename');
            await validateContent(classCode, 'Course code');
            await validateContent(professor, 'Professor name');
            await validateContent(semester, 'Semester');
            await validateContent(String(year), 'Year');
            await validateContent(category, 'Category');
            await validateContent(description, 'Description');
        } catch (contentError) {
            return res.status(400).json({
                error: contentError.message
            });
        }

        // Connect to MongoDB
        await ensureConnection();

        // Find the file in the database
        const file = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .findOne({ filename: filename });

        if (!file) {
            return res.status(404).json({ error: 'File not found' });
        }

        // Check permissions - only admin or file owner can edit
        if (user.role !== 'admin' && file.uploadedBy !== user.userid) {
            return res.status(403).json({ error: 'You can only edit your own files' });
        }

        // Update file metadata
        const major = classCode.replace(/[0-9]/g, '').trim();

        await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .updateOne(
                { filename: filename },
                {
                    $set: {
                        classCode: classCode,
                        major: major,
                        professor: professor,
                        semester: semester,
                        year: year,
                        category: category,
                        description: description,
                        lastModified: new Date()
                    }
                }
            );

        res.json({ success: true, message: 'File updated successfully' });

    } catch (error) {
        console.error('Edit file error:', error);
        res.status(500).json({ error: 'Failed to update file' });
    }
});

app.get("/delete/:filename", async (req, res) => {
    if (!req.session.user) return res.redirect("/login");

    const filename = decodeURIComponent(req.params.filename);

    try {
        await ensureConnection();

        // Check if user owns the file or is admin
        const fileDoc = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .findOne({ filename });

        if (!fileDoc) {
            return res.status(404).send("File not found.");
        }

        if (fileDoc.uploadedBy !== req.session.user.userid && req.session.user.role !== 'admin') {
            console.log('Permission denied - user cannot delete this file');
            return res.status(403).send("You don't have permission to delete this file.");
        }

        // Check if this file is deduplicated (used by other uploads)
        const fileHash = fileDoc.fileHash;
        const duplicateFiles = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .countDocuments({ fileHash: fileHash });

        // Download file for admin email BEFORE deleting from S3
        let fileBuffer = null;
        if (duplicateFiles === 1) {
            try {
                fileBuffer = await downloadFileFromS3(filename);
                console.log(`Downloaded file for admin notification: ${filename}`);
            } catch (downloadErr) {
                console.log(`Could not download file for admin notification: ${downloadErr.message}`);
            }
        }

        // Delete metadata from MongoDB FIRST
        await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .deleteOne({ filename });

        // Delete all reports for this specific file
        const deletedReports = await client
            .db(fileCollection.db)
            .collection('reports')
            .deleteMany({ filename: filename });

        if (deletedReports.deletedCount > 0) {
            console.log(` Dismissed ${deletedReports.deletedCount} report(s) for deleted file`);
        }

        // NOW do S3 deletion (after MongoDB is done)
        if (duplicateFiles === 1) {
            await s3.deleteObject({ Bucket: AWS_BUCKET, Key: filename }).promise();
            console.log(`Deleted file from S3: ${filename}`);
        } else {
            console.log(`File is deduplicated (${duplicateFiles} instances), keeping S3 file`);
        }

        // Send email notification to user using template (async, no await needed)
        const originalFilename = filename.split('_').slice(2).join('_'); // Extract original filename from S3 key
        sendEmail(
            req.session.user.email,
            "File Deleted - Terp Notes",
            emailTemplates.fileDeletionEmail(req.session.user.firstname, originalFilename)
        ).catch((err) => console.error("Failed to send file deletion confirmation:", err.message));

        // Send admin notification email with file attachment (async, no await needed)
        const adminEmail = process.env.ADMIN_EMAIL || 'paramraj15@gmail.com';
        const deleterInfo = {
            firstname: req.session.user.firstname,
            lastname: req.session.user.lastname,
            email: req.session.user.email,
            userid: req.session.user.userid,
            role: req.session.user.role
        };

        const fileInfo = {
            filename: filename,
            originalName: originalFilename,
            classCode: fileDoc.classCode,
            semester: fileDoc.semester,
            year: fileDoc.year,
            professor: fileDoc.professor,
            major: fileDoc.major,
            category: fileDoc.category,
            uploadDate: fileDoc.uploadDate,
            downloadCount: fileDoc.downloadCount,
            size: fileDoc.size,
            isDeduplicated: duplicateFiles > 1,
            remainingInstances: duplicateFiles - 1
        };

        // Send admin notification email with file attachment (if available)
        (async () => {
            try {
                if (fileBuffer) {
                    const attachment = {
                        filename: originalFilename,
                        content: fileBuffer.toString('base64'),
                        contentType: 'application/octet-stream'
                    };

                    await sendEmail(
                        adminEmail,
                        `[Terp Notes Admin] File Deleted: ${originalFilename}`,
                        emailTemplates.adminFileDeletionEmail(deleterInfo, fileInfo, 'single'),
                        [attachment]
                    );
                    console.log('Admin notification sent with file attachment');
                } else {
                    // Send without attachment if file couldn't be downloaded
                    await sendEmail(
                        adminEmail,
                        `[Terp Notes Admin] File Deleted: ${originalFilename}`,
                        emailTemplates.adminFileDeletionEmail(deleterInfo, fileInfo, 'single')
                    );
                    console.log('Admin notification sent without attachment (file not available)');
                }
            } catch (err) {
                console.error("Failed to send admin file deletion notification:", err.message);
            }
        })();

        // Redirect back to dashboard
        res.redirect("/dashboard");
    } catch (err) {
        console.error("Delete failed:", err);
        res.status(500).send("Error deleting file.");
    }
});

// Bulk delete endpoint for multiple files
app.post("/api/bulk-delete", apiLimiter, async (req, res) => {
    if (!req.session.user) {
        return res.status(401).json({ error: 'Not authenticated' });
    }

    const { filenames } = req.body;

    if (!filenames || !Array.isArray(filenames) || filenames.length === 0) {
        return res.status(400).json({ error: 'No filenames provided' });
    }

    if (filenames.length > 50) {
        return res.status(400).json({ error: 'Too many files. Maximum 50 files per bulk delete.' });
    }

    const results = {
        success: [],
        failed: [],
        skipped: []
    };

    try {
        await ensureConnection();

        // Get all files that user can delete
        const filesToDelete = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .find({
                filename: { $in: filenames },
                $or: [
                    { uploadedBy: req.session.user.userid },
                    { /* admin can delete any file */ }
                ]
            })
            .toArray();

        // Filter files user can actually delete
        const deletableFiles = filesToDelete.filter(file =>
            file.uploadedBy === req.session.user.userid || req.session.user.role === 'admin'
        );

        if (deletableFiles.length === 0) {
            return res.status(403).json({ error: 'No files found that you can delete' });
        }

        // Store detailed file information and download files for admin notification BEFORE deletion
        const deletedFilesDetails = [];
        const filesForZip = [];

        // First pass: download files and store details
        for (const file of deletableFiles) {
            try {
                // Store file details for admin notification
                deletedFilesDetails.push({
                    filename: file.filename,
                    originalName: file.originalName,
                    classCode: file.classCode,
                    semester: file.semester,
                    year: file.year,
                    professor: file.professor,
                    major: file.major,
                    category: file.category,
                    uploadDate: file.uploadDate,
                    downloadCount: file.downloadCount,
                    size: file.size,
                    isDeduplicated: duplicateFiles > 1,
                    remainingInstances: duplicateFiles - 1
                });

                // Check if file is deduplicated
                const fileHash = file.fileHash;
                const duplicateFiles = await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .countDocuments({ fileHash: fileHash });

                // Download file for zip if it will be deleted from S3
                if (duplicateFiles === 1) {
                    try {
                        const fileBuffer = await downloadFileFromS3(file.filename);
                        filesForZip.push({
                            name: file.originalName,
                            buffer: fileBuffer
                        });
                        console.log(`Downloaded file for admin notification: ${file.filename}`);
                    } catch (downloadErr) {
                        console.log(`Could not download file for admin notification: ${file.filename} - ${downloadErr.message}`);
                    }
                }
            } catch (fileError) {
                console.error(`Failed to prepare file ${file.filename}:`, fileError);
            }
        }

        // Second pass: delete files
        for (const file of deletableFiles) {
            try {
                // Check if file is deduplicated
                const fileHash = file.fileHash;
                const duplicateFiles = await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .countDocuments({ fileHash: fileHash });

                // Delete metadata from MongoDB
                await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .deleteOne({ filename: file.filename });

                // Delete all reports for this file
                await client
                    .db(fileCollection.db)
                    .collection('reports')
                    .deleteMany({ filename: file.filename });

                // Delete from S3 if not deduplicated
                if (duplicateFiles === 1) {
                    await s3.deleteObject({ Bucket: AWS_BUCKET, Key: file.filename }).promise();
                    console.log(`Deleted file from S3: ${file.filename}`);
                } else {
                    console.log(`File is deduplicated (${duplicateFiles} instances), keeping S3 file: ${file.filename}`);
                }

                results.success.push({
                    filename: file.filename,
                    originalName: file.originalName
                });

            } catch (fileError) {
                console.error(`Failed to delete file ${file.filename}:`, fileError);
                results.failed.push({
                    filename: file.filename,
                    originalName: file.originalName,
                    error: fileError.message
                });
            }
        }

        // Check for files that weren't found or user can't delete
        const processedFilenames = deletableFiles.map(f => f.filename);
        const skippedFilenames = filenames.filter(f => !processedFilenames.includes(f));

        for (const filename of skippedFilenames) {
            results.skipped.push({
                filename: filename,
                reason: 'File not found or permission denied'
            });
        }

        // Send email notification for successful deletions
        if (results.success.length > 0) {
            const originalFilenames = results.success.map(f => f.originalName);
            sendEmail(
                req.session.user.email,
                "Files Deleted - Terp Notes",
                emailTemplates.bulkFileDeletionEmail(req.session.user.firstname, originalFilenames)
            ).catch((err) => console.error("Failed to send bulk deletion confirmation:", err.message));

            // Send admin notification email for bulk deletion with zip attachment (async, no await needed)
            const adminEmail = process.env.ADMIN_EMAIL || 'paramraj15@gmail.com';
            const deleterInfo = {
                firstname: req.session.user.firstname,
                lastname: req.session.user.lastname,
                email: req.session.user.email,
                userid: req.session.user.userid,
                role: req.session.user.role
            };

