import express from 'express';
import session from 'express-session';
import path from 'path';
import { fileURLToPath } from 'url';
import dotenv from 'dotenv';
import bcrypt from 'bcrypt';
import pkg from './package.json' with { type: "json" }
dotenv.config();

import { initMongo, getCollections } from './db/mongo.js';
import { registerApiRoutes } from './routes/api.js';
import { registerAuthRoutes } from './routes/auth.js';
import { registerAddressRoute } from './routes/address.js';

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);

const app = express();
const PORT = process.env.PORT || 3000;
const SESSION_SECRET = process.env.SESSION_SECRET || 'supersecret';

app.use(express.urlencoded({ extended: true }));
app.use(express.json());
app.use(express.static(path.join(__dirname, 'public')));

app.use(session({
  secret: SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: { maxAge: 24 * 60 * 60 * 1000 }
}));

app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'pug');

// DB verbinden
await initMongo();
await bootstrapAdmin();

// Legt beim allerersten Start (leere user-Collection) einen Admin aus
// ADMIN_EMAIL/ADMIN_PASSWORD an - notwendig für extern verwaltete Deployments
// ohne direkten Mongo-Zugriff (z.B. per Portainer betriebene Server).
async function bootstrapAdmin() {
  const { usersCollection } = getCollections();
  const count = await usersCollection.countDocuments();
  if (count > 0) return;

  const email = process.env.ADMIN_EMAIL;
  const password = process.env.ADMIN_PASSWORD;
  if (!email || !password) {
    console.warn('Keine User in der Datenbank und ADMIN_EMAIL/ADMIN_PASSWORD nicht gesetzt — es kann sich niemand einloggen.');
    return;
  }
  const passwordHash = await bcrypt.hash(password, 10);
  await usersCollection.insertOne({ email: email.toLowerCase(), passwordHash, role: 'admin' });
  console.log(`Bootstrap-Admin angelegt: ${email.toLowerCase()}`);
}

// Login-Middleware
function requireLogin(req, res, next) {
  // Entwicklungs-Bypass: Automatischer Login als Admin
  if (process.env.DEV_AUTO_LOGIN === 'true') {
    req.session.userId = 'dev-user';
    req.session.isAdmin = true;
    return next();
  }
  
  if (req.session.userId) {
    return next();
  }
  res.redirect('/login');
}

// Routen registrieren
registerAuthRoutes(app);
registerApiRoutes(app, requireLogin);
registerAddressRoute(app, requireLogin);

// Hauptseite
app.get('/', requireLogin, (req, res) => {
  const version = pkg.version
  const vdate = pkg.date
  const isAdmin = req.session && req.session.isAdmin;
  res.render('index', { isAdmin, version, vdate });
});

app.listen(PORT, () => console.log(`Server läuft auf http://localhost:${PORT}`));