import 'reflect-metadata';
import { NestFactory } from '@nestjs/core';
import { ValidationPipe, Logger } from '@nestjs/common';
import { NestExpressApplication } from '@nestjs/platform-express';
import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
import { toOpenApi31 } from './common/utils/openapi31';
import { ConfigService } from '@nestjs/config';
import helmet from 'helmet';
import cookieParser from 'cookie-parser';
import * as fs from 'fs';
import * as path from 'path';
import * as express from 'express';
import { AppModule } from './app.module';
import { SpaFallbackMiddleware } from './frontend/spa.controller';
import { DatabaseInitService } from './database/database-init.service';
import { CsrfMiddleware } from './common/middleware/csrf.middleware';

async function bootstrap(): Promise<void> {
  const app = await NestFactory.create<NestExpressApplication>(AppModule, {
    bufferLogs: false,
  });

  const config = app.get(ConfigService);
  const nodeEnv = config.get<string>('NODE_ENV', 'development');
  const port = config.get<number>('PORT', 3000);
  const corsOrigins = (config.get<string>('CORS_ORIGINS', 'http://localhost:4200,http://localhost:3000'))
    .split(',')
    .map((s) => s.trim())
    .filter(Boolean);
  const bodyLimit = config.get<string>('BODY_SIZE_LIMIT', '1mb');
  const uploadDir = path.resolve(config.get<string>('UPLOAD_DIR', './data/uploads'));
  const tlsEnabled = config.get<boolean>('TLS_ENABLED', false);
  const frontendDist = path.resolve(config.get<string>('FRONTEND_DIST', '../frontend/dist'));

  if (!fs.existsSync(uploadDir)) fs.mkdirSync(uploadDir, { recursive: true });

  await app.get(DatabaseInitService).init();

  app.use(
    helmet({
      contentSecurityPolicy: {
        directives: {
          defaultSrc: ["'self'"],
          scriptSrc: ["'self'"],
          styleSrc: ["'self'", "'unsafe-inline'"],
          imgSrc: ["'self'", 'data:', 'blob:'],
          connectSrc: ["'self'"],
          fontSrc: ["'self'", 'data:'],
          objectSrc: ["'none'"],
          frameAncestors: ["'none'"],
        },
      },
      hsts: tlsEnabled ? { maxAge: 31536000, includeSubDomains: true, preload: true } : false,
      frameguard: { action: 'deny' },
      noSniff: true,
      referrerPolicy: { policy: 'no-referrer' },
    }),
  );

  app.enableCors({
    origin: corsOrigins,
    credentials: true,
    methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
  });

  // Body parsers MUST run before the CSRF middleware so that route handlers
  // can read `req.body` when the CsrfMiddleware short-circuits to next().
  app.use(cookieParser());
  app.use(express.json({ limit: bodyLimit }));
  app.use(express.urlencoded({ extended: true, limit: bodyLimit }));

  // CSRF: register globally via express so we have explicit ordering after
  // the body parsers. (Nest's configure()-time middleware is registered
  // before app.use middlewares, which would consume the body before the
  // CsrfMiddleware short-circuits to next().)
  const csrf = new CsrfMiddleware(config);
  app.use((req, res, next) => csrf.use(req as any, res as any, next));

  app.use('/uploads', express.static(uploadDir));

  app.useGlobalPipes(new ValidationPipe({ whitelist: true, forbidNonWhitelisted: false, transform: true }));

  const swaggerConfig = new DocumentBuilder()
    .setTitle('HIPCTF API')
    .setDescription('HIPCTF REST API')
    .setVersion('1.0.0')
    .addBearerAuth()
    .addCookieAuth('rt')
    .build();
  const rawDocument = SwaggerModule.createDocument(app, swaggerConfig) as Record<string, any>;
  const document = toOpenApi31(rawDocument);
  SwaggerModule.setup('api/docs', app, document, {
    jsonDocumentUrl: 'api/docs-json',
  });

  if (fs.existsSync(frontendDist)) {
    app.use(express.static(frontendDist, { index: false, fallthrough: true }));
    const browserDir = path.join(frontendDist, 'browser');
    if (fs.existsSync(browserDir)) {
      app.use(express.static(browserDir, { index: false, fallthrough: true }));
    }
  }

  const spa = new SpaFallbackMiddleware(config);
  app.use((req, res, next) => spa.use(req as any, res as any, next));

  await app.listen(port, '0.0.0.0');
  Logger.log(`HIPCTF API listening on http://0.0.0.0:${port} (env=${nodeEnv})`, 'Bootstrap');
}

bootstrap().catch((err) => {
  console.error('Fatal startup error:', err);
  process.exit(1);
});