server.js

require('dotenv').config();
const express = require('express');
const WebSocket = require('ws');
const http = require('http');
const path = require('path');
const fs = require('fs');
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');
const NodeCache = require('node-cache');
const { validateEvent, verifySignature, generatePrivateKey, getPublicKey, finishEvent, nip19 } = require('nostr-tools');
const ngeohash = require('ngeohash');

const app = express();
const server = http.createServer(app);
const wss = new WebSocket.Server({ server });

// Cache for storing geohash data
const cache = new NodeCache({ stdTTL: process.env.CACHE_TTL || 300 });

// Security middleware
app.use(helmet());
app.use(cors());

// Rate limiting
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // limit each IP to 100 requests per windowMs
  message: { error: 'Too many requests from this IP' }
});

app.use('/api/', apiLimiter);
app.use(express.json());

// Serve React build files (when built)
app.use(express.static(path.join(__dirname, 'dist')));

// Fallback to public folder for legacy support
app.use('/legacy', express.static(path.join(__dirname, 'public')));

// Serve the React app for all non-API routes
app.get('*', (req, res, next) => {
  if (req.path.startsWith('/api/')) {
    return next();
  }
  
  // Try to serve from React build first
  const reactIndexPath = path.join(__dirname, 'dist', 'index.html');
  if (fs.existsSync(reactIndexPath)) {
    res.sendFile(reactIndexPath);
  } else {
    // Fallback to legacy public folder during development
    res.sendFile(path.join(__dirname, 'public', 'index.html'));
  }
});

// Nostr relay connections
const RELAYS = process.env.NOSTR_RELAYS ? 
  process.env.NOSTR_RELAYS.split(',') : [
    'wss://relay.damus.io',
    'wss://nos.lol', 
    'wss://relay.primal.net',
    'wss://offchain.pub',
    'wss://nostr21.com',
    'wss://nostr-pub.wellorder.net',
    'wss://nostr.wine'
  ];

let relayConnections = new Map();

// Connect to Nostr relays
function connectToRelays() {
  RELAYS.forEach(relayUrl => {
    try {
      const ws = new WebSocket(relayUrl);
      
      ws.on('open', () => {
        console.log(`Connected to ${relayUrl}`);
        relayConnections.set(relayUrl, ws);
        
        // Subscribe to kind 20000 events (geohash events)
        const subscriptionId = `heatmap-${Math.random().toString(36).substring(2, 15)}`;
        const subscription = JSON.stringify([
          'REQ',
          subscriptionId,
          {
            kinds: [20000],
            limit: 100
          }
        ]);
        
        ws.send(subscription);
      });
      
      ws.on('message', (data) => {
        try {
          const message = JSON.parse(data.toString());
          handleNostrMessage(message);
        } catch (error) {
          console.error('Error parsing message:', error);
        }
      });
      
      ws.on('close', () => {
        console.log(`Disconnected from ${relayUrl}`);
        relayConnections.delete(relayUrl);
        // Reconnect after 5 seconds
        setTimeout(() => connectToRelays(), 5000);
      });
      
      ws.on('error', (error) => {
        console.error(`Error with ${relayUrl}:`, error);
      });
      
    } catch (error) {
      console.error(`Failed to connect to ${relayUrl}:`, error);
    }
  });
}

// Proper Nostr event verification function
function verifyEvent(event) {
  // First validate the event structure
  if (!validateEvent(event)) {
    return false;
  }
  
  // Then verify the cryptographic signature
  try {
    return verifySignature(event);
  } catch (error) {
    console.warn('Signature verification failed:', error.message);
    return false;
  }
}

// Handle incoming Nostr messages
function handleNostrMessage(message) {
  const [type, subscriptionId, event] = message;
  
  if (type === 'EVENT' && event) {
    // Validate event before processing
    if (!verifyEvent(event)) {
      console.warn('Invalid event, discarding:', event.id || 'unknown');
      return;
    }
    
    const { kind, tags, content, created_at } = event;
    
    if (kind === 20000) {
      // Extract geohash and nickname from tags
      const geohashTag = tags.find(tag => tag[0] === 'g');
      const nicknameTag = tags.find(tag => tag[0] === 'n');
      
      if (geohashTag && geohashTag[1]) {
        const geohashData = {
          geohash: geohashTag[1],
          nickname: nicknameTag ? nicknameTag[1] : 'Anonymous',
          message: content,
          timestamp: created_at,
          relay: 'unknown',
          npub: (() => { try { return nip19.npubEncode(event.pubkey); } catch (_) { return undefined; } })()
        };
        
