// OpenTelemetry SDK — must be imported first to instrument http, express, pg, etc.
import './src/tracing.js';

import express from 'express';
import cors from 'cors';
import sqlite3 from 'sqlite3';
import { promisify } from 'util';
import path from 'path';
import { fileURLToPath } from 'url';
import session from 'express-session';
import connectSqlite3 from 'connect-sqlite3';
import connectPg from 'connect-pg-simple';
import pg from 'pg';
import bcrypt from 'bcrypt';
import rateLimit from 'express-rate-limit';
import webpush from 'web-push';
import pino from 'pino';
import pinoHttp from 'pino-http';
import multer from 'multer';
import { createWorker } from 'tesseract.js';
import { BarcodeDetector } from 'barcode-detector';
import { searchMedicines, getMedicineDetails } from './cima-service.js';
import { runFarmaciaWebhookImport, DEFAULT_FARMACIAS_WEBHOOK, importPharmaciesFromRows } from './farmacias-webhook-import.js';
import { fetchPharmaciesExternal } from '../API/index.js';

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);

const app = express();
const PORT = process.env.PORT || 3001;

// Structured JSON logger. The Pino OTel instrumentation attaches trace_id /
// span_id to every log line so they can be correlated in Grafana.
const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  base: { service: process.env.OTEL_SERVICE_NAME || 'farmaclic-backend' },
});

// Trust the reverse proxy in front of us (Docker/Traefik/nginx/Cloudflare) so
// req.ip and X-Forwarded-For are honored. Configurable via TRUST_PROXY:
//   - unset/"1" → trust exactly one hop (typical single reverse proxy)
//   - "loopback" → only trust 127.0.0.1
//   - "true"     → trust any proxy (only behind a trusted network)
//   - any other value is passed through verbatim (number of hops or IP list)
const trustProxyEnv = process.env.TRUST_PROXY ?? '1';
if (trustProxyEnv === 'true') app.set('trust proxy', true);
else if (trustProxyEnv === 'false') app.set('trust proxy', false);
else if (/^\d+$/.test(trustProxyEnv)) app.set('trust proxy', Number(trustProxyEnv));
else app.set('trust proxy', trustProxyEnv);

// Configure CORS with credentials
app.use(cors({
  origin: process.env.CORS_ORIGIN || 'http://localhost:3000',
  credentials: true
}));
app.use(express.json());
app.use(pinoHttp({ logger }));

const PG_URL = process.env.PG_URL;
let pgPool = null;
if (PG_URL) {
  const { Pool } = pg;
  pgPool = new Pool({ connectionString: PG_URL });
}

const sessionConfig = {
  secret: process.env.SESSION_SECRET || 'farma-clic-secret-key-change-in-production',
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: process.env.COOKIE_SECURE === 'true',
    sameSite: 'lax',
    httpOnly: true,
    maxAge: 24 * 60 * 60 * 1000 // 24 hours
  }
};

if (process.env.NODE_ENV !== 'test') {
  if (pgPool) {
    const PgStore = connectPg(session);
    sessionConfig.store = new PgStore({ pool: pgPool, createTableIfMissing: true });
  } else {
    const SQLiteStore = connectSqlite3(session);
    sessionConfig.store = new SQLiteStore({ db: 'sessions.sqlite', dir: __dirname });
  }
}

// Configure session
app.use(session(sessionConfig));

const searchLimiter = rateLimit({ windowMs: 60_000, max: 30, standardHeaders: true, legacyHeaders: false });
const loginLimiter = rateLimit({ windowMs: 60_000, max: 5, standardHeaders: true, legacyHeaders: false });
const registerLimiter = rateLimit({ windowMs: 60 * 60_000, max: 10, standardHeaders: true, legacyHeaders: false });
const geocodeLimiter = rateLimit({ windowMs: 60_000, max: 10, standardHeaders: true, legacyHeaders: false });

const VAPID_PUBLIC_KEY = process.env.VAPID_PUBLIC_KEY || '';
const VAPID_PRIVATE_KEY = process.env.VAPID_PRIVATE_KEY || '';
const VAPID_SUBJECT = process.env.VAPID_SUBJECT || 'mailto:admin@example.com';
const PUSH_ENABLED = Boolean(VAPID_PUBLIC_KEY && VAPID_PRIVATE_KEY);
if (PUSH_ENABLED) {
  webpush.setVapidDetails(VAPID_SUBJECT, VAPID_PUBLIC_KEY, VAPID_PRIVATE_KEY);
} else if (process.env.NODE_ENV !== 'test') {
  console.warn('[push] VAPID keys not configured — push notifications disabled');
}

