admin_server.py

#!/usr/bin/env python3
"""
NexaDB Admin Server
===================

Serves the admin panel on HTTP with TOON export functionality.

Usage:
    python3 admin_server.py --port 9999
"""

import http.server
import socketserver
import json
import os
import sys
from urllib.parse import urlparse, parse_qs
import socket as sock
import struct
import msgpack
import uuid
import time
from http.cookies import SimpleCookie

# Binary protocol constants
MAGIC = 0x4E455841
VERSION = 0x01
MSG_CONNECT = 0x01
MSG_QUERY_TOON = 0x0B
MSG_EXPORT_TOON = 0x0C
MSG_SUCCESS = 0x81

# Import TOON module and auth
sys.path.append(os.path.dirname(__file__))
# Add nexadb-python to path to import NEW client (same as tests use)
sys.path.insert(0, os.path.join(os.path.dirname(__file__), 'nexadb-python'))
from toon_format import json_to_toon
from unified_auth import UnifiedAuthManager

# Session storage (in-memory for now)
SESSIONS = {}
SESSION_TIMEOUT = 24 * 60 * 60  # 24 hours


def pack_message(msg_type, data):
    """Pack message for binary protocol."""
    payload = msgpack.packb(data, use_bin_type=True)
    header = struct.pack('>IBBHI', MAGIC, VERSION, msg_type, 0, len(payload))
    return header + payload


def unpack_message(socket):
    """Unpack message from binary protocol."""
    header_bytes = socket.recv(12)
    magic, version, msg_type, flags, payload_len = struct.unpack('>IBBHI', header_bytes)

    payload_bytes = b''
    while len(payload_bytes) < payload_len:
        chunk = socket.recv(payload_len - len(payload_bytes))
        payload_bytes += chunk

    payload = msgpack.unpackb(payload_bytes, raw=False)
    return msg_type, payload


def create_session(username, role, api_key):
    """Create a new session."""
    session_id = str(uuid.uuid4())
    SESSIONS[session_id] = {
        'username': username,
        'role': role,
        'api_key': api_key,
        'created_at': time.time(),
        'last_access': time.time()
    }
    return session_id


def get_session(session_id):
    """Get session data if valid."""
    if not session_id or session_id not in SESSIONS:
        return None

    session = SESSIONS[session_id]

    # Check if session expired
    if time.time() - session['last_access'] > SESSION_TIMEOUT:
        del SESSIONS[session_id]
        return None

    # Update last access time
    session['last_access'] = time.time()
    return session


def delete_session(session_id):
    """Delete a session."""
    if session_id in SESSIONS:
        del SESSIONS[session_id]


class AdminRequestHandler(http.server.SimpleHTTPRequestHandler):
    """HTTP request handler with TOON API endpoints and authentication."""

    auth = None  # Will be set in run_server
    data_dir = None  # Will be set in run_server

    def end_headers(self):
        # Add cache-control headers to prevent caching
        self.send_header('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
        self.send_header('Pragma', 'no-cache')
        self.send_header('Expires', '0')
        super().end_headers()

    def get_session_from_cookie(self):
        """Extract session ID from cookie."""
        cookie_header = self.headers.get('Cookie')
        if not cookie_header:
            return None

        cookie = SimpleCookie()
        cookie.load(cookie_header)

        if 'nexadb_session' in cookie:
            return cookie['nexadb_session'].value

        return None

    def is_authenticated(self):
        """Check if request is authenticated."""
        session_id = self.get_session_from_cookie()
        session = get_session(session_id)
        return session is not None

    def do_GET(self):
        """Handle GET requests."""
        parsed_path = urlparse(self.path)

        # Serve admin panel - redirect root to login or dashboard
        if parsed_path.path == '/':
            if self.is_authenticated():
                self.send_response(302)
                self.send_header('Location', '/admin_panel/index.html')
                self.end_headers()
            else:
                self.send_response(302)
                self.send_header('Location', '/admin_panel/login.html')
                self.end_headers()
            return

        # Public paths that don't require authentication
        public_paths = [
            '/admin_panel/login.html',
            '/admin_panel/css/styles.css',
            '/admin_panel/js/auth.js'
        ]

        # Check if this is a public path
        is_public = any(parsed_path.path == p for p in public_paths)

        # Check if this is a JS/CSS asset that requires authentication
        is_protected_asset = (
            parsed_path.path.startswith('/admin_panel/js/') and
            parsed_path.path != '/admin_panel/js/auth.js'
        ) or (
            parsed_path.path == '/admin_panel/index.html'
        )