            // Send admin notification with pre-downloaded files
            (async () => {
                try {
                    if (filesForZip.length > 0) {
                        // Create zip file from pre-downloaded files
                        const zipBuffer = await createZipFromFiles(filesForZip);
                        const zipAttachment = {
                            filename: `deleted_files_${new Date().toISOString().split('T')[0]}.zip`,
                            content: zipBuffer.toString('base64'),
                            contentType: 'application/zip'
                        };

                        await sendEmail(
                            adminEmail,
                            `[Terp Notes Admin] Bulk File Deletion: ${results.success.length} files`,
                            emailTemplates.adminBulkFileDeletionEmail(deleterInfo, deletedFilesDetails),
                            [zipAttachment]
                        );
                        console.log(`Admin bulk deletion notification sent with zip attachment (${filesForZip.length} files)`);
                    } else {
                        // No files could be downloaded, send without attachment
                        await sendEmail(
                            adminEmail,
                            `[Terp Notes Admin] Bulk File Deletion: ${results.success.length} files`,
                            emailTemplates.adminBulkFileDeletionEmail(deleterInfo, deletedFilesDetails)
                        );
                        console.log('Admin bulk deletion notification sent without attachment (no files could be downloaded)');
                    }
                } catch (err) {
                    console.error("Failed to send admin bulk deletion notification:", err.message);
                }
            })();
        }

        res.json({
            message: `Bulk delete completed`,
            results: results,
            summary: {
                total: filenames.length,
                success: results.success.length,
                failed: results.failed.length,
                skipped: results.skipped.length
            }
        });

    } catch (error) {
        console.error("Bulk delete failed:", error);
        res.status(500).json({ error: 'Internal server error during bulk delete' });
    }
});

app.get("/download/:filename", async (req, res) => {
    if (!req.session.user) return res.redirect("/login");

    const filename = decodeURIComponent(req.params.filename);
    const showWarning = req.query.warn;
    const params = { Bucket: AWS_BUCKET, Key: filename };

    try {
        await ensureConnection();
        const fileDoc = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .findOne({ filename: filename });

        // Check if file exists in database
        if (!fileDoc) {
            console.error(`File not found in database: ${filename}`);
            return res.status(404).render('error', {
                title: "File Not Found",
                message: "The requested file could not be found in our database.",
                link: "/dashboard",
                linkText: "Go to Dashboard"
            });
        }

        // Check if force download is requested
        const forceDownload = req.query.force === 'download';

        // Show warning for compressed files (unless force download)
        const compressedTypes = ['application/zip', 'application/x-rar-compressed', 'application/x-7z-compressed', 'application/x-tar', 'application/gzip'];
        if (fileDoc && compressedTypes.includes(fileDoc.mimetype) && !showWarning && !forceDownload) {
            return res.render('download-warning', {
                title: "Download Warning",
                filename: filename,
                originalName: fileDoc.originalName,
                fileType: fileDoc.mimetype
            });
        }

        // Try to get file from S3
        let data;
        try {
            data = await s3.getObject(params).promise();
        } catch (s3Error) {
            console.error(`S3 file not found: ${filename}`, s3Error);

            // If S3 file doesn't exist, mark file as missing in database
            await client
                .db(fileCollection.db)
                .collection(fileCollection.collection)
                .updateOne(
                    { filename: filename },
                    { $set: { s3Missing: true, lastChecked: new Date() } }
                );

            return res.status(404).render('error', {
                title: "File Unavailable",
                message: "The file is no longer available on our servers. It may have been removed or corrupted.",
                link: "/dashboard",
                linkText: "Go to Dashboard"
            });
        }

        let downloadFilename = filename;
        if (fileDoc && fileDoc.originalName) {
            downloadFilename = fileDoc.originalName;
        }

        const sanitizedFilename = sanitizeForHeader(downloadFilename);

        // For most file types, try to display inline in browser (PDFs, images)
        const inlineTypes = [
            'application/pdf',
            'image/jpeg',
            'image/png',
            'image/gif',
            'image/svg+xml',
            'image/webp',
            'text/plain',
            'text/html',
            'text/css',
            'application/json'
        ];

        if (forceDownload) {
            // Force download regardless of file type
            res.setHeader("Content-Disposition", `attachment; filename="${sanitizedFilename}"`);
        } else if (fileDoc && inlineTypes.includes(fileDoc.mimetype)) {
            // Try to display inline for supported types
            res.setHeader("Content-Disposition", `inline; filename="${sanitizedFilename}"`);
            res.setHeader("Content-Type", fileDoc.mimetype);
        } else {
            // Default to download for other types
            res.setHeader("Content-Disposition", `attachment; filename="${sanitizedFilename}"`);
        }

        // Send the file first for better performance
        res.send(data.Body);

        // Increment download count after sending file (non-blocking)
        setImmediate(async () => {
            try {
                await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .updateOne(
                        { filename: filename },
                        { $inc: { downloadCount: 1 } }
                    );
            } catch (err) {
                console.error('Failed to increment download count:', err);
            }
        });
    } catch (err) {
        console.error("Download error:", err);
        res.status(500).render('error', {
            title: "Download Error",
            message: "An unexpected error occurred while downloading the file.",
            link: "/dashboard",
            linkText: "Go to Dashboard"
        });
    }
});

// Progress tracking for bulk downloads
const downloadProgress = new Map(); // Store progress by download ID

// Bulk download endpoint - creates a zip file of multiple files
app.post("/bulk-download", async (req, res) => {
    if (!req.session.user) return res.status(401).json({ error: 'Not authenticated' });

    try {
        const { filenames } = req.body;

        if (!filenames || !Array.isArray(filenames) || filenames.length === 0) {
            return res.status(400).json({ error: 'No files specified' });
        }

        // Limit bulk downloads to prevent abuse
        const maxFiles = 20;
        if (filenames.length > maxFiles) {
            return res.status(400).json({ error: `Too many files. Maximum ${maxFiles} files allowed.` });
        }

        await ensureConnection();

        // Get file metadata for all files
        const fileDocs = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .find({ filename: { $in: filenames } })
            .toArray();

        if (fileDocs.length === 0) {
            return res.status(404).json({ error: 'No valid files found' });
        }

        // Generate unique download ID for progress tracking
        const downloadId = `download_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`;

        // Initialize progress tracking
        downloadProgress.set(downloadId, {
            totalFiles: fileDocs.length,
            processedFiles: 0,
            currentFile: '',
            status: 'starting',
            startTime: Date.now()
        });

        // Set up zip archive
        res.setHeader('Content-Type', 'application/zip');
        res.setHeader('Content-Disposition', `attachment; filename="terp-notes-bulk-${Date.now()}.zip"`);
        res.setHeader('X-Download-ID', downloadId); // Send download ID for progress tracking

        const archive = archiver('zip', { zlib: { level: 9 } });
        archive.pipe(res);

        let processedCount = 0;
        const totalFiles = fileDocs.length;

        // Update progress status
        downloadProgress.set(downloadId, {
            ...downloadProgress.get(downloadId),
            status: 'processing',
            processedFiles: 0
        });

        // Download and add each file to the zip
        for (const fileDoc of fileDocs) {
            try {
                // Update current file being processed
                downloadProgress.set(downloadId, {
                    ...downloadProgress.get(downloadId),
                    currentFile: fileDoc.originalName || fileDoc.filename,
                    processedFiles: processedCount
                });

                const s3Params = { Bucket: AWS_BUCKET, Key: fileDoc.filename };
                const s3Data = await s3.getObject(s3Params).promise();

                // Use original filename if available, otherwise use stored filename
                const displayName = fileDoc.originalName || fileDoc.filename;

                archive.append(s3Data.Body, { name: displayName });

                // Increment download count
                await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .updateOne(
                        { filename: fileDoc.filename },
                        { $inc: { downloadCount: 1 } }
                    );

                processedCount++;

                // Log progress for monitoring
                console.log(`Bulk download progress: ${processedCount}/${totalFiles} files processed`);

            } catch (fileError) {
                console.error(`Error adding ${fileDoc.filename} to zip:`, fileError);
                processedCount++; // Count failed files too for progress
                // Continue with other files even if one fails
            }
        }

        // Update final progress
        downloadProgress.set(downloadId, {
            ...downloadProgress.get(downloadId),
            status: 'finalizing',
            processedFiles: processedCount
        });

        // Finalize the archive
        archive.finalize();

        archive.on('error', (err) => {
            console.error('Archive error:', err);
            downloadProgress.set(downloadId, {
                ...downloadProgress.get(downloadId),
                status: 'error'
            });
            if (!res.headersSent) {
                res.status(500).json({ error: 'Failed to create zip file' });
            }
        });

        archive.on('end', () => {
            // Clean up progress tracking after completion
            setTimeout(() => {
                downloadProgress.delete(downloadId);
            }, 30000); // Keep for 30 seconds after completion
        });

    } catch (error) {
        console.error('Bulk download error:', error);
        if (!res.headersSent) {
            res.status(500).json({ error: 'Failed to process bulk download' });
        }
    }
});

// Progress tracking endpoint
app.get("/bulk-download-progress/:downloadId", (req, res) => {
    const { downloadId } = req.params;

    res.setHeader('Content-Type', 'text/event-stream');
    res.setHeader('Cache-Control', 'no-cache');
    res.setHeader('Connection', 'keep-alive');
    res.setHeader('Access-Control-Allow-Origin', '*');

    const progress = downloadProgress.get(downloadId);

    if (!progress) {
        res.write(`data: ${JSON.stringify({ error: 'Download not found' })}\n\n`);
        res.end();
        return;
    }

    // Send initial progress
    res.write(`data: ${JSON.stringify({
        downloadId,
        ...progress,
        percentage: Math.round((progress.processedFiles / progress.totalFiles) * 100),
        elapsedTime: Date.now() - progress.startTime
    })}\n\n`);

    // Set up interval to send progress updates
    const interval = setInterval(() => {
        const currentProgress = downloadProgress.get(downloadId);

        if (!currentProgress) {
            clearInterval(interval);
            res.write(`data: ${JSON.stringify({ completed: true })}\n\n`);
            res.end();
            return;
        }

        res.write(`data: ${JSON.stringify({
            downloadId,
            ...currentProgress,
            percentage: Math.round((currentProgress.processedFiles / currentProgress.totalFiles) * 100),
            elapsedTime: Date.now() - currentProgress.startTime
        })}\n\n`);