        // Store in cache
        const cacheKey = `geohash_${geohashData.geohash}`;
        const existingData = cache.get(cacheKey) || [];
        existingData.push(geohashData);
        
        // Keep only last 10 messages per geohash
        if (existingData.length > 10) {
          existingData.splice(0, existingData.length - 10);
        }
        
        cache.set(cacheKey, existingData);
        
        // Broadcast to connected websocket clients
        wss.clients.forEach(client => {
          if (client.readyState === WebSocket.OPEN) {
            client.send(JSON.stringify({
              type: 'new_activity',
              data: geohashData
            }));
          }
        });
      }
    }
  }
}

// API endpoints
app.get('/api/activity', (req, res) => {
  const allData = cache.keys()
    .filter(key => key.startsWith('geohash_'))
    .map(key => {
      const data = cache.get(key);
      return data.map(item => ({
        ...item,
        channel: `bc_${item.geohash}`,
        coolrLinks: RELAYS.map(relay => ({
          relay,
          url: `https://www.coolr.chat/?relay=${encodeURIComponent(relay)}&channel=bc_${item.geohash}`
        }))
      }));
    })
    .flat();
  
  res.json(allData);
});

app.get('/api/heatmap-data', (req, res) => {
  const heatmapData = [];
  const keys = cache.keys().filter(key => key.startsWith('geohash_'));
  
  keys.forEach(key => {
    const data = cache.get(key);
    if (data && data.length > 0) {
      const latest = data[data.length - 1];
      const intensity = Math.min(data.length * 10, 100); // Scale intensity
      
      // Generate coolr.chat URLs for each relay
      const coolrLinks = RELAYS.map(relay => ({
        relay,
        url: `https://www.coolr.chat/?relay=${encodeURIComponent(relay)}&channel=bc_${latest.geohash}`
      }));
      
      heatmapData.push({
        geohash: latest.geohash,
        intensity: intensity,
        count: data.length,
        lastActivity: latest.timestamp,
        coolrLinks,
        channel: `bc_${latest.geohash}`
      });
    }
  });
  
  res.json(heatmapData);
});

// Get relay configuration
app.get('/api/relays', (req, res) => {
  const relayData = RELAYS.map(relay => {
    const relayName = relay.replace('wss://', '').replace('ws://', '');
    const connection = relayConnections.get(relay);
    
    return {
      url: relay,
      name: relayName,
      coolrUrl: `https://www.coolr.chat/?relay=${encodeURIComponent(relay)}`,
      status: connection && connection.readyState === 1 ? 'connected' : 'disconnected',
      readyState: connection ? connection.readyState : null
    };
  });
  
  res.json(relayData);
});

// Test coolr.chat URL format for a specific relay and channel
app.get('/api/coolr-test/:relay/:channel', (req, res) => {
  try {
    const { relay, channel } = req.params;
    const relayUrl = decodeURIComponent(relay);
    
    // Validate relay URL format
    if (!relayUrl.startsWith('wss://') && !relayUrl.startsWith('ws://')) {
      return res.status(400).json({ error: 'Invalid relay URL format' });
    }
    
    const coolrUrl = `https://www.coolr.chat/?relay=${encodeURIComponent(relayUrl)}&channel=${channel}`;
    
    res.json({
      relay: relayUrl,
      channel,
      coolrUrl,
      encodedRelay: encodeURIComponent(relayUrl),
      isConnected: relayConnections.has(relayUrl)
    });
  } catch (error) {
    res.status(500).json({ error: 'Failed to generate coolr.chat URL' });
  }
});