// Database setup
const dbPath = process.env.DATABASE_PATH || path.join(__dirname, 'database.sqlite');
const db = new sqlite3.Database(dbPath);

// Custom wrapper to get lastID from db.run
function dbRun(sql, params = []) {
  return new Promise((resolve, reject) => {
    db.run(sql, params, function(err) {
      if (err) reject(err);
      else resolve({ lastID: this.lastID, changes: this.changes });
    });
  });
}

const dbAll = promisify(db.all.bind(db));
const dbGet = promisify(db.get.bind(db));

// User DB helpers — route to PG when available, fallback to SQLite for tests
function toPositional(sql) {
  let i = 0;
  return sql.replace(/\?/g, () => `$${++i}`);
}

async function userDbGet(sql, params = []) {
  if (pgPool) {
    const res = await pgPool.query(toPositional(sql), params);
    return res.rows[0] ?? null;
  }
  return dbGet(sql, params);
}

async function userDbRun(sql, params = []) {
  if (pgPool) {
    const res = await pgPool.query(toPositional(sql), params);
    return { lastID: res.rows[0]?.id, changes: res.rowCount };
  }
  return dbRun(sql.replace(/\s+RETURNING\s+\w+\s*$/i, ''), params);
}

async function userDbAll(sql, params = []) {
  if (pgPool) {
    const res = await pgPool.query(toPositional(sql), params);
    return res.rows;
  }
  return dbAll(sql, params);
}

// Accept opening_hours as either an object or a JSON string from the client
// and return a TEXT value (or null) safe to persist.
function serializeOpeningHours(value) {
  if (value == null || value === '') return null;
  if (typeof value === 'string') {
    try {
      JSON.parse(value);
      return value;
    } catch {
      return null;
    }
  }
  if (typeof value === 'object') {
    try {
      return JSON.stringify(value);
    } catch {
      return null;
    }
  }
  return null;
}

// Initialize database tables
async function initDatabase() {
  try {
    // Create pharmacies table
    await dbRun(`
      CREATE TABLE IF NOT EXISTS pharmacies (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        name TEXT NOT NULL,
        address TEXT NOT NULL,
        phone TEXT,
        latitude REAL,
        longitude REAL,
        opening_hours TEXT
      )
    `);

    // Add opening_hours to pre-existing pharmacies tables (no-op if already present)
    try {
      await dbRun(`ALTER TABLE pharmacies ADD COLUMN opening_hours TEXT`);
    } catch (e) {
      if (!/duplicate column/i.test(e.message)) throw e;
    }

    // Create junction table for pharmacy-medicine relationships
    // Ahora usa nregistro (número de registro de CIMA) en lugar de medicine_id local
    await dbRun(`
      CREATE TABLE IF NOT EXISTS pharmacy_medicines (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        pharmacy_id INTEGER NOT NULL,
        medicine_nregistro TEXT NOT NULL,
        medicine_name TEXT,
        price REAL,
        stock INTEGER DEFAULT 0,
        FOREIGN KEY (pharmacy_id) REFERENCES pharmacies(id),
        UNIQUE(pharmacy_id, medicine_nregistro)
      )
    `);

    await dbRun(`CREATE INDEX IF NOT EXISTS idx_pharmacy_medicine ON pharmacy_medicines(medicine_nregistro)`);

    // Create users table — PG when available, SQLite fallback
    if (pgPool) {
      await pgPool.query(`
        CREATE TABLE IF NOT EXISTS users (
          id SERIAL PRIMARY KEY,
          username TEXT UNIQUE NOT NULL,
          password_hash TEXT NOT NULL,
          is_admin INTEGER NOT NULL DEFAULT 0,
          address TEXT,
          latitude DOUBLE PRECISION,
          longitude DOUBLE PRECISION,
          created_at TIMESTAMPTZ DEFAULT NOW()
        )
      `);
    } else {
      await dbRun(`
        CREATE TABLE IF NOT EXISTS users (
          id INTEGER PRIMARY KEY AUTOINCREMENT,
          username TEXT UNIQUE NOT NULL,
          password_hash TEXT NOT NULL,
          created_at DATETIME DEFAULT CURRENT_TIMESTAMP
        )
      `);
    }

    if (pgPool) {
      await pgPool.query(`
        CREATE TABLE IF NOT EXISTS user_alerts (
          id SERIAL PRIMARY KEY,
          user_id INTEGER NOT NULL REFERENCES users(id),
          type TEXT NOT NULL CHECK (type IN ('reminder', 'availability', 'schedule')),
          medicine_nregistro TEXT,
          title TEXT,
          detail TEXT,
          schedule TEXT,
          created_at TIMESTAMPTZ DEFAULT NOW(),
          updated_at TIMESTAMPTZ DEFAULT NOW()
        )
      `);
    }

