require('dotenv').config()

module.exports = {
    PORT: process.env.PORT || 3000,
    MONGODB_URL: process.env.MONGODB_URL,
    SESSION_SECRET: process.env.SESSION_SECRET || 'fallback_secret'
}

const { createLogger, format, transports } = require('winston')
const { combine, timestamp, printf, colorize } = format

const logFormat = printf(({ level, message, timestamp }) => {
    return `[${timestamp}] ${level.toUpperCase()}: ${message}`
})

const logger = createLogger({
    level: 'info',
    format: combine(
        timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
        logFormat
    ),
    transports: [
        new transports.Console({
            format: combine(
                colorize(),
                timestamp({ format: 'YYYY-MM-DD HH:mm:ss' }),
                logFormat
            )
        }),
        new transports.File({ filename: 'logs/error.log', level: 'error' }),
        new transports.File({ filename: 'logs/combined.log' })
    ]
})

module.exports = logger

const logger = require('../utils/logger')

logger.info('User logged in successfully')      // normal info
logger.warn('Failed login attempt')             // warning
logger.error('Database connection failed')      // error (also goes to error.log)

const { Schema, model } = require('mongoose')

const UserSchema = new Schema({
    name: { type: String, required: true },
    email: { type: String, required: true, unique: true, lowercase: true },
    password: { type: String, required: true },
    isVerified: { type: Boolean, default: false }
}, { timestamps: true })

module.exports = model('User', UserSchema)

const { Schema, model } = require('mongoose')

const OtpSchema = new Schema({
    email: { type: String, required: true },
    otp: { type: String, required: true },
    expiresAt: { type: Date, required: true }
})

// This line tells MongoDB to automatically delete the document when expiresAt passes
OtpSchema.index({ expiresAt: 1 }, { expireAfterSeconds: 0 })

module.exports = model('Otp', OtpSchema)

const { Schema, model } = require('mongoose')

const NoteSchema = new Schema({
    userId: { type: Schema.Types.ObjectId, ref: 'User', required: true },
    noteId: { type: String, required: true },
    noteName: { type: String, required: true },
    description: { type: String, required: true },
    status: { type: String, required: true, enum: ['active', 'inactive'] }
}, { timestamps: true })

module.exports = model('Note', NoteSchema)

const logger = require('../utils/logger')

const authMiddleware = (req, res, next) => {
    if (!req.session || !req.session.userId) {
        logger.warn(`Unauthorized access attempt → ${req.originalUrl}`)
        return res.redirect('/auth/login?msg=login_required')
    }
    next()
}

module.exports = authMiddleware

const bcrypt = require('bcryptjs')
const User = require('../model/userSchema')
const Otp = require('../model/otpSchema')
const logger = require('../utils/logger')

// Helper: generates a random 6-digit number as a string
const generateOtp = () => Math.floor(100000 + Math.random() * 900000).toString()

// ─── REGISTER PAGE (GET) ─────────────────────────────────
// Just renders the register HTML page
exports.registerPage = (req, res) => {
    res.render('auth/register', { title: 'Register' })
}

// ─── REGISTER (POST) ─────────────────────────────────────
exports.register = async (req, res) => {
    try {
        const { name, email, password } = req.body
        // req.body holds what the user typed in the form

        // Check if this email already exists in DB
        const existing = await User.findOne({ email })
        if (existing) {
            logger.warn(`Register failed - email already exists: ${email}`)
            return res.render('auth/register', {
                title: 'Register',
                error: 'Email already registered. Please login.'
            })
        }

        // Hash the password — NEVER store plain text passwords
        // bcrypt.hash(password, saltRounds) — 10 is the industry standard
        const hashed = await bcrypt.hash(password, 10)

        // Save new user to MongoDB — isVerified defaults to false
        await User.create({ name, email, password: hashed })