        // Close connection if download is complete or errored
        if (currentProgress.status === 'completed' || currentProgress.status === 'error') {
            clearInterval(interval);
            res.end();
        }
    }, 1000); // Update every second

    // Clean up on client disconnect
    req.on('close', () => {
        clearInterval(interval);
    });
});

app.post('/registerSubmit', registerLimiter, async function (req, res) {
    try {
        // Validate UMD email domain FIRST (before any DB queries)
        const email = req.body.email.toLowerCase();
        const validDomains = ['umd.edu', 'terpmail.umd.edu'];
        const emailDomain = email.split('@')[1];

        if (!validDomains.includes(emailDomain)) {
            return res.render('error', {
                title: "Invalid Email Domain",
                message: "Please use your UMD email (@umd.edu or @terpmail.umd.edu) to register.",
                link: "/register",
                linkText: "Back to Registration"
            });
        }

        // Password match validation
        if (req.body.password !== req.body.confirm_pass) {
            return res.render('error', {
                title: "Password Mismatch",
                message: "The passwords entered do not match.",
                link: "/register",
                linkText: "Try Again"
            });
        }

        // Password strength validation
        const passwordValidation = validatePassword(req.body.password);
        if (!passwordValidation.isValid) {
            return res.render('error', {
                title: "Weak Password",
                message: "Your password does not meet security requirements:\n\n" + passwordValidation.errors.join('\n'),
                link: "/register",
                linkText: "Try Again"
            });
        }

        // Normalize email to prevent duplicates (@umd.edu and @terpmail.umd.edu are the same)
        // Extract username part and always use @terpmail.umd.edu for storage
        const emailUsername = email.split('@')[0];
        const normalizedEmail = `${emailUsername}@terpmail.umd.edu`;

        // Trim and normalize user inputs
        const userid = req.body.userid.trim();
        const firstname = req.body.first_name.trim();
        const lastname = req.body.last_name.trim();

        // Content filtering for user registration inputs
        try {
            await validateContent(userid, 'Username');
            await validateContent(firstname, 'First name');
            await validateContent(lastname, 'Last name');
            // Note: Email validation skipped as requested (UMD verified)
        } catch (contentError) {
            return res.render('register', {
                title: 'Register',
                error: contentError.message,
                userid: userid,
                first_name: firstname,
                last_name: lastname,
                email: email
            });
        }

        // Check for existing email/username (check both formats)
        await ensureConnection();
        let conflictFilter = {
            $or: [
                { email: normalizedEmail },
                { email: `${emailUsername}@umd.edu` }, // Also check the other format
                { userid: userid }
            ]
        };
        const result = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne(conflictFilter);

        if (result) {
            // Check if existing user is banned
            if (result.banStatus && result.banStatus.isBanned) {
                return res.render('error', {
                    title: "Account Banned",
                    message: `This email is associated with a banned account. Reason: ${result.banStatus.banReason || 'Not specified'}. ${result.banStatus.banType === 'timed' && result.banStatus.banExpiry ? `Ban expires: ${new Date(result.banStatus.banExpiry).toLocaleString()}` : 'This is a permanent ban.'}`,
                    link: "/contact",
                    linkText: "Contact Support"
                });
            }

            if (result.email === email || result.email === `${emailUsername}@umd.edu`) {
                return res.render('error', {
                    title: "Email Already Registered",
                    message: "This email is already registered. Try logging in or use forgot password.",
                    link: "/login",
                    linkText: "Go to Login"
                });
            }
            if (result.userid === userid) {
                return res.render('error', {
                    title: "Username Taken",
                    message: "Please choose a different username.",
                    link: "/register",
                    linkText: "Back to Registration"
                });
            }
        }

        const hashedPassword = await bcrypt.hash(req.body.password, 10);

        // Generate verification token
        const verificationToken = crypto.randomBytes(32).toString('hex');

        // All new users are contributors by default
        // Admin can manually set roles via MongoDB or admin dashboard
        const newUser = {
            firstname: firstname,
            lastname: lastname,
            userid: userid,
            email: normalizedEmail, // Store normalized email (always @terpmail.umd.edu)
            pass: hashedPassword,
            role: 'contributor',
            isProtected: false,
            isVerified: false,
            verificationToken: verificationToken,
            createdAt: new Date(),
            // Ban system fields
            banStatus: {
                isBanned: false,
                banType: null, // 'timed' or 'permanent'
                banReason: null,
                bannedAt: null,
                bannedBy: null,
                banExpiry: null, // For timed bans
                banHistory: [] // Track all ban/unban events
            }
        };

        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .insertOne(newUser);

        // Send verification email
        // Fix protocol detection for Vercel (always HTTPS in production)
        const protocol = process.env.NODE_ENV === 'production' ? 'https' : req.protocol;
        const host = process.env.NODE_ENV === 'production' ? process.env.VERCEL_URL : req.get('host');
        const verificationLink = `${protocol}://${host}/verify/${verificationToken}`;


        // Send email asynchronously using template
        sendEmail(
            email,
            "Verify Your Terp Notes Account",
            emailTemplates.verificationEmail(firstname, verificationLink)
        ).catch((err) => console.error("Failed to send verification email:", err.message));

        return res.render('success', {
            title: "Check Your Email",
            message: `A verification link has been sent to ${email}. Please check your inbox and spam folder, then click the link to activate your account.`,
            link: "/login",
            linkText: "Go to Login"
        });
    } catch (e) {
        console.error(e);
        return res.render('error', {
            title: "Registration Failed",
            message: "An error occurred. Please try again.",
            link: "/register",
            linkText: "Back to Registration"
        });
    }
});

app.post('/loginSubmit', loginLimiter, async function (req, res) {
    try {
        await ensureConnection();
        // Trim userid to handle accidental spaces
        const loginUserid = req.body.userid.trim();
        let filter = { userid: loginUserid };
        const result = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne(filter);

        if (!result) {
            return res.render('error', {
                title: "User Not Found",
                message: "No account found with that username.",
                link: "/login",
                linkText: "Try Again"
            });
        }

        const passwordMatch = await bcrypt.compare(req.body.password, result.pass);
        if (!passwordMatch) {
            return res.render('error', {
                title: "Incorrect Password",
                message: "The password is incorrect. Please try again.",
                link: "/login",
                linkText: "Back to Login"
            });
        }

        // Check if email is verified
        if (!result.isVerified && !result.isProtected) {
            return res.render('unverified', {
                title: "Email Not Verified",
                email: result.email
            });
        }

        const { firstname, lastname, userid: userId, email, role } = result;
        const userData = { firstname, lastname, userid: userId, email, role };

        // Initialize session with timestamps for timeout tracking
        const now = Date.now();

        // Allow account switching but provide clear feedback
        if (req.session.user && req.session.user.userid !== userId) {
            console.log(`🔄 Account switch: ${req.session.user.userid} → ${userId}`);
        }

        // Regenerate session ID to prevent session fixation attacks
        req.session.regenerate((err) => {
            if (err) {
                console.error('Session regeneration error:', err);
                return res.status(500).send("Session error. Please try again.");
            }

            req.session.user = userData;
            req.session.createdAt = now;
            req.session.lastActivity = now;
            req.session.rememberMe = req.body.rememberMe === 'on'; // Handle "Remember Me" checkbox

            // Log login to account history
            logAccountHistory(userId, 'LOGIN',
                `Successful login from ${req.ip}`,
                null,
                {
                    ip: req.ip,
                    userAgent: req.get('User-Agent'),
                    rememberMe: req.body.rememberMe === 'on'
                }
            );

            // Set session expiration based on remember me option
            if (req.session.rememberMe) {
                // 30 days for "Remember Me"
                req.session.cookie.maxAge = 30 * 24 * 60 * 60 * 1000; // 30 days in milliseconds
            } else {
                // Default session timeout (likely 30 minutes or 1 hour)
                req.session.cookie.maxAge = 30 * 60 * 1000; // 30 minutes in milliseconds
            }

            // Set a flag to indicate successful login for tab synchronization
            req.session.loginTimestamp = now;

            return res.redirect('/dashboard');
        });
    } catch (e) {
        console.error(e);
        return res.status(500).send("Server error. Try again later.");
    }
});

// File upload (supports single or multiple files)
app.post("/upload", uploadLimiter, upload.array("documents", 50), async (req, res) => {
    if (!req.session.user) return res.redirect("/login");

    // Check if user is viewer
    if (req.session.user.role === 'viewer') {
        return res.render('error', {
            title: "Upload Restricted",
            message: "You don't have permission to upload files. Contact an admin.",
            link: "/dashboard",
            linkText: "Back to Dashboard"
        });
    }

    // Per-user daily upload cap (admins/managers bypass)
    try {
        const user = req.session.user;
            if (user && user.role !== 'admin' && user.role !== 'manager') {
                const uploadedCount = await countUserUploadsToday(user.userid);
                const filesToUpload = req.files ? req.files.length : 0;

                console.log(`🔍 Upload cap check: User ${user.userid}, Already uploaded: ${uploadedCount}, Trying to upload: ${filesToUpload}, Limit: ${DAILY_UPLOAD_CAP}`);

                if (uploadedCount + filesToUpload > DAILY_UPLOAD_CAP) {
                    return res.status(429).json({
                        error: `Upload limit reached! You have uploaded ${uploadedCount} files today and are trying to upload ${filesToUpload} more files. Your daily limit is ${DAILY_UPLOAD_CAP} files. Please try again tomorrow.`
                    });
                }
            }
    } catch (limitErr) {
        console.warn('Upload cap check failed, continuing:', limitErr?.message);
    }

    const files = req.files;
    if (!files || files.length === 0) return res.status(400).send("No files uploaded.");

    const classCode = req.body.classCode?.trim().toUpperCase();
    if (!classCode) {
        return res.render('error', {
            title: "Class Code Required",
            message: "Please specify a class code for your uploads.",
            link: "/dashboard",
            linkText: "Back to Dashboard"
        });
    }

    const uploadedFiles = [];
    const failedFiles = [];

    try {
        await ensureConnection();

        for (const file of files) {
            try {
                // Calculate file hash for deduplication
                const fileHash = crypto.createHash('sha256').update(file.buffer).digest('hex');

