const express = require("express");
const cors = require("cors");
const helmet = require("helmet");
const app = express();
const dotenv = require("dotenv");
const { authenticateToken } = require("./middleware/authenticate_token");
const { authLimiter, globalLimiter } = require("./middleware/rate_limit");
require("dotenv").config();

const allowedOrigins = (process.env.CORS_ALLOWED_ORIGINS || "")
  .split(",")
  .map((origin) => origin.trim())
  .filter(Boolean);

// Security headers and CORS apply to every endpoint, including preflight requests.
app.use(helmet());
app.use(cors({ origin: allowedOrigins, credentials: true }));
app.use(express.json());
// Brute-force protection: a strict limit on credential endpoints, a general
// limit on everything else.
app.use(globalLimiter);
app.use("/auth/login", authLimiter);
app.use("/auth/register", authLimiter);

// People routes
const CreatePersonRoute = require("./features/people/REGISTER_people");
const LoginPersonRoute = require("./features/people/LOGIN_people");
const VerifyAuthRoute = require("./features/people/VERIFY_auth");

app.use("/auth/register", CreatePersonRoute);
app.use("/auth/login", LoginPersonRoute);
app.use("/auth/me", VerifyAuthRoute);
app.use("/auth/verify", VerifyAuthRoute);

// Every route below this point requires a valid JWT or session cookie. Registration and login stay public.
app.use(authenticateToken);

// Post routes
const CreatePostRoute = require("./features/posts/CREATE_post");
const DeletePostRoute = require("./features/posts/DELETE_post");
const GetPostsRoute = require("./features/posts/GET_posts");
const EditPostRoute = require("./features/posts/EDIT_post");
const GetProfileRoute = require("./features/people/GET_profile");
const ManageSessionsRoute = require("./features/people/MANAGE_sessions");
const GetPostDetailRoute = require("./features/posts/GET_post_detail");
const FriendsRoute = require("./features/relations/FRIENDS_people");
const LogoutAuthRoute = require("./features/people/LOGOUT_auth");
const LikePostRoute = require("./features/posts/LIKE_post");

app.use("/posts", GetPostsRoute);
app.use("/posts/like", LikePostRoute);
app.use("/posts/create", CreatePostRoute);
app.use("/posts/delete", DeletePostRoute);
app.use("/posts/edit", EditPostRoute);
app.use("/profiles", GetProfileRoute);
app.use("/auth/sessions", ManageSessionsRoute);
app.use("/posts", GetPostDetailRoute);
app.use("/friends", FriendsRoute);
app.use("/auth/logout", LogoutAuthRoute);

app.listen(process.env.PORT, () => {
  console.log(`Server draait op port ${process.env.PORT}`);
});