        // Generate OTP and save to DB
        const otp = generateOtp()
        const expiresAt = new Date(Date.now() + 10 * 60 * 1000) // expires in 10 minutes
        await Otp.deleteMany({ email }) // delete any old OTPs for this email first
        await Otp.create({ email, otp, expiresAt })

        // Log the OTP via Winston (in production this would be emailed)
        logger.info(`OTP generated for ${email} → ${otp}`)

        // Redirect to verify page, passing the OTP in devOtp for dev/testing
        res.render('auth/verifyOtp', {
            title: 'Verify OTP',
            email,
            devOtp: otp
        })
    } catch (err) {
        logger.error(`Register error: ${err.message}`)
        res.render('auth/register', { title: 'Register', error: 'Something went wrong.' })
    }
}

// ─── VERIFY OTP PAGE (GET) ───────────────────────────────
exports.verifyOtpPage = (req, res) => {
    res.render('auth/verifyOtp', { title: 'Verify OTP', email: req.query.email })
}

// ─── VERIFY OTP (POST) ───────────────────────────────────
exports.verifyOtp = async (req, res) => {
    try {
        const { email, otp } = req.body

        // Look for an OTP record matching this email
        const record = await Otp.findOne({ email })

        if (!record) {
            logger.warn(`OTP verify failed - no OTP found for: ${email}`)
            return res.render('auth/verifyOtp', {
                title: 'Verify OTP',
                email,
                error: 'OTP expired or not found. Register again.'
            })
        }

        // Check if the code the user entered matches what we saved
        if (record.otp !== otp.trim()) {
            logger.warn(`OTP verify failed - wrong OTP for: ${email}`)
            return res.render('auth/verifyOtp', {
                title: 'Verify OTP',
                email,
                error: 'Invalid OTP. Try again.'
            })
        }

        // Check if OTP has expired (extra safety check alongside MongoDB TTL)
        if (new Date() > record.expiresAt) {
            await Otp.deleteMany({ email })
            logger.warn(`OTP expired for: ${email}`)
            return res.render('auth/verifyOtp', {
                title: 'Verify OTP',
                email,
                error: 'OTP has expired. Register again.'
            })
        }

        // OTP is valid — mark user as verified in DB
        await User.findOneAndUpdate({ email }, { isVerified: true })

        // Delete the OTP record — it's been used, we don't need it anymore
        await Otp.deleteMany({ email })

        logger.info(`Email verified successfully: ${email}`)

        // Send user to login page with a success message
        res.redirect('/auth/login?verified=true')
    } catch (err) {
        logger.error(`OTP verify error: ${err.message}`)
        res.render('auth/verifyOtp', {
            title: 'Verify OTP',
            email: req.body.email,
            error: 'Something went wrong.'
        })
    }
}

// ─── LOGIN PAGE (GET) ────────────────────────────────────
exports.loginPage = (req, res) => {
    const verified = req.query.verified === 'true'
    const loginRequired = req.query.msg === 'login_required'
    res.render('auth/login', { title: 'Login', verified, loginRequired })
}

// ─── LOGIN (POST) ────────────────────────────────────────
exports.login = async (req, res) => {
    try {
        const { email, password } = req.body

        // Find user by email
        const user = await User.findOne({ email })
        if (!user) {
            logger.warn(`Login failed - user not found: ${email}`)
            return res.render('auth/login', {
                title: 'Login',
                error: 'Invalid email or password.'
            })
        }

        // Block login if email is not verified yet
        if (!user.isVerified) {
            logger.warn(`Login blocked - email not verified: ${email}`)
            return res.render('auth/login', {
                title: 'Login',
                error: 'Please verify your email first.'
            })
        }

        // Compare typed password with the hashed one in DB
        // bcrypt.compare returns true if they match
        const match = await bcrypt.compare(password, user.password)
        if (!match) {
            logger.warn(`Login failed - wrong password for: ${email}`)
            return res.render('auth/login', {
                title: 'Login',
                error: 'Invalid email or password.'
            })
        }

