import express, { Request, Response } from 'express'
import { Pool } from 'pg'
import crypto from 'crypto'

const app = express()
const db = new Pool({ connectionString: process.env.DATABASE_URL })
const WEBHOOK_SECRET = process.env.TRUEDY_WEBHOOK_SECRET!

// Use raw body middleware to preserve bytes for HMAC verification
app.post('/webhooks/truedy', express.raw({ type: 'application/json' }), async (req: Request, res: Response) => {
  const rawBody = req.body as Buffer
  const timestamp = req.headers['x-truedy-timestamp'] as string ?? ''
  const signature = req.headers['x-truedy-signature'] as string ?? ''

  // Step 1: Verify signature
  if (!verifySignature(rawBody, timestamp, signature)) {
    return res.status(401).json({ error: 'Invalid signature' })
  }

  let envelope: Record<string, unknown>
  try {
    envelope = JSON.parse(rawBody.toString('utf8'))
  } catch {
    return res.status(400).json({ error: 'Invalid JSON' })
  }

  const eventType = envelope.event as string
  const dedupeKey = extractDedupeKey(envelope)

  if (!dedupeKey) {
    console.error('Missing dedupe key for event:', eventType, JSON.stringify(envelope).slice(0, 200))
    return res.status(400).json({ error: 'Missing dedupe key' })
  }

  const recordKey = `${eventType}:${dedupeKey}`

  // Step 2: Idempotency check + side effects in a single transaction
  const client = await db.connect()
  try {
    await client.query('BEGIN')

    const existing = await client.query(
      'SELECT 1 FROM webhook_events WHERE dedupe_key = $1',
      [recordKey]
    )
    if (existing.rowCount && existing.rowCount > 0) {
      await client.query('ROLLBACK')
      return res.status(204).send() // Already processed — safe to ignore
    }

    // Apply your business side effects here
    await handleEvent(client, eventType, envelope)

    // Record dedupe key atomically with side effects
    await client.query(
      'INSERT INTO webhook_events (dedupe_key, event_type, processed_at) VALUES ($1, $2, NOW())',
      [recordKey, eventType]
    )

    await client.query('COMMIT')
  } catch (err) {
    await client.query('ROLLBACK')
    console.error('Webhook processing failed:', err)
    return res.status(500).json({ error: 'Processing failed' }) // Truedy will retry
  } finally {
    client.release()
  }

  res.status(204).send()
})

function verifySignature(rawBody: Buffer, timestamp: string, signature: string): boolean {
  const now = Math.floor(Date.now() / 1000)
  const ts = parseInt(timestamp, 10)
  if (isNaN(ts) || now - ts > 300 || ts > now + 60) return false

  const message = `${timestamp}.${rawBody.toString('utf8')}`
  const expected = crypto.createHmac('sha256', WEBHOOK_SECRET).update(message).digest('hex')

  if (expected.length !== signature.length) return false
  return crypto.timingSafeEqual(Buffer.from(expected, 'hex'), Buffer.from(signature, 'hex'))
}

function extractDedupeKey(envelope: Record<string, unknown>): string | null {
  const data = envelope.data as Record<string, unknown> | undefined
  if (!data) return null

  // Check data.id / data.eventId first
  if (typeof data.id === 'string') return data.id
  if (typeof data.eventId === 'string') return data.eventId

  // Call events
  const call = data.call as Record<string, unknown> | undefined
  const callId = call?.callId ?? call?.call_id ?? data.call_id ?? data.callId
  if (typeof callId === 'string') return callId

  // Batch events
  const batchId = data.batch_id ?? data.batchId
  if (typeof batchId === 'string') return batchId as string

  // Voice events
  const voiceId = data.voice_id ?? data.voiceId
  if (typeof voiceId === 'string') return voiceId as string

  return null
}

async function handleEvent(client: unknown, eventType: string, envelope: Record<string, unknown>) {
  const data = envelope.data as Record<string, unknown>
  switch (eventType) {
    case 'call.ended': {
      const call = data.call as Record<string, unknown> | undefined
      console.log('Call ended:', call?.callId, '— duration:', call?.duration, 's')
      // e.g. update your CRM, store transcript
      break
    }
    case 'batch.completed': {
      console.log('Batch completed:', data.batch_id ?? data.batchId)
      // e.g. send summary email to campaign owner
      break
    }
    default:
      console.log('Unhandled event type:', eventType)
  }
}