                // Check if file already exists (by hash)
                const existingFile = await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .findOne({ fileHash: fileHash });

                let s3Key, s3Url;

                if (existingFile) {
                    // File already exists - reuse S3 file, just create new metadata entry
                    s3Key = existingFile.filename;
                    s3Url = existingFile.s3Url;
                    console.log(`Deduplicated: ${file.originalname} (reusing existing file)`);
                } else {
                    // New file - upload to S3
                    s3Key = `${Date.now()}_${Math.random().toString(36).substring(7)}_${file.originalname}`;
                    const s3Params = {
                        Bucket: AWS_BUCKET,
                        Key: s3Key,
                        Body: file.buffer,
                        ContentType: file.mimetype
                    };

                    const s3Result = await s3.upload(s3Params).promise();
                    s3Url = s3Result.Location;
                }

                // Extract major from class code (e.g., CMSC330 → CMSC, HIST000 → HIST)
                const major = classCode.replace(/[0-9]/g, '').trim() || classCode;

                const fileMeta = {
                    filename: s3Key,
                    originalName: file.originalname,
                    s3Url: s3Url,
                    mimetype: file.mimetype,
                    size: file.size,
                    fileHash: fileHash,
                    uploadDate: new Date(),
                    uploadedBy: req.session.user.userid,
                    description: req.body.description || "",
                    classCode: classCode,
                    major: major,
                    semester: req.body.semester || "",
                    year: req.body.year || "",
                    professor: req.body.professor || "",
                    category: req.body.category || "Other", // New: File category
                    downloadCount: 0, // New: Track downloads
                    virusScanStatus: existingFile ? existingFile.virusScanStatus : 'pending', // pending, clean, infected
                    virusScanDate: existingFile ? existingFile.virusScanDate : null,
                    virusScanDetails: existingFile ? existingFile.virusScanDetails : null,
                    scanAttempts: existingFile ? existingFile.scanAttempts || 0 : 0
                };

                const insertResult = await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .insertOne(fileMeta);

                // Log upload to account history
                await logAccountHistory(req.session.user.userid, 'UPLOAD',
                    `Uploaded file: ${file.originalname} (${file.filename})`,
                    null,
                    {
                        filename: file.filename,
                        originalName: file.originalname,
                        size: file.size,
                        classCode: classCode,
                        professor: professor,
                        semester: semester,
                        year: year
                    }
                );

                uploadedFiles.push(file.originalname);

                // Trigger background virus scan for new files (not deduplicated)
                if (!existingFile && VIRUSTOTAL_ENABLED) {
                    scanFileWithVirusTotal(insertResult.insertedId, file.buffer, file.originalname).catch(err => {
                        console.error('Background virus scan error:', err);
                    });
                }
            } catch (fileError) {
                console.error(`Error uploading ${file.originalname}:`, fileError);
                failedFiles.push(file.originalname);
            }
        }

        // Send confirmation email using template
        sendEmail(
            req.session.user.email,
            "Upload Successful - Terp Notes",
            emailTemplates.uploadSuccessEmail(req.session.user.firstname, uploadedFiles.length, classCode)
        ).catch((err) => console.error("Failed to send upload confirmation:", err.message));

        let message = `Successfully uploaded ${uploadedFiles.length} file(s) to ${classCode}!`;
        if (failedFiles.length > 0) {
            message += ` ${failedFiles.length} file(s) failed to upload.`;
        }

        res.render('success', {
            title: "Upload Complete",
            message: message,
            link: "/dashboard",
            linkText: "Return to Dashboard"
        });
    } catch (err) {
        console.error("Upload failed:", err);
        res.status(500).send("File upload failed.");
    }
});

// Admin Dashboard
app.get('/admin', async (req, res) => {
    // Debug logging

    if (!req.session.user) {
        return res.redirect('/login');
    }

    // Validate admin role and session integrity
    if (req.session.user.role !== 'admin') {
        return res.render('error', {
            title: "Access Restricted",
            message: "Administrative access is required to view this page. Please contact your system administrator if you believe this is an error.",
            link: "/dashboard",
            linkText: "Return to Dashboard"
        });
    }

    // Additional security check - verify user still exists and has admin role
    try {
        await ensureConnection();
        const currentUser = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ userid: req.session.user.userid });

        if (!currentUser || currentUser.role !== 'admin') {
            // Session compromised or user role changed
            req.session.destroy();
            return res.render('error', {
                title: "Session Invalid",
                message: "Your session is no longer valid. Please log in again to continue.",
                link: "/login",
                linkText: "Log In"
            });
        }
    } catch (error) {
        console.error('Error validating admin session:', error);
        return res.render('error', {
            title: "System Error",
            message: "Unable to verify your access permissions. Please try again or contact support.",
            link: "/dashboard",
            linkText: "Return to Dashboard"
        });
    }

    try {
        await ensureConnection();

        // Get all users with enhanced analytics
        const users = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .find({}, { projection: { pass: 0 } })
            .sort({ _id: -1 })
            .toArray();

        // Get pending reports
        const reports = await client
            .db(fileCollection.db)
            .collection('reports')
            .find({ status: 'pending' })
            .sort({ reportedAt: -1 })
            .toArray();

        // Get announcements
        const announcements = await client
            .db(fileCollection.db)
            .collection('announcements')
            .find({})
            .sort({ createdAt: -1 })
            .toArray();

        // Helper function to convert ban duration to readable text
        function getBanDurationText(duration) {
            if (!duration) return 'Permanent';
            if (duration === 24) return '1 Day';
            if (duration === 72) return '3 Days';
            if (duration === 168) return '1 Week';
            if (duration === 336) return '2 Weeks';
            if (duration === 720) return '1 Month';
            if (duration === 2160) return '3 Months';
            if (duration === 4320) return '6 Months';
            if (duration === 8760) return '1 Year';
            return `${duration} hours`;
        }

        // Enhanced user analytics
        const usersWithAnalytics = await Promise.all(users.map(async (user) => {
            // Count files uploaded by this user
            const filesUploaded = await client
                .db(fileCollection.db)
                .collection(fileCollection.collection)
                .countDocuments({ uploadedBy: user.userid });

            // Count files reported by this user
            const filesReported = await client
                .db(fileCollection.db)
                .collection('reports')
                .countDocuments({ reportedBy: user.userid });

            // Count reports against this user's files
            const filesOfUserReported = await client
                .db(fileCollection.db)
                .collection('reports')
                .countDocuments({ fileUploader: user.userid });

            // Get total downloads of user's files
            const userFiles = await client
                .db(fileCollection.db)
                .collection(fileCollection.collection)
                .find({ uploadedBy: user.userid }, { projection: { downloadCount: 1 } })
                .toArray();
            const totalDownloads = userFiles.reduce((sum, file) => sum + (file.downloadCount || 0), 0);

            // Count actual bans (exclude unbans and auto-unbans)
            const banHistoryCount = user.banStatus?.banHistory?.filter(entry => entry.action === 'banned')?.length || 0;

            // Get last ban details
            const lastBanEntry = user.banStatus?.banHistory?.filter(entry => entry.action === 'banned')?.slice(-1)[0];
            const lastBanDate = lastBanEntry?.timestamp || null;
            const lastBanDuration = lastBanEntry?.duration || null;

            // Get user's latest activity (most recent file upload)
            const latestUpload = await client
                .db(fileCollection.db)
                .collection(fileCollection.collection)
                .findOne(
                    { uploadedBy: user.userid },
                    { projection: { uploadDate: 1, originalName: 1 }, sort: { uploadDate: -1 } }
                );

            // Calculate account age
            const accountAge = user.createdAt ? Math.floor((new Date() - new Date(user.createdAt)) / (1000 * 60 * 60 * 24)) : 0;

            return {
                ...user,
                analytics: {
                    filesUploaded,
                    filesReported,
                    filesOfUserReported,
                    totalDownloads,
                    banHistoryCount,
                    latestUpload,
                    accountAge,
                    isCurrentlyBanned: user.banStatus?.isBanned || false,
                    banType: user.banStatus?.banType || null,
                    banExpiry: user.banStatus?.banExpiry || null,
                    lastBanReason: user.banStatus?.banHistory?.filter(entry => entry.action === 'banned')?.slice(-1)[0]?.reason || null,
                    lastBanDate: lastBanDate,
                    lastBanDuration: lastBanDuration,
                    lastBanDurationText: lastBanDuration ? getBanDurationText(lastBanDuration) : null
                }
            };
        }));

        res.render('admin', {
            title: "Admin Dashboard",
            user: req.session.user,
            users: usersWithAnalytics,
            reports: reports,
            announcements: announcements
        });
    } catch (error) {
        console.error('Error fetching admin data:', error);
        res.render('error', {
            title: "Database Error",
            message: "Failed to load admin data.",
            link: "/dashboard",
            linkText: "Back to Dashboard"
        });
    }
});

// API: Resolve file report
app.post('/api/resolve-report', apiLimiter, async (req, res) => {
    if (!req.session.user || req.session.user.role !== 'admin') {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { reportId, action } = req.body; // action: 'delete' or 'dismiss'

        if (!reportId || !action) {
            return res.status(400).json({ error: 'Missing required fields' });
        }

        await ensureConnection();

        const report = await client
            .db(fileCollection.db)
            .collection('reports')
            .findOne({ _id: new ObjectId(reportId) });

        if (!report) {
            return res.status(404).json({ error: 'Report not found' });
        }

        if (action === 'delete') {
            // Get file info for deduplication check
            const fileDoc = await client
                .db(fileCollection.db)
                .collection(fileCollection.collection)
                .findOne({ filename: report.filename });

            if (fileDoc) {
                // Check if this file is deduplicated (used by other uploads)
                const fileHash = fileDoc.fileHash;
                const duplicateFiles = await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .countDocuments({ fileHash: fileHash });

                // Delete from S3 only if this is the last instance of this file
                if (duplicateFiles === 1) {
                    await s3.deleteObject({ Bucket: AWS_BUCKET, Key: report.filename }).promise();
                    console.log(`Admin deleted file from S3: ${report.filename}`);
                } else {
                    console.log(`File is deduplicated (${duplicateFiles} instances), keeping S3 file`);
                }

                // Delete file metadata from database
                await client
                    .db(fileCollection.db)
                    .collection(fileCollection.collection)
                    .deleteOne({ filename: report.filename });

                // Delete ALL reports for this specific file
                const deletedReports = await client
                    .db(fileCollection.db)
                    .collection('reports')
                    .deleteMany({ filename: report.filename });

                if (deletedReports.deletedCount > 1) {
                    console.log(` Dismissed ${deletedReports.deletedCount - 1} additional report(s) for deleted file`);
                }
            }
        }