// Key management endpoints
app.post('/api/keys/generate', (req, res) => {
  try {
    const privateKey = generatePrivateKey();
    const publicKey = getPublicKey(privateKey);
    const nsec = nip19.nsecEncode(privateKey);
    const npub = nip19.npubEncode(publicKey);
    
    res.json({
      privateKey: Buffer.from(privateKey).toString('hex'),
      publicKey,
      nsec,
      npub
    });
  } catch (error) {
    console.error('Error generating keys:', error);
    res.status(500).json({ error: 'Failed to generate keys', details: error.message });
  }
});

app.post('/api/keys/decode', (req, res) => {
  try {
    const { key } = req.body;
    
    if (!key) {
      return res.status(400).json({ error: 'Key is required' });
    }
    
    const decoded = nip19.decode(key);
    
    if (decoded.type === 'npub') {
      res.json({
        type: 'npub',
        publicKey: decoded.data,
        npub: key
      });
    } else if (decoded.type === 'nsec') {
      const publicKey = getPublicKey(decoded.data);
      res.json({
        type: 'nsec',
        privateKey: Buffer.from(decoded.data).toString('hex'),
        publicKey,
        nsec: key,
        npub: nip19.npubEncode(publicKey)
      });
    } else if (decoded.type === 'nprofile') {
      res.json({
        type: 'nprofile',
        publicKey: decoded.data.pubkey,
        relays: decoded.data.relays,
        npub: nip19.npubEncode(decoded.data.pubkey)
      });
    } else {
      res.json({
        type: decoded.type,
        data: decoded.data
      });
    }
  } catch (error) {
    res.status(400).json({ error: 'Invalid key format' });
  }
});

// Lightning address validation endpoint
app.post('/api/lightning/validate', async (req, res) => {
  try {
    const { address } = req.body;
    
    if (!address) {
      return res.status(400).json({ error: 'Lightning address is required' });
    }
    
    // Validate lightning address format (user@domain.com)
    const emailRegex = /^[a-z0-9\-_.+]+@[a-z0-9\-_.]+\.[a-z]{2,}$/i;
    if (!emailRegex.test(address)) {
      return res.status(400).json({ error: 'Invalid lightning address format' });
    }
    
    const [username, domain] = address.split('@');
    const lnurlEndpoint = `https://${domain}/.well-known/lnurlp/${username}`;
    
    try {
      const response = await fetch(lnurlEndpoint);
      const lnurlData = await response.json();
      
      if (response.ok && lnurlData.callback) {
        res.json({
          valid: true,
          address,
          lnurlEndpoint,
          callback: lnurlData.callback,
          minSendable: lnurlData.minSendable,
          maxSendable: lnurlData.maxSendable,
          allowsNostr: lnurlData.allowsNostr || false,
          nostrPubkey: lnurlData.nostrPubkey,
          metadata: lnurlData.metadata
        });
      } else {
        res.status(400).json({ 
          valid: false, 
          error: 'Lightning address not found or invalid' 
        });
      }
    } catch (fetchError) {
      res.status(400).json({ 
        valid: false, 
        error: 'Failed to validate lightning address' 
      });
    }
  } catch (error) {
    res.status(500).json({ error: 'Server error validating lightning address' });
  }
});

// Create and publish geohash event endpoint
app.post('/api/events/publish', (req, res) => {
  try {
    const { privateKey, latitude, longitude, nickname, message, lightningAddress } = req.body;
    
    if (!privateKey || !latitude || !longitude) {
      return res.status(400).json({ 
        error: 'privateKey, latitude, and longitude are required' 
      });
    }
    
    // Decode private key if it's in nsec format
    let sk;
    if (privateKey.startsWith('nsec')) {
      const decoded = nip19.decode(privateKey);
      if (decoded.type !== 'nsec') {
        return res.status(400).json({ error: 'Invalid nsec format' });
      }
      sk = decoded.data;
    } else {
      // Assume hex format
      sk = new Uint8Array(Buffer.from(privateKey, 'hex'));
    }
    
    const publicKey = getPublicKey(sk);
    const geohash = ngeohash.encode(latitude, longitude, 8);
    
    const tags = [
      ['g', geohash],
      ['n', nickname || 'Anonymous']
    ];
    
    // Add lightning address tag if provided
    if (lightningAddress) {
      tags.push(['lud16', lightningAddress]);
    }
    
    const event = finishEvent({
      kind: 20000,
      created_at: Math.floor(Date.now() / 1000),
      tags,
      content: message || ''
    }, sk);
    
    // Store locally
    const geohashData = {
      geohash,
      nickname: nickname || 'Anonymous',
      message: message || '',
      timestamp: event.created_at,
      relay: 'local',
      lightningAddress,
      npub: nip19.npubEncode(publicKey)
    };
    
    const key = `geohash_${geohash}`;
    let existing = cache.get(key) || [];
    existing.push(geohashData);
    cache.set(key, existing);
    
