server.js

// ===================================================================
// CRASH PROTECTION — log but don't exit in production
// ===================================================================
process.on('uncaughtException', err => {
  console.error('[FATAL] UNCAUGHT EXCEPTION:', err.message);
  console.error(err.stack);
});

process.on('unhandledRejection', (reason) => {
  console.error('[FATAL] UNHANDLED REJECTION:', reason);
});

// ===================================================================
// IMPORTS
// ===================================================================
const express = require('express');
const cookieParser = require('cookie-parser');
const bcrypt = require('bcryptjs');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const path = require('path');
const morgan = require('morgan');
const compression = require('compression');
require('dotenv').config();

const db = require('./db');
const MISSIONS = require('./missions');
const { signToken } = require('./auth');
const { authMiddleware } = require('./middleware');
const pkg = require('./package.json');

// ===================================================================
// APP SETUP
// ===================================================================
const app = express();
const PORT = process.env.PORT || 3000;
const IS_PROD = process.env.NODE_ENV === 'production';

console.log('[STARTUP] PORT=' + PORT + ' NODE_ENV=' + process.env.NODE_ENV + ' __dirname=' + __dirname);

// Trust Railway proxy for rate limiting and cookies
app.set('trust proxy', 1);

// ===================================================================
// MIDDLEWARE (correct order)
// ===================================================================
app.use(morgan(IS_PROD ? 'combined' : 'dev'));
app.use(compression());
app.use(express.json());
app.use(cookieParser());

// Security - Disabled temporarily for deployment debugging
// app.use(helmet(...));

// Serve static files with caching
app.use(express.static(path.join(__dirname, 'public'), {
  maxAge: IS_PROD ? '1d' : '0',
  etag: true
}));

// ===================================================================
// HEALTH CHECK — no DB dependency
// ===================================================================

app.get('/health', (req, res) => {
  res.json({
    status: 'ok',
    uptime: process.uptime(),
    timestamp: new Date().toISOString(),
    version: pkg.version
  });
});

// ===================================================================
// HELPERS
// ===================================================================

const RANKS = [
  { xp: 6000, name: "PHANTOM" },
  { xp: 3000, name: "GHOST" },
  { xp: 1500, name: "ELITE" },
  { xp: 500, name: "HACKER" },
  { xp: 0, name: "ROOKIE" }
];

function getRank(xp) {
  return RANKS.find(r => xp >= r.xp).name;
}

function stripHtml(str) {
  return String(str).replace(/<[^>]*>/g, '').slice(0, 100);
}

function updateSessionTimer(session) {
  if (!session || !session.last_tick) return;
  
  try {
    const now = new Date();
    let lastTickStr = session.last_tick;
    
    // Safety check for endsWith (only if it's a string)
    if (typeof lastTickStr === 'string') {
      if (!lastTickStr.endsWith('Z')) {
        // Handle SQLite format (YYYY-MM-DD HH:MM:SS) vs ISO
        if (!lastTickStr.includes('T') && lastTickStr.includes(' ')) {
          lastTickStr = lastTickStr.replace(' ', 'T');
        }
        lastTickStr += 'Z';
      }
    }
    
    const lastTick = new Date(lastTickStr);
    if (isNaN(lastTick.getTime())) {
      console.warn('[TIMER] Invalid lastTick date:', session.last_tick);
      session.last_tick = now.toISOString();
      return;
    }

    const elapsed = Math.floor((now - lastTick) / 1000);

    if (elapsed > 0) {
      session.timer_remaining = Math.max(0, session.timer_remaining - elapsed);
      session.last_tick = now.toISOString();
    }
  } catch (err) {
    console.error('[TIMER] Error updating session timer:', err.message);
  }
}

function buildSessionResponse(session) {
  const mission = MISSIONS[session.mission_idx];
  if (!mission) return null;
  return {
    missionIdx: session.mission_idx,
    stepIdx: session.step_idx,
    lives: session.lives,
    timerRemaining: session.timer_remaining,
    xp: session.xp,
    score: session.score,
    missionName: mission.name,
    missionStory: mission.story,
    missionTime: mission.time,
    objectives: mission.steps.map((s, i) => ({ text: s.obj, done: i < session.step_idx })),
    tools: mission.tools,
    wrongStreak: session.wrong_streak,
    status: session.status
  };
}

