server.js

import express from "express";
import cors from "cors";
import { open } from "sqlite";
import sqlite3 from "sqlite3";
import path from "path";
import fs from "fs";
import { fileURLToPath } from "url";
import multer from "multer";
import archiver from "archiver";
import { exec } from "child_process";

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);

// === CRASH PREVENTION ===
process.on("uncaughtException", (err) => {
  console.error("[CRITICAL] Uncaught Exception:", err);
});

process.on("unhandledRejection", (reason, promise) => {
  console.error(
    "[CRITICAL] Unhandled Rejection at:",
    promise,
    "reason:",
    reason
  );
});

const app = express();
const PORT = process.env.PORT || 3001;

// Middlewares
app.use(cors());
app.use(express.json({ limit: "50mb" }));

// Logging Middleware
app.use((req, res, next) => {
  console.log(`[${new Date().toISOString()}] ${req.method} ${req.url}`);
  next();
});

let db;

// === ROBUST DRIVER SELECTION ===
const getDriver = () => {
  try {
    if (
      sqlite3 &&
      sqlite3.default &&
      typeof sqlite3.default.Database === "function"
    ) {
      return sqlite3.default.Database;
    }
    if (sqlite3 && typeof sqlite3.Database === "function") {
      return sqlite3.Database;
    }
    if (sqlite3 && typeof sqlite3.verbose === "function") {
      const verbose = sqlite3.verbose();
      if (verbose && typeof verbose.Database === "function")
        return verbose.Database;
    }
  } catch (e) {
    console.error("Failed to resolve sqlite3 driver:", e);
  }
  return null;
};

// === DATABASE INITIALIZATION ===
async function initDb() {
  try {
    const dbPath = path.resolve(__dirname, "devstudio.db");
    const driver = getDriver();

    if (!driver) {
      console.warn(
        "WARNING: SQLite driver not found. Database features will be disabled."
      );
      return;
    }

    db = await open({
      filename: dbPath,
      driver: driver,
    });
    console.log(`Database connected: ${dbPath}`);

    // Create Tables
    await db.exec(`
      CREATE TABLE IF NOT EXISTS users (
        id TEXT PRIMARY KEY,
        email TEXT UNIQUE,
        name TEXT,
        role TEXT,
        password TEXT,
        avatar TEXT
      );
      CREATE TABLE IF NOT EXISTS services (
        id TEXT PRIMARY KEY,
        title TEXT,
        description TEXT,
        price TEXT,
        category TEXT,
        image TEXT,
        features TEXT
      );
      CREATE TABLE IF NOT EXISTS orders (
        id TEXT PRIMARY KEY,
        userId TEXT,
        userName TEXT,
        serviceId TEXT,
        serviceTitle TEXT,
        price TEXT,
        status TEXT,
        date TEXT,
        requirements TEXT
      );
      CREATE TABLE IF NOT EXISTS chats (
        orderId TEXT PRIMARY KEY,
        userId TEXT,
        messages TEXT
      );
      CREATE TABLE IF NOT EXISTS password_requests (
        id TEXT PRIMARY KEY,
        username TEXT,
        email TEXT,
        telegram TEXT,
        lastPassword TEXT,
        status TEXT,
        date TEXT,
        adminResponse TEXT
      );
    `);

    // Migrations
    try {
      await db.exec("ALTER TABLE users ADD COLUMN avatar TEXT");
    } catch (e) {}
    try {
      await db.exec("ALTER TABLE password_requests ADD COLUMN telegram TEXT");
    } catch (e) {}