        # Also support legacy /js/ path
        if parsed_path.path.startswith('/js/'):
            is_protected_asset = True

        # If /admin_panel/ without index.html, redirect to index.html if authenticated, else login
        if parsed_path.path == '/admin_panel/' or parsed_path.path == '/admin_panel':
            if self.is_authenticated():
                self.send_response(302)
                self.send_header('Location', '/admin_panel/index.html')
                self.end_headers()
            else:
                self.send_response(302)
                self.send_header('Location', '/admin_panel/login.html')
                self.end_headers()
            return

        # If it's a protected asset and not authenticated, redirect to login
        if is_protected_asset and not is_public and not self.is_authenticated():
            self.send_response(302)
            self.send_header('Location', '/admin_panel/login.html')
            self.end_headers()
            return

        # Block access to old admin panel
        if 'admin_modern' in parsed_path.path:
            self.send_error(404, "File not found")
            return

        # API endpoint for TOON export
        if parsed_path.path == '/api/toon/export':
            self.handle_toon_export(parsed_path)
        # Collections endpoint
        elif parsed_path.path == '/api/collections':
            self.handle_get_collections()
        # Vectors endpoint
        elif parsed_path.path == '/api/vectors':
            self.handle_get_vectors()
        # Storage endpoint (NEW v2.3.1 fix)
        elif parsed_path.path == '/api/storage':
            self.handle_get_storage()
        # Monitoring stats endpoint (NEW v3.0.0 - aggregated stats for monitoring)
        elif parsed_path.path == '/api/stats/monitoring':
            self.handle_get_monitoring_stats()
        # API endpoints that require authentication
        elif parsed_path.path == '/api/databases':
            # Protected endpoint - check authentication
            if not self.is_authenticated():
                self.send_response(401)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({'error': 'Unauthorized'}).encode())
                return
            self.handle_get_databases()
        # User management endpoints (GET)
        elif parsed_path.path == '/api/users/list':
            self.handle_list_users()
        # Database endpoints (NEW v3.0.0)
        elif parsed_path.path.startswith('/api/databases/') and parsed_path.path.endswith('/collections'):
            # GET /api/databases/{name}/collections
            database_name = parsed_path.path.split('/')[3]
            self.handle_get_database_collections(database_name)
        elif parsed_path.path.startswith('/api/databases/') and parsed_path.path.endswith('/stats'):
            # GET /api/databases/{name}/stats
            database_name = parsed_path.path.split('/')[3]
            self.handle_get_database_stats(database_name)
        elif parsed_path.path.startswith('/api/users/') and not parsed_path.path.endswith('/database-access'):
            # GET /api/users/{username}
            username = parsed_path.path.split('/')[3]
            self.handle_get_user(username)
        # Status endpoint (REST API compatible) - NEW v3.0.5
        elif parsed_path.path == '/status':
            self.handle_rest_status()
        # REST API compatible routes (proxy to binary server) - NEW v3.0.5
        # These allow admin panel to use same paths as REST API
        elif parsed_path.path.startswith('/collections/'):
            # GET /collections/{name} - list documents
            parts = parsed_path.path.strip('/').split('/')
            if len(parts) >= 2:
                collection_name = parts[1]
                query_params = parse_qs(parsed_path.query)
                database = query_params.get('database', ['default'])[0]
                self.handle_rest_get_documents(collection_name, database, query_params)
            else:
                self.send_error_response(400, 'Invalid collection path')
        elif parsed_path.path == '/collections':
            # GET /collections - list all collections
            query_params = parse_qs(parsed_path.query)
            database = query_params.get('database', ['default'])[0]
            self.handle_rest_list_collections(database)
        else:
            # Handle .js files explicitly to ensure correct Content-Type
            if parsed_path.path.endswith('.js'):
                try:
                    # Get file path relative to current directory
                    file_path = parsed_path.path.lstrip('/')

                    # Support legacy /js/ path by redirecting to /admin_panel/js/
                    if file_path.startswith('js/'):
                        file_path = 'admin_panel/' + file_path

                    with open(file_path, 'r') as f:
                        content = f.read()

                    self.send_response(200)
                    self.send_header('Content-Type', 'application/javascript')
                    self.end_headers()
                    self.wfile.write(content.encode('utf-8'))
                except FileNotFoundError:
                    self.send_error(404, "File not found")
                except Exception as e:
                    self.send_error(500, f"Server error: {str(e)}")
            else:
                # Serve other static files
                super().do_GET()

    def do_POST(self):
        """Handle POST requests."""
        parsed_path = urlparse(self.path)

