// cmd/server/main.go
package main

import (
    "context"
    "crypto/hmac"
    "crypto/sha256"
    "embed"
    "encoding/csv"
    "encoding/json"
    "errors"
    "fmt"
    "log"
    "net/http"
    "os"
    "path/filepath"
    "strconv"
    "strings"
    "time"

    "database/sql"
    _ "modernc.org/sqlite"
)

//go:embed ../../web/*
var webFS embed.FS

//go:embed ../../internal/db/schema.sql
var schemaSQL string

type App struct {
    db     *sql.DB
    secret []byte // for cookie signing
}

func main() {
    dsn := env("DB_PATH", "data/app.db")
    secret := []byte(env("APP_SECRET", "change-me"))

    if err := os.MkdirAll(filepath.Dir(dsn), 0o755); err != nil {
        log.Fatal(err)
    }

    db, err := sql.Open("sqlite", dsn+"?_busy_timeout=5000&_fk=1")
    if err != nil { log.Fatal(err) }
    if err := migrate(db, schemaSQL); err != nil { log.Fatal(err) }

    app := &App{db: db, secret: secret}

    mux := http.NewServeMux()

    // static files
    fs := http.FS(webFS)
    mux.Handle("/", withSecurityHeaders(http.FileServer(fs)))

    // api routes
    mux.HandleFunc("/api/ping", func(w http.ResponseWriter, r *http.Request){
        writeJSON(w, map[string]string{"pong":"ok", "time": time.Now().UTC().Format(time.RFC3339)})
    })

    mux.HandleFunc("/api/items", app.itemsHandler)
    mux.HandleFunc("/export", app.exportCSV)

    srv := &http.Server{
        Addr:         ":8080",
        Handler:      logRequests(mux),
        ReadTimeout:  5 * time.Second,
        WriteTimeout: 10 * time.Second,
        IdleTimeout:  60 * time.Second,
    }

    log.Println("listening on :8080")
    if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
        log.Fatal(err)
    }
}

func migrate(db *sql.DB, sqlText string) error {
    ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
    defer cancel()
    _, err := db.ExecContext(ctx, sqlText)
    return err
}

// minimal example entity
type Item struct {
    ID    int64  `json:"id"`
    Title string `json:"title"`
    Note  string `json:"note"`
}

func (a *App) itemsHandler(w http.ResponseWriter, r *http.Request) {
    switch r.Method {
    case http.MethodGet:
        rows, err := a.db.Query("SELECT id, title, note FROM items ORDER BY id")
        if err != nil { http.Error(w, err.Error(), 500); return }
        defer rows.Close()
        var out []Item
        for rows.Next(){ var it Item; if err:=rows.Scan(&it.ID,&it.Title,&it.Note); err!=nil { http.Error(w, err.Error(), 500); return }; out=append(out,it) }
        writeJSON(w, out)
    case http.MethodPost:
        var in Item
        if err := json.NewDecoder(r.Body).Decode(&in); err != nil { http.Error(w, "bad json", 400); return }
        if strings.TrimSpace(in.Title) == "" { http.Error(w, "title required", 400); return }
        res, err := a.db.Exec("INSERT INTO items(title,note) VALUES(?,?)", in.Title, in.Note)
        if err != nil { http.Error(w, err.Error(), 500); return }
        id, _ := res.LastInsertId(); in.ID = id
        writeJSON(w, in)
    default:
        w.WriteHeader(http.StatusMethodNotAllowed)
    }
}

func (a *App) exportCSV(w http.ResponseWriter, r *http.Request) {
    w.Header().Set("Content-Type", "text/csv")
    w.Header().Set("Content-Disposition", "attachment; filename=items.csv")
    cw := csv.NewWriter(w)
    defer cw.Flush()
    cw.Write([]string{"id","title","note"})
    rows, err := a.db.Query("SELECT id, title, note FROM items ORDER BY id")
    if err != nil { http.Error(w, err.Error(), 500); return }
    defer rows.Close()
    for rows.Next(){ var id int64; var title, note string; rows.Scan(&id,&title,&note); cw.Write([]string{strconv.FormatInt(id,10), title, note}) }
}

func writeJSON(w http.ResponseWriter, v any) {
    w.Header().Set("Content-Type", "application/json; charset=utf-8")
    json.NewEncoder(w).Encode(v)
}

func withSecurityHeaders(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request){
        w.Header().Set("X-Content-Type-Options", "nosniff")
        w.Header().Set("X-Frame-Options", "DENY")
        w.Header().Set("Referrer-Policy", "no-referrer")
        w.Header().Set("Content-Security-Policy", "default-src 'self'")
        next.ServeHTTP(w, r)
    })
}

func logRequests(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request){
        start := time.Now()
        next.ServeHTTP(w, r)
        log.Printf("%s %s %s", r.Method, r.URL.Path, time.Since(start))
    })
}

func env(k, def string) string {
    if v := os.Getenv(k); v != "" { return v }
    return def
}