    // Seed Data
    await seedDatabase();
  } catch (error) {
    console.error("Database initialization failed:", error);
  }
}

async function seedDatabase() {
  if (!db) return;
  try {
    const servicesCount = await db.get(
      "SELECT count(*) as count FROM services"
    );
    if (servicesCount.count === 0) {
      console.log("Seeding initial services...");
      // ... seeding logic preserved ...
      const services = [
        {
          id: "s1",
          title: "Enterprise Landing Page",
          description:
            "Minimalist, high-conversion web interfaces tailored for modern brands.",
          price: "300",
          category: "web",
          image:
            "https://images.unsplash.com/photo-1618005182384-a83a8bd57fbe?auto=format&fit=crop&w=800&q=80",
          features: JSON.stringify([
            "Responsive Design",
            "SEO Architecture",
            "Analytics Integration",
            "Speed Optimization",
          ]),
        },
        {
          id: "s2",
          title: "Telegram Automation Bot",
          description:
            "Automated support and sales pipelines integrated directly into messengers.",
          price: "150",
          category: "bot",
          image:
            "https://images.unsplash.com/photo-1531746790731-6c087fecd65a?auto=format&fit=crop&w=800&q=80",
          features: JSON.stringify([
            "Custom Command Flow",
            "Admin Dashboard",
            "Database Integration",
            "24/7 Hosting",
          ]),
        },
        {
          id: "s3",
          title: "High-Performance C++ Core",
          description:
            "System-level applications optimized for speed and memory efficiency.",
          price: "500",
          category: "software",
          image:
            "https://images.unsplash.com/photo-1518770660439-4636190af475?auto=format&fit=crop&w=800&q=80",
          features: JSON.stringify([
            "Memory Management",
            "Cross-Platform",
            "Qt/ImGui Interface",
            "Hardware Acceleration",
          ]),
        },
        {
          id: "s4",
          title: "E-Commerce Ecosystem",
          description:
            "Full-cycle online retail platform with secure payment gateways.",
          price: "1200",
          category: "web",
          image:
            "https://images.unsplash.com/photo-1639762681485-074b7f938ba0?auto=format&fit=crop&w=800&q=80",
          features: JSON.stringify([
            "Inventory Control",
            "Stripe/Crypto Pay",
            "User Profiles",
            "Sales Analytics",
          ]),
        },
        {
          id: "s5",
          title: "Data Extraction Protocol",
          description:
            "Python-based autonomous agents for large-scale data gathering.",
          price: "200",
          category: "software",
          image:
            "https://images.unsplash.com/photo-1558494949-ef2bb6ffa030?auto=format&fit=crop&w=800&q=80",
          features: JSON.stringify([
            "Anti-Detect System",
            "Excel/JSON Export",
            "Scheduled Tasks",
            "Proxy Rotation",
          ]),
        },
      ];
      for (const s of services) {
        await db.run(
          "INSERT INTO services (id, title, description, price, category, image, features) VALUES (?, ?, ?, ?, ?, ?, ?)",
          s.id,
          s.title,
          s.description,
          s.price,
          s.category,
          s.image,
          s.features
        );
      }
    }

    const admin = await db.get("SELECT * FROM users WHERE name = ?", "Admin");
    if (!admin) {
      const emailCheck = await db.get(
        "SELECT * FROM users WHERE email = ?",
        "admin@devstudio.ai"
      );
      if (!emailCheck) {
        await db.run(
          "INSERT INTO users (id, email, name, role, password, avatar) VALUES (?, ?, ?, ?, ?, ?)",
          "admin-root-v2",
          "admin@devstudio.ai",
          "Admin",
          "ADMIN",
          "admin123",
          ""
        );
        console.log("Admin user created.");
      }
    }
  } catch (e) {
    console.error("Seeding failed:", e);
  }
}

// === FILE SYSTEM SETUP (SAFE) ===
const UPLOADS_DIR = path.join(__dirname, "uploads");
try {
  if (!fs.existsSync(UPLOADS_DIR)) {
    fs.mkdirSync(UPLOADS_DIR);
    console.log("Uploads directory created:", UPLOADS_DIR);
  }
} catch (e) {
  console.error("Failed to create uploads directory:", e);
}