    await dbRun(`
      CREATE TABLE IF NOT EXISTS push_subscriptions (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        medicine_nregistro TEXT NOT NULL,
        medicine_name TEXT,
        endpoint TEXT NOT NULL,
        p256dh TEXT NOT NULL,
        auth TEXT NOT NULL,
        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
        UNIQUE(medicine_nregistro, endpoint)
      )
    `);
    await dbRun(`CREATE INDEX IF NOT EXISTS idx_push_subscriptions_med ON push_subscriptions(medicine_nregistro)`);

    await dbRun(`
      CREATE TABLE IF NOT EXISTS push_subscriptions_pharmacy (
        id INTEGER PRIMARY KEY AUTOINCREMENT,
        medicine_nregistro TEXT NOT NULL,
        medicine_name TEXT,
        pharmacy_id INTEGER NOT NULL,
        endpoint TEXT NOT NULL,
        p256dh TEXT NOT NULL,
        auth TEXT NOT NULL,
        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
        UNIQUE(medicine_nregistro, pharmacy_id, endpoint)
      )
    `);
    await dbRun(`CREATE INDEX IF NOT EXISTS idx_push_subs_pharm ON push_subscriptions_pharmacy(medicine_nregistro, pharmacy_id)`);

if (!pgPool) {
      // SQLite-only migrations for existing deployments
      try { await dbRun('ALTER TABLE users ADD COLUMN is_admin INTEGER NOT NULL DEFAULT 0'); } catch {}
      try { await dbRun('ALTER TABLE users ADD COLUMN address TEXT'); } catch {}
      try { await dbRun('ALTER TABLE users ADD COLUMN latitude REAL'); } catch {}
      try { await dbRun('ALTER TABLE users ADD COLUMN longitude REAL'); } catch {}
    }

// Add user_id to push tables (SQLite — no cross-DB FK)
    try { await dbRun('ALTER TABLE push_subscriptions ADD COLUMN user_id INTEGER'); } catch {}
    try { await dbRun('ALTER TABLE push_subscriptions_pharmacy ADD COLUMN user_id INTEGER'); } catch {}

    // Create alerts table for persistent Avisos data
    try {
      await dbRun(`
        CREATE TABLE IF NOT EXISTS user_alerts (
          id INTEGER PRIMARY KEY AUTOINCREMENT,
          user_id INTEGER NOT NULL,
          type TEXT NOT NULL CHECK (type IN ('reminder', 'availability', 'schedule')),
          medicine_nregistro TEXT,
          title TEXT,
          detail TEXT,
          schedule TEXT,
          created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
          updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
          FOREIGN KEY (user_id) REFERENCES users(id)
        )
      `);
    } catch (e) {
      if (!/table already exists/i.test(e.message)) throw e;
    }
  } catch (err) {
    console.error('initDatabase failed:', err);
    throw err;
  }
}

// API Routes

// Search medicines using CIMA API with Redis cache
app.get('/api/medicines/search', searchLimiter, async (req, res) => {
  try {
    const query = req.query.q || '';
    
    if (!query.trim()) {
      return res.json([]);
    }

    // Usar el servicio de CIMA con caché de Redis
    const medicines = await searchMedicines(query);

    res.json(medicines);
  } catch (error) {
    console.error('Error searching medicines:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Get pharmacies that sell a specific medicine (usando nregistro de CIMA)
app.get('/api/medicines/:medicineId/pharmacies', async (req, res) => {
  try {
    const nregistro = req.params.medicineId; // Ahora es el nregistro de CIMA

    const pharmacies = await dbAll(`
      SELECT
        p.id,
        p.name,
        p.address,
        p.phone,
        p.latitude,
        p.longitude,
        p.opening_hours,
        pm.price,
        pm.stock
      FROM pharmacies p
      INNER JOIN pharmacy_medicines pm ON p.id = pm.pharmacy_id
      WHERE pm.medicine_nregistro = ?
      ORDER BY p.name
    `, [nregistro]);

    res.json(pharmacies);
  } catch (error) {
    console.error('Error fetching pharmacies:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Get medicine details from CIMA API (usando nregistro)
app.get('/api/medicines/:medicineId', async (req, res) => {
  try {
    const nregistro = req.params.medicineId; // Ahora es el nregistro de CIMA

    const medicine = await getMedicineDetails(nregistro);

    if (!medicine) {
      return res.status(404).json({ error: 'Medicine not found' });
    }

    res.json(medicine);
  } catch (error) {
    console.error('Error fetching medicine:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// ========== AUTHENTICATION MIDDLEWARE ==========