        # Login endpoint
        if parsed_path.path == '/api/auth/login':
            self.handle_login()
        # Logout endpoint
        elif parsed_path.path == '/api/auth/logout':
            self.handle_logout()
        # Vector search endpoint
        elif parsed_path.path == '/api/search':
            self.handle_vector_search()
        # Database creation (NEW v3.0.0)
        elif parsed_path.path == '/api/databases':
            self.handle_create_database()
        # Collection creation
        elif parsed_path.path.startswith('/api/databases/') and '/collections' in parsed_path.path and not parsed_path.path.endswith('/documents'):
            database_name = parsed_path.path.split('/')[3]
            self.handle_create_collection(database_name)
        # Document insertion
        elif parsed_path.path.startswith('/api/databases/') and '/collections/' in parsed_path.path and parsed_path.path.endswith('/documents'):
            parts = parsed_path.path.split('/')
            database_name = parts[3]
            collection_name = parts[5]
            self.handle_insert_document(database_name, collection_name)
        # Query documents
        elif parsed_path.path == '/api/query':
            self.handle_query_documents()
        # User management endpoints
        elif parsed_path.path == '/api/users/create':
            self.handle_create_user()
        elif parsed_path.path == '/api/users/delete':
            self.handle_delete_user()
        elif parsed_path.path == '/api/users/update-password':
            self.handle_update_password()
        elif parsed_path.path == '/api/users/regenerate-api-key':
            self.handle_regenerate_api_key()
        elif parsed_path.path == '/api/users/grant-database-permission':
            self.handle_grant_database_permission()
        # REST API compatible route for collection creation - NEW v3.0.5
        elif parsed_path.path.startswith('/collections/'):
            parts = parsed_path.path.strip('/').split('/')
            if len(parts) >= 2:
                collection_name = parts[1]
                query_params = parse_qs(parsed_path.query)
                database = query_params.get('database', ['default'])[0]
                self.handle_rest_insert_document(collection_name, database)
            else:
                self.send_error(400, "Invalid collection path")
        else:
            self.send_error(404, "Endpoint not found")

    def do_DELETE(self):
        """Handle DELETE requests."""
        parsed_path = urlparse(self.path)

        # Delete document - /api/databases/{db}/collections/{collection}/documents/{id}
        if parsed_path.path.startswith('/api/databases/') and '/documents/' in parsed_path.path:
            parts = parsed_path.path.split('/')
            database_name = parts[3]
            collection_name = parts[5]
            document_id = parts[7]
            self.handle_delete_document(database_name, collection_name, document_id)
        # Delete document - /databases/{db}/collections/{collection}/documents/{id} (without /api prefix) - NEW v3.0.5
        elif parsed_path.path.startswith('/databases/') and '/documents/' in parsed_path.path:
            parts = parsed_path.path.split('/')
            database_name = parts[2]
            collection_name = parts[4]
            document_id = parts[6]
            self.handle_delete_document(database_name, collection_name, document_id)
        # Delete collection
        elif parsed_path.path.startswith('/api/databases/') and '/collections/' in parsed_path.path:
            parts = parsed_path.path.split('/')
            database_name = parts[3]
            collection_name = parts[5]
            self.handle_drop_collection(database_name, collection_name)
        # Delete database (NEW v3.0.0)
        elif parsed_path.path.startswith('/api/databases/'):
            database_name = parsed_path.path.split('/')[3]
            self.handle_delete_database(database_name)
        # REST API compatible route for document deletion - NEW v3.0.5
        elif parsed_path.path.startswith('/collections/'):
            parts = parsed_path.path.strip('/').split('/')
            if len(parts) >= 3:
                collection_name = parts[1]
                document_id = parts[2]
                query_params = parse_qs(parsed_path.query)
                database = query_params.get('database', ['default'])[0]
                self.handle_rest_delete_document(collection_name, document_id, database)
            else:
                self.send_error(400, "Invalid path - expected /collections/{name}/{id}")
        else:
            self.send_error(404, "Endpoint not found")

    def do_PUT(self):
        """Handle PUT requests."""
        parsed_path = urlparse(self.path)