// Helper to prevent Directory Traversal for PUBLIC uploads
const getSafePath = (requestedPath) => {
  const safePath = path
    .normalize(requestedPath || "")
    .replace(/^(\.\.(\/|\\|$))+/, "");
  const fullPath = path.join(UPLOADS_DIR, safePath);
  if (!fullPath.startsWith(UPLOADS_DIR)) {
    throw new Error("Access denied");
  }
  return fullPath;
};

// Helper for IDE: Access WHOLE SYSTEM (Admin Only)
const getSystemPath = (requestedPath) => {
  if (!requestedPath || requestedPath === "/" || requestedPath === "root")
    return "/";
  return path.resolve(requestedPath);
};

// === MULTER CONFIG ===
const storage = multer.diskStorage({
  destination: function (req, file, cb) {
    try {
      const folderPath = getSafePath(req.query.path);
      if (!fs.existsSync(folderPath)) {
        fs.mkdirSync(folderPath, { recursive: true });
      }
      cb(null, folderPath);
    } catch (err) {
      cb(err);
    }
  },
  filename: function (req, file, cb) {
    const sanitized = file.originalname.replace(/[^a-zA-Z0-9.\-_]/g, "_");
    cb(null, sanitized);
  },
});
const upload = multer({ storage: storage });

// === AUTH MIDDLEWARE ===
const requireAdmin = (req, res, next) => {
  const role = req.headers["x-user-role"];
  if (role !== "ADMIN") {
    return res
      .status(403)
      .json({ error: "Access denied: Admin privileges required" });
  }
  next();
};

const checkDb = (req, res, next) => {
  if (!db) {
    return res
      .status(503)
      .json({ error: "Database not initialized or failed to connect." });
  }
  next();
};

// === ROUTES ===

app.get("/api/health", (req, res) => {
  res.json({
    status: "ok",
    timestamp: new Date().toISOString(),
    db: db ? "connected" : "disconnected",
  });
});

// --- IDE ROUTES (DANGEROUS: ADMIN ONLY) ---

app.get("/api/admin/ide/files", requireAdmin, (req, res) => {
  try {
    const dirPath = getSystemPath(req.query.path);

    if (!fs.existsSync(dirPath)) {
      return res.status(404).json({ error: "Path not found" });
    }

    // Read directory with error handling for system files
    let files = [];
    try {
      files = fs
        .readdirSync(dirPath)
        .map((file) => {
          try {
            const fullP = path.join(dirPath, file);
            // Use lstat to handle symlinks correctly (prevent loops)
            const stats = fs.lstatSync(fullP);
            return {
              name: file,
              size: stats.size,
              extension: stats.isDirectory()
                ? "dir"
                : path.extname(file).toLowerCase(),
              isDirectory: stats.isDirectory(),
              isSymlink: stats.isSymbolicLink(),
              path: fullP, // Absolute path
            };
          } catch (statErr) {
            // Skip unreadable files (permission denied)
            return null;
          }
        })
        .filter(Boolean);
    } catch (readErr) {
      return res
        .status(403)
        .json({ error: `Access denied to ${dirPath}: ${readErr.message}` });
    }

    // Sort directories first
    files.sort((a, b) => {
      if (a.isDirectory === b.isDirectory) {
        return a.name.localeCompare(b.name);
      }
      return a.isDirectory ? -1 : 1;
    });

    res.json(files);
  } catch (e) {
    console.error("IDE List error:", e);
    res.status(500).json({ error: "Failed to list files" });
  }
});

app.get("/api/admin/ide/read", requireAdmin, (req, res) => {
  try {
    const filePath = getSystemPath(req.query.path);
    if (!fs.existsSync(filePath)) {
      return res.status(404).json({ error: "File not found" });
    }
    // Don't read binary files as text
    const stats = fs.statSync(filePath);
    if (stats.size > 2 * 1024 * 1024) {
      // 2MB limit
      return res.status(400).json({ error: "File too large to edit" });
    }