// Middleware to check if user is authenticated
const requireAuth = (req, res, next) => {
  if (req.session && req.session.userId) {
    return next();
  }
  return res.status(401).json({ error: 'Authentication required' });
};

// Middleware to check if user is an admin
const requireAdmin = (req, res, next) => {
  if (req.session && req.session.userId && req.session.isAdmin) {
    return next();
  }
  if (req.session && req.session.userId) {
    return res.status(403).json({ error: 'Admin access required' });
  }
  return res.status(401).json({ error: 'Authentication required' });
};

// ========== RECENT SEARCHES (session-based) ==========

const MAX_RECENT = 10;

// Get recent searches for the logged-in user
app.get('/api/search/recent', requireAuth, (req, res) => {
  res.json(req.session.recentSearches || []);
});

// Save a medicine to recent searches
app.post('/api/search/recent', requireAuth, (req, res) => {
  try {
    const { medicine } = req.body;
    if (!medicine || !medicine.id) {
      return res.status(400).json({ error: 'Medicine data required' });
    }

    if (!req.session.recentSearches) {
      req.session.recentSearches = [];
    }

    // Remove duplicate if exists (by id)
    req.session.recentSearches = req.session.recentSearches.filter(
      (m) => m.id !== medicine.id
    );

    // Add to front with timestamp
    req.session.recentSearches.unshift({
      id: medicine.id,
      name: medicine.name,
      active_ingredient: medicine.active_ingredient,
      dosage: medicine.dosage,
      form: medicine.form,
      timestamp: Date.now(),
    });

    // Keep only last MAX_RECENT
    if (req.session.recentSearches.length > MAX_RECENT) {
      req.session.recentSearches = req.session.recentSearches.slice(0, MAX_RECENT);
    }

    res.json({ ok: true });
  } catch (error) {
    console.error('Error saving recent search:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Get all pharmacies (for admin/debugging)
app.get('/api/pharmacies', async (req, res) => {
  try {
    const pharmacies = await dbAll(`
      SELECT * FROM pharmacies ORDER BY name
    `);
    res.json(pharmacies);
  } catch (error) {
    console.error('Error fetching pharmacies:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// TSI Card scan: return mock prescriptions for a given CIP
// In production this would integrate with a real health data source
app.get('/api/tsi/:cip/prescriptions', async (req, res) => {
  try {
    const cip = req.params.cip || '';

    // Deterministic prescription set based on CIP prefix — simulates per-patient data
    const cipUpper = cip.toUpperCase();
    let medicineNames;
    if (cipUpper.startsWith('ALPE')) {
      medicineNames = ['Paracetamol', 'Omeprazol', 'Ibuprofeno'];
    } else if (cipUpper.startsWith('MADS')) {
      medicineNames = ['Amoxicilina', 'Loratadina', 'Ibuprofeno'];
    } else if (cipUpper.startsWith('VALE')) {
      medicineNames = ['Atorvastatina', 'Metformina', 'Losartán'];
    } else {
      medicineNames = ['Paracetamol', 'Ibuprofeno'];
    }

    // Build a static prescription list (CIMA API mock)
    const prescriptions = medicineNames.map((name, idx) => {
      const dosages = ['500mg', '20mg', '600mg', '500mg', '850mg'];
      const forms   = ['Comprimidos', 'Cápsulas', 'Comprimidos recubiertos', 'Cápsulas', 'Comprimidos'];
      const actives = {
        'Paracetamol':   'Paracetamol',
        'Omeprazol':     'Omeprazol',
        'Ibuprofeno':    'Ibuprofeno',
        'Amoxicilina':   'Amoxicilina',
        'Loratadina':    'Loratadina',
        'Atorvastatina': 'Atorvastatina',
        'Metformina':    'Metformina',
        'Losartán':      'Losartán potásico',
      };
      return {
        id:               `RX_${cip}_${idx}`,
        name:             name,
        active_ingredient: actives[name] || name,
        dosage:           dosages[idx % dosages.length],
        form:             forms[idx % forms.length],
      };
    });

    res.json(prescriptions);
  } catch (error) {
    console.error('Error fetching TSI prescriptions:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// ========== TSI OCR: extract CIP from uploaded photo ==========

const upload = multer({
  storage: multer.memoryStorage(),
  limits: { fileSize: 10 * 1024 * 1024 }, // 10 MB max
  fileFilter: (_req, file, cb) => {
    if (file.mimetype.startsWith('image/')) cb(null, true);
    else cb(new Error('Only image files are accepted'));
  },
});