        # Update document
        if parsed_path.path.startswith('/api/databases/') and '/documents/' in parsed_path.path:
            parts = parsed_path.path.split('/')
            database_name = parts[3]
            collection_name = parts[5]
            document_id = parts[7]
            self.handle_update_document(database_name, collection_name, document_id)
        # Grant/revoke database access (NEW v3.0.0)
        elif parsed_path.path.endswith('/database-access'):
            username = parsed_path.path.split('/')[3]
            self.handle_update_database_access(username)
        else:
            self.send_error(404, "Endpoint not found")

    def handle_login(self):
        """Handle login request."""
        try:
            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            username = data.get('username')
            password = data.get('password')

            if not username or not password:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': 'Missing username or password'
                }).encode())
                return

            # Authenticate with unified auth manager
            user_info = self.auth.authenticate_password(username, password)

            if not user_info:
                self.send_response(401)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',  # Match test expectations
                    'error': 'Invalid username or password'
                }).encode())
                return

            # Create session
            session_id = create_session(
                user_info['username'],
                user_info['role'],
                user_info['api_key']
            )

            # Set session cookie
            cookie = SimpleCookie()
            cookie['nexadb_session'] = session_id
            cookie['nexadb_session']['path'] = '/'
            cookie['nexadb_session']['max-age'] = SESSION_TIMEOUT
            cookie['nexadb_session']['httponly'] = True

            # Send response
            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Set-Cookie', cookie['nexadb_session'].OutputString())
            self.end_headers()

            self.wfile.write(json.dumps({
                'status': 'success',  # Match test expectations
                'success': True,  # Keep for backward compatibility
                'username': user_info['username'],
                'role': user_info['role'],
                'api_key': user_info['api_key']
            }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_logout(self):
        """Handle logout request."""
        try:
            session_id = self.get_session_from_cookie()
            if session_id:
                delete_session(session_id)

            # Clear cookie
            cookie = SimpleCookie()
            cookie['nexadb_session'] = ''
            cookie['nexadb_session']['path'] = '/'
            cookie['nexadb_session']['max-age'] = 0

            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Set-Cookie', cookie['nexadb_session'].OutputString())
            self.end_headers()

            self.wfile.write(json.dumps({
                'status': 'success',  # Match test expectations
                'success': True,  # Keep for backward compatibility
                'message': 'Logged out successfully'
            }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_get_collections(self):
        """Handle GET /api/collections - fetch all collections from binary server."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server (THE SINGLE SOURCE OF TRUTH)
            with NexaClient(host='localhost', port=6970) as db:
                collections = db.list_collections()

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'collections': collections,
                    'count': len(collections)
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_get_vectors(self):
        """Handle GET /api/vectors - get vector index statistics from binary server."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server (THE SINGLE SOURCE OF TRUTH)
            with NexaClient(host='localhost', port=6970) as db:
                result = db.get_vectors()

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps(result).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_get_storage(self):
        """Handle GET /api/storage - calculate actual storage size (NEW v2.3.1 fix)."""
        try:
            total_size = 0

            # Calculate actual directory size
            if self.data_dir and os.path.exists(self.data_dir):
                for dirpath, dirnames, filenames in os.walk(self.data_dir):
                    for filename in filenames:
                        filepath = os.path.join(dirpath, filename)
                        try:
                            total_size += os.path.getsize(filepath)
                        except OSError:
                            pass  # Skip files that can't be accessed

            # Convert bytes to KB
            size_kb = total_size / 1024

            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()

            self.wfile.write(json.dumps({
                'storage_bytes': total_size,
                'storage_kb': round(size_kb, 2),
                'storage_mb': round(size_kb / 1024, 2)
            }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_get_monitoring_stats(self):
        """Handle GET /api/stats/monitoring - get aggregated monitoring stats (NEW v3.0.0)."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server (THE SINGLE SOURCE OF TRUTH)
            with NexaClient(host='localhost', port=6970) as db:
                # Get all databases
                databases = db.list_databases()
                total_databases = len(databases)

                # Get total collections across all databases
                total_collections = 0
                for database in databases:
                    collections = db.list_collections(database=database)
                    total_collections += len(collections)

                # Get total users
                total_users = 0
                if self.auth:
                    users_dict = self.auth.list_users()
                    total_users = len(users_dict)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'databases': total_databases,
                    'collections': total_collections,
                    'users': total_users
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_vector_search(self):
        """Handle POST /api/search - perform vector search."""
        try:
            from nexaclient import NexaClient

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            collection = data.get('collection')
            query_vector = data.get('query_vector')
            k = data.get('k', 10)
            dimensions = data.get('dimensions', 768)  # Default to 768
            database = data.get('database')  # v3.0.0: Extract database parameter

            if not collection:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': 'Missing collection parameter'
                }).encode())
                return

            if not query_vector:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': 'Missing query_vector parameter'
                }).encode())
                return