// Cookie options — environment-aware
function cookieOpts() {
  return {
    httpOnly: true,
    secure: IS_PROD,
    sameSite: IS_PROD ? 'none' : 'lax',
    maxAge: 7 * 24 * 60 * 60 * 1000 // 7 days
  };
}

// Rate Limiting
const authLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 10,
  message: { error: 'Too many requests' }
});

const cmdLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 60,
  message: { error: 'Command rate limit exceeded' }
});

function checkAchievements(userId, session, missionIdx, final = false) {
  const newAchievements = [];

  const add = (key) => {
    try {
      db.run('INSERT INTO user_achievements (user_id, achievement_key) VALUES (?, ?)', [userId, key]);
      newAchievements.push(key);
    } catch (e) { /* already unlocked */ }
  };

  if (missionIdx === 0 && final) add("first_blood");
  if (session.hint_count === 0 && final) add("no_hints");

  const mission = MISSIONS[missionIdx];
  if (final && mission && session.timer_remaining > (mission.time * 0.8)) add("speedrun");

  if (final && missionIdx === MISSIONS.length - 1) add("ghost_protocol");

  if (final && missionIdx === MISSIONS.length - 1 && session.lives === 3) add("untouchable");

  return newAchievements;
}

// ===================================================================
// AUTH ROUTES
// ===================================================================

app.post('/api/register', authLimiter, (req, res) => {
  const { username, password } = req.body;
  console.log(`[AUTH] Register attempt: ${username}`);
  
  if (!username || !password || !/^[a-zA-Z0-9]{3,16}$/.test(username) || password.length < 8) {
    console.log(`[AUTH] Register validation failed for: ${username}`);
    return res.status(400).json({ error: 'Username: 3-16 alphanumeric. Password: 8+ chars.' });
  }

  try {
    const hash = bcrypt.hashSync(password, 12);
    const result = db.run('INSERT INTO users (username, password_hash) VALUES (?, ?)', [username, hash]);
    const token = signToken({ id: result.lastInsertRowid, username });
    res.cookie('token', token, cookieOpts());
    res.json({ success: true, user: { username, xp: 0, rank: "ROOKIE", score: 0 } });
  } catch (err) {
    res.status(400).json({ error: 'Username taken' });
  }
});

app.post('/api/login', authLimiter, (req, res) => {
  const { username, password } = req.body;
  console.log(`[AUTH] Login attempt: ${username}`);
  
  const user = db.get('SELECT * FROM users WHERE username = ?', [username]);
  if (!user || !bcrypt.compareSync(password, user.password_hash)) {
    console.log(`[AUTH] Login failed for: ${username}`);
    return res.status(401).json({ error: 'Invalid credentials' });
  }

  const token = signToken({ id: user.id, username: user.username });
  res.cookie('token', token, cookieOpts());
  res.json({ success: true, user: { username: user.username, xp: user.xp, rank: getRank(user.xp), score: user.score } });
});

app.post('/api/logout', (req, res) => {
  res.clearCookie('token', { ...cookieOpts(), maxAge: 0 }).json({ success: true });
});

// ===================================================================
// USER PROFILE
// ===================================================================

app.get('/api/me', authMiddleware, (req, res) => {
  const user = db.get('SELECT username, xp, score, missions_completed FROM users WHERE id = ?', [req.user.id]);
  if (!user) {
    res.clearCookie('token');
    return res.status(401).json({ error: 'User not found' });
  }
  const achievements = db.all('SELECT achievement_key FROM user_achievements WHERE user_id = ?', [req.user.id]);
  res.json({
    ...user,
    rank: getRank(user.xp),
    achievements: achievements.map(a => a.achievement_key)
  });
});