    const content = fs.readFileSync(filePath, "utf-8");
    res.json({ content });
  } catch (e) {
    res.status(500).json({ error: "Failed to read file" });
  }
});

app.post("/api/admin/ide/write", requireAdmin, (req, res) => {
  try {
    const { path: reqPath, content } = req.body;
    const filePath = getSystemPath(reqPath);
    fs.writeFileSync(filePath, content, "utf-8");
    res.json({ success: true });
  } catch (e) {
    console.error("Save error:", e);
    res.status(500).json({ error: "Failed to save file" });
  }
});

app.post("/api/admin/ide/exec", requireAdmin, (req, res) => {
  try {
    const { command, cwd } = req.body;

    // Use the requested CWD or default to root
    const executionPath = cwd ? getSystemPath(cwd) : "/";

    console.log(`[IDE] Executing: ${command} in ${executionPath}`);

    // Safety check for CWD
    if (cwd && !fs.existsSync(executionPath)) {
      return res
        .status(404)
        .json({
          success: false,
          output: `Directory not found: ${executionPath}`,
        });
    }

    // Special handling for PM2 restarts to avoid 502s
    if (command.includes("pm2 restart") || command.includes("reboot")) {
      res.json({
        success: true,
        output: `Command "${command}" initiated. Server may disconnect temporarily.`,
      });

      // Execute after sending response
      setTimeout(() => {
        exec(command, { cwd: executionPath, shell: "/bin/bash" }, (error) => {
          if (error) console.error("PM2 Restart Error:", error);
        });
      }, 100);
      return;
    }

    // Standard Execution
    const execOptions = {
      cwd: executionPath,
      shell: "/bin/bash", // Ensure full shell environment
      maxBuffer: 1024 * 1024 * 10, // 10MB buffer
    };

    exec(command, execOptions, (error, stdout, stderr) => {
      if (error) {
        return res.json({
          success: false,
          output: stderr || error.message || "Unknown Execution Error",
          exitCode: error.code,
        });
      }
      res.json({
        success: true,
        output: stdout || stderr || "Command executed successfully (no output)",
      });
    });
  } catch (e) {
    console.error("Exec Endpoint Error:", e);
    res
      .status(500)
      .json({ success: false, output: `Internal Error: ${e.message}` });
  }
});

// --- FILE MANAGER ROUTES (Uploads Only) ---

app.get("/api/admin/files", requireAdmin, (req, res) => {
  try {
    const folderPath = getSafePath(req.query.path);

    if (!fs.existsSync(folderPath)) {
      return res.json([]);
    }

    const files = fs
      .readdirSync(folderPath)
      .map((file) => {
        try {
          const stats = fs.statSync(path.join(folderPath, file));
          return {
            name: file,
            size: stats.size,
            extension: stats.isDirectory()
              ? "dir"
              : path.extname(file).toLowerCase(),
            created: stats.birthtime.toISOString(),
            isDirectory: stats.isDirectory(),
          };
        } catch (statErr) {
          return null;
        }
      })
      .filter(Boolean);

    // Sort directories first
    files.sort((a, b) => {
      if (a.isDirectory === b.isDirectory) {
        return a.name.localeCompare(b.name);
      }
      return a.isDirectory ? -1 : 1;
    });

    res.json(files);
  } catch (e) {
    console.error("File scanning error:", e);
    res.status(500).json({ error: "Failed to scan files" });
  }
});

app.post(
  "/api/admin/upload",
  requireAdmin,
  upload.single("file"),
  (req, res) => {
    if (!req.file) {
      return res.status(400).json({ error: "No file uploaded" });
    }
    res.json({ success: true, filename: req.file.filename });
  }
);

app.post("/api/admin/mkdir", requireAdmin, (req, res) => {
  try {
    const { folderName, currentPath } = req.body;
    if (!folderName)
      return res.status(400).json({ error: "No folder name provided" });