            # Validate vector dimensions
            if len(query_vector) != dimensions:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': f'Query vector must have {dimensions} dimensions, got {len(query_vector)}'
                }).encode())
                return

            # Connect to binary server (THE SINGLE SOURCE OF TRUTH)
            with NexaClient(host='localhost', port=6970) as db:
                results = db.vector_search(collection, query_vector, limit=k, dimensions=dimensions, database=database)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'success': True,
                    'results': results,
                    'count': len(results)
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_toon_export(self, parsed_path):
        """Handle TOON export API request."""
        try:
            from nexaclient import NexaClient

            # Parse query parameters
            params = parse_qs(parsed_path.query)
            collection = params.get('collection', [''])[0]

            if not collection:
                self.send_error(400, "Missing collection parameter")
                return

            # Connect to binary server (THE SINGLE SOURCE OF TRUTH)
            with NexaClient(host='localhost', port=6970) as db:
                response = db.export_toon(collection)

                # Return TOON data as JSON response
                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                result = {
                    'success': True,
                    'toon_data': response.get('data', ''),
                    'token_stats': response.get('token_stats', {}),
                    'count': response.get('count', 0)
                }

                self.wfile.write(json.dumps(result).encode())

        except Exception as e:
            self.send_error(500, f"Server error: {str(e)}")

    def handle_get_databases(self):
        """Handle GET /api/databases - list all databases (NEW v3.0.0)."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server
            with NexaClient(host='localhost', port=6970) as db:
                databases = db.list_databases()

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'databases': databases,
                    'count': len(databases)
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_create_database(self):
        """Handle POST /api/databases - create new database (NEW v3.0.0)."""
        try:
            from nexaclient import NexaClient

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            database_name = data.get('name')

            if not database_name:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': 'Missing database name'
                }).encode())
                return

            # Connect to binary server
            with NexaClient(host='localhost', port=6970) as db:
                result = db.create_database(database_name)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'database': database_name,
                    'message': f"Database '{database_name}' created successfully"
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_delete_database(self, database_name):
        """Handle DELETE /api/databases/{name} - drop database (NEW v3.0.0)."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server
            with NexaClient(host='localhost', port=6970) as db:
                result = db.drop_database(database_name)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'message': f"Database '{database_name}' deleted successfully"
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_get_database_collections(self, database_name):
        """Handle GET /api/databases/{name}/collections - list collections in database (NEW v3.0.0)."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server
            with NexaClient(host='localhost', port=6970) as db:
                collections = db.list_collections(database=database_name)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'database': database_name,
                    'collections': collections,
                    'count': len(collections)
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_get_database_stats(self, database_name):
        """Handle GET /api/databases/{name}/stats - get database statistics (NEW v3.0.0)."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server and get real stats
            with NexaClient(host='localhost', port=6970) as db:
                collections = db.list_collections(database=database_name)
                collections_count = len(collections)

                # Count documents in each collection
                documents_count = 0
                for collection in collections:
                    try:
                        docs = db.query(collection, {}, database=database_name, limit=0)
                        # Query with limit=0 should return count or empty list
                        # Let's count manually with a high limit
                        docs = db.query(collection, {}, database=database_name, limit=100000)
                        documents_count += len(docs)
                    except:
                        pass

                stats = {
                    'database': database_name,
                    'collections_count': collections_count,
                    'documents_count': documents_count
                }

            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()

            self.wfile.write(json.dumps({
                'database': database_name,
                'collections_count': stats.get('collections_count', 0),
                'documents_count': stats.get('documents_count', 0),
                'stats': stats
            }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_get_user(self, username):
        """Handle GET /api/users/{username} - get user with database permissions (NEW v3.0.0)."""
        try:
            if not self.auth:
                self.send_response(500)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': 'Authentication system not initialized'
                }).encode())
                return

            user_data = self.auth.get_user(username)

            if not user_data:
                self.send_response(404)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': f"User '{username}' not found"
                }).encode())
                return

            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()

            self.wfile.write(json.dumps({
                'username': username,
                'role': user_data.get('role', 'guest'),
                'database_permissions': user_data.get('database_permissions', {}),
                'created_at': user_data.get('created_at', 0)
            }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_update_database_access(self, username):
        """Handle PUT /api/users/{username}/database-access - grant/revoke database access (NEW v3.0.0)."""
        try:
            if not self.auth:
                self.send_response(500)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': 'Authentication system not initialized'
                }).encode())
                return

