server.js

const express = require('express');
const session = require('express-session');
const FileStore = require('session-file-store')(session);
const { Issuer, Strategy } = require('openid-client');
const path = require('path');
const https = require('https');
const http = require('http');
const fs = require('fs');
const yaml = require('js-yaml');

const dataFolder = path.resolve(process.env.DATA_FOLDER || 'data');
const configuration = yaml.load(fs.readFileSync(path.join(dataFolder, 'configuration.yaml'), 'utf8'));

const app = express();

let openIDClient;

// Initialize OpenID Connect client
async function initializeOIDC() {
  try {
    const issuer = await Issuer.discover(configuration.oidc.issuer);
    openIDClient = new issuer.Client({
      client_id: configuration.oidc.clientId,
      client_secret: configuration.oidc.clientSecret,
      redirect_uris: [`${configuration.server.baseUrl}/callback`],
      response_types: ['code'],
    });
    console.log('OIDC client initialized successfully');
  } catch (error) {
    console.error('Failed to initialize OIDC client:', error.message);
    process.exit(1);
  }
}

// Set EJS as template engine
app.set('view engine', 'ejs');
app.set('views', path.join(dataFolder, 'public'));

// Session configuration
app.use(session({
  store: new FileStore({
    path: path.join(dataFolder, 'sessions'),
    retries: 0,
    ttl: 86400 // 24 hours
  }),
  secret: configuration.server.sessionSecret,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: configuration.server.secureCookies ?? !!configuration.server.ssl,
    maxAge: 24 * 60 * 60 * 1000 // 24 hours
  }
}));

// Log all requests
app.use((req, res, next) => {
  console.log(`${new Date().toISOString()} - ${req.method} ${req.url}`);
  next();
});

// Block direct access to EJS files
app.use('*.ejs', (req, res) => {
  res.status(403).send('Access denied');
});

// Serve static files
app.use(express.static(path.join(dataFolder, 'public')));

// Routes
app.get('/', (req, res) => {
  res.redirect(req.session.user ? '/projects' : '/login');
});

app.get('/login', (req, res) => {
  if (!openIDClient)
    return res.status(500).send('OIDC client not initialized');
  const state = require('crypto').randomBytes(16).toString('base64url');
  req.session.state = state;
  res.redirect(openIDClient.authorizationUrl({
    scope: 'openid profile email',
    state: state,
  }));
});

app.get('/callback', async (req, res) => {
  try {
    const parameters = openIDClient.callbackParams(req);

    // Check if we have a stored state in session
    if (!req.session.state) {
      console.error('Authentication error: No state found in session');
      return res.redirect('/login');
    }

    const tokenSet = await openIDClient.callback(`${configuration.server.baseUrl}/callback`, parameters, {
      state: req.session.state
    });

    req.session.user = await openIDClient.userinfo(tokenSet.access_token);
    req.session.tokenSet = tokenSet;

    // Clear the state after successful authentication
    delete req.session.state;

    res.redirect('/projects');
  } catch (error) {
    console.error('Authentication error:', error);
    res.status(500).send('Authentication failed');
  }
});


// Helper function to shuffle array
function shuffleArray(array) {
  const shuffled = [...array];
  for (let i = shuffled.length - 1; i > 0; i--) {
    const j = Math.floor(Math.random() * (i + 1));
    [shuffled[i], shuffled[j]] = [shuffled[j], shuffled[i]];
  }
  return shuffled;
}

app.get('/projects', async (req, res) => {
  if (!req.session.user)
    return res.redirect('/');

  try {
    // Get user info
    const user = req.session.user;
    const displayName = user.preferred_username || user.name || user.email || 'User';

    // Get projects data
    const projectsData = yaml.load(fs.readFileSync(path.join(dataFolder, 'projects.yaml'), 'utf8'));
    const accessToken = req.session.tokenSet.access_token;
    let userGroups = [];

    try {
      const payload = JSON.parse(Buffer.from(accessToken.split('.')[1], 'base64').toString());
      userGroups = payload.groups || payload.realm_access?.roles || [];
    } catch (error) {
      console.error('Error parsing token for groups:', error);
    }

    console.log(`User ${user.email || user.name || user.preferred_username || 'User'} is in groups: ${userGroups.join(', ')}`);
    // Filter projects based on user permissions
    const allProjects = [], privateProjects = [], publicProjects = [];
    (projectsData.projects || []).forEach(project => {
      const privateAccess =
        project.private_groups && project.private_groups.length > 0 &&
        (project.private_groups.some(requiredGroup => userGroups.includes(requiredGroup)) || project.private_groups.includes('*'));
      const publicAccess = privateAccess ||
        project.public_groups && project.public_groups.length > 0 &&
        (project.public_groups.some(requiredGroup => userGroups.includes(requiredGroup)) || project.public_groups.includes('*'));

      if (!publicAccess)
        return null;
      project = {
        private: privateAccess,
        ...(project.public),
        ...(privateAccess && project.private)
      };
      allProjects.push(project);
      (privateAccess ? privateProjects : publicProjects).push(project);
    });

    // Apply shuffle based on configuration
    const shuffleMode = configuration.server.shuffleMode || 'private_first';
    const finalProjects = shuffleMode === 'none' ? allProjects
      : shuffleMode === 'private_first' ? [...shuffleArray(privateProjects), ...shuffleArray(publicProjects)]
        : /* 'all' */ shuffleArray(allProjects);

    // Render the template
    res.render('projects', {
      displayName,
      projects: finalProjects
    });
  } catch (error) {
    console.error('Error loading projects page:', error);
    res.status(500).send('Failed to load projects page');
  }
});

app.get('/logout', (req, res) => {
  const idToken = req.session?.tokenSet?.id_token;
  let url = configuration.oidc.logoutRedirectUri.replace('{REDIRECT_URI}', encodeURIComponent(`${configuration.server.baseUrl}/logged-out`));
  if (idToken)
    url += `&id_token_hint=${encodeURIComponent(idToken)}`;
  req.session.destroy((error) => {
    if (error)
      console.error('Session destruction error:', error);
    res.redirect(url);
  });
});

app.get('/logged-out', (req, res) => {
  res.render('logged-out');
});

// Start server after OIDC initialization
initializeOIDC().then(() => {
  if (configuration.server.ssl) {
    const httpsOptions = {
      key: fs.readFileSync(path.join(dataFolder, configuration.server.ssl.keyFile.replace('data/', ''))),
      cert: fs.readFileSync(path.join(dataFolder, configuration.server.ssl.certFile.replace('data/', '')))
    };
    https.createServer(httpsOptions, app).listen(configuration.server.port, '0.0.0.0', () => {
      console.log(`HTTPS Server running on https://0.0.0.0:${configuration.server.port}`);
    });
  } else {
    http.createServer(app).listen(configuration.server.port, '0.0.0.0', () => {
      console.log(`HTTP Server running on http://0.0.0.0:${configuration.server.port}`);
    });
  }
});