server.ts

import "dotenv/config";
import express from "express";
import path from "path";
import cors from "cors";
import helmet from "helmet";
import morgan from "morgan";
import { createServer as createViteServer } from "vite";
import Groq from "groq-sdk";
import { authRouter } from "./src/server/routes/auth";
import { apiRouter } from "./src/server/routes/api";
import { authenticate, AuthRequest } from "./src/server/auth";
import {
  generalLimiter,
  authLimiter,
  authStrictLimiter,
  authBackoffMiddleware,
  aiLimiter,
  writeLimiter,
} from "./src/server/rateLimit";

const INAPPROPRIATE_PATTERNS = [
  /\badult\s*(actor|actress|video|film|movie|content|entertainment|star|star)\b/i,
  /\bporn(?:o|ographic)?(?:\s*(?:star|actor|actress|video|film|movie|content|site|hub))?\b/i,
  /\bnsfw\b/i,
  /\bxxx\b/i,
  /\bsexual(?:ly)?\s*(?:explicit|suggestive|content|innuendo)\b/i,
  /\bescort(?:s)?\b/i,
  /\bstripper|striptease|lapdance\b/i,
  /\bnude(?:ty|s)?\b/i,
  /\bplayboy|playgirl\b/i,
  /\berotic(?:a|ally)?\b/i,
  /\blust\b/i,
  /\bhookup|one\s*night\s*stand\b/i,
  /\bonly\s*fans\b/i,
  /\bsex\s*chat\b/i,
  /\bintimate\s*relationship\b/i,
];

function isAppropriateContent(text: string): boolean {
  return !INAPPROPRIATE_PATTERNS.some((pattern) => pattern.test(text));
}

const INAPPROPRIATE_RESPONSE =
  "I'm StudySync AI, your educational study assistant. I can only help with academic topics like math, science, programming, history, literature, and more. Please search for educational content related to your studies. Is there a school subject I can help you with?";

async function startServer() {
  const app = express();
  const PORT = parseInt(process.env.PORT || "3000", 10);

  // Trust proxy (required for rate limiting behind reverse proxy)
  app.set("trust proxy", 1);

  // Security headers
  app.use(
    helmet({
      contentSecurityPolicy: {
        directives: {
          defaultSrc: ["'self'"],
          scriptSrc: ["'self'", "'unsafe-inline'"],
          styleSrc: [
            "'self'",
            "'unsafe-inline'",
            "https://fonts.googleapis.com",
          ],
          fontSrc: ["'self'", "https://fonts.gstatic.com"],
          imgSrc: ["'self'", "data:"],
          connectSrc: ["'self'"],
        },
      },
      crossOriginEmbedderPolicy: false,
    }),
  );

  // CORS
  const allowedOrigins = process.env.ALLOWED_ORIGINS?.split(",") || [
    "http://localhost:3000",
  ];
  app.use(
    cors({
      origin: allowedOrigins,
      credentials: true,
    }),
  );

  // Body parsing
  app.use(express.json({ limit: "100kb" }));

  // Logging
  app.use(morgan("combined"));

  // Global rate limiter
  app.use("/api", generalLimiter);
  app.use("/auth", generalLimiter);

  // Auth routes with strict rate limiting + exponential backoff
  app.use("/auth", authLimiter);
  app.use("/auth", authStrictLimiter);
  app.use("/auth", authBackoffMiddleware);
  app.use("/auth", authRouter);

  // Protected API routes with write limiter for mutations
  app.use("/api", apiRouter);

  // AI Routes (authenticated + AI-specific rate limit)
  app.post(
    "/api/ai/chat",
    authenticate,
    aiLimiter,
    async (req: AuthRequest, res) => {
      try {
        const { message, history } = req.body;

        if (
          !message ||
          typeof message !== "string" ||
          message.trim().length === 0
        ) {
          return res.status(400).json({ error: "Message is required" });
        }

        if (message.length > 5000) {
          return res
            .status(400)
            .json({ error: "Message too long (max 5000 characters)" });
        }

        if (!isAppropriateContent(message)) {
          return res.json({ response: INAPPROPRIATE_RESPONSE });
        }

        if (!process.env.GROQ_API_KEY) {
          return res
            .status(503)
            .json({ error: "AI service is not configured." });
        }

        const groq = new Groq({ apiKey: process.env.GROQ_API_KEY });

        const systemMessage = `You are StudySync AI, an expert AI productivity assistant and learning tutor for students.
You provide clear, concise, and educational answers. Use markdown formatting to make your responses easy to read.
Break down complex topics into simple terms. If the user asks for a quiz, provide a few multiple choice questions.