        // Mark report as resolved (or delete if action is dismiss)
        if (action === 'dismiss') {
            // Just remove the report from the reports collection
            await client
                .db(fileCollection.db)
                .collection('reports')
                .deleteOne({ _id: new ObjectId(reportId) });
        } else {
            // Mark as resolved for delete action
            await client
                .db(fileCollection.db)
                .collection('reports')
                .updateOne(
                    { _id: new ObjectId(reportId) },
                    {
                        $set: {
                            status: 'resolved',
                            resolvedBy: req.session.user.userid,
                            resolvedAt: new Date(),
                            action: action
                        }
                    }
                );
        }

        res.json({ success: true, message: `Report ${action}d successfully` });
    } catch (error) {
        console.error('Error resolving report:', error);
        res.status(500).json({ error: 'Failed to resolve report' });
    }
});

// API: File Reporting
app.post('/api/report-file', apiLimiter, async (req, res) => {
    if (!req.session.user) {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        // Per-user daily report cap (admins/managers bypass)
        const currentUser = req.session.user;
        try {
            if (currentUser && currentUser.role !== 'admin' && currentUser.role !== 'manager') {
                const reportsToday = await countUserReportsToday(currentUser.userid);
                if (reportsToday >= DAILY_REPORT_CAP) {
                    return res.status(429).json({ error: `Daily report limit reached (${DAILY_REPORT_CAP}/day). Please try again tomorrow.` });
                }
            }
        } catch (capErr) {
            console.warn('Report cap check failed, continuing:', capErr?.message);
        }

        const { filename, originalName, reason, details } = req.body;

        if (!filename || !reason) {
            return res.status(400).json({ error: 'Missing required fields' });
        }

        // Content filtering for report inputs
        try {
            await validateContent(filename, 'Filename');
            if (originalName) await validateContent(originalName, 'Original filename');
            await validateContent(reason, 'Report reason');
            if (details) await validateContent(details, 'Report details');
        } catch (contentError) {
            return res.status(400).json({
                error: contentError.message
            });
        }

        await ensureConnection();

        // Check if file exists
        const file = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .findOne({ filename: filename });

        if (!file) {
            return res.status(404).json({ error: 'File not found' });
        }

        // Create report
        const report = {
            filename: filename,
            originalName: originalName,
            reason: reason,
            details: details || '',
            reportedBy: req.session.user.userid,
            reportedAt: new Date(),
            status: 'pending',
            fileUploader: file.uploadedBy,
            classCode: file.classCode
        };

        await client
            .db(fileCollection.db)
            .collection('reports')
            .insertOne(report);

        // Log report to account history
        await logAccountHistory(req.session.user.userid, 'REPORT',
            `Reported file: ${originalName} - Reason: ${reason}`,
            null,
            {
                reportedFile: filename,
                originalName: originalName,
                reason: reason,
                details: details,
                fileUploader: file.uploadedBy,
                classCode: file.classCode
            }
        );

        res.json({ success: true, message: 'Report submitted successfully' });
    } catch (error) {
        console.error('Error submitting report:', error);
        res.status(500).json({ error: 'Failed to submit report' });
    }
});

// API: Create Announcement
app.post('/api/create-announcement', apiLimiter, async (req, res) => {
    if (!req.session.user || req.session.user.role !== 'admin') {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { message, type } = req.body;

        if (!message || !type) {
            return res.status(400).json({ error: 'Missing required fields' });
        }

        if (!['info', 'warning', 'success'].includes(type)) {
            return res.status(400).json({ error: 'Invalid announcement type' });
        }

        await ensureConnection();

        const announcement = {
            message: message.trim(),
            type: type,
            createdBy: req.session.user.userid,
            createdAt: new Date(),
            isActive: true
        };

        await client
            .db(fileCollection.db)
            .collection('announcements')
            .insertOne(announcement);

        res.json({ success: true, message: 'Announcement created successfully' });
    } catch (error) {
        console.error('Error creating announcement:', error);
        res.status(500).json({ error: 'Failed to create announcement' });
    }
});

// API: Delete Announcement
app.post('/api/edit-announcement', apiLimiter, async (req, res) => {
    if (!req.session.user || req.session.user.role !== 'admin') {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { announcementId, message, type } = req.body;

        if (!announcementId || !message || !type) {
            return res.status(400).json({ error: 'Missing required fields' });
        }

        await ensureConnection();

        const result = await client
            .db(fileCollection.db)
            .collection('announcements')
            .updateOne(
                { _id: new ObjectId(announcementId) },
                {
                    $set: {
                        message: message,
                        type: type,
                        updatedAt: new Date(),
                        updatedBy: req.session.user.userid
                    }
                }
            );

        if (result.matchedCount === 0) {
            return res.status(404).json({ error: 'Announcement not found' });
        }

        res.json({ success: true, message: 'Announcement updated successfully' });
    } catch (error) {
        console.error('Error editing announcement:', error);
        res.status(500).json({ error: 'Internal server error' });
    }
});

app.post('/api/delete-announcement', apiLimiter, async (req, res) => {
    if (!req.session.user || req.session.user.role !== 'admin') {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { announcementId } = req.body;

        if (!announcementId) {
            return res.status(400).json({ error: 'Missing announcement ID' });
        }

        await ensureConnection();

        await client
            .db(fileCollection.db)
            .collection('announcements')
            .deleteOne({ _id: new ObjectId(announcementId) });

        res.json({ success: true, message: 'Announcement deleted successfully' });
    } catch (error) {
        console.error('Error deleting announcement:', error);
        res.status(500).json({ error: 'Failed to delete announcement' });
    }
});

// API: Toggle Announcement Status
app.post('/api/toggle-announcement', apiLimiter, async (req, res) => {
    if (!req.session.user || req.session.user.role !== 'admin') {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { announcementId } = req.body;

        if (!announcementId) {
            return res.status(400).json({ error: 'Missing announcement ID' });
        }

        await ensureConnection();

        const announcement = await client
            .db(fileCollection.db)
            .collection('announcements')
            .findOne({ _id: new ObjectId(announcementId) });

        if (!announcement) {
            return res.status(404).json({ error: 'Announcement not found' });
        }

        await client
            .db(fileCollection.db)
            .collection('announcements')
            .updateOne(
                { _id: new ObjectId(announcementId) },
                { $set: { isActive: !announcement.isActive } }
            );

        res.json({
            success: true,
            message: 'Announcement toggled successfully',
            isActive: !announcement.isActive
        });
    } catch (error) {
        console.error('Error toggling announcement:', error);
        res.status(500).json({ error: 'Failed to toggle announcement' });
    }
});

// API: Update user role
app.post('/api/update-user-role', async (req, res) => {
    if (!req.session.user || req.session.user.role !== 'admin') {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { userId, newRole } = req.body;

        if (!userId || !newRole) {
            return res.status(400).json({ error: 'Missing userId or newRole' });
        }

        if (!['admin', 'contributor', 'viewer'].includes(newRole)) {
            return res.status(400).json({ error: 'Invalid role' });
        }

        await ensureConnection();

        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ userid: userId });

        if (!user) {
            return res.status(404).json({ error: 'User not found' });
        }

        if (user.isProtected) {
            return res.status(403).json({
                error: 'Cannot modify protected system account'
            });
        }

        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .updateOne(
                { userid: userId },
                { $set: { role: newRole, updatedAt: new Date() } }
            );

        // Log role change to account history
        await logAccountHistory(userId, 'ROLE_CHANGE',
            `Role changed from ${user.role} to ${newRole} by admin`,
            req.session.user.userid,
            {
                oldRole: user.role,
                newRole: newRole,
                changedBy: req.session.user.userid
            }
        );

        res.json({ success: true, message: 'User role updated successfully' });
    } catch (error) {
        console.error('Error updating user role:', error);
        res.status(500).json({ error: 'Failed to update user role' });
    }
});

// API: Ban user
app.post('/api/ban-user', async (req, res) => {
    // Debug logging

    if (!req.session.user || req.session.user.role !== 'admin') {
        console.log('❌ Unauthorized - Session or role check failed');
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { userId, banType, banReason, banDuration } = req.body;

        if (!userId || !banType || !banReason) {
            return res.status(400).json({ error: 'Missing required fields' });
        }

        if (banType !== 'timed' && banType !== 'permanent') {
            return res.status(400).json({ error: 'Invalid ban type' });
        }

        // Content filtering for ban reason
        try {
            await validateContent(banReason, 'Ban reason');
        } catch (contentError) {
            return res.status(400).json({
                error: contentError.message
            });
        }

        await ensureConnection();

        // Check if user exists
        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ userid: userId });

        if (!user) {
            return res.status(404).json({ error: 'User not found' });
        }

        // Calculate ban expiry for timed bans
        let banExpiry = null;
        if (banType === 'timed' && banDuration) {
            banExpiry = new Date();
            banExpiry.setHours(banExpiry.getHours() + parseInt(banDuration));
        }

        // Update user with ban information
        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .updateOne(
                { userid: userId },
                {
                    $set: {
                        role: 'banned',
                        'banStatus.isBanned': true,
                        'banStatus.banType': banType,
                        'banStatus.banReason': banReason,
                        'banStatus.bannedAt': new Date(),
                        'banStatus.bannedBy': req.session.user.userid,
                        'banStatus.banExpiry': banExpiry
                    },
                    $push: {
                        'banStatus.banHistory': {
                            action: 'banned',
                            timestamp: new Date(),
                            reason: banReason,
                            bannedBy: req.session.user.userid,
                            banType: banType,
                            banExpiry: banExpiry,
                            duration: banType === 'timed' ? parseInt(banDuration) : null
                        }
                    }
                }
            );

        // Send ban notification email
        try {
            const { accountBannedEmail } = require('./emails/templates');
            const emailContent = accountBannedEmail(
                user.first_name || 'User',
                banReason,
                banType,
                banExpiry
            );

            await sendEmail(
                user.email,
                'Account Banned - Terp Notes',
                emailContent
            );
        } catch (emailError) {
            console.error('Error sending ban notification email:', emailError);
            // Don't fail the ban if email fails
        }

        // Log ban to account history
        await logAccountHistory(userId, 'BAN',
            `Banned by admin: ${banReason} (${banType === 'timed' ? banDuration + ' days' : 'permanent'})`,
            req.session.user.userid,
            {
                banType: banType,
                banReason: banReason,
                banDuration: banType === 'timed' ? banDuration : null,
                banExpiry: banExpiry
            }
        );

        res.json({ success: true, message: 'User banned successfully' });
    } catch (error) {
        console.error('Ban user error:', error);
        res.status(500).json({ error: 'Failed to ban user' });
    }
});