// ===================================================================
// SESSION ROUTES
// ===================================================================

app.get('/api/session', authMiddleware, (req, res) => {
  let session = db.get('SELECT * FROM game_sessions WHERE user_id = ?', [req.user.id]);
  if (!session) return res.status(404).json({ error: 'No active session' });

  updateSessionTimer(session);
  db.run('UPDATE game_sessions SET timer_remaining = ?, last_tick = ? WHERE id = ?', 
    [session.timer_remaining, session.last_tick, session.id]);

  const data = buildSessionResponse(session);
  if (!data) return res.status(400).json({ error: 'Invalid session state' });
  res.json(data);
});

app.post('/api/session/start', authMiddleware, (req, res) => {
  const { replay } = req.body || {};
  const mission = MISSIONS[0];
  const now = new Date().toISOString();

  if (replay) {
    db.run('UPDATE users SET score = 0 WHERE id = ?', [req.user.id]);
  }

  db.run(`
    INSERT OR REPLACE INTO game_sessions
    (user_id, mission_idx, step_idx, lives, timer_remaining, wrong_streak, xp, score, hint_count, status, last_tick)
    VALUES (?, 0, 0, 3, ?, 0, 0, 0, 0, 'active', ?)
  `, [req.user.id, mission.time, now]);

  const session = db.get('SELECT * FROM game_sessions WHERE user_id = ?', [req.user.id]);
  res.json(buildSessionResponse(session));
});

app.post('/api/session/next-mission', authMiddleware, (req, res) => {
  let session = db.get('SELECT * FROM game_sessions WHERE user_id = ?', [req.user.id]);
  if (!session || session.status !== 'complete') return res.status(400).json({ error: 'Mission not complete' });

  const nextIdx = session.mission_idx + 1;
  if (nextIdx >= MISSIONS.length) return res.status(400).json({ error: 'No more missions' });

  const nextMission = MISSIONS[nextIdx];
  const now = new Date().toISOString();

  db.run(`
    UPDATE game_sessions SET
    mission_idx = ?, step_idx = 0, timer_remaining = ?, wrong_streak = 0,
    xp = 0, hint_count = 0, status = 'active', last_tick = ?
    WHERE id = ?
  `, [nextIdx, nextMission.time, now, session.id]);

  const updated = db.get('SELECT * FROM game_sessions WHERE user_id = ?', [req.user.id]);
  res.json(buildSessionResponse(updated));
});

// ===================================================================
// COMMAND ROUTE — ALL GAME LOGIC
// ===================================================================

app.post('/api/command', authMiddleware, cmdLimiter, (req, res) => {
  let { command } = req.body;
  if (!command) return res.status(400).json({ error: 'Empty command' });
  command = stripHtml(command).toLowerCase().trim();
  if (!command) return res.status(400).json({ error: 'Empty command' });

  let session = db.get('SELECT * FROM game_sessions WHERE user_id = ?', [req.user.id]);
  if (!session || session.status !== 'active') return res.status(400).json({ error: 'No active session' });

  updateSessionTimer(session);

  // Check timeout
  if (session.timer_remaining <= 0) {
    db.run('UPDATE game_sessions SET status = "failed", timer_remaining = 0, last_tick = ? WHERE id = ?', 
      [session.last_tick, session.id]);
    return res.json({ result: "timeout", score: session.score });
  }

  // --- BUILT-IN COMMANDS ---
  if (command === 'help') {
    const m = MISSIONS[session.mission_idx];
    if (!m) {
      console.error('[COMMAND] Mission not found for idx:', session.mission_idx);
      return res.status(400).json({ error: 'System error: Mission data mismatch' });
    }
    const toolList = m.tools.map(t => `  ${(t.name || '').padEnd(14)} — ${t.desc || ''}`).join('\n');
    return res.json({
      result: "info",
      response: `AVAILABLE TOOLS:\n${toolList}\n\nSYSTEM COMMANDS:\n  help           — Show this help\n  status         — Current mission info\n  profile        — Agent profile card\n  clear          — Clear terminal (local)\n  logout         — Disconnect session`
    });
  }
  if (command === 'status') {
    const m = MISSIONS[session.mission_idx];
    return res.json({
      result: "info",
      response: `MISSION: ${m.name}\nSTEP: ${session.step_idx + 1}/${m.steps.length}\nLIVES: ${'❤'.repeat(session.lives)}${'♡'.repeat(3 - session.lives)}\nXP: ${session.xp}\nSCORE: ${session.score}\nTIME: ${Math.floor(session.timer_remaining / 60)}:${String(session.timer_remaining % 60).padStart(2, '0')}`
    });
  }
  if (command === 'profile') {
    const u = db.get('SELECT * FROM users WHERE id = ?', [req.user.id]);
    const { c: achCount } = db.get('SELECT COUNT(*) as c FROM user_achievements WHERE user_id = ?', [req.user.id]);
    return res.json({
      result: "info",
      response: `╔══════════════════════════╗\n║  AGENT PROFILE           ║\n╠══════════════════════════╣\n║  NAME:  ${u.username.padEnd(17)}║\n║  RANK:  ${getRank(u.xp).padEnd(17)}║\n║  XP:    ${String(u.xp).padEnd(17)}║\n║  SCORE: ${String(u.score).padEnd(17)}║\n║  ACHV:  ${String(achCount + '/5').padEnd(17)}║\n╚══════════════════════════╝`
    });
  }