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            database_name = data.get('database')
            permission = data.get('permission')  # Can be null to revoke

            if not database_name:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': 'Missing database name'
                }).encode())
                return

            if permission:
                # Grant access
                self.auth.grant_database_access(username, database_name, permission)
                message = f"Granted '{permission}' access to database '{database_name}' for user '{username}'"
            else:
                # Revoke access
                self.auth.revoke_database_access(username, database_name)
                message = f"Revoked access to database '{database_name}' for user '{username}'"

            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()

            self.wfile.write(json.dumps({
                'success': True,
                'message': message
            }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_create_collection(self, database_name):
        """Handle POST /api/databases/{db}/collections - create collection."""
        try:
            from nexaclient import NexaClient

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            collection_name = data.get('name')
            vector_dimensions = data.get('vector_dimensions')

            if not collection_name:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': 'Missing collection name'
                }).encode())
                return

            # Connect to binary server
            with NexaClient(host='localhost', port=6970) as db:
                # Create collection by inserting a placeholder document
                # Collections are created implicitly on first insert
                placeholder_data = {'_collection_init': True}
                if vector_dimensions:
                    # For vector collections, add vector field
                    placeholder_data['vector'] = [0.0] * vector_dimensions

                result = db.create(collection_name, placeholder_data, database=database_name)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'collection': collection_name,
                    'database': database_name,
                    'message': f"Collection '{collection_name}' created successfully"
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_drop_collection(self, database_name, collection_name):
        """Handle DELETE /api/databases/{db}/collections/{name} - drop collection."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server
            with NexaClient(host='localhost', port=6970) as db:
                result = db.drop_collection(collection_name, database=database_name)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'message': f"Collection '{collection_name}' dropped successfully"
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_insert_document(self, database_name, collection_name):
        """Handle POST /api/databases/{db}/collections/{coll}/documents - insert document."""
        try:
            from nexaclient import NexaClient

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            document = json.loads(body)

            # Connect to binary server
            with NexaClient(host='localhost', port=6970) as db:
                result = db.create(collection_name, document, database=database_name)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'id': result.get('document_id'),
                    'document_id': result.get('document_id'),
                    'message': 'Document inserted successfully'
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_query_documents(self):
        """Handle POST /api/query - query documents."""
        try:
            from nexaclient import NexaClient

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            database_name = data.get('database')
            collection_name = data.get('collection')
            filters = data.get('filters', {})
            limit = data.get('limit', 100)

            if not collection_name:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'error': 'Missing collection parameter'
                }).encode())
                return

            # Connect to binary server
            with NexaClient(host='localhost', port=6970) as db:
                documents = db.query(collection_name, filters=filters, limit=limit, database=database_name)

                # Filter out collection marker documents (belt and suspenders - client already filters)
                filtered_docs = [doc for doc in documents if not (doc.get('_collection_init') or doc.get('_nexadb_collection_marker'))]

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'documents': filtered_docs,
                    'count': len(filtered_docs)
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_update_document(self, database_name, collection_name, document_id):
        """Handle PUT /api/databases/{db}/collections/{coll}/documents/{id} - update document."""
        try:
            from nexaclient import NexaClient

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            updates = json.loads(body)

            # Connect to binary server
            with NexaClient(host='localhost', port=6970) as db:
                result = db.update(collection_name, document_id, updates, database=database_name)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'message': 'Document updated successfully'
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_delete_document(self, database_name, collection_name, document_id):
        """Handle DELETE /api/databases/{db}/collections/{coll}/documents/{id} - delete document."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server
            with NexaClient(host='localhost', port=6970) as db:
                result = db.delete(collection_name, document_id, database=database_name)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'message': 'Document deleted successfully'
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_create_user(self):
        """Handle POST /api/users/create - create new user."""
        try:
            if not self.auth:
                self.send_response(500)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Authentication system not initialized'
                }).encode())
                return

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            username = data.get('username')
            password = data.get('password')
            role = data.get('role', 'read')

            if not username or not password:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Missing username or password'
                }).encode())
                return

            # Create user
            api_key = self.auth.create_user(username, password, role)

            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()

            self.wfile.write(json.dumps({
                'status': 'success',
                'username': username,
                'api_key': api_key,
                'message': f"User '{username}' created successfully"
            }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_delete_user(self):
        """Handle POST /api/users/delete - delete user."""
        try:
            if not self.auth:
                self.send_response(500)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Authentication system not initialized'
                }).encode())
                return

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            username = data.get('username')

            if not username:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Missing username'
                }).encode())
                return