        // Save user info in the session — this is how the server "remembers" them
        req.session.userId = user._id
        req.session.userName = user.name

        logger.info(`User logged in: ${email}`)
        res.redirect('/')   // send to home page
    } catch (err) {
        logger.error(`Login error: ${err.message}`)
        res.render('auth/login', { title: 'Login', error: 'Something went wrong.' })
    }
}

// ─── LOGOUT (GET) ────────────────────────────────────────
exports.logout = (req, res) => {
    const name = req.session.userName
    req.session.destroy()   // destroys the session on the server
    logger.info(`User logged out: ${name}`)
    res.redirect('/auth/login')
}

const { Router } = require('express')
const router = Router()
const auth = require('../controllers/authController')

router.get('/register', auth.registerPage)   // shows the register form
router.post('/register', auth.register)      // handles form submission

router.get('/verify-otp', auth.verifyOtpPage)  // shows the OTP form
router.post('/verify-otp', auth.verifyOtp)     // handles OTP check

router.get('/login', auth.loginPage)   // shows the login form
router.post('/login', auth.login)      // handles login form

router.get('/logout', auth.logout)     // logs the user out

module.exports = router

const mongoose = require('mongoose')
const Note = require('../model/noteSchema')
const logger = require('../utils/logger')

// Helper: checks if a MongoDB ID is valid format
const isValidId = (id) => mongoose.Types.ObjectId.isValid(id)

// Home page — only reached after login because of authMiddleware
exports.home = (req, res) => {
    res.render('home', {
        title: 'Home',
        userName: req.session.userName  // pass name to show "Welcome back, John!"
    })
}

// Show the Add Note form page
exports.addNotePage = (req, res) => {
    res.render('noteApp/addNote', { title: 'Add Note' })
}

// Handle the Add Note form submission
exports.createNote = async (req, res) => {
    try {
        // req.body has the form data. We add userId from session so the note is linked to this user
        await Note.create({ ...req.body, userId: req.session.userId })
        logger.info(`Note created by user: ${req.session.userId}`)
        res.redirect('/api/allNotes')
    } catch (err) {
        logger.error(`Create note error: ${err.message}`)
        res.render('noteApp/addNote', { title: 'Add Note', error: 'Failed to create note.' })
    }
}

// Show all notes belonging to the logged-in user only
exports.allNotes = async (req, res) => {
    // IMPORTANT: filter by userId so users never see each other's notes
    const payload = await Note.find({ userId: req.session.userId }).lean()
    // .lean() converts Mongoose documents to plain JS objects — needed for Handlebars
    res.render('noteApp/allNotes', { title: 'All Notes', payload })
}

// Show one specific note
exports.singleNote = async (req, res) => {
    if (!isValidId(req.params.id)) return res.redirect('/api/allNotes')
    // Also filter by userId — prevents User A from viewing User B's note by guessing the ID
    const payload = await Note.findOne({
        _id: req.params.id,
        userId: req.session.userId
    }).lean()
    if (!payload) return res.redirect('/api/allNotes')
    res.render('noteApp/singleNote', { title: payload.noteName, payload })
}

// Show the Edit form pre-filled with existing note data
exports.editPage = async (req, res) => {
    if (!isValidId(req.params.id)) return res.redirect('/api/allNotes')
    const payload = await Note.findOne({
        _id: req.params.id,
        userId: req.session.userId
    }).lean()
    if (!payload) return res.redirect('/api/allNotes')
    res.render('noteApp/editNote', { title: 'Edit Note', payload })
}

// Handle the Edit form submission — update the note in DB
exports.updateNote = async (req, res) => {
    if (!isValidId(req.params.id)) return res.redirect('/api/allNotes')
    await Note.findOneAndUpdate(
        { _id: req.params.id, userId: req.session.userId },
        req.body
    )
    logger.info(`Note updated: ${req.params.id}`)
    res.redirect('/api/allNotes')
}