    // Broadcast to connected WebSocket clients
    wss.clients.forEach(client => {
      if (client.readyState === client.OPEN) {
        client.send(JSON.stringify({
          type: 'new_activity',
          data: geohashData
        }));
      }
    });
    
    res.json({
      success: true,
      event,
      npub: nip19.npubEncode(publicKey),
      geohash,
      eventId: event.id
    });
  } catch (error) {
    console.error('Error publishing event:', error);
    res.status(500).json({ error: 'Failed to publish event' });
  }
});

// Lightning Zap functionality
app.post('/api/zaps/create-request', (req, res) => {
  try {
    const { 
      senderPrivateKey, 
      recipientPubkey, 
      amount, 
      message, 
      eventId,
      relays 
    } = req.body;
    
    if (!senderPrivateKey || !recipientPubkey || !amount) {
      return res.status(400).json({ 
        error: 'senderPrivateKey, recipientPubkey, and amount are required' 
      });
    }
    
    // Decode sender private key if needed
    let sk;
    if (senderPrivateKey.startsWith('nsec')) {
      const decoded = nip19.decode(senderPrivateKey);
      if (decoded.type !== 'nsec') {
        return res.status(400).json({ error: 'Invalid nsec format' });
      }
      sk = decoded.data;
    } else {
      sk = new Uint8Array(Buffer.from(senderPrivateKey, 'hex'));
    }
    
    const senderPubkey = getPublicKey(sk);
    const zapRelays = relays || ['wss://relay.damus.io', 'wss://nos.lol'];
    
    const tags = [
      ['relays', ...zapRelays],
      ['amount', amount.toString()],
      ['p', recipientPubkey]
    ];
    
    // Add event tag if zapping a specific event
    if (eventId) {
      tags.push(['e', eventId]);
    }
    
    const zapRequest = finishEvent({
      kind: 9734,
      created_at: Math.floor(Date.now() / 1000),
      tags,
      content: message || ''
    }, sk);
    
    res.json({
      success: true,
      zapRequest,
      senderNpub: nip19.npubEncode(senderPubkey),
      recipientNpub: nip19.npubEncode(recipientPubkey)
    });
  } catch (error) {
    console.error('Error creating zap request:', error);
    res.status(500).json({ error: 'Failed to create zap request' });
  }
});

// Get user profile with Lightning info
app.get('/api/users/:npub', async (req, res) => {
  try {
    const { npub } = req.params;
    
    if (!npub.startsWith('npub')) {
      return res.status(400).json({ error: 'Invalid npub format' });
    }
    
    const decoded = nip19.decode(npub);
    if (decoded.type !== 'npub') {
      return res.status(400).json({ error: 'Invalid npub' });
    }
    
    const publicKey = decoded.data;
    
    // Get user's geohash activities
    const userActivities = [];
    const keys = cache.keys().filter(key => key.startsWith('geohash_'));
    
    keys.forEach(key => {
      const data = cache.get(key);
      if (data && Array.isArray(data)) {
        const userEvents = data.filter(event => {
          return event.npub === npub || 
                 (event.publicKey && event.publicKey === publicKey);
        });
        userActivities.push(...userEvents);
      }
    });
    
    res.json({
      npub,
      publicKey,
      activities: userActivities.slice(0, 50), // Limit to recent 50
      totalActivities: userActivities.length,
      lastActivity: userActivities.length > 0 ? 
        Math.max(...userActivities.map(a => a.timestamp)) : null
    });
  } catch (error) {
    console.error('Error fetching user profile:', error);
    res.status(500).json({ error: 'Failed to fetch user profile' });
  }
});

// WebSocket connection handling
wss.on('connection', (ws) => {
  console.log('Client connected to heatmap');
  
  ws.on('message', (message) => {
    try {
      const data = JSON.parse(message.toString());
      // Handle client messages if needed
    } catch (error) {
      console.error('Error parsing WebSocket message:', error);
    }
  });
  
  ws.on('close', () => {
    console.log('Client disconnected from heatmap');
  });
});

// Start server
const PORT = process.env.PORT || 3001;
server.listen(PORT, () => {
  console.log(`Heatmap server running on port ${PORT}`);
  connectToRelays();
});

// Graceful shutdown
process.on('SIGINT', () => {
  console.log('Shutting down gracefully...');
  relayConnections.forEach((ws, url) => {
    ws.close();
  });
  server.close();
  process.exit(0);
});