server.js

import express from 'express';
import cors from 'cors';
import pg from 'pg';
import bcrypt from 'bcryptjs';
import jwt from 'jsonwebtoken';

const { Pool } = pg;
const app = express();
const PORT = process.env.PORT || 3000;

// Middleware
app.use(cors());
app.use(express.json());

// Database
const pool = new Pool({
  connectionString: process.env.DATABASE_URL,
  ssl: process.env.NODE_ENV === 'production' ? { rejectUnauthorized: false } : false
});

// Initialize database
async function initDB() {
  await pool.query(`
    CREATE TABLE IF NOT EXISTS users (
      email VARCHAR(255) PRIMARY KEY,
      password_hash VARCHAR(255) NOT NULL,
      credits INTEGER DEFAULT 0,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    )
  `);
  await pool.query(`
    CREATE TABLE IF NOT EXISTS tasks (
      id SERIAL PRIMARY KEY,
      email VARCHAR(255) NOT NULL,
      description TEXT NOT NULL,
      status VARCHAR(50) DEFAULT 'pending',
      credits_spent INTEGER DEFAULT 10,
      created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
    )
  `);
  await pool.query(`
    CREATE TABLE IF NOT EXISTS redeemed_codes (
      email VARCHAR(255) NOT NULL,
      code VARCHAR(50) NOT NULL,
      redeemed_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
      PRIMARY KEY (email, code)
    )
  `);
}

initDB().catch(console.error);

// Credit codes
const CODES = {
  'BETA10K': 10000,
  'BETA5K': 5000,
  'WELCOME': 1000
};

// Helper functions
function generateToken(email) {
  return jwt.sign({ email }, 'impacteragi-secret-key', { expiresIn: '7d' });
}

function getUserFromToken(token) {
  try {
    const decoded = jwt.verify(token, 'impacteragi-secret-key');
    return decoded.email;
  } catch {
    return null;
  }
}

// Routes
app.post('/api/auth/signup', async (req, res) => {
  try {
    const { email, password } = req.body;

    if (!email || !password) {
      return res.status(400).json({ error: 'Email and password required' });
    }

    if (password.length < 8) {
      return res.status(400).json({ error: 'Password must be at least 8 characters' });
    }

    // Check if exists
    const existing = await pool.query('SELECT email FROM users WHERE email = $1', [email]);
    if (existing.rows.length > 0) {
      return res.status(409).json({ error: 'User already exists' });
    }

    // Create user
    const passwordHash = await bcrypt.hash(password, 10);
    await pool.query(
      'INSERT INTO users (email, password_hash, credits) VALUES ($1, $2, 0)',
      [email, passwordHash]
    );

    const token = generateToken(email);
    res.json({ success: true, token, email, credits: 0 });
  } catch (error) {
    console.error('Signup error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

app.post('/api/auth/login', async (req, res) => {
  try {
    const { email, password } = req.body;

    if (!email || !password) {
      return res.status(400).json({ error: 'Email and password required' });
    }

    const result = await pool.query(
      'SELECT email, password_hash, credits FROM users WHERE email = $1',
      [email]
    );

    if (result.rows.length === 0) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }

    const user = result.rows[0];
    const isValid = await bcrypt.compare(password, user.password_hash);

    if (!isValid) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }

    const token = generateToken(email);
    res.json({ success: true, token, email, credits: user.credits });
  } catch (error) {
    console.error('Login error:', error);
    res.status(401).json({ error: 'Invalid credentials' });
  }
});

app.get('/api/user', async (req, res) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Unauthorized' });
    }

    const token = authHeader.substring(7);
    const email = getUserFromToken(token);

    if (!email) {
      return res.status(401).json({ error: 'Invalid token' });
    }

    const result = await pool.query(
      'SELECT email, credits, created_at FROM users WHERE email = $1',
      [email]
    );

    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'User not found' });
    }

    res.json({ success: true, ...result.rows[0] });
  } catch (error) {
    console.error('User API error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

app.post('/api/redeem', async (req, res) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Unauthorized' });
    }

    const token = authHeader.substring(7);
    const email = getUserFromToken(token);

    if (!email) {
      return res.status(401).json({ error: 'Invalid token' });
    }

    const { code } = req.body;
    if (!code) {
      return res.status(400).json({ error: 'Code required' });
    }

    const codeUpper = code.toUpperCase();
    const credits = CODES[codeUpper];

    if (!credits) {
      return res.status(400).json({ error: 'Invalid code' });
    }

    // Check if already redeemed
    const redeemed = await pool.query(
      'SELECT 1 FROM redeemed_codes WHERE email = $1 AND code = $2',
      [email, codeUpper]
    );

    if (redeemed.rows.length > 0) {
      return res.status(400).json({ error: 'Code already redeemed' });
    }

    // Add credits
    const result = await pool.query(
      'UPDATE users SET credits = credits + $1 WHERE email = $2 RETURNING credits',
      [credits, email]
    );

    // Mark as redeemed
    await pool.query(
      'INSERT INTO redeemed_codes (email, code) VALUES ($1, $2)',
      [email, codeUpper]
    );

    const newTotal = result.rows[0].credits;
    res.json({ success: true, credits: newTotal, message: `Successfully redeemed ${credits} credits!` });
  } catch (error) {
    console.error('Redeem error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

app.get('/api/tasks', async (req, res) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Unauthorized' });
    }

    const token = authHeader.substring(7);
    const email = getUserFromToken(token);

    if (!email) {
      return res.status(401).json({ error: 'Invalid token' });
    }

    const result = await pool.query(
      'SELECT * FROM tasks WHERE email = $1 ORDER BY created_at DESC',
      [email]
    );

    res.json({ success: true, tasks: result.rows });
  } catch (error) {
    console.error('Tasks error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

app.post('/api/tasks', async (req, res) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'Unauthorized' });
    }

    const token = authHeader.substring(7);
    const email = getUserFromToken(token);

    if (!email) {
      return res.status(401).json({ error: 'Invalid token' });
    }

    const { description } = req.body;
    if (!description) {
      return res.status(400).json({ error: 'Description required' });
    }

    // Check credits
    const userResult = await pool.query('SELECT credits FROM users WHERE email = $1', [email]);
    const userCredits = userResult.rows[0].credits;

    if (userCredits < 10) {
      return res.status(400).json({ error: 'Insufficient credits', required: 10, available: userCredits });
    }

    // Create task
    await pool.query(
      'INSERT INTO tasks (email, description, status, credits_spent) VALUES ($1, $2, $3, $4)',
      [email, description, 'pending', 10]
    );

    // Deduct credits
    const result = await pool.query(
      'UPDATE users SET credits = credits - 10 WHERE email = $1 RETURNING credits',
      [email]
    );

    const newCredits = result.rows[0].credits;
    res.json({ success: true, credits: newCredits, message: 'Task submitted successfully' });
  } catch (error) {
    console.error('Task creation error:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

app.get('/health', (req, res) => {
  res.json({ status: 'ok' });
});

app.listen(PORT, () => {
  console.log(`ImpacterAGI API running on port ${PORT}`);
});