import 'reflect-metadata';
import { NestFactory } from '@nestjs/core';
import { ValidationPipe } from '@nestjs/common';
import { NestExpressApplication } from '@nestjs/platform-express';
import { extname, join } from 'node:path';
import type { Response } from 'express';
import { AppModule } from './app.module';
import { prepareDatabase } from './prisma/bootstrap';
import { PrismaExceptionFilter } from './prisma/prisma-exception.filter';
import { assertSmsConfigured } from './modules/sms/sms.service';
import { envOr, envOrNull } from './common/env';
import { isValidOrigin, parseCorsOrigins, productionConfigProblems } from './common/production-checks';
import { ensureJwtSecrets } from './prisma/boot-secrets';
import { masterOtpCode, masterOtpEnabled } from './modules/customer-auth/customer-auth.service';

// serve-static's bundled `mime` version predates .avif, so it falls back to
// application/octet-stream — browsers still render the image (they sniff
// content), but a strict client or an <img> under some CSPs would not.
const EXTRA_MIME_TYPES: Record<string, string> = {
  '.avif': 'image/avif',
};

/**
 * REL-01, REL-03, SEC-04 — every production config problem is printed at once,
 * then the server starts with a safe fallback for each: random keys kept in
 * the database (boot-secrets.ts), the fixed test login disabled
 * (masterOtpCode), and all origins allowed. Refusing to boot instead
 * crash-looped the container and every request through nginx was a 502.
 * The rules live in common/production-checks.ts.
 */
function warnProductionConfig(problems: string[]) {
  if (!problems.length) return;
  // eslint-disable-next-line no-console
  console.warn(
    '\n' +
      '='.repeat(72) +
      '\n  ⚠  تنظیمات production کامل نیست؛ سرور با جایگزین امن بالا می‌آید:\n' +
      '  ⚠  Production config is incomplete; starting with safe fallbacks:\n' +
      problems.map((p) => '  • ' + p).join('\n') +
      '\n  (see docs/SERVER-SETUP-CHECKLIST.md)\n' +
      '='.repeat(72) +
      '\n',
  );
}

/**
 * SEC-04 — which sites may call the API from a browser. CORS_ORIGINS is a
 * comma-separated list of exact origins (e.g. https://adm.example.ir,https://app.example.ir).
 * Invalid entries are dropped; an empty list allows every origin.
 */
function corsOrigins(): string[] | true {
  const list = parseCorsOrigins(envOrNull('CORS_ORIGINS') ?? '').filter(isValidOrigin);
  return list.length ? list : true;
}

async function bootstrap() {
  warnProductionConfig(productionConfigProblems(process.env));

  // D20 — reports the SMS configuration and never throws. A missing credential
  // no longer stops the boot; messages are logged instead of sent.
  assertSmsConfigured();

  await prepareDatabase();
  await ensureJwtSecrets();

  // A missing JWT_CUSTOMER_SECRET is not a cosmetic default: customerJwtSecret()
  // falls back to JWT_SECRET, so admin and app tokens end up signed with the
  // SAME key. The `typ` check in JwtStrategy is then the only thing keeping an
  // app token off the admin routes — one guard instead of two independent ones,
  // and a sales expert's app token carries their AdminUser id in `sub`. Warn as
  // loudly as the master-code banner rather than fail the boot, so a running
  // deployment that has not set it yet still starts.
  if (!envOrNull('JWT_CUSTOMER_SECRET')) {
    const sharedWithAdmin = Boolean(envOrNull('JWT_SECRET'));
    // eslint-disable-next-line no-console
    console.warn(
      '\n' +
        '='.repeat(72) +
        '\n  ⚠  JWT_CUSTOMER_SECRET تنظیم نشده است\n' +
        '  ⚠  JWT_CUSTOMER_SECRET IS NOT SET.\n' +
        (sharedWithAdmin
          ? '  ⚠  Customer/expert app tokens are being signed with JWT_SECRET,\n' +
            '  ⚠  the SAME key as admin tokens. The two token realms are no\n' +
            '  ⚠  longer cryptographically separated.\n'
          : '  ⚠  Neither JWT_SECRET nor JWT_CUSTOMER_SECRET is set, so app\n' +
            '  ⚠  tokens are signed with a well-known development string.\n') +
        '  ⚠  Set JWT_CUSTOMER_SECRET to a distinct random value before release.\n' +
        '='.repeat(72) +
        '\n',
    );
  }

  // D20 — a loud, unmissable banner whenever the delivery bypass is armed, so
  // it cannot reach the real release unnoticed.
  if (masterOtpEnabled()) {
    const code = masterOtpCode() ?? '';
    // Both apps render the login OTP as FOUR single-character boxes and only
    // submit on @on-complete, i.e. at exactly 4 digits
    // (LoginView.vue:43 in each app, OtpInput.vue:43). The API itself accepts
    // any length, so a longer master code works over HTTP but can never be
    // typed into the apps. Warn rather than reject: an operator may be using it
    // for API testing only.
    const typable = /^\d{4}$/.test(code);
    // eslint-disable-next-line no-console
    console.warn(
      '\n' +
        '='.repeat(72) +
        '\n  ⚠  OTP_MASTER_CODE فعال است — قبل از انتشار اصلی حذف شود\n' +
        '  ⚠  OTP_MASTER_CODE IS ACTIVE: any active customer can sign in with\n' +
        '  ⚠  this fixed code. Remove it from the environment before release.\n' +
        (typable
          ? ''
          : '  ⚠\n' +
            '  ⚠  NOTE: this code is not 4 digits, so it CANNOT be entered in the\n' +
            '  ⚠  customer apps — their OTP box has exactly 4 boxes. Use a\n' +
            '  ⚠  4-digit code for the apps; this one works over the API only.\n') +
        '='.repeat(72) +
        '\n',
    );
  }

  const app = await NestFactory.create<NestExpressApplication>(AppModule);
  app.setGlobalPrefix('api');
  app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }));
  app.useGlobalFilters(new PrismaExceptionFilter());
  app.enableCors({ origin: corsOrigins() });
  // Uploaded files, mounted OUTSIDE the /api prefix so the URLs stored on
  // UploadedFile.url ("/uploads/<name>") resolve directly.
  app.useStaticAssets(envOr('UPLOAD_DIR', join(process.cwd(), 'storage', 'uploads')), {
    prefix: '/uploads/',
    index: false,
    dotfiles: 'deny',
    setHeaders: (res: Response, path: string) => {
      const mime = EXTRA_MIME_TYPES[extname(path).toLowerCase()];
      if (mime) res.setHeader('Content-Type', mime);
    },
  });
  // envOr, not `??`: Number('') is 0, which would bind a random ephemeral port
  // and make the container unreachable at the port compose maps. See DEPLOY-02.
  const port = Number(envOr('PORT', '3000'));

  try {
    // Bind all interfaces explicitly so the container is reachable from nginx.
    await app.listen(port, '0.0.0.0');
  } catch (err) {
    if ((err as NodeJS.ErrnoException).code === 'EADDRINUSE') {
      // eslint-disable-next-line no-console
      console.error(
        `\n[api] Port ${port} is already in use. Free it or change API_PORT ` +
          `in the repo-root .env (and PORT in apps/api/.env to match) — the ` +
          `API will not fall back to a different port.\n`,
      );
      process.exit(1);
    }
    throw err;
  }
}
bootstrap();