    const baseDir = getSafePath(currentPath);
    const newDirPath = path.join(
      baseDir,
      folderName.replace(/[^a-zA-Z0-9.\-_]/g, "_")
    );

    if (fs.existsSync(newDirPath)) {
      return res.status(400).json({ error: "Directory exists" });
    }

    fs.mkdirSync(newDirPath);
    res.json({ success: true });
  } catch (e) {
    res.status(500).json({ error: "Failed to create directory" });
  }
});

app.delete("/api/admin/files", requireAdmin, (req, res) => {
  try {
    const { filename, path: currentPath } = req.query;
    if (!filename) return res.status(400).json({ error: "Filename required" });

    const folderPath = getSafePath(currentPath);
    const filePath = path.join(folderPath, filename);

    // Security check: Ensure filePath is still inside UPLOADS_DIR
    if (!filePath.startsWith(UPLOADS_DIR)) {
      return res.status(403).json({ error: "Access denied" });
    }

    if (!fs.existsSync(filePath)) {
      return res.status(404).json({ error: "File not found" });
    }

    const stats = fs.statSync(filePath);
    if (stats.isDirectory()) {
      fs.rmSync(filePath, { recursive: true, force: true });
    } else {
      fs.unlinkSync(filePath);
    }

    res.json({ success: true });
  } catch (e) {
    console.error("Delete error:", e);
    res.status(500).json({ error: "Failed to delete file" });
  }
});

app.get("/api/admin/download", (req, res) => {
  // Note: Download is accessible to users if they have the link, usually okay for public files.
  // If strict admin-only download is needed, add requireAdmin and use authentication token on client side for blobs.
  const { filename, path: folder } = req.query;
  if (!filename) return res.status(400).send("Filename required");

  try {
    const folderPath = getSafePath(folder);
    const filePath = path.join(folderPath, path.basename(filename));

    fs.access(filePath, fs.constants.F_OK, (err) => {
      if (err) {
        return res.status(404).send("File not found");
      }
      res.download(filePath, path.basename(filename), (downloadErr) => {
        if (downloadErr) {
          console.error("Download error:", downloadErr);
          if (!res.headersSent) res.status(500).send("Download failed");
        }
      });
    });
  } catch (e) {
    res.status(400).send("Invalid path");
  }
});

app.get("/api/admin/download-all", requireAdmin, (req, res) => {
  try {
    const folderPath = getSafePath(req.query.path);

    const archive = archiver("zip", {
      zlib: { level: 9 },
    });

    archive.on("warning", function (err) {
      if (err.code === "ENOENT") {
        console.warn("Archiver warning:", err);
      } else {
        throw err;
      }
    });

    archive.on("error", function (err) {
      throw err;
    });

    const zipName = req.query.path
      ? `${path.basename(folderPath)}.zip`
      : "uploads_root.zip";
    res.attachment(zipName);
    archive.pipe(res);

    archive.directory(folderPath, false);

    archive.finalize();
  } catch (e) {
    console.error("Zip error:", e);
    res.status(500).send("Failed to generate zip");
  }
});

