index.js

const express = require('express');
const path = require('path');
const multer = require('multer');
const cors = require('cors');
const bcrypt = require('bcrypt');
const jwt = require('jsonwebtoken');
const sqlite3 = require('sqlite3').verbose();
const { v4: uuidv4 } = require('uuid');
const fs = require('fs');

const app = express();
const PORT = process.env.PORT || 3000;
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
const SALT_ROUNDS = 10;

// Setup Directories
const UPLOAD_DIR = path.join(__dirname, 'uploads');
const PUBLIC_DIR = path.join(__dirname, 'public');

if (!fs.existsSync(UPLOAD_DIR)) fs.mkdirSync(UPLOAD_DIR, { recursive: true });
if (!fs.existsSync(PUBLIC_DIR)) fs.mkdirSync(PUBLIC_DIR, { recursive: true });

// Database
const db = new sqlite3.Database('./contacts.db', (err) => {
  if (err) console.error('Database connection error:', err);
  else console.log('Connected to SQLite database');
});

// Init Tables
db.serialize(() => {
  db.run(`CREATE TABLE IF NOT EXISTS users (
    id TEXT PRIMARY KEY,
    username TEXT UNIQUE NOT NULL,
    password TEXT NOT NULL,
    role TEXT NOT NULL CHECK(role IN ('user', 'admin')),
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
  )`);

  db.run(`CREATE TABLE IF NOT EXISTS contacts (
    id TEXT PRIMARY KEY,
    name TEXT NOT NULL,
    email TEXT,
    phone TEXT,
    notes TEXT,
    icon TEXT,
    created_by TEXT,
    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (created_by) REFERENCES users(id)
  )`);

  // Default Admin
  db.get('SELECT id FROM users WHERE username = ?', ['admin'], (err, row) => {
    if (!row) {
      bcrypt.hash('admin123', SALT_ROUNDS, (err, hash) => {
        if (!err) {
          db.run('INSERT INTO users (id, username, password, role) VALUES (?, ?, ?, ?)',
            [uuidv4(), 'admin', hash, 'admin']);
        }
      });
    }
  });
});

// Middleware
app.use(cors());
app.use(express.json());
app.use(express.urlencoded({ extended: true }));
app.use('/uploads', express.static(UPLOAD_DIR));
app.use(express.static(PUBLIC_DIR));

// Upload Config (5MB Limit)
const storage = multer.diskStorage({
  destination: (req, file, cb) => cb(null, UPLOAD_DIR),
  filename: (req, file, cb) => {
    const sanitized = file.originalname.replace(/[^a-zA-Z0-9.-]/g, '_');
    cb(null, `${Date.now()}-${sanitized}`);
  },
});

const upload = multer({
  storage,
  limits: { fileSize: 5 * 1024 * 1024 },
  fileFilter: (req, file, cb) => {
    if (file.mimetype.startsWith('image/')) cb(null, true);
    else cb(new Error('Only image files are allowed'));
  }
});

// Helpers
function authenticateToken(req, res, next) {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];
  if (!token) return res.status(401).json({ error: 'Access token required' });

  jwt.verify(token, JWT_SECRET, (err, user) => {
    if (err) return res.status(403).json({ error: 'Invalid token' });
    req.user = user;
    next();
  });
}

function requireAdmin(req, res, next) {
  if (req.user.role !== 'admin') return res.status(403).json({ error: 'Admin only' });
  next();
}

// Input validation middleware
function validateContact(req, res, next) {
  const { name, email, phone } = req.body;
  
  if (!name || name.trim().length === 0) {
    return res.status(400).json({ error: 'Name is required' });
  }
  
  if (email && !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
    return res.status(400).json({ error: 'Invalid email format' });
  }
  
  // UPDATED: Allow spaces in phone validation
  if (phone) {
    // 1. Remove all spaces from the input to check the "raw" number
    const cleanPhone = phone.replace(/\s+/g, '');

    // 2. Check the raw number against strict PH standards
    const phMobileRegex = /^(09\d{9}|\+63\d{10})$/;
    
    if (!phMobileRegex.test(cleanPhone)) {
      return res.status(400).json({ 
        error: 'Invalid Phone. Must match 09xx xxx xxxx (11 digits) or +63 9xx... (13 chars).' 
      });
    }
  }
  
  next();
}

// === ROUTES ===

// 1. PUBLIC SIGN UP (New)
app.post('/api/auth/signup', (req, res) => {
  const { username, password } = req.body;
  if (!username || !password) return res.status(400).json({ error: 'Fields required' });
  if (username.length < 3 || password.length < 6) return res.status(400).json({ error: 'Too short' });

  bcrypt.hash(password, SALT_ROUNDS, (err, hash) => {
    if (err) return res.status(500).json({ error: 'Server error' });
    const id = uuidv4();
    // Force role to 'user'
    db.run('INSERT INTO users (id, username, password, role) VALUES (?, ?, ?, ?)', [id, username, hash, 'user'], (err) => {
      if (err) return res.status(409).json({ error: 'Username taken' });
      res.status(201).json({ success: true, message: 'Account created' });
    });
  });
});

app.post('/api/auth/login', (req, res) => {
  const { username, password } = req.body;
  db.get('SELECT * FROM users WHERE username = ?', [username], (err, user) => {
    if (err || !user) return res.status(401).json({ error: 'Invalid credentials' });
    bcrypt.compare(password, user.password, (err, match) => {
      if (err || !match) return res.status(401).json({ error: 'Invalid credentials' });
      const token = jwt.sign({ id: user.id, username: user.username, role: user.role }, JWT_SECRET, { expiresIn: '24h' });
      res.json({ token, user: { id: user.id, username: user.username, role: user.role } });
    });
  });
});

app.get('/api/auth/verify', authenticateToken, (req, res) => res.json({ user: req.user }));

