server.js

require('dotenv').config();
const express = require('express');
const { createNodeMiddleware, createProbot } = require('probot');
const {
    getInstallation,
    saveInstallation,
    deleteInstallation,
    recordUsage,
    getPRMetadata,
    updatePRMetadata
} = require('./lib/db');
const { decrypt, encrypt } = require('./lib/crypto');
const { performReview } = require('./lib/reviewer');
const { sendReviewEmail, sendApprovalEmail } = require('./lib/email-service');
const helmet = require('helmet');
const path = require('path');
const axios = require('axios');
const queryString = require('query-string');

const app = express();
app.use(helmet({
    contentSecurityPolicy: false // Allow styles/scripts for our UI
}));
app.use(express.json());
app.use(express.urlencoded({ extended: true }));
app.use(express.static('public'));

const probot = createProbot();

// GitHub App Webhook logic
probot.on(['pull_request.opened', 'pull_request.synchronize'], async (context) => {
    const installationId = context.payload.installation.id;
    const pr = context.payload.pull_request;
    const repo = context.payload.repository.full_name;

    console.log(`Received PR event for ${repo} (Installation: ${installationId})`);

    try {
        const config = await getInstallation(installationId.toString());

        if (!config || !config.gemini_key) {
            console.log("No stored key found.");
            return context.octokit.issues.createComment(context.issue({
                body: `⚠️ **Gemini API Key not configured.** Please configure it [here](${process.env.APP_URL}/login?installation_id=${installationId}).`
            }));
        }

        // Noise Suppression Check: If PR is already approved, only run for high/critical findings
        const metadata = await getPRMetadata(repo, pr.number);
        const isApproved = metadata && metadata.approval_status === 'approved';

        if (isApproved) {
            console.log(`PR ${repo} #${pr.number} is already approved. Running in Noise-Suppression mode.`);
        }

        const geminiKey = decrypt(config.gemini_key);
        const severity = isApproved ? 'High' : (config.severity || 'Medium'); // Auto-escalate threshold post-approval

        // Get the Diff
        const { data: diff } = await context.octokit.pulls.get({
            owner: context.payload.repository.owner.login,
            repo: context.payload.repository.name,
            pull_number: pr.number,
            mediaType: { format: 'diff' }
        });

        // Perform Review
        const reviewResult = await performReview({
            patch: diff,
            geminiKey,
            severity,
            octokit: context.octokit,
            repo,
            prNumber: pr.number
        });

        // Update Metadata
        await updatePRMetadata(repo, pr.number, {
            lastSha: pr.head.sha,
            findingHashes: JSON.stringify((reviewResult.findings || []).map(f => `${f.file}:${f.issue}`))
        });

        // Send Email Notification
        if (config.email) {
            await sendReviewEmail({
                to: config.email,
                repo,
                prNumber: pr.number,
                summary: reviewResult.summary,
                findingsCount: (reviewResult.findings || []).length,
                isUpdate: context.name === 'pull_request_synchronize'
            });
        }

        // Record usage
        if (reviewResult && reviewResult.totalTokens) {
            await recordUsage(installationId.toString(), reviewResult.totalTokens);
            console.log(`Recorded usage for ${installationId}: ${reviewResult.totalTokens} tokens`);
        }

    } catch (error) {
        console.error("Review process failed:", error);
    }
});

// Approval Tracking
probot.on('pull_request_review', async (context) => {
    if (context.payload.review.state === 'approved') {
        const repo = context.payload.repository.full_name;
        const prNumber = context.payload.pull_request.number;
        const installationId = context.payload.installation.id;

        console.log(`PR ${repo} #${prNumber} approved! Updating metadata.`);
        await updatePRMetadata(repo, prNumber, { approvalStatus: 'approved' });

        // Trigger Closure Email
        const config = await getInstallation(installationId.toString());
        if (config && config.email) {
            await sendApprovalEmail({
                to: config.email,
                repo,
                prNumber,
                summary: "AI review has been verified and PR is marked as safe to merge."
            });
        }
    }
});

// Purge data on uninstall
probot.on('installation.deleted', async (context) => {
    const installationId = context.payload.installation.id;
    console.log(`Purging data for uninstalled installation: ${installationId}`);
    try {
        await deleteInstallation(installationId.toString());
    } catch (error) {
        console.error("Failed to purge installation data:", error);
    }
});

app.use(createNodeMiddleware(probot, { probot }));

// --- Premium Flow Routes ---

// 1. Initial login point after installation
app.get('/login', (req, res) => {
    const { installation_id } = req.query;
    const authorizeUrl = `https://github.com/login/oauth/authorize?${queryString.stringify({
        client_id: process.env.GITHUB_CLIENT_ID,
        redirect_uri: process.env.OAUTH_CALLBACK_URL || `${process.env.APP_URL}/oauth/callback`,
        state: installation_id,
        scope: 'repo' // Optional, depending on if you need user-level access
    })}`;
    res.redirect(authorizeUrl);
});

// 2. OAuth Callback
app.get('/oauth/callback', async (req, res) => {
    const { code, state: installation_id } = req.query;

    try {
        const response = await axios.post('https://github.com/login/oauth/access_token', {
            client_id: process.env.GITHUB_CLIENT_ID,
            client_secret: process.env.GITHUB_CLIENT_SECRET,
            code
        }, {
            headers: { Accept: 'application/json' }
        });

        const accessToken = response.data.access_token;
        // In a real app, you'd verify the user here and set a session.
        // For now, we'll redirect to config with the installation_id.
        const configUrl = process.env.INSTALLATION_CALLBACK_URL || '/config.html';
        res.redirect(`${configUrl}?installation_id=${installation_id}`);
    } catch (error) {
        console.error("OAuth failed:", error);
        res.status(500).send("Authentication failed");
    }
});

// 3. Config API
app.post('/api/config', async (req, res) => {
    const { installation_id, gemini_key, severity, email } = req.body;

    if (!installation_id || !gemini_key) {
        return res.status(400).json({ error: "Missing required fields" });
    }

    try {
        const encryptedKey = encrypt(gemini_key);
        await saveInstallation(installation_id, encryptedKey, severity, email);
        res.json({ message: "Configuration saved successfully! Gemini is now enabled with professional notifications." });
    } catch (e) {
        console.error(e);
        res.status(500).json({ error: "Failed to save configuration" });
    }
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
    console.log(`Server listening on port ${PORT}`);
});