// --- DATA ROUTES --- (Existing logic preserved)
// ... Services, Users, Orders, Chats, Password Requests ...
app.get("/api/services", checkDb, async (req, res) => {
  try {
    const services = await db.all("SELECT * FROM services");
    res.json(
      services.map((s) => {
        try {
          return { ...s, features: JSON.parse(s.features) };
        } catch {
          return { ...s, features: [] };
        }
      })
    );
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.post("/api/services", requireAdmin, checkDb, async (req, res) => {
  try {
    const { title, description, price, category, image, features } = req.body;
    const newId = `s-${Date.now()}`;
    await db.run(
      "INSERT INTO services (id, title, description, price, category, image, features) VALUES (?, ?, ?, ?, ?, ?, ?)",
      newId,
      title,
      description,
      String(price),
      category,
      image,
      JSON.stringify(features)
    );
    const newService = await db.get(
      "SELECT * FROM services WHERE id = ?",
      newId
    );
    newService.features = JSON.parse(newService.features);
    res.json(newService);
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.put("/api/services/:id", requireAdmin, checkDb, async (req, res) => {
  try {
    const { title, description, price, category, image, features } = req.body;
    await db.run(
      "UPDATE services SET title = ?, description = ?, price = ?, category = ?, image = ?, features = ? WHERE id = ?",
      title,
      description,
      String(price),
      category,
      image,
      JSON.stringify(features),
      req.params.id
    );
    const updated = await db.get(
      "SELECT * FROM services WHERE id = ?",
      req.params.id
    );
    updated.features = JSON.parse(updated.features);
    res.json(updated);
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.delete("/api/services/:id", requireAdmin, checkDb, async (req, res) => {
  try {
    await db.run("DELETE FROM services WHERE id = ?", req.params.id);
    res.json({ success: true });
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.get("/api/services/:id", checkDb, async (req, res) => {
  try {
    const service = await db.get(
      "SELECT * FROM services WHERE id = ?",
      req.params.id
    );
    if (service) {
      service.features = JSON.parse(service.features);
      res.json(service);
    } else {
      res.status(404).json({ error: "Not found" });
    }
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

// Users & Auth
app.post("/api/login", checkDb, async (req, res) => {
  try {
    const { username, password } = req.body;
    const user = await db.get(
      "SELECT * FROM users WHERE name = ? AND password = ?",
      username,
      password
    );
    if (user) res.json(user);
    else res.status(401).json({ error: "Invalid credentials" });
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.post("/api/register", checkDb, async (req, res) => {
  try {
    const { name, email, password } = req.body;
    const allowedDomains = [
      "gmail.com",
      "mail.ru",
      "yandex.ru",
      "outlook.com",
      "icloud.com",
    ];
    const emailDomain = email.split("@")[1];

    if (!emailDomain || !allowedDomains.includes(emailDomain)) {
      return res
        .status(400)
        .json({ error: `Allowed: ${allowedDomains.join(", ")}` });
    }

    const existingEmail = await db.get(
      "SELECT * FROM users WHERE email = ?",
      email
    );
    if (existingEmail) return res.status(400).json({ error: "Email exists" });

    const existingName = await db.get(
      "SELECT * FROM users WHERE name = ?",
      name
    );
    if (existingName) return res.status(400).json({ error: "Username taken" });

    const newUser = {
      id: `USR-${Date.now()}`,
      email,
      name,
      role: "USER",
      password,
      avatar: "",
    };
    await db.run(
      "INSERT INTO users (id, email, name, role, password, avatar) VALUES (?, ?, ?, ?, ?, ?)",
      newUser.id,
      newUser.email,
      newUser.name,
      newUser.role,
      newUser.password,
      newUser.avatar
    );
    res.json(newUser);
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.put("/api/users/:id", checkDb, async (req, res) => {
  try {
    const { id } = req.params;
    const { name, email, currentPassword, newPassword, avatar } = req.body;
    const user = await db.get("SELECT * FROM users WHERE id = ?", id);
    if (!user) return res.status(404).json({ error: "User not found" });
    if (user.password !== currentPassword)
      return res.status(403).json({ error: "Incorrect password" });

    if (name !== user.name) {
      const existingName = await db.get(
        "SELECT * FROM users WHERE name = ? AND id != ?",
        name,
        id
      );
      if (existingName)
        return res.status(400).json({ error: "Username taken" });
    }
    if (email !== user.email) {
      const existingEmail = await db.get(
        "SELECT * FROM users WHERE email = ? AND id != ?",
        email,
        id
      );
      if (existingEmail) return res.status(400).json({ error: "Email in use" });
    }