// Delete a note
exports.deleteNote = async (req, res) => {
    await Note.findOneAndDelete({
        _id: req.params.id,
        userId: req.session.userId
    })
    logger.info(`Note deleted: ${req.params.id}`)
    res.redirect('/api/allNotes')
}

const { Router } = require('express')
const router = Router()
const controller = require('../controllers/noteController')
const authMiddleware = require('../middleware/authMiddleware')

// Apply authMiddleware to EVERY route in this file
// If you're not logged in, ALL of these will redirect you to login
router.use(authMiddleware)

router.get('/addNote', controller.addNotePage)      // show add form
router.get('/allNotes', controller.allNotes)         // show all notes
router.get('/edit/:id', controller.editPage)         // show edit form

router.post('/addNote', controller.createNote)       // submit add form
router.post('/edit/:id', controller.updateNote)      // submit edit form
router.get('/delete/:id', controller.deleteNote)     // delete a note

// ⚠️ IMPORTANT: this route MUST be last
// Because /:id would match /addNote and /allNotes too if placed first
router.get('/:id', controller.singleNote)

module.exports = router

const express = require('express')
const mongoose = require('mongoose')
const session = require('express-session')
const { engine } = require('express-handlebars')
const { PORT, MONGODB_URL, SESSION_SECRET } = require('./config/config')
const logger = require('./utils/logger')
const authMiddleware = require('./middleware/authMiddleware')
const noteRoutes = require('./router/noteRoutes')
const authRoutes = require('./router/authRoutes')
const noteController = require('./controllers/noteController')

const app = express()

// ─── BODY PARSERS ─────────────────────────────────────────
// These two lines allow Express to read form data (req.body)
app.use(express.urlencoded({ extended: true }))  // for HTML forms
app.use(express.json())                           // for JSON body (API calls)

// ─── STATIC FILES ─────────────────────────────────────────
// Tells Express: "serve files from the public/ folder directly"
// So /style.css in the browser actually serves public/style.css
app.use(express.static('public'))

// ─── SESSION SETUP ────────────────────────────────────────
app.use(session({
    secret: SESSION_SECRET,       // used to sign/encrypt the session cookie
    resave: false,                // don't save session if nothing changed
    saveUninitialized: false,     // don't create a session until something is stored
    cookie: { maxAge: 1000 * 60 * 60 * 24 }  // session lasts 1 day (in milliseconds)
}))

// ─── INJECT SESSION INTO ALL VIEWS ───────────────────────
// This middleware runs on EVERY request.
// It puts isLoggedIn and userName into res.locals so EVERY Handlebars
// template can use {{isLoggedIn}} and {{userName}} without us passing
// them manually in every controller.
app.use((req, res, next) => {
    res.locals.isLoggedIn = !!req.session.userId   // !! converts to true/false
    res.locals.userName = req.session.userName || null
    next()
})

// ─── HANDLEBARS ENGINE SETUP ──────────────────────────────
app.engine('handlebars', engine({
    helpers: {
        // Custom helper: allows {{#if (eq a b)}} comparisons in templates
        eq: (a, b) => a === b
    }
}))
app.set('view engine', 'handlebars')  // tells Express to use handlebars by default

// ─── ROUTES ───────────────────────────────────────────────
// Home route — protected by authMiddleware (must be logged in)
app.get('/', authMiddleware, noteController.home)

// Auth routes — /auth/register, /auth/login, etc.
app.use('/auth', authRoutes)

// Note routes — /api/allNotes, /api/addNote, etc. (all protected inside)
app.use('/api', noteRoutes)

// ─── CONNECT DB AND START SERVER ──────────────────────────
const connectDb = async () => {
    await mongoose.connect(MONGODB_URL)
    logger.info('MongoDB connected successfully')
    app.listen(PORT, () => {
        logger.info(`Server running at http://localhost:${PORT}`)
    })
}

connectDb().catch(err => logger.error(`DB connection failed: ${err.message}`))