import "./config/env";
const express = require("express");
const app = express();
const bodyParser = require("body-parser");
const cors = require("cors");
const useragent = require("express-useragent");
const swaggerUi = require("swagger-ui-express");
import { openapiSpec } from "./openapiSpec";

// The production server sits behind a single reverse proxy (nginx), which
// sets X-Forwarded-For. Without this, Express's default trust-proxy=false
// makes express-rate-limit (login/signup/otp limiters) throw
// ERR_ERL_UNEXPECTED_X_FORWARDED_FOR on every request instead of rate
// limiting by real client IP — in practice this blocks those routes
// entirely. `1` = trust exactly one hop in front of this process.
app.set("trust proxy", 1);

app.use(useragent.express());
app.use(
  cors({
    // Allow requests from all origins (or specify allowed origins)
    origin: "*",
    methods: ["POST", "GET", "PUT", "PATCH", "DELETE", "OPTIONS"],
    // Allow the following headers to be sent in the request
    allowedHeaders: ["Content-Type", "Authorization", "x-auth-token"],
    // Allow the following headers to be exposed to the client
    exposedHeaders: ["x-auth-token"],
  })
);

app.use(bodyParser.urlencoded({ limit: "50mb", extended: true }));
app.use(express.json({ limit: "50mb" }));
app.use(bodyParser.json({ limit: "50mb" }));
app.use(express.urlencoded({ limit: "50mb", extended: true }));

app.use(require("./routes/login"));
app.use(require("./routes/signup"));
app.use(require("./routes/forgotPassword"));
app.use(require("./routes/socialLogin"));
app.use(require("./routes/products"));
app.use(require("./routes/events"));
app.use(require("./routes/paymentMethod"));
app.use(require("./routes/stripe"));
app.use(require("./routes/orders"));
app.use(require("./routes/reviews"));
app.use(require("./routes/user"));
app.use(require("./routes/notifications"));
app.use(require("./routes/notificationSettings"));
app.use(require("./routes/payments"));
app.use(require("./routes/vendor"));
app.use(require("./routes/store"));
app.use(require("./routes/subscriptions"));
app.use(require("./routes/admins"));
app.use(require("./routes/wish"));
app.use(require("./routes/occasions"));

// Mounted under /api (not /api-docs) so it rides the same Apache proxy
// rule that already forwards /api/* to this Node process — no separate
// Apache config change needed.
app.use(
  "/api/docs",
  swaggerUi.serve,
  swaggerUi.setup(openapiSpec, { customSiteTitle: "Before the Dates API Docs" })
);

// Create an event
export default app;