server.js

// server.js
const express = require("express");
const path = require("path");
const bcrypt = require("bcrypt");
const jwt = require("jsonwebtoken");
const cookieParser = require("cookie-parser");

const app = express();
const PORT = process.env.PORT || 3000;
const JWT_SECRET = process.env.JWT_SECRET || "super-secret-change-this";

// --- Middleware ---
app.use(express.json());
app.use(cookieParser());

// Serve static assets (CSS, images, etc.)
app.use(express.static(path.join(__dirname, "public")));

// ===== Simple in-memory user database =====
// You will fill this with your actual accounts.
const DEFAULT_PASSWORD = "cryptohawks";

// Example users – add ALL your premade accounts here:
const users = [
  // role can be "Mechanical", "Control", "PR", "Driver", "Scouter"
  {
    username: "RonithG",
    role: "Control",
    passwordHash: bcrypt.hashSync(DEFAULT_PASSWORD, 10),
  },
  {
    username: "JathonC",
    role: "Driver",
    passwordHash: bcrypt.hashSync(DEFAULT_PASSWORD, 10),
  },
  {
    username: "SomeScouter",
    role: "Scouter",
    passwordHash: bcrypt.hashSync(DEFAULT_PASSWORD, 10),
  },
  // Add the rest of your members here...
];

// Helper: find user by username
function findUser(username) {
  return users.find((u) => u.username.toLowerCase() === username.toLowerCase());
}

// Helper: auth middleware (requires any logged-in user)
function requireAuth(req, res, next) {
  const token = req.cookies.token;
  if (!token) return res.redirect("/");

  try {
    const payload = jwt.verify(token, JWT_SECRET);
    req.user = payload; // { username, role }
    next();
  } catch (err) {
    return res.redirect("/");
  }
}

// Helper: role-based middleware
function requireRole(allowedRoles) {
  return (req, res, next) => {
    const token = req.cookies.token;
    if (!token) return res.redirect("/");

    try {
      const payload = jwt.verify(token, JWT_SECRET);
      if (!allowedRoles.includes(payload.role)) {
        return res.status(403).send("Access denied. Insufficient role.");
      }
      req.user = payload;
      next();
    } catch (err) {
      return res.redirect("/");
    }
  };
}

// ===== API Routes =====

// POST /api/auth/login  -> log in and set cookie
app.post("/api/auth/login", async (req, res) => {
  const { username, password } = req.body;

  if (!username || !password) {
    return res
      .status(400)
      .json({ ok: false, message: "Username and password are required." });
  }

  const user = findUser(username);
  if (!user) {
    return res
      .status(401)
      .json({ ok: false, message: "Invalid username or password." });
  }

  const match = await bcrypt.compare(password, user.passwordHash);
  if (!match) {
    return res
      .status(401)
      .json({ ok: false, message: "Invalid username or password." });
  }

  const token = jwt.sign(
    {
      username: user.username,
      role: user.role,
    },
    JWT_SECRET,
    { expiresIn: "8h" }
  );

  res.cookie("token", token, {
    httpOnly: true,
    sameSite: "lax",
    secure: process.env.NODE_ENV === "production",
  });

  return res.json({
    ok: true,
    user: { username: user.username, role: user.role },
  });
});

// GET /api/auth/me  -> who is logged in?
app.get("/api/auth/me", (req, res) => {
  const token = req.cookies.token;
  if (!token) return res.json({ ok: false });

  try {
    const payload = jwt.verify(token, JWT_SECRET);
    return res.json({ ok: true, user: payload });
  } catch (err) {
    return res.json({ ok: false });
  }
});

// POST /api/auth/logout  -> clear cookie
app.post("/api/auth/logout", (req, res) => {
  res.clearCookie("token");
  res.json({ ok: true });
});

// POST /api/auth/request-account  -> collect requests
app.post("/api/auth/request-account", (req, res) => {
  const { name, email, desiredUsername, role, message } = req.body;

  if (!name || !email || !desiredUsername || !role) {
    return res.status(400).json({
      ok: false,
      message: "Name, email, username, and role are required.",
    });
  }

  // For now: just log it to the server (you can later email or save to DB)
  console.log("New account request:", {
    name,
    email,
    desiredUsername,
    role,
    message: message || "",
  });

  return res.json({
    ok: true,
    message:
      "Account request submitted. A lead/mentor will review and create your account.",
  });
});

// ===== Page Routes (protected) =====

// Main site (no auth required)
app.get("/", (req, res) => {
  res.sendFile(path.join(__dirname, "public", "index.html"));
});

// Portal – any logged-in user
app.get("/portal.html", requireAuth, (req, res) => {
  res.sendFile(path.join(__dirname, "public", "portal.html"));
});

// Scouting – only Driver/Scouter
app.get(
  "/scouting.html",
  requireRole(["Driver", "Scouter"]),
  (req, res) => {
    res.sendFile(path.join(__dirname, "public", "scouting.html"));
  }
);

// Only listen locally in dev. In Vercel, we just export the app.
if (process.env.NODE_ENV !== "production") {
    const PORT = process.env.PORT || 3000;
    app.listen(PORT, () => {
      console.log(`Server running on http://localhost:${PORT}`);
    });
  }
  
  // Export the Express app so Vercel can use it as a serverless function
  module.exports = app;