// Extract CIP from OCR text — looks for a long alphanumeric token (16 chars typical for CIP)
function extractCip(text) {
  const cleaned = text.replace(/\s+/g, '');
  // Try exact 16-char alphanumeric match first
  const exact = cleaned.match(/[A-Z0-9]{16}/i);
  if (exact) return exact[0].toUpperCase();
  // Fallback: 8–30 alphanumeric chars
  const loose = cleaned.match(/[A-Z0-9]{8,30}/i);
  if (loose) return loose[0].toUpperCase();
  return null;
}

app.post('/api/tsi/ocr', upload.single('photo'), async (req, res) => {
  try {
    if (!req.file) {
      return res.status(400).json({ error: 'No image file provided' });
    }

    const worker = await createWorker('spa+eng');
    const { data } = await worker.recognize(req.file.buffer);
    await worker.terminate();

    console.log('[OCR] Raw text:', data.text);
    const cip = extractCip(data.text);
    console.log('[OCR] Extracted CIP:', cip);

    if (!cip) {
      return res.status(422).json({
        error: 'No se pudo detectar un código CIP en la imagen',
        ocrText: data.text.trim().slice(0, 500),
      });
    }

    res.json({ cip });
  } catch (error) {
    console.error('TSI OCR error:', error);
    res.status(500).json({ error: 'Error procesando la imagen' });
  }
});

// ========== AUTHENTICATION ROUTES ==========

// Login endpoint
app.post('/api/auth/login', loginLimiter, async (req, res) => {
  try {
    const { username, password } = req.body;

    if (!username || !password) {
      return res.status(400).json({ error: 'Username and password are required' });
    }

    // Find user by username
    const user = await userDbGet(
      'SELECT * FROM users WHERE username = ?',
      [username.trim()]
    );

    if (!user) {
      return res.status(401).json({ error: 'Invalid username or password' });
    }

    // Verify password
    const isValidPassword = await bcrypt.compare(password, user.password_hash);

    if (!isValidPassword) {
      return res.status(401).json({ error: 'Invalid username or password' });
    }

    // Create session
    req.session.userId = user.id;
    req.session.username = user.username;
    req.session.isAdmin = Boolean(user.is_admin);

    res.json({
      message: 'Login successful',
      user: {
        id: user.id,
        username: user.username,
        is_admin: Boolean(user.is_admin),
        address: user.address || null,
        latitude: user.latitude,
        longitude: user.longitude,
      }
    });
  } catch (error) {
    console.error('Error during login:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Register a new user (non-admin) and start a session
app.post('/api/auth/register', registerLimiter, async (req, res) => {
  try {
    const { username, password } = req.body || {};
    const u = String(username || '').trim();
    const p = String(password || '');

    if (!/^[A-Za-z0-9_]{3,32}$/.test(u)) {
      return res.status(400).json({ error: 'Username must be 3–32 characters: letters, digits, or underscore' });
    }
    if (p.length < 8) {
      return res.status(400).json({ error: 'Password must be at least 8 characters' });
    }

    const existing = await userDbGet('SELECT id FROM users WHERE username = ?', [u]);
    if (existing) {
      return res.status(409).json({ error: 'Username already taken' });
    }

    const passwordHash = await bcrypt.hash(p, 10);
    const result = await userDbRun(
      'INSERT INTO users (username, password_hash, is_admin) VALUES (?, ?, 0) RETURNING id',
      [u, passwordHash]
    );

    req.session.userId = result.lastID;
    req.session.username = u;
    req.session.isAdmin = false;

    res.status(201).json({
      message: 'Registered',
      user: {
        id: result.lastID,
        username: u,
        is_admin: false,
        address: null,
        latitude: null,
        longitude: null,
      }
    });
  } catch (error) {
    console.error('Error during registration:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Logout endpoint
app.post('/api/auth/logout', (req, res) => {
  req.session.destroy((err) => {
    if (err) {
      console.error('Error destroying session:', err);
      return res.status(500).json({ error: 'Error logging out' });
    }
    res.json({ message: 'Logout successful' });
  });
});