            # Delete user
            result = self.auth.delete_user(username)

            if result:
                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'message': f"User '{username}' deleted successfully"
                }).encode())
            else:
                self.send_response(404)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': f"User '{username}' not found"
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_update_password(self):
        """Handle POST /api/users/update-password - update user password."""
        try:
            if not self.auth:
                self.send_response(500)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Authentication system not initialized'
                }).encode())
                return

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            username = data.get('username')
            new_password = data.get('new_password')

            if not username or not new_password:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Missing username or new_password'
                }).encode())
                return

            # Update password
            result = self.auth.change_password(username, new_password)

            if result:
                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'message': f"Password updated for user '{username}'"
                }).encode())
            else:
                self.send_response(404)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': f"User '{username}' not found"
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_regenerate_api_key(self):
        """Handle POST /api/users/regenerate-api-key - regenerate user API key."""
        try:
            if not self.auth:
                self.send_response(500)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Authentication system not initialized'
                }).encode())
                return

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            username = data.get('username')

            if not username:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Missing username'
                }).encode())
                return

            # Regenerate API key
            new_api_key = self.auth.regenerate_api_key(username)

            if new_api_key:
                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'api_key': new_api_key,
                    'message': f"API key regenerated for user '{username}'"
                }).encode())
            else:
                self.send_response(404)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': f"User '{username}' not found"
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_grant_database_permission(self):
        """Handle POST /api/users/grant-database-permission - grant database permission to user."""
        try:
            if not self.auth:
                self.send_response(500)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Authentication system not initialized'
                }).encode())
                return

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length).decode('utf-8')
            data = json.loads(body)

            username = data.get('username')
            database = data.get('database')
            permission = data.get('permission')

            if not username or not database or not permission:
                self.send_response(400)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Missing username, database, or permission'
                }).encode())
                return

            # Grant permission
            result = self.auth.grant_database_access(username, database, permission)

            if result:
                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'message': f"Granted '{permission}' access to database '{database}' for user '{username}'"
                }).encode())
            else:
                self.send_response(404)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': f"Failed to grant permission"
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    def handle_list_users(self):
        """Handle GET /api/users/list - list all users."""
        try:
            if not self.auth:
                self.send_response(500)
                self.send_header('Content-Type', 'application/json')
                self.end_headers()
                self.wfile.write(json.dumps({
                    'status': 'error',
                    'error': 'Authentication system not initialized'
                }).encode())
                return

            # Get all users
            users_dict = self.auth.list_users()

            # Convert to list format
            users_list = []
            for username, user_data in users_dict.items():
                users_list.append({
                    'username': username,
                    'role': user_data.get('role', 'guest'),
                    'database_permissions': user_data.get('database_permissions', {}),
                    'created_at': user_data.get('created_at', 0)
                })

            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()

            self.wfile.write(json.dumps({
                'users': users_list,
                'count': len(users_list)
            }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': f'Server error: {str(e)}'
            }).encode())

    # ============================================================
    # REST API Compatible Handlers (v3.0.5)
    # These allow admin panel to use same paths as REST API
    # ============================================================

    def handle_rest_status(self):
        """Handle GET /status - server status (REST API compatible)."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server and get status
            with NexaClient(host='localhost', port=6970) as db_client:
                # Get databases list
                databases = db_client.list_databases()
                db_list = databases if isinstance(databases, list) else databases.get('databases', [])

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'connected',
                    'version': '3.0.6',
                    'server': 'NexaDB',
                    'database': 'NexaDB',  # For admin panel connection status display
                    'binary_port': 6970,
                    'rest_port': 6969,
                    'admin_port': 9999,
                    'databases': db_list,
                    'database_count': len(db_list)
                }).encode())

        except Exception as e:
            self.send_response(200)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'disconnected',
                'version': '3.0.6',
                'database': 'NexaDB',
                'error': str(e)
            }).encode())

    def handle_rest_insert_document(self, collection_name, database):
        """Handle POST /collections/{name}?database={db} - insert document (REST API compatible)."""
        try:
            from nexaclient import NexaClient

            # Read request body
            content_length = int(self.headers.get('Content-Length', 0))
            body = self.rfile.read(content_length)
            doc = json.loads(body)

            # Connect to binary server and insert
            with NexaClient(host='localhost', port=6970) as db_client:
                result = db_client.create(collection_name, doc, database=database)
                doc_id = result.get('document_id')

                self.send_response(201)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'collection': collection_name,
                    'document_id': doc_id,
                    'message': 'Document inserted'
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': str(e)
            }).encode())

    def handle_rest_get_documents(self, collection_name, database, query_params):
        """Handle GET /collections/{name}?database={db} - list documents (REST API compatible)."""
        try:
            from nexaclient import NexaClient