// API: Unban user
app.post('/api/unban-user', async (req, res) => {
    if (!req.session.user || req.session.user.role !== 'admin') {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { userId } = req.body;

        if (!userId) {
            return res.status(400).json({ error: 'Missing user ID' });
        }

        await ensureConnection();

        // Check if user exists
        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ userid: userId });

        if (!user) {
            return res.status(404).json({ error: 'User not found' });
        }

        // Update user to unban
        await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .updateOne(
                { userid: userId },
                {
                    $set: {
                        role: 'viewer', // Revert to viewer role
                        'banStatus.isBanned': false,
                        'banStatus.banType': null,
                        'banStatus.banReason': null,
                        'banStatus.bannedAt': null,
                        'banStatus.bannedBy': null,
                        'banStatus.banExpiry': null
                    },
                    $push: {
                        'banStatus.banHistory': {
                            action: 'unbanned',
                            timestamp: new Date(),
                            reason: 'Manually unbanned by admin',
                            unbannedBy: req.session.user.userid
                        }
                    }
                }
            );

        // Send unban notification email
        try {
            const { accountUnbannedEmail } = require('./emails/templates');
            const emailContent = accountUnbannedEmail(user.first_name || 'User');

            await sendEmail(
                user.email,
                'Account Restored - Terp Notes',
                emailContent
            );
        } catch (emailError) {
            console.error('Error sending unban notification email:', emailError);
            // Don't fail the unban if email fails
        }

        // Log unban to account history
        await logAccountHistory(userId, 'UNBAN',
            `Unbanned by admin: Manually unbanned`,
            req.session.user.userid,
            {
                unbanReason: 'Manually unbanned by admin'
            }
        );

        res.json({ success: true, message: 'User unbanned successfully' });
    } catch (error) {
        console.error('Unban user error:', error);
        res.status(500).json({ error: 'Failed to unban user' });
    }
});

// API: Get user account history
app.get('/api/user-history/:userId', async (req, res) => {
    if (!req.session.user || req.session.user.role !== 'admin') {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { userId } = req.params;
        const { page = 1, limit = 50, action = null } = req.query;

        await ensureConnection();

        // Build query
        let query = { userId: userId };
        if (action) {
            query.action = action;
        }

        // Get total count for pagination
        const totalCount = await client
            .db(fileCollection.db)
            .collection('account_history')
            .countDocuments(query);

        // Get history with pagination
        const history = await client
            .db(fileCollection.db)
            .collection('account_history')
            .find(query)
            .sort({ timestamp: -1 })
            .skip((page - 1) * limit)
            .limit(parseInt(limit))
            .toArray();

        // Get user info for context
        const user = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ userid: userId });

        res.json({
            success: true,
            history: history,
            user: {
                userid: user?.userid,
                first_name: user?.first_name,
                last_name: user?.last_name,
                email: user?.email,
                role: user?.role,
                createdAt: user?.createdAt
            },
            pagination: {
                page: parseInt(page),
                limit: parseInt(limit),
                total: totalCount,
                pages: Math.ceil(totalCount / limit)
            }
        });
    } catch (error) {
        console.error('Error fetching user history:', error);
        res.status(500).json({ error: 'Failed to fetch user history' });
    }
});

// API: Delete user
app.post('/api/delete-user', async (req, res) => {
    if (!req.session.user || req.session.user.role !== 'admin') {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { userId } = req.body;

        if (!userId) {
            return res.status(400).json({ error: 'Missing userId' });
        }

        if (userId === req.session.user.userid) {
            return res.status(400).json({ error: 'Cannot delete your own account' });
        }

        await client.connect();

        const userToDelete = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .findOne({ userid: userId });

        if (userToDelete && userToDelete.isProtected) {
            return res.status(403).json({
                error: 'Cannot delete protected system account'
            });
        }

        // Delete user's files from S3 and database
        const userFiles = await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .find({ uploadedBy: userId })
            .toArray();

        for (const file of userFiles) {
            try {
                await s3.deleteObject({
                    Bucket: AWS_BUCKET,
                    Key: file.filename
                }).promise();
            } catch (s3Error) {
                console.error('Error deleting file from S3:', s3Error);
            }
        }

        await client
            .db(fileCollection.db)
            .collection(fileCollection.collection)
            .deleteMany({ uploadedBy: userId });

        const result = await client
            .db(userCollection.db)
            .collection(userCollection.collection)
            .deleteOne({ userid: userId });

        if (result.deletedCount === 0) {
            return res.status(404).json({ error: 'User not found' });
        }

        res.json({ success: true, message: 'User deleted successfully' });
    } catch (error) {
        console.error('Error deleting user:', error);
        res.status(500).json({ error: 'Failed to delete user' });
    }
});

// Error handling middleware for multer errors
app.use((error, req, res, next) => {
    if (error.code === 'LIMIT_FILE_SIZE') {
        return res.render('error', {
            title: "File Too Large",
            message: "File exceeds the 100MB limit. Please choose a smaller file.",
            link: "/dashboard",
            linkText: "Back to Dashboard"
        });
    }

    // Handle file type rejection
    if (error.message && error.message.includes('File type not allowed')) {
        return res.render('error', {
            title: "File Type Not Supported",
            message: error.message + " We're actively working on implementing virus scanning to support more file types in the future!",
            link: "/dashboard",
            linkText: "Back to Dashboard"
        });
    }

    next(error);
});

// Multiple cache endpoints for efficient dropdown population
app.get('/api/professor-cache', async (req, res) => {
    try {
        const fs = require('fs').promises;
        const cachePath = path.join(__dirname, 'data', 'professor-cache.json');
        const cacheData = await fs.readFile(cachePath, 'utf8');
        const cache = JSON.parse(cacheData);

        // Check if cache is stale (7 days) - but serve anyway
        const cacheAge = Date.now() - new Date(cache.metadata.generated).getTime();
        const isStale = cacheAge > (7 * 24 * 60 * 60 * 1000);

        if (isStale) {
            console.log('⚠️ Professor cache is stale but serving anyway - users can still enter data manually');
        } else {
            console.log('✅ Serving fresh professor cache');
        }

        res.json(cache);
    } catch (error) {
        console.error('❌ Error serving professor cache:', error);
        res.status(500).json({ error: 'Failed to load professor cache' });
    }
});

app.get('/api/course-cache', async (req, res) => {
    try {
        const fs = require('fs').promises;
        const cachePath = path.join(__dirname, 'data', 'course-cache.json');
        const cacheData = await fs.readFile(cachePath, 'utf8');
        const cache = JSON.parse(cacheData);

        // Check if cache is stale (7 days) - but serve anyway
        const cacheAge = Date.now() - new Date(cache.metadata.generated).getTime();
        const isStale = cacheAge > (7 * 24 * 60 * 60 * 1000);

        if (isStale) {
            console.log('⚠️ Course cache is stale but serving anyway - users can still enter data manually');
        } else {
            console.log('✅ Serving fresh course cache');
        }

        res.json(cache);
    } catch (error) {
        console.error('❌ Error serving course cache:', error);
        res.status(500).json({ error: 'Failed to load course cache' });
    }
});

app.get('/api/semester-year-cache', async (req, res) => {
    try {
        const fs = require('fs').promises;
        const cachePath = path.join(__dirname, 'data', 'semester-year-cache.json');
        const cacheData = await fs.readFile(cachePath, 'utf8');
        const cache = JSON.parse(cacheData);

        // Check if cache is stale (7 days) - but serve anyway
        const cacheAge = Date.now() - new Date(cache.metadata.generated).getTime();
        const isStale = cacheAge > (7 * 24 * 60 * 60 * 1000);

        if (isStale) {
            console.log('⚠️ Semester-year cache is stale but serving anyway - users can still enter data manually');
        } else {
            console.log('✅ Serving fresh semester-year cache');
        }

        res.json(cache);
    } catch (error) {
        console.error('❌ Error serving semester-year cache:', error);
        res.status(500).json({ error: 'Failed to load semester-year cache' });
    }
});


// OAuth Routes
app.get('/auth/google', (req, res) => {
    if (!req.session.user) {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const authData = oauthManager.generateAuthUrl('google', req.session.user.userid);
        res.redirect(authData.authUrl);
    } catch (error) {
        console.error('Google OAuth error:', error);
        res.status(500).json({ error: 'OAuth configuration error' });
    }
});

app.get('/auth/microsoft', (req, res) => {
    if (!req.session.user) {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const authData = oauthManager.generateAuthUrl('microsoft', req.session.user.userid);
        res.redirect(authData.authUrl);
    } catch (error) {
        console.error('Microsoft OAuth error:', error);
        res.status(500).json({ error: 'OAuth configuration error' });
    }
});

app.get('/auth/notion', (req, res) => {
    if (!req.session.user) {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        console.log('Notion OAuth initiation - user:', req.session.user.userid);
        const authData = oauthManager.generateAuthUrl('notion', req.session.user.userid);
        console.log('Notion OAuth - generated auth URL:', authData.authUrl);
        res.redirect(authData.authUrl);
    } catch (error) {
        console.error('Notion OAuth error:', error);
        res.status(500).json({ error: 'OAuth configuration error' });
    }
});

// OAuth Callback Routes
app.get('/auth/google/callback', async (req, res) => {
    try {
        const { code, state } = req.query;

        if (!code) {
            return res.redirect('/integrations?error=oauth_cancelled');
        }

        // Exchange code for tokens
        const tokenResult = await oauthManager.exchangeCodeForToken('google', code, state);

        if (!tokenResult.success) {
            console.error('Token exchange failed:', tokenResult.error);
            return res.redirect('/integrations?error=oauth_failed');
        }

        // If no session, try to get user from state parameter
        let userId;
        if (req.session.user) {
            userId = req.session.user.userid;
        } else {
            try {
                const decodedState = Buffer.from(state, 'base64').toString('utf-8');
                const stateParts = decodedState.split(':');
                userId = stateParts[0];
            } catch (error) {
                console.error('Error decoding state:', error);
                return res.redirect('/integrations?error=oauth_failed');
            }
        }