STRICT RULES:
- You MUST ONLY answer questions related to educational and academic topics (e.g. math, science, programming, history, literature, languages, business, engineering, etc.).
- You MUST REFUSE any question related to adult content, sexual material, adult actors/actresses, adult videos, pornographic content, NSFW topics, or any sexually suggestive material.
- If the user asks about such content, respond with: "I'm StudySync AI, your educational study assistant. I can only help with academic topics. Please search for educational content related to your studies. Is there a school subject I can help you with?"
- Never provide links to or discuss adult/sexual content under any circumstances.`;

        const sanitizedMessage = message.trim().slice(0, 5000);
        const safeHistory = Array.isArray(history) ? history.slice(-5) : [];

        const messages: Array<{
          role: "system" | "user" | "assistant";
          content: string;
        }> = [{ role: "system", content: systemMessage }];

        for (const msg of safeHistory) {
          if (msg && typeof msg.content === "string") {
            messages.push({
              role: msg.role === "user" ? "user" : "assistant",
              content: String(msg.content).trim().slice(0, 2000),
            });
          }
        }

        messages.push({ role: "user", content: sanitizedMessage });

        const response = await groq.chat.completions.create({
          model: "llama-3.3-70b-versatile",
          messages,
          temperature: 0.7,
        });

        res.json({ response: response.choices[0]?.message?.content || "" });
      } catch (error: any) {
        console.error("AI Chat Error:", error?.message || error);
        res.status(500).json({ error: "Failed to generate AI response." });
      }
    },
  );

  app.post(
    "/api/ai/suggestion",
    authenticate,
    aiLimiter,
    async (req: AuthRequest, res) => {
      try {
        if (!process.env.GROQ_API_KEY) {
          return res.json({
            suggestion:
              "Set up your Groq API key to get personalized study suggestions.",
          });
        }

        const groq = new Groq({ apiKey: process.env.GROQ_API_KEY });

        const prompt =
          "Generate a short, encouraging 1-sentence study suggestion for a computer science student. Example: 'Focus more on Database Normalization and practice past year questions.'";

        const response = await groq.chat.completions.create({
          model: "llama-3.3-70b-versatile",
          messages: [{ role: "user", content: prompt }],
          temperature: 0.9,
        });

        res.json({ suggestion: response.choices[0]?.message?.content || "" });
      } catch (error) {
        console.error("AI Suggestion Error:", (error as any)?.message || error);
        res.json({
          suggestion:
            "Review your upcoming assignments and start preparing early.",
        });
      }
    },
  );

  app.post(
    "/api/ai/flashcards",
    authenticate,
    aiLimiter,
    async (req: AuthRequest, res) => {
      try {
        const { topic } = req.body;

        if (!topic || typeof topic !== "string" || topic.trim().length === 0) {
          return res.status(400).json({ error: "Topic is required" });
        }

        if (topic.length > 500) {
          return res
            .status(400)
            .json({ error: "Topic too long (max 500 characters)" });
        }

        if (!isAppropriateContent(topic)) {
          return res.status(400).json({
            error:
              "This topic is not appropriate for educational content. Please choose an academic subject.",
          });
        }

        if (!process.env.GROQ_API_KEY) {
          return res
            .status(503)
            .json({ error: "AI service is not configured." });
        }

        const groq = new Groq({ apiKey: process.env.GROQ_API_KEY });
        const sanitizedTopic = topic.trim().slice(0, 500);

        const prompt = `Generate 5 educational flashcards for the topic: "${sanitizedTopic}". Return ONLY a valid JSON array of objects with "front" and "back" keys. Do not include markdown formatting or the word json.`;

        const response = await groq.chat.completions.create({
          model: "llama-3.3-70b-versatile",
          messages: [{ role: "user", content: prompt }],
        });

