forge/index.ts

import 'dotenv/config';
import path from 'node:path';
import express, { type Request, type Response, type NextFunction } from 'express';
import rateLimit from 'express-rate-limit';
import { pool, initDB, upsertTickets, attachJira, type JiraAttach } from './server/db';
import { listTickets, getTicket, getStats } from './server/tickets';
import { resolveToken, createToken, listTokens, revokeToken } from './server/tokens';
import { sessionMiddleware, requireAuth, requireRole, verifyLogin } from './server/auth';
import { listUsers, createUser, deleteUser, isRole, getUserRole, countAdmins } from './server/db';
import { getOverview, getSlaHeatmaps, getConfig, getJiraDurations } from './server/analytics';
import { getInsights } from './server/insights';
import type { Ticket, TicketStatus } from './server/types';

const PORT = Number(process.env.PORT ?? 3000);
// Prod: __dirname is /app/dist (compiled) → client/dist is a sibling ('..').
// Dev (tsx index.ts): __dirname is the project root → client/dist is under it ('.').
const CLIENT_DIST = path.join(__dirname, __dirname.endsWith('dist') ? '..' : '.', 'client', 'dist');

if (!process.env.DATABASE_URL) {
  console.error('FATAL: DATABASE_URL is required (points at the `forge` Postgres database)');
  process.exit(1);
}

const app = express();
app.disable('x-powered-by');
app.set('trust proxy', 1);
app.use(express.json({ limit: '25mb' })); // sync payloads carry activity timelines
app.use(sessionMiddleware());

// --- Health ----------------------------------------------------------------
app.get('/healthz', async (_req: Request, res: Response) => {
  try {
    await pool.query('SELECT 1');
    res.json({ ok: true });
  } catch {
    res.status(503).json({ ok: false });
  }
});

// --- Auth ------------------------------------------------------------------
const loginLimiter = rateLimit({ windowMs: 15 * 60_000, max: 20, standardHeaders: true, legacyHeaders: false });

app.post('/login', loginLimiter, async (req: Request, res: Response) => {
  const { username, password } = (req.body ?? {}) as { username?: string; password?: string };
  const ok = await verifyLogin(String(username ?? ''), String(password ?? ''));
  if (!ok) return res.status(401).json({ success: false, error: 'Invalid username or password' });
  // Regenerate the session id at the privilege transition (anti session-fixation).
  req.session.regenerate(err => {
    if (err) { console.error('session regenerate failed:', err.message); return res.status(500).json({ success: false, error: 'session_error' }); }
    req.session.user = ok;
    req.session.save(saveErr => {
      if (saveErr) { console.error('session save failed:', saveErr.message); return res.status(500).json({ success: false, error: 'session_error' }); }
      res.json({ success: true, user: ok });
    });
  });
});

app.post('/logout', (req: Request, res: Response) => {
  req.session.destroy(() => {
    res.clearCookie('forge.sid');
    res.json({ success: true });
  });
});

app.get('/api/me', (req: Request, res: Response) => {
  res.json({ user: req.session?.user ?? null });
});

// --- Read API (auth-gated) -------------------------------------------------
app.get('/api/tickets', requireAuth, async (req: Request, res: Response) => {
  try {
    const q = req.query;
    const status = q.status === 'active' || q.status === 'closed' ? (q.status as TicketStatus) : undefined;
    const tickets = await listTickets({
      status,
      state:    typeof q.state === 'string' ? q.state : undefined,
      group:    typeof q.group === 'string' ? q.group : undefined,
      assignee: typeof q.assignee === 'string' ? q.assignee : undefined,
      q:        typeof q.q === 'string' ? q.q : undefined,
    });
    res.json({ tickets, count: tickets.length });
  } catch (err) {
    console.error('GET /api/tickets', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.get('/api/tickets/:number', requireAuth, async (req: Request, res: Response) => {
  try {
    const t = await getTicket(String(req.params.number));
    if (!t) return res.status(404).json({ error: 'not_found' });
    res.json(t);
  } catch (err) {
    console.error('GET /api/tickets/:number', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.get('/api/stats', requireAuth, async (_req: Request, res: Response) => {
  try {
    res.json(await getStats());
  } catch (err) {
    console.error('GET /api/stats', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.get('/api/analytics/overview', requireRole('pm'), async (_req: Request, res: Response) => {
  try {
    res.json(await getOverview());
  } catch (err) {
    console.error('GET /api/analytics/overview', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.get('/api/analytics/sla', requireRole('pm'), async (_req: Request, res: Response) => {
  try {
    res.json({ metrics: await getSlaHeatmaps() });
  } catch (err) {
    console.error('GET /api/analytics/sla', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.get('/api/analytics/jira-durations', requireRole('pm'), async (_req: Request, res: Response) => {
  try {
    res.json(await getJiraDurations());
  } catch (err) {
    console.error('GET /api/analytics/jira-durations', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.get('/api/insights', requireRole('pm'), async (_req: Request, res: Response) => {
  try {
    res.json(await getInsights());
  } catch (err) {
    console.error('GET /api/insights', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.get('/api/config', requireAuth, async (_req: Request, res: Response) => {
  try {
    res.json(await getConfig());
  } catch (err) {
    console.error('GET /api/config', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