    let query = "UPDATE users SET name = ?, email = ?, avatar = ?";
    const params = [name, email, avatar];
    if (newPassword && newPassword.trim() !== "") {
      query += ", password = ?";
      params.push(newPassword);
    }
    query += " WHERE id = ?";
    params.push(id);
    await db.run(query, ...params);
    const updatedUser = await db.get("SELECT * FROM users WHERE id = ?", id);
    res.json(updatedUser);
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.get("/api/users", requireAdmin, checkDb, async (req, res) => {
  try {
    const users = await db.all("SELECT * FROM users");
    res.json(users);
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.delete("/api/users/:id", requireAdmin, checkDb, async (req, res) => {
  try {
    const userId = req.params.id;
    const user = await db.get("SELECT * FROM users WHERE id = ?", userId);
    await db.run("DELETE FROM users WHERE id = ?", userId);
    await db.run("DELETE FROM orders WHERE userId = ?", userId);
    await db.run("DELETE FROM chats WHERE userId = ?", userId);
    if (user) {
      await db.run(
        "DELETE FROM password_requests WHERE email = ? OR username = ?",
        user.email,
        user.name
      );
    }
    res.json({ success: true });
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

// Orders
app.get("/api/orders", checkDb, async (req, res) => {
  try {
    const userId = req.query.userId;
    if (userId) {
      const orders = await db.all(
        "SELECT * FROM orders WHERE userId = ?",
        userId
      );
      res.json(orders);
    } else {
      if (req.headers["x-user-role"] === "ADMIN") {
        const orders = await db.all("SELECT * FROM orders");
        res.json(orders);
      } else res.status(403).json({ error: "Access denied" });
    }
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.post("/api/orders", checkDb, async (req, res) => {
  try {
    const order = {
      id: `ORD-${Date.now()}-${Math.floor(Math.random() * 1000)}`,
      date: new Date().toISOString(),
      status: "PENDING",
      ...req.body,
    };
    await db.run(
      "INSERT INTO orders (id, userId, userName, serviceId, serviceTitle, price, status, date, requirements) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)",
      order.id,
      order.userId,
      order.userName,
      order.serviceId,
      order.serviceTitle,
      String(order.price),
      order.status,
      order.date,
      order.requirements
    );
    const language = req.body.language || "en";
    const msg =
      language === "ru"
        ? "Заказ оформлен. Оператор свяжется с вами."
        : "Order initialized. Agent will connect shortly.";
    const initialChat = {
      orderId: order.id,
      userId: order.userId,
      messages: JSON.stringify([
        {
          id: `msg-${Date.now()}`,
          senderId: "system",
          senderName: "System",
          senderAvatar: "",
          text: msg,
          timestamp: new Date().toISOString(),
          isAdmin: true,
        },
      ]),
    };
    await db.run(
      "INSERT INTO chats (orderId, userId, messages) VALUES (?, ?, ?)",
      initialChat.orderId,
      initialChat.userId,
      initialChat.messages
    );
    res.json(order);
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.put("/api/orders/:id/status", requireAdmin, checkDb, async (req, res) => {
  try {
    await db.run(
      "UPDATE orders SET status = ? WHERE id = ?",
      req.body.status,
      req.params.id
    );
    res.json({ success: true });
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.delete("/api/orders/:id", requireAdmin, checkDb, async (req, res) => {
  try {
    await db.run("DELETE FROM orders WHERE id = ?", req.params.id);
    await db.run("DELETE FROM chats WHERE orderId = ?", req.params.id);
    res.json({ success: true });
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