  // --- MISSION COMMAND MATCHING ---
  const mission = MISSIONS[session.mission_idx];
  if (!mission) {
    console.error('[COMMAND] Mission not found for idx:', session.mission_idx);
    return res.status(400).json({ error: 'System error: Mission data mismatch' });
  }

  const step = mission.steps[session.step_idx];
  if (!step) {
    console.warn('[COMMAND] No more steps or invalid step_idx:', session.step_idx);
    // If they finished all steps but haven't moved to next mission
    if (session.step_idx >= mission.steps.length) {
       return res.status(400).json({ error: 'Mission objective complete. Move to NEXT MISSION.' });
    }
    return res.status(400).json({ error: 'System error: Step data mismatch' });
  }

  // Case-insensitive, trimmed, partial match
  const matched = step.keys.some(k => {
    const kLower = k.toLowerCase();
    if (command === kLower) return true;
    // Partial match: same base command and contains key arguments
    const cmdBase = command.split(' ')[0];
    const kBase = kLower.split(' ')[0];
    if (cmdBase === kBase) {
      const kParts = kLower.split(' ');
      if (kParts.length > 1) return command.includes(kParts[1]);
      return true;
    }
    return false;
  });

  if (matched) {
    session.wrong_streak = 0;
    session.xp += step.xp;
    session.score += step.xp;
    session.step_idx++;

    let missionDone = session.step_idx >= mission.steps.length;
    let achievements = [];
    let completionData = null;

    if (missionDone) {
      const timeBonus = session.timer_remaining * 2;
      session.score += timeBonus;
      session.status = 'complete';

      achievements = checkAchievements(req.user.id, session, session.mission_idx, true);

      db.run('INSERT INTO mission_completions (user_id, mission_idx, xp_earned, time_bonus) VALUES (?, ?, ?, ?)', 
        [req.user.id, session.mission_idx, session.xp, timeBonus]);

      db.run('UPDATE users SET xp = xp + ?, score = score + ?, missions_completed = ? WHERE id = ?', 
        [session.xp, session.score, session.mission_idx + 1, req.user.id]);

      db.run('INSERT INTO scores (user_id, score, mission) VALUES (?, ?, ?)', 
        [req.user.id, session.score, session.mission_idx + 1]);

      completionData = { xpEarned: session.xp, timeBonus, totalScore: session.score };
    }

    db.run('UPDATE game_sessions SET step_idx = ?, xp = ?, score = ?, wrong_streak = ?, status = ?, timer_remaining = ?, last_tick = ? WHERE id = ?', 
      [session.step_idx, session.xp, session.score, session.wrong_streak, session.status, session.timer_remaining, session.last_tick, session.id]);

    return res.json({
      result: "success",
      response: step.responses[Math.floor(Math.random() * step.responses.length)],
      xp: step.xp,
      stepDone: true,
      missionDone,
      newStepIdx: session.step_idx,
      objectives: mission.steps.map((s, i) => ({ text: s.obj, done: i < session.step_idx })),
      achievements,
      completionData,
      timerRemaining: session.timer_remaining
    });
  } else {
    // Wrong command
    session.wrong_streak++;
    let livesLost = 0;
    let timeBonus = 0;

    if (session.wrong_streak >= 3) {
      session.wrong_streak = 0;
      session.lives--;
      livesLost = 1;
      timeBonus = 30;
      session.timer_remaining = Math.min(session.timer_remaining + 30, mission.time);
    }