// --- Token-authed sync ingest (used by the Chrome extension) ---------------
const syncLimiter = rateLimit({ windowMs: 60_000, max: 60, standardHeaders: true, legacyHeaders: false });

async function requireToken(req: Request, res: Response, next: NextFunction) {
  const principal = await resolveToken(req);
  if (!principal) return res.status(401).json({ error: 'token_invalid' });
  next();
}

function s(v: unknown): string | null {
  if (v == null) return null;
  const str = String(v).trim();
  return str === '' ? null : str;
}
function n(v: unknown): number | null {
  if (v == null || v === '') return null;
  const x = Number(v);
  return Number.isFinite(x) ? x : null;
}

// Coerce an untrusted activity array into well-typed { kind, t, who } string
// entries. Prevents a non-string `t` (which the client's date parser would call
// .includes() on) from being persisted and later crashing the render.
function sanitizeActivity(v: unknown): Ticket['activity'] {
  if (!Array.isArray(v)) return [];
  return v
    .filter((e): e is Record<string, unknown> => !!e && typeof e === 'object')
    .map(e => ({ kind: String(e.kind ?? 'comment'), t: String(e.t ?? ''), who: String(e.who ?? '') }));
}

// Coerce an untrusted incoming record into a normalized Ticket. Drops records
// without a number. Unknown fields are ignored.
function normalizeIncoming(raw: Record<string, unknown>): Ticket | null {
  const number = s(raw.number);
  if (!number) return null;
  const status: TicketStatus = raw.status === 'closed' ? 'closed' : 'active';
  return {
    number,
    status,
    state:             String(raw.state ?? ''),
    shortDesc:         String(raw.shortDesc ?? ''),
    assignedTo:        s(raw.assignedTo),
    assignmentGroup:   s(raw.assignmentGroup),
    brand:             s(raw.brand),
    market:            s(raw.market),
    businessUnit:      s(raw.businessUnit),
    requestedFor:      s(raw.requestedFor),
    openedBy:          s(raw.openedBy),
    openedAt:          s(raw.openedAt),
    openedDate:        s(raw.openedDate) ?? s(raw.openedAt),
    closedDate:        s(raw.closedDate),
    toDoAt:            s(raw.toDoAt),
    inUatAt:           s(raw.inUatAt),
    jiraKey:           s(raw.jiraKey),
    currencyCode:      s(raw.currencyCode),
    ticketYear:        n(raw.ticketYear),
    size:              s(raw.size),
    poNumber:          s(raw.poNumber),
    invoiced:          s(raw.invoiced),
    dueDate:           s(raw.dueDate),
    stateChangedAt:    s(raw.stateChangedAt),
    stateChangedBy:    s(raw.stateChangedBy),
    lastActivityAt:    s(raw.lastActivityAt),
    lastActivityBy:    s(raw.lastActivityBy),
    lastComment:       s(raw.lastComment),
    description:       s(raw.description),
    link:              s(raw.link),
    finalCost:         n(raw.finalCost),
    ttfrMinutes:       n(raw.ttfrMinutes),
    clientRespMinutes: n(raw.clientRespMinutes),
    fulfillmentDate:   s(raw.fulfillmentDate),
    firstReplyAt:      s(raw.firstReplyAt),
    firstAssignedDate: s(raw.firstAssignedDate),
    updatedAt:         s(raw.updatedAt),
    jira:              (raw.jira ?? null) as Ticket['jira'],
    activity:          sanitizeActivity(raw.activity),
  };
}

app.post('/api/sync', syncLimiter, requireToken, async (req: Request, res: Response) => {
  try {
    const body = req.body as { tickets?: unknown };
    if (!Array.isArray(body.tickets)) return res.status(400).json({ error: 'bad_payload' });
    const tickets = body.tickets
      .map(r => normalizeIncoming(r as Record<string, unknown>))
      .filter((t): t is Ticket => t !== null);
    if (tickets.length === 0) return res.json({ upserted: 0 });
    const upserted = await upsertTickets(tickets);
    res.json({ upserted });
  } catch (err) {
    console.error('POST /api/sync', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