// Check authentication status — reads fresh user record so profile fields stay current
app.get('/api/auth/check', async (req, res) => {
  try {
    if (req.session && req.session.userId) {
      const user = await userDbGet(
        'SELECT id, username, is_admin, address, latitude, longitude FROM users WHERE id = ?',
        [req.session.userId]
      );
      if (!user) {
        req.session.destroy(() => {});
        return res.json({ authenticated: false });
      }
      return res.json({
        authenticated: true,
        user: {
          id: user.id,
          username: user.username,
          is_admin: Boolean(user.is_admin),
          address: user.address || null,
          latitude: user.latitude,
          longitude: user.longitude,
        }
      });
    }
    res.json({ authenticated: false });
  } catch (error) {
    console.error('Error checking auth:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Current user's profile
app.get('/api/users/me', requireAuth, async (req, res) => {
  try {
    const user = await userDbGet(
      'SELECT id, username, is_admin, address, latitude, longitude FROM users WHERE id = ?',
      [req.session.userId]
    );
    if (!user) return res.status(404).json({ error: 'Not found' });
    res.json({
      id: user.id,
      username: user.username,
      is_admin: Boolean(user.is_admin),
      address: user.address || null,
      latitude: user.latitude,
      longitude: user.longitude,
    });
  } catch (error) {
    console.error('Error loading profile:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Update the current user's address + coordinates
app.put('/api/users/me', requireAuth, async (req, res) => {
  try {
    const { address, latitude, longitude } = req.body || {};
    const addr =
      address == null || String(address).trim() === ''
        ? null
        : String(address).trim().slice(0, 500);

    let lat = null;
    let lon = null;
    if (latitude !== '' && latitude != null) {
      lat = typeof latitude === 'number' ? latitude : parseFloat(latitude);
      if (!Number.isFinite(lat) || lat < -90 || lat > 90) {
        return res.status(400).json({ error: 'Invalid latitude' });
      }
    }
    if (longitude !== '' && longitude != null) {
      lon = typeof longitude === 'number' ? longitude : parseFloat(longitude);
      if (!Number.isFinite(lon) || lon < -180 || lon > 180) {
        return res.status(400).json({ error: 'Invalid longitude' });
      }
    }

    await userDbRun(
      'UPDATE users SET address = ?, latitude = ?, longitude = ? WHERE id = ?',
      [addr, lat, lon, req.session.userId]
    );

    const user = await userDbGet(
      'SELECT id, username, is_admin, address, latitude, longitude FROM users WHERE id = ?',
      [req.session.userId]
    );
    res.json({
      id: user.id,
      username: user.username,
      is_admin: Boolean(user.is_admin),
      address: user.address || null,
      latitude: user.latitude,
      longitude: user.longitude,
    });
  } catch (error) {
    console.error('Error updating profile:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// ========== USER ALERTS API ==========

// Get all alerts for the current user
app.get('/api/alerts', requireAuth, async (req, res) => {
  try {
    const userId = req.session.userId;
    const rows = await userDbAll(
      'SELECT id, type, medicine_nregistro, title, detail, schedule, created_at, updated_at FROM user_alerts WHERE user_id = ? ORDER BY created_at DESC',
      [userId]
    );
    res.json(rows);
  } catch (error) {
    console.error('Error fetching alerts:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Create a new alert
app.post('/api/alerts', requireAuth, async (req, res) => {
  try {
    const userId = req.session.userId;
    const { type, medicine_nregistro, title, detail, schedule } = req.body || {};

    if (!type || !['reminder', 'availability', 'schedule'].includes(type)) {
      return res.status(400).json({ error: 'Valid type is required (reminder, availability, schedule)' });
    }

    const result = await userDbRun(
      'INSERT INTO user_alerts (user_id, type, medicine_nregistro, title, detail, schedule) VALUES (?, ?, ?, ?, ?, ?)',
      [userId, type, medicine_nregistro || null, title || null, detail || null, schedule || null]
    );

    const newAlert = await userDbGet('SELECT * FROM user_alerts WHERE id = ?', [result.lastID]);
    res.status(201).json(newAlert);
  } catch (error) {
    console.error('Error creating alert:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Update an existing alert
app.put('/api/alerts/:id', requireAuth, async (req, res) => {
  try {
    const userId = req.session.userId;
    const alertId = parseInt(req.params.id);
    const { medicine_nregistro, title, detail, schedule } = req.body || {};

    const result = await userDbRun(
      'UPDATE user_alerts SET medicine_nregistro = ?, title = ?, detail = ?, schedule = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ? AND user_id = ?',
      [medicine_nregistro || null, title || null, detail || null, schedule || null, alertId, userId]
    );

    if (result.changes === 0) {
      return res.status(404).json({ error: 'Alert not found' });
    }

    const updatedAlert = await userDbGet('SELECT * FROM user_alerts WHERE id = ?', [alertId]);
    res.json(updatedAlert);
  } catch (error) {
    console.error('Error updating alert:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Delete an alert
app.delete('/api/alerts/:id', requireAuth, async (req, res) => {
  try {
    const userId = req.session.userId;
    const alertId = parseInt(req.params.id);

    const result = await userDbRun(
      'DELETE FROM user_alerts WHERE id = ? AND user_id = ?',
      [alertId, userId]
    );

    if (result.changes === 0) {
      return res.status(404).json({ error: 'Alert not found' });
    }

