server.js

/*
 ═══════════════════════════════════════════════════════════════════════════
   STREAMBOX — server.js v3
   DB persistante : utilise DB_PATH env var (Render persistent disk)
   ou chemin local par défaut.
   
   ⚠ PERSISTENCE SUR RENDER :
   1. Dans le dashboard Render : Add Disk → Mount Path: /data → 1 GB free
   2. Dans les env vars Render : DB_PATH=/data/db.json
   
   ⚠ PERSISTENCE SUR RAILWAY :
   1. Volumes → Mount: /data
   2. Env var : DB_PATH=/data/db.json
   
   ⚠ LOCAL : db.json reste à la racine du projet (ignoré par .gitignore)
 ═══════════════════════════════════════════════════════════════════════════
*/

const express = require("express");
const fs = require("fs");
const path = require("path");
const crypto = require("crypto");

const app = express();
const PORT = process.env.PORT || 3001;

/* ─── DB PATH — persistant si env var définie ────────────────────────────── */
const DB = process.env.DB_PATH || path.join(__dirname, "db.json");
console.log(`📁 Base de données → ${DB}`);

/* ─── MIDDLEWARE ─────────────────────────────────────────────────────────── */
app.use(express.json({ limit: "10mb" }));

app.use((req, res, next) => {
  const origin = req.headers.origin;
  const allowed = [
    "http://localhost:5173",
    "http://localhost:4173",
    "http://localhost:3001",
    "https://streambox-wfe3.onrender.com",
    "https://stream-box-fr.vercel.app",
  ];
  if (!origin || allowed.includes(origin)) {
    res.setHeader("Access-Control-Allow-Origin", origin || "*");
  }
  res.setHeader("Access-Control-Allow-Methods", "GET,POST,PUT,DELETE,OPTIONS");
  res.setHeader("Access-Control-Allow-Headers", "Content-Type,Authorization");
  if (req.method === "OPTIONS") return res.sendStatus(200);
  next();
});

/* ─── BASE DE DONNÉES JSON ───────────────────────────────────────────────── */
function loadDB() {
  try {
    if (!fs.existsSync(DB)) return initDB();
    return JSON.parse(fs.readFileSync(DB, "utf8"));
  } catch {
    return initDB();
  }
}

function initDB() {
  const data = { users: [], progress: {}, requests: [], catalog: [], sessions: {} };
  saveDB(data);
  return data;
}

function saveDB(data) {
  // Ensure directory exists (for mounted disks)
  const dir = path.dirname(DB);
  if (!fs.existsSync(dir)) {
    fs.mkdirSync(dir, { recursive: true });
  }
  fs.writeFileSync(DB, JSON.stringify(data, null, 2), "utf8");
}

/* ─── AUTH HELPERS ───────────────────────────────────────────────────────── */
function genToken() { return crypto.randomBytes(32).toString("hex"); }
function hash(pwd) { return crypto.createHash("sha256").update(pwd).digest("hex"); }

function authMiddleware(req, res, next) {
  const token = req.headers.authorization?.replace("Bearer ", "");
  if (!token) return res.status(401).json({ error: "Non authentifié" });
  const db = loadDB();
  const userId = db.sessions[token];
  if (!userId) return res.status(401).json({ error: "Session invalide" });
  req.userId = userId;
  req.db = db;
  next();
}

function safeUser(u) {
  const { pwd: _, ...rest } = u;
  return rest;
}

/* ═══════════════════════════════════════════════════════════════════════════
   AUTH
═══════════════════════════════════════════════════════════════════════════ */

app.post("/api/auth/register", (req, res) => {
  const { name, email, pwd } = req.body;
  if (!name || !email || !pwd) return res.status(400).json({ error: "Champs requis manquants" });
  if (pwd.length < 6) return res.status(400).json({ error: "Mot de passe trop court (6 min)" });

  const db = loadDB();
  if (db.users.find((u) => u.email === email)) return res.status(409).json({ error: "Email déjà utilisé" });

  const user = {
    id: Date.now(), name: name.trim(), email, pwd: hash(pwd),
    avatar: name.trim()[0].toUpperCase(), myList: [], liked: [],
    avatarEmoji: "", avatarUrl: "",
    createdAt: new Date().toISOString(),
  };
  db.users.push(user);
  const token = genToken();
  db.sessions[token] = user.id;
  saveDB(db);
  res.json({ user: safeUser(user), token });
});

app.post("/api/auth/login", (req, res) => {
  const { email, pwd } = req.body;
  const db = loadDB();
  const user = db.users.find((u) => u.email === email && u.pwd === hash(pwd || ""));
  if (!user) return res.status(401).json({ error: "Email ou mot de passe incorrect" });

  const token = genToken();
  db.sessions[token] = user.id;
  saveDB(db);
  res.json({ user: safeUser(user), token });
});

app.post("/api/auth/logout", authMiddleware, (req, res) => {
  const token = req.headers.authorization?.replace("Bearer ", "");
  const db = req.db;
  delete db.sessions[token];
  saveDB(db);
  res.json({ ok: true });
});