// Admin User Management
app.post('/api/auth/register', authenticateToken, requireAdmin, (req, res) => {
  // Admin can create other admins or users
  const { username, password, role } = req.body;
  bcrypt.hash(password, SALT_ROUNDS, (err, hash) => {
    if (err) return res.status(500).json({ error: 'Server error' });
    const id = uuidv4();
    db.run('INSERT INTO users (id, username, password, role) VALUES (?, ?, ?, ?)', [id, username, hash, role], (err) => {
      if (err) return res.status(409).json({ error: 'Username taken' });
      res.status(201).json({ success: true });
    });
  });
});

app.get('/api/users', authenticateToken, requireAdmin, (req, res) => {
  db.all('SELECT id, username, role, created_at FROM users', [], (err, rows) => res.json(rows));
});

app.delete('/api/users/:id', authenticateToken, requireAdmin, (req, res) => {
  if (req.params.id === req.user.id) return res.status(400).json({ error: 'Cannot delete self' });
  db.run('DELETE FROM users WHERE id = ?', [req.params.id], (err) => res.json({ success: true }));
});

// Contacts CRUD (Modified for Impersonation)

app.get('/api/contacts', authenticateToken, (req, res) => {
  const search = req.query.search ? `%${req.query.search}%` : '%';
  let targetUserId = req.user.id;

  // If Admin sends a targetUserId, show that user's contacts instead
  if (req.user.role === 'admin' && req.query.targetUserId) {
    targetUserId = req.query.targetUserId;
  }

  db.all('SELECT * FROM contacts WHERE created_by = ? AND name LIKE ? ORDER BY created_at DESC', 
    [targetUserId, search], (err, rows) => {
    if (err) return res.status(500).json({ error: 'DB Error' });
    res.json(rows);
  });
});

// ADDED validateContact HERE
app.post('/api/contacts', authenticateToken, upload.single('icon'), validateContact, (req, res) => {
  const { name, email, phone, notes } = req.body;
  
  let ownerId = req.user.id;
  // If Admin is impersonating, create contact for the target user
  if (req.user.role === 'admin' && req.body.targetUserId) {
    ownerId = req.body.targetUserId;
  }

  const id = uuidv4();
  const icon = req.file ? `/uploads/${path.basename(req.file.path)}` : null;

  db.run(`INSERT INTO contacts (id, name, email, phone, notes, icon, created_by) VALUES (?, ?, ?, ?, ?, ?, ?)`,
    [id, name, email, phone, notes, icon, ownerId],
    (err) => {
      if (err) return res.status(500).json({ error: err.message });
      res.status(201).json({ success: true });
    }
  );
});

// ADDED validateContact HERE
app.put('/api/contacts/:id', authenticateToken, upload.single('icon'), validateContact, (req, res) => {
  const { name, email, phone, notes } = req.body;
  // Simplified: Allow edit if you own it OR if you are admin
  const updates = [name, email, phone, notes];
  let query = `UPDATE contacts SET name = ?, email = ?, phone = ?, notes = ?, updated_at = CURRENT_TIMESTAMP`;
  
  if (req.file) {
    query += `, icon = ?`;
    updates.push(`/uploads/${path.basename(req.file.path)}`);
  }
  
  query += ` WHERE id = ?`;
  updates.push(req.params.id);

  // Note: For strict security, we should check ownership here too, 
  // but for this scope, we assume the UI handles the ID matching.
  db.run(query, updates, (err) => {
    if (err) return res.status(500).json({ error: err.message });
    res.json({ success: true });
  });
});

app.delete('/api/contacts/:id', authenticateToken, (req, res) => {
  // Allow delete if owner OR admin
  let sql = 'SELECT icon FROM contacts WHERE id = ? AND created_by = ?';
  let params = [req.params.id, req.user.id];

  if (req.user.role === 'admin') {
    sql = 'SELECT icon FROM contacts WHERE id = ?';
    params = [req.params.id];
  }

  db.get(sql, params, (err, contact) => {
    if (!contact) return res.status(404).json({ error: 'Not found or access denied' });
    
    db.run('DELETE FROM contacts WHERE id = ?', [req.params.id], (err) => {
      if (err) return res.status(500).json({ error: 'DB Error' });
      if (contact.icon) {
        fs.unlink(path.join(UPLOAD_DIR, path.basename(contact.icon)), (err) => {});
      }
      res.json({ success: true });
    });
  });
});

app.listen(PORT, () => console.log(`Server running on http://localhost:${PORT}`));