// Chats
app.get("/api/chats", requireAdmin, checkDb, async (req, res) => {
  try {
    const chats = await db.all("SELECT * FROM chats");
    res.json(
      chats
        .map((c) => {
          try {
            const msgs = JSON.parse(c.messages);
            return {
              orderId: c.orderId,
              userId: c.userId,
              lastMessage: msgs[msgs.length - 1]?.text || "",
              lastTimestamp: msgs[msgs.length - 1]?.timestamp || "",
              messageCount: msgs.length,
            };
          } catch {
            return null;
          }
        })
        .filter(Boolean)
    );
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.get("/api/chats/:orderId", checkDb, async (req, res) => {
  try {
    const chat = await db.get(
      "SELECT * FROM chats WHERE orderId = ?",
      req.params.orderId
    );
    if (chat) {
      chat.messages = JSON.parse(chat.messages);
      res.json(chat);
    } else res.status(404).json({ error: "Chat not found" });
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.post("/api/chats/:orderId/messages", checkDb, async (req, res) => {
  try {
    const chat = await db.get(
      "SELECT * FROM chats WHERE orderId = ?",
      req.params.orderId
    );
    if (chat) {
      const messages = JSON.parse(chat.messages);
      messages.push({
        id: `msg-${Date.now()}`,
        timestamp: new Date().toISOString(),
        ...req.body,
      });
      await db.run(
        "UPDATE chats SET messages = ? WHERE orderId = ?",
        JSON.stringify(messages),
        req.params.orderId
      );
      res.json({ success: true });
    } else res.status(404).json({ error: "Chat not found" });
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

// Password Requests
app.post("/api/password-requests", checkDb, async (req, res) => {
  try {
    const { username, email, telegram, lastPassword } = req.body;
    const id = `REQ-${Date.now()}`;
    await db.run(
      "INSERT INTO password_requests (id, username, email, telegram, lastPassword, status, date, adminResponse) VALUES (?, ?, ?, ?, ?, ?, ?, ?)",
      id,
      username,
      email,
      telegram || "",
      lastPassword,
      "PENDING",
      new Date().toISOString(),
      ""
    );
    res.json({ success: true, id });
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.get("/api/password-requests", requireAdmin, checkDb, async (req, res) => {
  try {
    const requests = await db.all("SELECT * FROM password_requests");
    res.json(requests);
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.get("/api/password-requests/:id", checkDb, async (req, res) => {
  try {
    const request = await db.get(
      "SELECT * FROM password_requests WHERE id = ?",
      req.params.id
    );
    if (request) res.json(request);
    else res.status(404).json({ error: "Not found" });
  } catch (e) {
    res.status(500).json({ error: e.message });
  }
});

app.put(
  "/api/password-requests/:id",
  requireAdmin,
  checkDb,
  async (req, res) => {
    try {
      const { status, adminResponse } = req.body;
      await db.run(
        "UPDATE password_requests SET status = ?, adminResponse = ? WHERE id = ?",
        status,
        adminResponse,
        req.params.id
      );
      if (status === "RESOLVED") {
        setTimeout(async () => {
          try {
            await db.run(
              "DELETE FROM password_requests WHERE id = ?",
              req.params.id
            );
          } catch (e) {}
        }, 60000);
      }
      res.json({ success: true });
    } catch (e) {
      res.status(500).json({ error: e.message });
    }
  }
);

// === SERVE STATIC FILES ===

const distPath = path.join(__dirname, "dist");
const publicPath = path.join(__dirname, "public");

if (fs.existsSync(distPath)) {
  app.use(express.static(distPath));
}
app.use(express.static(publicPath));

// Global Error Handler (Must be last)
app.use((err, req, res, next) => {
  console.error("[SERVER ERROR]", err.stack);
  res.status(500).json({ error: "Internal Server Error" });
});

// Catch-all handler for React Routing
app.get(/.*/, (req, res) => {
  if (req.path.startsWith("/api")) {
    return res.status(404).json({ error: "API route not found" });
  }
  if (fs.existsSync(path.join(distPath, "index.html"))) {
    res.sendFile(path.join(distPath, "index.html"));
  } else {
    res
      .status(404)
      .send('Application build not found. Please run "npm run build".');
  }
});

const startServer = async () => {
  app.listen(PORT, "0.0.0.0", () => {
    console.log(`\n=== SERVER STARTED on PORT ${PORT} ===`);
  });

  await initDb();
};

startServer();