    if (session.lives <= 0) {
      session.status = 'failed';
    }

    db.run('UPDATE game_sessions SET lives = ?, wrong_streak = ?, timer_remaining = ?, status = ?, last_tick = ? WHERE id = ?', 
      [session.lives, session.wrong_streak, session.timer_remaining, session.status, session.last_tick, session.id]);

    if (session.status === 'failed') {
      return res.json({ result: "gameover", score: session.score });
    }

    return res.json({
      result: "wrong",
      message: "Command failed. Security systems engaged.",
      wrongStreak: session.wrong_streak,
      livesLost,
      lives: session.lives,
      timeBonus,
      timerRemaining: session.timer_remaining
    });
  }
});

// ===================================================================
// HINT ROUTE
// ===================================================================

app.post('/api/hint', authMiddleware, (req, res) => {
  let session = db.get('SELECT * FROM game_sessions WHERE user_id = ?', [req.user.id]);
  if (!session || session.status !== 'active') return res.status(400).json({ error: 'No active session' });

  if (session.xp < 50) return res.status(400).json({ error: 'Not enough XP (need 50)' });

  const mission = MISSIONS[session.mission_idx];
  const step = mission.steps[session.step_idx];

  session.xp -= 50;
  session.score = Math.max(0, session.score - 50);
  session.hint_count++;

  db.run('UPDATE game_sessions SET xp = ?, score = ?, hint_count = ? WHERE id = ?', 
    [session.xp, session.score, session.hint_count, session.id]);

  res.json({ hint: step.hint, xp: session.xp });
});

// ===================================================================
// LEADERBOARD (public)
// ===================================================================

app.get('/api/leaderboard', (req, res) => {
  const scores = db.all(`
    SELECT u.username, MAX(s.score) as score
    FROM scores s
    JOIN users u ON s.user_id = u.id
    GROUP BY u.id
    ORDER BY score DESC
    LIMIT 10
  `);
  res.json(scores);
});

// ===================================================================
// SERVE FRONTEND — SPA fallback
// ===================================================================

app.get('*', (req, res) => {
  res.sendFile(path.join(__dirname, 'public', 'index.html'));
});

// ===================================================================
// GLOBAL ERROR HANDLER
// ===================================================================

app.use((err, req, res, next) => {
  console.error('[ERROR]', err.stack);
  res.status(500).json({
    error: err.message, // Temporarily show full error for debugging
    stack: IS_PROD ? undefined : err.stack
  });
});

// ===================================================================
// STARTUP & GRACEFUL SHUTDOWN
// ===================================================================

let server;

async function main() {
  // 1. Initialize database
  console.log('[STARTUP] Initializing database...');
  try {
    await db.getDb();
    console.log('[STARTUP] Database initialized.');
  } catch (err) {
    console.error('[STARTUP] Database init error:', err.message);
    // Continue anyway so healthcheck can respond
  }

  // 2. Listen on the PORT env var (Railway injects this, e.g. 8080)
  server = app.listen(PORT, '0.0.0.0', () => {
    console.log('[STARTUP] Server listening on port ' + PORT);
  });

  // 3. ALSO listen on port 3000 if PORT is different
  //    Railway's load balancer may route HTTP traffic to port 3000
  //    (cached from a previous railway.toml port=3000 setting)
  //    while healthcheck uses PORT=8080. This dual-listen covers both.
  const portNum = parseInt(PORT, 10);
  if (portNum !== 3000) {
    const server2 = app.listen(3000, '0.0.0.0', () => {
      console.log('[STARTUP] Server also listening on port 3000');
    });
    server2.on('error', (err) => {
      console.warn('[STARTUP] Could not also bind port 3000:', err.message);
    });
  }
}

process.on('SIGTERM', () => {
  console.log('SIGTERM received. Shutting down gracefully.');
  try { db.close(); } catch (e) { /* ignore */ }
  if (server) {
    server.close(() => {
      console.log('Server closed.');
      process.exit(0);
    });
  } else {
    process.exit(0);
  }
});

main().catch(err => {
  console.error('[STARTUP] Fatal error:', err);
  process.exit(1);
});