// Jira enrichment ingest (from the extension's Jira REST collector). Attach-only:
// updates only jira/jira_key on existing tickets, keyed by RITM number.
app.post('/api/sync/jira', syncLimiter, requireToken, async (req: Request, res: Response) => {
  try {
    const body = req.body as { items?: unknown };
    if (!Array.isArray(body.items)) return res.status(400).json({ error: 'bad_payload' });
    const items: JiraAttach[] = body.items
      .map(r => r as Record<string, unknown>)
      .filter(r => r && typeof r.number === 'string' && (r.number as string).trim())
      .map(r => ({
        number: String(r.number).trim(),
        jira: (r.jira && typeof r.jira === 'object' ? r.jira : {}) as Record<string, unknown>,
        jiraKey: typeof r.jiraKey === 'string' ? r.jiraKey : (typeof (r.jira as { key?: unknown })?.key === 'string' ? (r.jira as { key: string }).key : null),
      }));
    if (items.length === 0) return res.json({ matched: 0 });
    const matched = await attachJira(items);
    res.json({ matched, received: items.length });
  } catch (err) {
    console.error('POST /api/sync/jira', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

// --- User management (Project Leadership + Admin) --------------------------
app.get('/api/users', requireRole('lead'), async (_req: Request, res: Response) => {
  try {
    res.json({ users: await listUsers() });
  } catch (err) {
    console.error('GET /api/users', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.post('/api/users', requireRole('lead'), async (req: Request, res: Response) => {
  const { username, password, role } = (req.body ?? {}) as { username?: string; password?: string; role?: string };
  const u = String(username ?? '').trim();
  const p = String(password ?? '');
  if (u.length < 2 || p.length < 6) return res.status(400).json({ error: 'invalid', message: 'Username ≥2 and password ≥6 chars required' });
  if (!isRole(role)) return res.status(400).json({ error: 'invalid_role' });
  // Only an admin may create another admin (leadership tops out at 'lead').
  if (role === 'admin' && req.session.user?.role !== 'admin') return res.status(403).json({ error: 'forbidden', message: 'Only an admin can create an admin' });
  try {
    const result = await createUser(u, p, role);
    if (result === 'exists') return res.status(409).json({ error: 'exists', message: 'Username already taken' });
    res.json({ user: result });
  } catch (err) {
    console.error('POST /api/users', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.delete('/api/users/:username', requireRole('lead'), async (req: Request, res: Response) => {
  const target = String(req.params.username);
  const actor = req.session.user!;
  if (target === actor.username) return res.status(400).json({ error: 'self', message: 'You cannot delete your own account' });
  try {
    const targetRole = await getUserRole(target);
    if (!targetRole) return res.status(404).json({ error: 'not_found' });
    // Only an admin may remove an admin, and never the last admin (would lock everyone out).
    if (targetRole === 'admin') {
      if (actor.role !== 'admin') return res.status(403).json({ error: 'forbidden', message: 'Only an admin can remove an admin' });
      if (await countAdmins() <= 1) return res.status(400).json({ error: 'last_admin', message: 'Cannot delete the last admin' });
    }
    await deleteUser(target);
    res.json({ success: true });
  } catch (err) {
    console.error('DELETE /api/users', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

// --- API tokens (Admin only) -----------------------------------------------
app.get('/api/tokens', requireRole('admin'), async (_req: Request, res: Response) => {
  try {
    res.json({ tokens: await listTokens() });
  } catch (err) {
    console.error('GET /api/tokens', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.post('/api/tokens', requireRole('admin'), async (req: Request, res: Response) => {
  try {
    const label = typeof req.body?.label === 'string' && req.body.label.trim() ? req.body.label.trim() : 'sync-extension';
    const raw = await createToken(label);
    res.json({ token: raw, label });
  } catch (err) {
    console.error('POST /api/tokens', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

app.post('/api/tokens/:id/revoke', requireRole('admin'), async (req: Request, res: Response) => {
  const id = Number(req.params.id);
  if (!Number.isInteger(id)) return res.status(400).json({ error: 'invalid_id' });
  try {
    await revokeToken(id);
    res.json({ success: true });
  } catch (err) {
    console.error('POST /api/tokens/:id/revoke', (err as Error).message);
    res.status(500).json({ error: 'server_error' });
  }
});

// --- Static client + SPA fallback -----------------------------------------
app.use(express.static(CLIENT_DIST));
app.get('*', (req: Request, res: Response, next: NextFunction) => {
  if (req.path.startsWith('/api/')) return next();
  res.sendFile(path.join(CLIENT_DIST, 'index.html'), err => { if (err) next(); });
});

(async () => {
  try {
    await initDB();
    console.log('DB ready (forge)');
  } catch (err) {
    console.error('initDB failed:', (err as Error).message);
    process.exit(1);
  }
  app.listen(PORT, () => console.log(`FORGE listening on http://localhost:${PORT}`));
})();