        const text = response.choices[0]?.message?.content || "[]";
        let flashcards = [];
        try {
          flashcards = JSON.parse(text);
        } catch (e) {
          const cleaned = text
            .replace(/```json/g, "")
            .replace(/```/g, "")
            .trim();
          try {
            flashcards = JSON.parse(cleaned);
          } catch (e2) {
            return res
              .status(500)
              .json({ error: "Failed to parse flashcard data from AI." });
          }
        }

        res.json(flashcards);
      } catch (error) {
        console.error("Flashcard AI Error:", (error as any)?.message || error);
        res.status(500).json({ error: "Failed to generate flashcards." });
      }
    },
  );

  app.post(
    "/api/ai/quiz",
    authenticate,
    aiLimiter,
    async (req: AuthRequest, res) => {
      try {
        const { topic, difficulty, questions } = req.body;

        if (!topic || typeof topic !== "string" || topic.trim().length === 0) {
          return res.status(400).json({ error: "Topic is required" });
        }

        if (topic.length > 500) {
          return res
            .status(400)
            .json({ error: "Topic too long (max 500 characters)" });
        }

        if (!isAppropriateContent(topic)) {
          return res.status(400).json({
            error:
              "This topic is not appropriate for educational content. Please choose an academic subject.",
          });
        }

        const validDifficulties = ["Beginner", "Intermediate", "Advanced"];
        const safeDifficulty = validDifficulties.includes(difficulty)
          ? difficulty
          : "Intermediate";
        const safeQuestions =
          typeof questions === "number" && questions >= 1 && questions <= 20
            ? Math.floor(questions)
            : 10;

        if (!process.env.GROQ_API_KEY) {
          return res
            .status(503)
            .json({ error: "AI service is not configured." });
        }

        const groq = new Groq({ apiKey: process.env.GROQ_API_KEY });
        const sanitizedTopic = topic.trim().slice(0, 500);

        const prompt = `Generate a ${safeDifficulty} level multiple choice quiz about "${sanitizedTopic}" with ${safeQuestions} questions.
      Return ONLY a valid JSON array of objects. Each object should have:
      - "question" (string)
      - "options" (array of exactly 4 string options)
      - "correctAnswer" (integer, 0-3 index of the correct option)
      Do not include markdown formatting or the word json.`;

        const response = await groq.chat.completions.create({
          model: "llama-3.3-70b-versatile",
          messages: [{ role: "user", content: prompt }],
        });

        const text = response.choices[0]?.message?.content || "[]";
        let quiz = [];
        try {
          quiz = JSON.parse(text);
        } catch (e) {
          const cleaned = text
            .replace(/```json/g, "")
            .replace(/```/g, "")
            .trim();
          try {
            quiz = JSON.parse(cleaned);
          } catch (e2) {
            return res
              .status(500)
              .json({ error: "Failed to parse quiz data from AI." });
          }
        }

        res.json(quiz);
      } catch (error) {
        console.error("Quiz AI Error:", (error as any)?.message || error);
        res.status(500).json({ error: "Failed to generate quiz." });
      }
    },
  );

  // Vite middleware for development
  if (process.env.NODE_ENV !== "production") {
    const vite = await createViteServer({
      server: { middlewareMode: true },
      appType: "spa",
    });
    app.use(vite.middlewares);
  } else {
    const distPath = path.join(process.cwd(), "dist");
    app.use(express.static(distPath));
    app.get("*", (req, res) => {
      res.sendFile(path.join(distPath, "index.html"));
    });
  }

  // Global error handler — never leak stack traces or internal details
  app.use(
    (
      err: Error,
      _req: express.Request,
      res: express.Response,
      _next: express.NextFunction,
    ) => {
      console.error("Unhandled error:", err?.message || err);
      if (process.env.NODE_ENV !== "production") {
        console.error("Stack:", err?.stack);
      }
      res.status(500).json({ error: "Internal server error" });
    },
  );

  app.listen(PORT, "0.0.0.0", () => {
    console.log(`Server running on http://localhost:${PORT}`);
  });
}

startServer().catch((err) => {
  console.error("Failed to start server:", (err as any)?.message || err);
  process.exit(1);
});