import express, { type Express } from 'express';
import cors from 'cors';
import pinoHttp from 'pino-http';
import session from 'express-session';
import connectPgSimple from 'connect-pg-simple';
import router from './routes';
import testUtilsRouter from './routes/test-utils';
import { logger } from './lib/logger';
import { pool } from './data/db';

// Extend session type
declare module 'express-session' {
  interface SessionData {
    userId?: number;
  }
}

const app: Express = express();
app.set('trust proxy', 1); // Replit proxy terminates HTTPS; trust forwarded headers

app.use(
  pinoHttp({
    logger,
    serializers: {
      req(req) { return { id: req.id, method: req.method, url: req.url?.split('?')[0] }; },
      res(res) { return { statusCode: res.statusCode }; },
    },
  }),
);

app.use(cors({ credentials: true, origin: true }));

const PgSession = connectPgSimple(session);

app.use(
  session({
    store: new PgSession({
      pool,
      tableName: 'sc_sessions',
    }),
    secret: process.env.SESSION_SECRET ?? 'shelter-cluster-dev-secret',
    resave: false,
    saveUninitialized: false,
    cookie: {
      httpOnly: true,
      // Production (deploy): app is served behind Replit's HTTPS proxy — cookie must be
      // Secure + SameSite=None so it survives cross-context iframe delivery.
      // Development: cookie runs over plain HTTP (Playwright baseURL, curl) — Lax/non-Secure
      // is correct; same-site API calls still work because the request origin is replit.dev.
      sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax',
      secure: process.env.NODE_ENV === 'production',
      maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
    },
  }),
);

app.use(express.json());
app.use(express.urlencoded({ extended: true }));

app.use('/api', router);

// Dev-only test utilities — never available in production
if (process.env.NODE_ENV !== 'production') {
  app.use('/api', testUtilsRouter);
}

export default app;