// ✅ CORRECT - Server-side only
import { createClient } from '@supabase/supabase-js';

const supabase = createClient(
  process.env.SUPABASE_URL!,
  process.env.SUPABASE_SERVICE_ROLE!, // Server-side only
  { auth: { persistSession: false } }
);

// ❌ WRONG - Never in frontend
const supabase = createClient(
  import.meta.env.VITE_SUPABASE_URL,
  import.meta.env.VITE_SUPABASE_SERVICE_ROLE // NEVER DO THIS
);

// Frontend checks before minting
const { available } = await fetch(
  `/api/certificates/availability?certId=${certId}`
).then(r => r.json());

if (!available) {
  throw new Error('Certificate ID already exists');
}

// Backend prevents duplicate indexing
const idempotencyKey = sha256(
  `${fileCid}-${ownerAddress}-${Date.now()}`
);

await fetch('/api/certificates/index', {
  method: 'POST',
  headers: {
    'x-idempotency-key': idempotencyKey
  },
  body: JSON.stringify(certificateData)
});

// Backend handles conflicts gracefully
try {
  await supabase.from('certificates').insert(data);
} catch (error) {
  if (error.code === '23505') { // Unique violation
    return res.status(409).json({ 
      error: 'Certificate already exists' 
    });
  }
  throw error;
}

// 1. File type validation
const ALLOWED_TYPES = new Set([
  'image/png',
  'image/jpeg',
  'application/pdf'
]);

if (!ALLOWED_TYPES.has(req.file.mimetype)) {
  return res.status(415).json({ 
    error: `Unsupported type: ${req.file.mimetype}` 
  });
}

// 2. File size validation
const MAX_SIZE = Number(process.env.MAX_UPLOAD_MB || 15) * 1024 * 1024;

if (req.file.size > MAX_SIZE) {
  return res.status(413).json({ 
    error: `File too large (max ${MAX_SIZE / 1024 / 1024}MB)` 
  });
}

// 3. Content validation (for images)
const buffer = req.file.buffer;
// Validate image headers, dimensions, etc.

// Pre-upload checks
const MAX_SIZE = 15 * 1024 * 1024; // 15MB

if (file.size > MAX_SIZE) {
  toast.error('File too large (max 15MB)');
  return;
}

const allowedTypes = ['image/png', 'image/jpeg', 'application/pdf'];
if (!allowedTypes.includes(file.type)) {
  toast.error('Unsupported file type');
  return;
}

import { isAddress } from 'viem';

if (!isAddress(ownerAddress)) {
  return res.status(400).json({ 
    error: 'Invalid Ethereum address' 
  });
}

// Normalize to checksum format
const normalizedAddress = ownerAddress.toLowerCase();

import { isAddress } from 'viem';

if (!isAddress(address)) {
  toast.error('Invalid wallet address');
  return;
}

// ✅ SAFE - Parameterized query
const { data } = await supabase
  .from('certificates')
  .select('*')
  .eq('cert_id', userInput);

// ❌ DANGEROUS - Never use raw SQL with user input
const { data } = await supabase.rpc('raw_query', {
  query: `SELECT * FROM certificates WHERE cert_id = '${userInput}'`
});

import cors from 'cors';

const allowedOrigins = [
  process.env.FRONTEND_URL,
  'http://localhost:5173', // Development
];

app.use(cors({
  origin: (origin, callback) => {
    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  },
  credentials: true,
  methods: ['GET', 'POST', 'PATCH', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'x-admin-key', 'x-idempotency-key']
}));

// Backend middleware
function requireAdmin(req, res, next) {
  const providedKey = req.headers['x-admin-key'];
  const validKey = process.env.ADMIN_API_KEY;
  
  if (!providedKey || providedKey !== validKey) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  
  next();
}

// Apply to admin routes
app.use('/api/admin/*', requireAdmin);

import rateLimit from 'express-rate-limit';

// OCR endpoint (expensive operation)
const ocrLimiter = rateLimit({
  windowMs: 60 * 1000, // 1 minute
  max: 10, // 10 requests per minute
  message: 'Too many OCR requests, please try again later'
});

app.post('/api/ocr', ocrLimiter, ocrHandler);

// Admin endpoints
const adminLimiter = rateLimit({
  windowMs: 60 * 1000,
  max: 100,
  message: 'Too many admin requests'
});

app.use('/api/admin/*', adminLimiter);

// Redirect HTTP to HTTPS
app.use((req, res, next) => {
  if (req.header('x-forwarded-proto') !== 'https') {
    res.redirect(`https://${req.header('host')}${req.url}`);
  } else {
    next();
  }
});

// HSTS header
app.use((req, res, next) => {
  res.setHeader(
    'Strict-Transport-Security',
    'max-age=31536000; includeSubDomains'
  );
  next();
});

// Log admin actions
function logAdminAction(action: string, details: any) {
  console.log({
    timestamp: new Date().toISOString(),
    action,
    details,
    ip: req.ip,
    userAgent: req.headers['user-agent']
  });
  
  // Also store in database for audit trail
  await supabase.from('admin_logs').insert({
    action,
    details,
    ip: req.ip,
    created_at: new Date()
  });
}

// Usage
app.post('/api/admin/institutions/:id/approve', async (req, res) => {
  // ... approve logic ...
  
  await logAdminAction('institution_approved', {
    institutionId: req.params.id,
    institutionName: institution.name
  });
});