server.js

require('dotenv').config();

const path = require('path');
const http = require('http');
const express = require('express');
const cors = require('cors');
const helmet = require('helmet');
const rateLimit = require('express-rate-limit');
const { WebSocketServer } = require('ws');
const { initializeDatabase } = require('./config/database');
const createAuthRouter = require('./routes/auth');
const createDashboardRouter = require('./routes/dashboard');
const createScansRouter = require('./routes/scans');
const createTeamsRouter = require('./routes/teams');
const JobQueue = require('./lib/job-queue');
const logger = require('./lib/logger');
const { verifyToken } = require('./middleware/auth');

const app = express();
const server = http.createServer(app);
const db = initializeDatabase();

class Broadcaster {
  constructor() {
    this.clients = new Set();
  }

  add(client) {
    this.clients.add(client);
  }

  remove(client) {
    this.clients.delete(client);
  }

  broadcastCompany(companyId, payload) {
    const message = JSON.stringify(payload);
    for (const client of this.clients) {
      if (client.companyId === companyId && client.ws.readyState === client.ws.OPEN) {
        client.ws.send(message);
      }
    }
  }
}

const broadcaster = new Broadcaster();
const queue = new JobQueue({ db, broadcaster });

app.disable('x-powered-by');
app.use(helmet({
  contentSecurityPolicy: false,
  crossOriginEmbedderPolicy: false
}));
app.use(cors({ origin: true, credentials: true }));
app.use(express.json({ limit: '1mb' }));
app.use(express.urlencoded({ extended: false }));
app.use(rateLimit({
  windowMs: 15 * 60 * 1000,
  limit: 400,
  standardHeaders: true,
  legacyHeaders: false
}));

app.use('/api/auth', createAuthRouter({ db }));
app.use('/api/scans', createScansRouter({ db, queue }));
app.use('/api/dashboard', createDashboardRouter({ db }));
app.use('/api/teams', createTeamsRouter({ db }));

app.get('/api/health', (_req, res) => {
  res.json({ ok: true, name: 'AG GitHub Security Scanner', time: new Date().toISOString() });
});

app.use(express.static(path.join(__dirname, 'public')));
app.get('*', (_req, res) => {
  res.sendFile(path.join(__dirname, 'public', 'index.html'));
});

const wss = new WebSocketServer({ server, path: '/ws' });
wss.on('connection', (ws, req) => {
  try {
    const url = new URL(req.url, `http://${req.headers.host}`);
    const token = url.searchParams.get('token');
    if (!token) {
      ws.close(1008, 'Authentication token required');
      return;
    }
    const payload = verifyToken(token);
    const user = db.prepare('SELECT id, company_id, role FROM users WHERE id = ?').get(payload.sub);
    if (!user) {
      ws.close(1008, 'Invalid user');
      return;
    }
    const client = { ws, userId: user.id, companyId: user.company_id };
    broadcaster.add(client);
    ws.send(JSON.stringify({ type: 'socket.ready', userId: user.id }));
    ws.on('close', () => broadcaster.remove(client));
  } catch (error) {
    ws.close(1008, 'Invalid token');
  }
});

app.use((err, req, res, _next) => {
  logger.error('Request failed', {
    path: req.path,
    method: req.method,
    error: err.stack || err.message
  });
  res.status(err.status || 400).json({ error: err.message || 'Request failed.' });
});

const port = Number(process.env.PORT || 3000);
server.listen(port, () => {
  logger.info(`AG GitHub Security Scanner listening on http://localhost:${port}`);
});

function shutdown() {
  logger.info('Shutting down AG GitHub Security Scanner');
  wss.close();
  server.close(() => {
    db.close();
    process.exit(0);
  });
}

process.on('SIGINT', shutdown);
process.on('SIGTERM', shutdown);

module.exports = { app, db, server };