const express = require('express');

const Database = require('better-sqlite3');

const Joi = require('joi');

const cors = require('cors');

const helmet = require('helmet');

const morgan = require('morgan');

const swaggerUi = require('swagger-ui-express');

const jwt = require('jsonwebtoken');

const bcrypt = require('bcryptjs');

const rateLimit = require('express-rate-limit');

const app = express();

const PORT = process.env.PORT || 3000;

const JWT_SECRET = process.env.JWT_SECRET || 'your-super-secret-jwt-key-change-this';

app.use(helmet());

app.use(cors());

app.use(express.json());

app.use(morgan('combined'));

const limiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100 });

app.use('/api/', limiter);

const db = new Database(':memory:');

db.exec(`CREATE TABLE users (id INTEGER PRIMARY KEY, username TEXT UNIQUE, password TEXT)`);

db.exec(`CREATE TABLE videos (id INTEGER PRIMARY KEY AUTOINCREMENT, title TEXT, description TEXT, url TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP)`);

const hashed = bcrypt.hashSync('admin', 10);

db.prepare(`INSERT INTO users (username, password) VALUES ('admin', ?)`).run(hashed);

const authenticateToken = (req, res, next) => {

  const token = req.header('Authorization')?.replace('Bearer ', '');

  if (!token) return res.status(401).json({ message: 'Access token required' });

  jwt.verify(token, JWT_SECRET, (err, user) => {

    if (err) return res.status(403).json({ message: 'Invalid token' });

    req.user = user;

    next();

  });

};

const videoSchema = Joi.object({

  title: Joi.string().min(1).max(255).required(),

  description: Joi.string().min(1).max(1000).required(),

  url: Joi.string().uri().required()

});

app.post('/api/login', (req, res) => {

  const { username, password } = req.body;

  const user = db.prepare('SELECT * FROM users WHERE username = ?').get(username);

  if (!user || !bcrypt.compareSync(password, user.password)) {

    return res.status(401).json({ message: 'Invalid credentials' });

  }

  const token = jwt.sign({ id: user.id }, JWT_SECRET, { expiresIn: '24h' });

  res.json({ token });

});

app.get('/api/videos', authenticateToken, (req, res) => {

  const page = parseInt(req.query.page) || 1;

  const limit = parseInt(req.query.limit) || 10;

  const offset = (page - 1) * limit;

  const rows = db.prepare('SELECT * FROM videos ORDER BY created_at DESC LIMIT ? OFFSET ?').all(limit, offset);

  const count = db.prepare('SELECT COUNT(*) as count FROM videos').get();

  res.json({ data: rows, pagination: { page, limit, total: count.count, pages: Math.ceil(count.count / limit) } });

});

app.get('/api/videos/:id', authenticateToken, (req, res) => {

  const row = db.prepare('SELECT * FROM videos WHERE id = ?').get(req.params.id);

  if (!row) return res.status(404).json({ message: 'Video not found' });

  res.json(row);

});

app.post('/api/videos', authenticateToken, (req, res) => {

  const { error } = videoSchema.validate(req.body);

  if (error) return res.status(400).json({ message: error.details[0].message });

  const result = db.prepare('INSERT INTO videos (title, description, url) VALUES (?, ?, ?)').run(req.body.title, req.body.description, req.body.url);

  res.status(201).json({ id: result.lastInsertRowid });

});

app.put('/api/videos/:id', authenticateToken, (req, res) => {

  const { error } = videoSchema.validate(req.body);

  if (error) return res.status(400).json({ message: error.details[0].message });

  const result = db.prepare('UPDATE videos SET title = ?, description = ?, url = ? WHERE id = ?').run(req.body.title, req.body.description, req.body.url, req.params.id);

  if (result.changes === 0) return res.status(404).json({ message: 'Video not found' });

  res.json({ updated: true });

});

app.delete('/api/videos/:id', authenticateToken, (req, res) => {

  const result = db.prepare('DELETE FROM videos WHERE id = ?').run(req.params.id);

  if (result.changes === 0) return res.status(404).json({ message: 'Video not found' });

  res.status(204).send();

});

app.get('/api/search', authenticateToken, (req, res) => {

  const q = req.query.q;

  if (!q) return res.status(400).json({ message: 'Query required' });

  const rows = db.prepare('SELECT * FROM videos WHERE title LIKE ? OR description LIKE ?').all(`%${q}%`, `%${q}%`);

  res.json(rows);

});

app.use('/docs', swaggerUi.serve, swaggerUi.setup({

  openapi: '3.0.0',

  info: { title: 'Video Library API', version: '1.0.0' },

  paths: {

    '/api/login': {

      post: {

        summary: 'Login',

        requestBody: { content: { 'application/json': { schema: { type: 'object', properties: { username: { type: 'string' }, password: { type: 'string' } } } } } },

        responses: { '200': { description: 'Token' } }

      }

    },

    '/api/videos': {

      get: { summary: 'List videos', responses: { '200': { description: 'Videos' } } },

      post: { summary: 'Create video', responses: { '201': { description: 'Created' } } }

    }

  }

}));

app.use((err, req, res, next) => res.status(500).json({ message: err.message }));

app.listen(PORT, () => console.log(`Video API running on http://localhost:${PORT}`));