        // Get user info (with fallback if it fails)
        let userInfo;
        try {
            const userInfoResult = await oauthManager.getUserInfo('google', tokenResult.accessToken);
            if (userInfoResult.success) {
                userInfo = userInfoResult.userInfo;
            } else {
                console.log('Failed to get user info, using fallback:', userInfoResult.error);
                userInfo = { email: 'Connected Account', name: 'Google User' };
            }
        } catch (error) {
            console.log('Failed to get user info, using fallback:', error.message);
            userInfo = { email: 'Connected Account', name: 'Google User' };
        }

        // Save to database
        await userIntegrationsModel.saveIntegration(userId, 'google-docs', {
            accessToken: tokenResult.accessToken,
            refreshToken: tokenResult.refreshToken,
            expiresAt: tokenResult.expiresIn ? new Date(Date.now() + (tokenResult.expiresIn * 1000)) : null,
            tokenType: tokenResult.tokenType,
            scope: tokenResult.scope,
            connectedAccount: userInfo.email || userInfo.name
        });

        res.redirect('/integrations?success=google_connected');
    } catch (error) {
        console.error('Google OAuth callback error:', error);
        res.redirect('/integrations?error=oauth_failed');
    }
});

app.get('/auth/microsoft/callback', async (req, res) => {
    try {
        const { code, state } = req.query;

        if (!code) {
            return res.redirect('/integrations?error=oauth_cancelled');
        }

        // Exchange code for tokens
        const tokenResult = await oauthManager.exchangeCodeForToken('microsoft', code, state);

        if (!tokenResult.success) {
            console.error('Token exchange failed:', tokenResult.error);
            return res.redirect('/integrations?error=oauth_failed');
        }

        // Get user info
        const userInfoResult = await oauthManager.getUserInfo('microsoft', tokenResult.accessToken);
        const userInfo = userInfoResult.success ? userInfoResult.userInfo : { email: 'Connected Account', name: 'Microsoft User' };

        // If no session, try to get user from state parameter
        let userId;
        if (req.session.user) {
            userId = req.session.user.userid;
        } else {
            try {
                const decodedState = Buffer.from(state, 'base64').toString('utf-8');
                const stateParts = decodedState.split(':');
                userId = stateParts[0];
            } catch (error) {
                console.error('Error decoding state:', error);
                return res.redirect('/integrations?error=oauth_failed');
            }
        }

        // Save to database
        await userIntegrationsModel.saveIntegration(userId, 'onenote', {
            accessToken: tokenResult.accessToken,
            refreshToken: tokenResult.refreshToken,
            expiresAt: tokenResult.expiresIn ? new Date(Date.now() + (tokenResult.expiresIn * 1000)) : null,
            tokenType: tokenResult.tokenType,
            scope: tokenResult.scope,
            connectedAccount: userInfo.email || userInfo.displayName
        });

        res.redirect('/integrations?success=microsoft_connected');
    } catch (error) {
        console.error('Microsoft OAuth callback error:', error);
        res.redirect('/integrations?error=oauth_failed');
    }
});

app.get('/auth/notion/callback', async (req, res) => {
    try {
        const { code, state } = req.query;
        console.log('Notion OAuth callback - code:', code ? 'present' : 'missing');
        console.log('Notion OAuth callback - state:', state ? 'present' : 'missing');
        console.log('Notion OAuth callback - session user:', req.session.user ? 'present' : 'missing');

        if (!code) {
            return res.redirect('/integrations?error=oauth_cancelled');
        }

        // If no session, try to get user from state parameter
        let userId;
        if (req.session.user) {
            userId = req.session.user.userid;
        } else {
            // Extract user ID from state parameter
            try {
                const decodedState = Buffer.from(state, 'base64').toString('utf-8');
                const stateParts = decodedState.split(':');
                userId = stateParts[0];
                console.log('Extracted user ID from state:', userId);
            } catch (error) {
                console.error('Error decoding state:', error);
                return res.redirect('/integrations?error=oauth_failed');
            }
        }

        // Exchange code for tokens
        const tokenResult = await oauthManager.exchangeCodeForToken('notion', code, state);

        if (!tokenResult.success) {
            console.error('Token exchange failed:', tokenResult.error);
            return res.redirect('/integrations?error=oauth_failed');
        }

        // Get user info
        const userInfoResult = await oauthManager.getUserInfo('notion', tokenResult.accessToken);
        const userInfo = userInfoResult.success ? userInfoResult.userInfo : { email: 'Connected Account', name: 'Notion User' };

        // Save to database
        await userIntegrationsModel.saveIntegration(userId, 'notion', {
            accessToken: tokenResult.accessToken,
            refreshToken: tokenResult.refreshToken,
            expiresAt: tokenResult.expiresIn ? new Date(Date.now() + (tokenResult.expiresIn * 1000)) : null,
            tokenType: tokenResult.tokenType,
            scope: tokenResult.scope,
            connectedAccount: userInfo.email || userInfo.name
        });

        res.redirect('/integrations?success=notion_connected');
    } catch (error) {
        console.error('Notion OAuth callback error:', error);
        res.redirect('/integrations?error=oauth_failed');
    }
});

// Health check endpoint
app.get('/health', (req, res) => {
    res.json({
        status: 'OK',
        timestamp: new Date().toISOString(),
        service: 'Terp Notes'
    });
});


// Export the app for testing
module.exports = app;

// Register integration routes immediately (synchronously) to avoid race conditions on serverless
// Routes will check if model is initialized when requests arrive
registerIntegrationRoutes();

// Register 404 handler AFTER all routes are registered
// This ensures integration routes are available before the 404 handler catches unmatched routes
// 404 Handler - Must be last route (after all routes are registered)
app.use((req, res) => {
    // If it's an API route, return JSON instead of HTML
    if (req.path.startsWith('/api/')) {
        return res.status(404).json({ error: 'API endpoint not found' });
    }
    res.status(404).render('404', {
        title: "Page Not Found - Terp Notes"
    });
});

if (require.main === module) {
    console.log('🔧 All routes registered successfully!');
} else {
    console.log('🔧 Vercel: All routes and 404 handler registered successfully!');
}

// Initialize integrations model (async, but routes are already registered)
initializeIntegrations().then(() => {
    console.log('✅ Integrations initialized');
}).catch(error => {
    console.error('Failed to initialize integrations:', error);
    // Don't exit in serverless environment - routes are already registered
    if (require.main === module) {
        process.exit(1);
    }
});

// Only start the server if this file is run directly
if (require.main === module) {
    try {
        app.listen(portNumber, () => {
            console.log(`Terp Notes Server running on port ${portNumber}`);
            console.log(`Ready to share notes!`);
        });
    } catch (error) {
        console.error('Failed to start server:', error);
        process.exit(1);
    }
}


// ================================
// INTEGRATION SYSTEM
// ================================

// Initialize OAuth manager and user integrations model
const oauthManager = new OAuthManager();
let userIntegrationsModel;

// Register integration API routes
function registerIntegrationRoutes() {
    console.log('🔧 Registering integration API routes...');

    // API: Get available integrations
    app.get('/api/integrations', async (req, res) => {
        console.log('🔧 /api/integrations route hit!');
        console.log('🔧 Session user:', req.session.user);
        console.log('🔧 OAuth Manager configured check:');
        console.log('🔧 Google configured:', oauthManager.isConfigured('google'));
        console.log('🔧 Microsoft configured:', oauthManager.isConfigured('microsoft'));
        console.log('🔧 Notion configured:', oauthManager.isConfigured('notion'));
        console.log('🔧 Environment variables check:');
        console.log('🔧 BASE_URL:', process.env.BASE_URL || 'NOT SET');
        console.log('🔧 GOOGLE_CLIENT_ID:', process.env.GOOGLE_CLIENT_ID ? 'SET' : 'NOT SET');
        console.log('🔧 MICROSOFT_CLIENT_ID:', process.env.MICROSOFT_CLIENT_ID ? 'SET' : 'NOT SET');
        console.log('🔧 NOTION_CLIENT_ID:', process.env.NOTION_CLIENT_ID ? 'SET' : 'NOT SET');

        if (!req.session.user) {
            console.log('🔧 No session user, returning 401');
            return res.status(401).json({ error: 'Unauthorized' });
        }

        // Check if integrations model is initialized
        if (!userIntegrationsModel) {
            return res.status(500).json({ error: 'Integrations not initialized' });
        }

        try {
            // Get user's connected integrations with account details
            const userIntegrationsResult = await userIntegrationsModel.getUserIntegrations(req.session.user.userid);
            const connectedIntegrations = userIntegrationsResult.success ?
                userIntegrationsResult.integrations : [];

            // Helper function to validate integration credentials
            const validateIntegrationCredentials = async (integrationId, credentials) => {
                if (!credentials || !credentials.accessToken || credentials.accessToken === 'null') {
                    return false;
                }

                try {
                    let IntegrationClass;
                    switch (integrationId) {
                        case 'notion':
                            IntegrationClass = require('./integrations/notion');
                            break;
                        case 'onenote':
                            IntegrationClass = require('./integrations/onenote');
                            break;
                        case 'google-docs':
                            IntegrationClass = require('./integrations/google-docs');
                            break;
                        case 'obsidian':
                            IntegrationClass = require('./integrations/obsidian');
                            break;
                        default:
                            return false;
                    }

                    const integrationInstance = new IntegrationClass();
                    const result = await integrationInstance.initialize(credentials);
                    return result.success;
                } catch (error) {
                    console.error(`Validation failed for ${integrationId}:`, error.message);
                    return false;
                }
            };

            // Validate each connected integration
            const validatedIntegrations = [];
            for (const integration of connectedIntegrations) {
                // Temporarily skip validation to test OAuth flow
                console.log(`Skipping validation for ${integration.integrationId} integration for user ${req.session.user.userid}`);
                validatedIntegrations.push(integration);