            # Parse query parameters
            query = query_params.get('query', ['{}'])[0]
            limit = int(query_params.get('limit', [100])[0])
            skip = int(query_params.get('skip', [0])[0])

            # Connect to binary server and query
            with NexaClient(host='localhost', port=6970) as db_client:
                result = db_client.query(collection_name, json.loads(query), database=database)
                documents = result if isinstance(result, list) else result.get('documents', [])

                # Apply pagination
                paginated_docs = documents[skip:skip + limit]

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'collection': collection_name,
                    'documents': paginated_docs,
                    'count': len(paginated_docs),
                    'total': len(documents)
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': str(e)
            }).encode())

    def handle_rest_list_collections(self, database):
        """Handle GET /collections?database={db} - list collections (REST API compatible)."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server and list collections
            with NexaClient(host='localhost', port=6970) as db_client:
                result = db_client.list_collections(database=database)
                collections = result if isinstance(result, list) else result.get('collections', [])

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'collections': collections,
                    'count': len(collections)
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': str(e)
            }).encode())

    def handle_rest_delete_document(self, collection_name, document_id, database):
        """Handle DELETE /collections/{name}/{id}?database={db} - delete document (REST API compatible)."""
        try:
            from nexaclient import NexaClient

            # Connect to binary server and delete
            with NexaClient(host='localhost', port=6970) as db_client:
                result = db_client.delete(collection_name, document_id, database=database)

                self.send_response(200)
                self.send_header('Content-Type', 'application/json')
                self.send_header('Access-Control-Allow-Origin', '*')
                self.end_headers()

                self.wfile.write(json.dumps({
                    'status': 'success',
                    'message': f'Document {document_id} deleted'
                }).encode())

        except Exception as e:
            self.send_response(500)
            self.send_header('Content-Type', 'application/json')
            self.send_header('Access-Control-Allow-Origin', '*')
            self.end_headers()
            self.wfile.write(json.dumps({
                'status': 'error',
                'error': str(e)
            }).encode())

    def log_message(self, format, *args):
        """Custom log format."""
        print(f"[{self.log_date_time_string()}] {format % args}")


def run_server(port=9999, data_dir=None):
    """Run the admin HTTP server."""
    # Change to nexadb directory
    nexadb_dir = os.path.dirname(__file__) or '.'
    os.chdir(nexadb_dir)

    # Use same data directory as main server (./nexadb_data)
    # Check environment variable first for consistency with other servers
    if data_dir is None:
        data_dir = os.getenv('NEXADB_DATA_DIR')
        if data_dir is None:
            data_dir = os.path.join(nexadb_dir, 'nexadb_data')

    # Initialize unified auth manager
    auth = UnifiedAuthManager(data_dir=data_dir)
    AdminRequestHandler.auth = auth
    AdminRequestHandler.data_dir = data_dir  # Set data_dir for storage calculation

    # Create server
    Handler = AdminRequestHandler

    with socketserver.TCPServer(("", port), Handler) as httpd:
        print("=" * 70)
        print("NexaDB Admin Server")
        print("=" * 70)
        print(f"Serving admin panel at: http://localhost:{port}")
        print(f"\n🎨 Admin Panel: http://localhost:{port}/admin_panel/")
        print(f"   Login: root / nexadb123")
        print(f"\n🔒 Server-side session authentication enabled")
        print(f"   Session timeout: {SESSION_TIMEOUT // 3600} hours")
        print(f"\nTOON viewer: http://localhost:{port}/toon_viewer.html")
        print(f"\nHTTP REST API: localhost:6969")
        print(f"Binary Protocol: localhost:6970")
        print("=" * 70)
        print("\nPress Ctrl+C to stop")

        try:
            httpd.serve_forever()
        except KeyboardInterrupt:
            print("\n\nShutting down server...")
            httpd.shutdown()


if __name__ == '__main__':
    port = 9999
    data_dir = None

    if '--port' in sys.argv:
        port_idx = sys.argv.index('--port')
        if port_idx + 1 < len(sys.argv):
            port = int(sys.argv[port_idx + 1])

    if '--data-dir' in sys.argv:
        data_dir_idx = sys.argv.index('--data-dir')
        if data_dir_idx + 1 < len(sys.argv):
            data_dir = sys.argv[data_dir_idx + 1]

    run_server(port, data_dir)