    res.status(204).end();
  } catch (error) {
    console.error('Error deleting alert:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Geocode for any authenticated user (rate-limited). Same impl as /api/admin/geocode.
app.get('/api/geocode', requireAuth, geocodeLimiter, async (req, res) => {
  const q = (req.query.q || '').trim();
  if (!q) return res.status(400).json({ error: 'Query parameter q is required' });
  try {
    const result = await nominatimSearchFirstHit(q);
    if (!result.ok) return res.status(result.status).json({ error: result.error });
    const lat = parseFloat(result.hit.lat);
    const lon = parseFloat(result.hit.lon);
    if (!Number.isFinite(lat) || !Number.isFinite(lon)) {
      return res.status(502).json({ error: 'Geocoder result missing coordinates' });
    }
    res.json({
      lat,
      lon,
      displayName: result.hit.display_name || q,
      matchedQuery: result.triedQuery,
    });
  } catch (err) {
    console.error('Geocode error:', err);
    res.status(500).json({ error: err.message || 'Geocode failed' });
  }
});

// ========== ADMIN API ROUTES ==========

/** Suggested search radius (m) from Nominatim bounding box [south, north, west, east] */
function radiusMetersFromBoundingBox(south, north, west, east) {
  const s = parseFloat(south);
  const n = parseFloat(north);
  const w = parseFloat(west);
  const e = parseFloat(east);
  if (![s, n, w, e].every(Number.isFinite)) return null;
  const latMid = (s + n) / 2;
  const latM = Math.abs(n - s) * 111320;
  const lonM = Math.abs(e - w) * 111320 * Math.cos((latMid * Math.PI) / 180);
  const half = (Math.max(latM, lonM) / 2) * 1.12;
  return Math.round(Math.min(Math.max(half, 1500), 50000));
}

async function nominatimSearchFirstHit(originalQuery) {
  const trimmed = originalQuery.trim();
  const variants = [
    trimmed,
    `${trimmed}, España`,
    `${trimmed}, Spain`,
    `${trimmed}, ES`,
  ];
  const seen = new Set();
  const uniqueVariants = variants.filter((v) => {
    const k = v.toLowerCase();
    if (seen.has(k)) return false;
    seen.add(k);
    return true;
  });

  const delay = (ms) => new Promise((r) => setTimeout(r, ms));

  for (let i = 0; i < uniqueVariants.length; i++) {
    const q = uniqueVariants[i];
    if (i > 0) await delay(1100);
    const params = new URLSearchParams({
      format: 'json',
      limit: '1',
      q,
      addressdetails: '0',
    });
    const url = `https://nominatim.openstreetmap.org/search?${params}`;
    const nomRes = await fetch(url, {
      headers: {
        Accept: 'application/json',
        'Accept-Language': 'es,en',
        'User-Agent':
          'FarmaClic/1.0 (pharmacy admin; geocoding; https://github.com/)',
      },
    });
    const text = await nomRes.text();
    let data;
    try {
      data = text ? JSON.parse(text) : [];
    } catch {
      return { ok: false, error: 'Geocoder returned invalid JSON', status: 502 };
    }
    if (!nomRes.ok) {
      return {
        ok: false,
        error: `Geocoder HTTP ${nomRes.status}`,
        status: 502,
      };
    }
    if (Array.isArray(data) && data.length > 0) {
      return { ok: true, hit: data[0], triedQuery: q };
    }
  }


  return {
    ok: false,
    error:
      'No place found. Try adding the region (e.g. "Rubí, Barcelona" or "Toledo, Spain").',
    status: 422,
  };
}

// Geocode city → lat, lon, radius (OpenStreetMap Nominatim; admin-only, low volume)
app.get('/api/admin/geocode', requireAdmin, async (req, res) => {
  const q = (req.query.q || '').trim();
  if (!q) {
    return res.status(400).json({ error: 'Query parameter q is required' });
  }
  try {
    const result = await nominatimSearchFirstHit(q);
    if (!result.ok) {
      return res.status(result.status).json({ error: result.error });
    }
    const hit = result.hit;
    const lat = parseFloat(hit.lat);
    const lon = parseFloat(hit.lon);
    if (!Number.isFinite(lat) || !Number.isFinite(lon)) {
      return res.status(502).json({ error: 'Geocoder result missing coordinates' });
    }
    let radius = 12000;
    if (hit.boundingbox && hit.boundingbox.length >= 4) {
      const r = radiusMetersFromBoundingBox(
        hit.boundingbox[0],
        hit.boundingbox[1],
        hit.boundingbox[2],
        hit.boundingbox[3]
      );
      if (r != null) radius = r;
    }
    res.json({
      lat,
      lon,
      radius,
      displayName: hit.display_name || q,
      matchedQuery: result.triedQuery,
    });
  } catch (err) {
    console.error('Geocode error:', err);
    res.status(500).json({ error: err.message || 'Geocode failed' });
  }
});