                // const isValid = await validateIntegrationCredentials(integration.integrationId, integration.credentials);
                // if (isValid) {
                //     validatedIntegrations.push(integration);
                // } else {
                //     // Remove invalid integration from database
                //     console.log(`Removing invalid ${integration.integrationId} integration for user ${req.session.user.userid}`);
                //     await userIntegrationsModel.disconnectIntegration(req.session.user.userid, integration.integrationId);
                // }
            }

            const integrations = [
                {
                    id: 'notion',
                    name: 'Notion',
                    description: 'Import and export notes from Notion databases',
                    icon: '📝',
                    features: ['import', 'export'],
                    authRequired: true,
                    isConnected: validatedIntegrations.some(i => i.integrationId === 'notion') && oauthManager.isConfigured('notion'),
                    connectedAccount: validatedIntegrations.find(i => i.integrationId === 'notion')?.connectedAccount || null,
                    oauthSupported: oauthManager.isConfigured('notion')
                },
                {
                    id: 'onenote',
                    name: 'OneNote',
                    description: 'Sync with Microsoft OneNote notebooks',
                    icon: '📓',
                    features: ['import', 'export'],
                    authRequired: true,
                    isConnected: validatedIntegrations.some(i => i.integrationId === 'onenote') && oauthManager.isConfigured('microsoft'),
                    connectedAccount: validatedIntegrations.find(i => i.integrationId === 'onenote')?.connectedAccount || null,
                    oauthSupported: oauthManager.isConfigured('microsoft')
                },
                {
                    id: 'google-docs',
                    name: 'Google Docs',
                    description: 'Import and export Google Docs',
                    icon: '📄',
                    features: ['import', 'export'],
                    authRequired: true,
                    isConnected: validatedIntegrations.some(i => i.integrationId === 'google-docs') && oauthManager.isConfigured('google'),
                    connectedAccount: validatedIntegrations.find(i => i.integrationId === 'google-docs')?.connectedAccount || null,
                    oauthSupported: oauthManager.isConfigured('google')
                },
                {
                    id: 'obsidian',
                    name: 'Obsidian',
                    description: 'Import and export from Obsidian vaults',
                    icon: '🔗',
                    features: ['import', 'export'],
                    authRequired: false,
                    isConnected: validatedIntegrations.some(i => i.integrationId === 'obsidian'),
                    connectedAccount: validatedIntegrations.find(i => i.integrationId === 'obsidian')?.connectedAccount || null,
                    oauthSupported: false
                }
            ];

            res.json({ success: true, integrations });
        } catch (error) {
            console.error('Error fetching integrations:', error);
            res.status(500).json({ error: 'Failed to fetch integrations' });
        }
    });

    // API: Initialize integration
    app.post('/api/integrations/:integrationId/initialize', apiLimiter, async (req, res) => {
        if (!req.session.user) {
            return res.status(401).json({ error: 'Unauthorized' });
        }

        try {
            const { integrationId } = req.params;
            const { credentials } = req.body;

            if (!credentials) {
                return res.status(400).json({ error: 'Credentials required' });
            }

            let integration;
            let result;

            switch (integrationId) {
                case 'notion':
                    integration = require('./integrations/notion');
                    result = await integration.initialize(credentials);
                    break;
                case 'onenote':
                    integration = require('./integrations/onenote');
                    result = await integration.initialize(credentials);
                    break;
                case 'google-docs':
                    integration = require('./integrations/google-docs');
                    result = await integration.initialize(credentials);
                    break;
                case 'obsidian':
                    integration = require('./integrations/obsidian');
                    result = await integration.initialize(credentials);
                    break;
                default:
                    return res.status(400).json({ error: 'Unsupported integration' });
            }

            if (result.success) {
                // Save integration to database
                await userIntegrationsModel.saveIntegration(req.session.user.userid, integrationId, {
                    ...credentials,
                    connectedAccount: result.connectedAccount || 'Connected'
                });
                res.json({ success: true, message: 'Integration initialized successfully' });
            } else {
                res.status(400).json({ error: result.error });
            }
        } catch (error) {
            console.error('Integration initialization error:', error);
            res.status(500).json({ error: 'Failed to initialize integration' });
        }
    });

    // API: Get integration data (workspaces, notebooks, etc.)
    app.get('/api/integrations/:integrationId/data', async (req, res) => {
        if (!req.session.user) {
            return res.status(401).json({ error: 'Unauthorized' });
        }

        try {
            const { integrationId } = req.params;
            const userIntegrations = await userIntegrationsModel.getUserIntegrations(req.session.user.userid);
            const integration = userIntegrations.integrations.find(i => i.integrationId === integrationId);

            if (!integration) {
                return res.status(404).json({ error: 'Integration not found' });
            }

            let IntegrationClass;
            switch (integrationId) {
                case 'notion':
                    IntegrationClass = require('./integrations/notion');
                    break;
                case 'onenote':
                    IntegrationClass = require('./integrations/onenote');
                    break;
                case 'google-docs':
                    IntegrationClass = require('./integrations/google-docs');
                    break;
                case 'obsidian':
                    IntegrationClass = require('./integrations/obsidian');
                    break;
                default:
                    return res.status(400).json({ error: 'Unsupported integration' });
            }

            // Get integration credentials
            const integrationCredentials = await userIntegrationsModel.getIntegration(req.session.user.userid, integrationId);
            if (!integrationCredentials.success) {
                return res.status(404).json({ error: 'Integration credentials not found' });
            }

            // Instantiate integration class and get data
            const integrationInstance = new IntegrationClass();
            const data = await integrationInstance.getData(integrationCredentials.credentials);
            res.json({ success: true, data });
        } catch (error) {
            console.error('Error fetching integration data:', error);
            res.status(500).json({ error: 'Failed to fetch integration data' });
        }
    });

    // API: Import from integration
    app.post('/api/integrations/:integrationId/import', apiLimiter, async (req, res) => {
        if (!req.session.user) {
            return res.status(401).json({ error: 'Unauthorized' });
        }

        try {
            const { integrationId } = req.params;
            const { sourceId, options } = req.body;

            if (!sourceId) {
                return res.status(400).json({ error: 'Source ID required' });
            }

            const userIntegrations = await userIntegrationsModel.getUserIntegrations(req.session.user.userid);
            const integration = userIntegrations.integrations.find(i => i.integrationId === integrationId);

            if (!integration) {
                return res.status(404).json({ error: 'Integration not found' });
            }

            let IntegrationClass;
            switch (integrationId) {
                case 'notion':
                    IntegrationClass = require('./integrations/notion');
                    break;
                case 'onenote':
                    IntegrationClass = require('./integrations/onenote');
                    break;
                case 'google-docs':
                    IntegrationClass = require('./integrations/google-docs');
                    break;
                case 'obsidian':
                    IntegrationClass = require('./integrations/obsidian');
                    break;
                default:
                    return res.status(400).json({ error: 'Unsupported integration' });
            }

            // Get integration credentials
            const integrationCredentials = await userIntegrationsModel.getIntegration(req.session.user.userid, integrationId);
            if (!integrationCredentials.success) {
                return res.status(404).json({ error: 'Integration credentials not found' });
            }

            // Instantiate integration class and import
            const integrationInstance = new IntegrationClass();
            const result = await integrationInstance.import(sourceId, integrationCredentials.credentials, options);
            res.json({ success: true, count: result.count, files: result.files });
        } catch (error) {
            console.error('Import error:', error);
            res.status(500).json({ error: 'Import failed' });
        }
    });

    // API: Export to integration
    app.post('/api/integrations/:integrationId/export', apiLimiter, async (req, res) => {
        if (!req.session.user) {
            return res.status(401).json({ error: 'Unauthorized' });
        }

        try {
            const { integrationId } = req.params;
            const { fileId, targetId, title } = req.body;

            if (!fileId || !targetId) {
                return res.status(400).json({ error: 'File ID and target ID required' });
            }

            const userIntegrations = await userIntegrationsModel.getUserIntegrations(req.session.user.userid);
            const integration = userIntegrations.integrations.find(i => i.integrationId === integrationId);

            if (!integration) {
                return res.status(404).json({ error: 'Integration not found' });
            }

            let IntegrationClass;
            switch (integrationId) {
                case 'notion':
                    IntegrationClass = require('./integrations/notion');
                    break;
                case 'onenote':
                    IntegrationClass = require('./integrations/onenote');
                    break;
                case 'google-docs':
                    IntegrationClass = require('./integrations/google-docs');
                    break;
                case 'obsidian':
                    IntegrationClass = require('./integrations/obsidian');
                    break;
                default:
                    return res.status(400).json({ error: 'Unsupported integration' });
            }

            // Get integration credentials
            const integrationCredentials = await userIntegrationsModel.getIntegration(req.session.user.userid, integrationId);
            if (!integrationCredentials.success) {
                return res.status(404).json({ error: 'Integration credentials not found' });
            }

            // Instantiate integration class and export
            const integrationInstance = new IntegrationClass();
            const result = await integrationInstance.export(fileId, integrationCredentials.credentials, { targetId, title });
            res.json({ success: true, url: result.url });
        } catch (error) {
            console.error('Export error:', error);
            res.status(500).json({ error: 'Export failed' });
        }
    });

    // API: Disconnect integration
    app.delete('/api/integrations/:integrationId', async (req, res) => {
        if (!req.session.user) {
            return res.status(401).json({ error: 'Unauthorized' });
        }

        try {
            const { integrationId } = req.params;
            await userIntegrationsModel.deleteIntegration(req.session.user.userid, integrationId);
            res.json({ success: true, message: 'Integration disconnected' });
        } catch (error) {
            console.error('Disconnect error:', error);
            res.status(500).json({ error: 'Failed to disconnect integration' });
        }
    });

    console.log('🔧 Integration API routes registered successfully!');
}

// Initialize user integrations model when database is connected
async function initializeIntegrations() {
    try {
        await ensureConnection();
        userIntegrationsModel = new UserIntegrationsModel(client.db(userCollection.db));
        console.log('✅ User integrations model initialized');

    } catch (error) {
        console.error('❌ Failed to initialize integrations model:', error);
    }
}




// Store user integration credentials (in production, use encrypted storage)
const userIntegrations = new Map();

// ================================
// OAUTH AUTHENTICATION ROUTES
// ================================

// OAuth: Start authentication flow
app.get('/auth/:provider', async (req, res) => {
    if (!req.session.user) {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    try {
        const { provider } = req.params;

        if (!oauthManager.isConfigured(provider)) {
            return res.status(400).json({
                error: `${provider} OAuth is not configured. Please set up ${provider.toUpperCase()}_CLIENT_ID and ${provider.toUpperCase()}_CLIENT_SECRET environment variables.`
            });
        }

        const { authUrl, state } = oauthManager.generateAuthUrl(provider, req.session.user.userid);

        // Store state in session for verification
        req.session.oauthState = state;
        req.session.oauthProvider = provider;

        res.json({ success: true, authUrl: authUrl });
    } catch (error) {
        console.error('OAuth initiation error:', error);
        res.status(500).json({ error: 'Failed to initiate OAuth flow' });
    }
});

// Generic OAuth callback route removed - using specific routes for each provider