app.get("/api/auth/me", authMiddleware, (req, res) => {
  const user = req.db.users.find((u) => u.id === req.userId);
  if (!user) return res.status(404).json({ error: "Introuvable" });
  res.json(safeUser(user));
});

app.put("/api/auth/me", authMiddleware, (req, res) => {
  const db = req.db;
  const allowed = ["name", "avatar", "myList", "liked", "avatarEmoji", "avatarUrl"];
  const idx = db.users.findIndex((u) => u.id === req.userId);
  if (idx === -1) return res.status(404).json({ error: "Introuvable" });
  allowed.forEach((k) => { if (req.body[k] !== undefined) db.users[idx][k] = req.body[k]; });
  // Update avatar letter if name changed
  if (req.body.name) db.users[idx].avatar = req.body.name.trim()[0].toUpperCase();
  saveDB(db);
  res.json(safeUser(db.users[idx]));
});

/* ═══════════════════════════════════════════════════════════════════════════
   PROGRESS
═══════════════════════════════════════════════════════════════════════════ */

app.get("/api/progress", authMiddleware, (req, res) => {
  const uid = String(req.userId);
  res.json(req.db.progress[uid] || {});
});

app.put("/api/progress/:key", authMiddleware, (req, res) => {
  const db = req.db;
  const uid = String(req.userId);
  const key = req.params.key;
  if (!db.progress[uid]) db.progress[uid] = {};
  db.progress[uid][key] = { ...req.body, ts: Date.now() };
  saveDB(db);
  res.json({ ok: true });
});

app.delete("/api/progress/:key", authMiddleware, (req, res) => {
  const db = req.db;
  const uid = String(req.userId);
  if (db.progress[uid]) delete db.progress[uid][req.params.key];
  saveDB(db);
  res.json({ ok: true });
});

/* ═══════════════════════════════════════════════════════════════════════════
   DEMANDES
═══════════════════════════════════════════════════════════════════════════ */

app.get("/api/requests", (req, res) => { res.json(loadDB().requests); });

app.post("/api/requests", (req, res) => {
  const db = loadDB();
  const r = { id: Date.now(), title: req.body.title || "?", type: req.body.type || "movie", note: req.body.note || "", status: "pending", date: new Date().toLocaleDateString("fr-FR"), createdAt: new Date().toISOString() };
  db.requests.push(r);
  saveDB(db);
  res.json(r);
});

app.put("/api/requests/:id", (req, res) => {
  const db = loadDB();
  const idx = db.requests.findIndex((r) => r.id === Number(req.params.id));
  if (idx === -1) return res.status(404).json({ error: "Introuvable" });
  db.requests[idx] = { ...db.requests[idx], ...req.body };
  saveDB(db);
  res.json(db.requests[idx]);
});

app.delete("/api/requests/:id", (req, res) => {
  const db = loadDB();
  db.requests = db.requests.filter((r) => r.id !== Number(req.params.id));
  saveDB(db);
  res.json({ ok: true });
});

/* ═══════════════════════════════════════════════════════════════════════════
   CATALOGUE CUSTOM
═══════════════════════════════════════════════════════════════════════════ */

app.get("/api/catalog", (req, res) => { res.json(loadDB().catalog); });

app.post("/api/catalog", (req, res) => {
  const db = loadDB();
  const vid = { ...req.body, id: Date.now(), views: 0, addedAt: new Date().toISOString().split("T")[0] };
  db.catalog.push(vid);
  saveDB(db);
  res.json(vid);
});

app.put("/api/catalog/:id", (req, res) => {
  const db = loadDB();
  const idx = db.catalog.findIndex((v) => v.id === Number(req.params.id));
  if (idx === -1) return res.status(404).json({ error: "Introuvable" });
  db.catalog[idx] = { ...db.catalog[idx], ...req.body };
  saveDB(db);
  res.json(db.catalog[idx]);
});

app.delete("/api/catalog/:id", (req, res) => {
  const db = loadDB();
  db.catalog = db.catalog.filter((v) => v.id !== Number(req.params.id));
  saveDB(db);
  res.json({ ok: true });
});

/* ─── SANTÉ ──────────────────────────────────────────────────────────────── */
app.get("/api/health", (req, res) => res.json({ status: "ok", ts: new Date().toISOString(), db: DB }));

/* ─── BUILD VITE ─────────────────────────────────────────────────────────── */
const DIST = path.join(__dirname, "dist");
if (fs.existsSync(DIST)) {
  app.use(express.static(DIST));
  app.get(/.*/, (req, res) => { res.sendFile(path.join(DIST, "index.html")); });
  console.log("📦 Mode production — dist/ servi statiquement");
} else {
  console.log("⚡ Mode développement — lance aussi 'npm run dev' (Vite port 5173)");
}

app.listen(PORT, () => {
  console.log(`\n🎬 StreamBox Server → http://localhost:${PORT}`);
  console.log(`📁 Base de données  → ${DB}\n`);
});