// Add a new pharmacy
app.post('/api/admin/pharmacies', requireAdmin, async (req, res) => {
  try {
    const { name, address, phone, latitude, longitude, opening_hours } = req.body;

    if (!name || !address) {
      return res.status(400).json({ error: 'Name and address are required' });
    }

    // Check for duplicate (same name and address)
    const existing = await dbGet(
      'SELECT * FROM pharmacies WHERE name = ? AND address = ?',
      [name.trim(), address.trim()]
    );

    if (existing) {
      return res.status(400).json({ error: 'A pharmacy with this name and address already exists' });
    }

    const openingHoursValue = serializeOpeningHours(opening_hours);

    const result = await dbRun(
      'INSERT INTO pharmacies (name, address, phone, latitude, longitude, opening_hours) VALUES (?, ?, ?, ?, ?, ?)',
      [name.trim(), address.trim(), phone ? phone.trim() : null, latitude || null, longitude || null, openingHoursValue]
    );

    if (!result || result.lastID === undefined) {
      throw new Error('Failed to get lastID from database insert');
    }

    const newPharmacy = await dbGet(
      'SELECT * FROM pharmacies WHERE id = ?',
      [result.lastID]
    );

    if (!newPharmacy) {
      throw new Error('Failed to retrieve created pharmacy');
    }

    res.status(201).json(newPharmacy);
  } catch (error) {
    console.error('Error adding pharmacy:', error);
    if (error.message.includes('UNIQUE constraint')) {
      res.status(400).json({ error: 'A pharmacy with this information already exists' });
    } else {
      res.status(500).json({ error: error.message || 'Internal server error' });
    }
  }
});

// Update a pharmacy
app.put('/api/admin/pharmacies/:id', requireAdmin, async (req, res) => {
  try {
    const pharmacyId = parseInt(req.params.id);
    const { name, address, phone, latitude, longitude, opening_hours } = req.body;

    if (!name || !address) {
      return res.status(400).json({ error: 'Name and address are required' });
    }

    const openingHoursValue = serializeOpeningHours(opening_hours);

    await dbRun(
      'UPDATE pharmacies SET name = ?, address = ?, phone = ?, latitude = ?, longitude = ?, opening_hours = ? WHERE id = ?',
      [name, address, phone || null, latitude || null, longitude || null, openingHoursValue, pharmacyId]
    );

    const updatedPharmacy = await dbGet(
      'SELECT * FROM pharmacies WHERE id = ?',
      [pharmacyId]
    );

    if (!updatedPharmacy) {
      return res.status(404).json({ error: 'Pharmacy not found' });
    }

    res.json(updatedPharmacy);
  } catch (error) {
    console.error('Error updating pharmacy:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Delete a pharmacy
app.delete('/api/admin/pharmacies/:id', requireAdmin, async (req, res) => {
  try {
    const pharmacyId = parseInt(req.params.id);

    // Delete related pharmacy_medicines first
    await dbRun('DELETE FROM pharmacy_medicines WHERE pharmacy_id = ?', [pharmacyId]);
    
    // Delete the pharmacy
    await dbRun('DELETE FROM pharmacies WHERE id = ?', [pharmacyId]);

    res.json({ message: 'Pharmacy deleted successfully' });
  } catch (error) {
    console.error('Error deleting pharmacy:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Import pharmacies from webhook (e.g. n8n).
// Body: { "url"?: string, "lat"?, "lon"|"lng"?, "radio"? } — lat/lon/radio add ?lat=&lon=&radio= (metres)
app.post('/api/admin/pharmacies/import-webhook', requireAdmin, async (req, res) => {
  try {
    const body = req.body && typeof req.body === 'object' ? req.body : {};
    const url =
      (typeof body.url === 'string' && body.url.trim()) ||
      process.env.FARMACIAS_WEBHOOK_URL ||
      DEFAULT_FARMACIAS_WEBHOOK;
    const region = {};
    if (body.lat != null && String(body.lat).trim() !== '') region.lat = body.lat;
    const lonVal = body.lon ?? body.lng;
    if (lonVal != null && String(lonVal).trim() !== '') region.lon = lonVal;
    if (body.radio != null && String(body.radio).trim() !== '') region.radio = body.radio;
    const hasRegion =
      region.lat != null || region.lon != null || region.radio != null;
    const result = await runFarmaciaWebhookImport(
      dbGet,
      dbRun,
      url.trim(),
      hasRegion ? region : null
    );
    res.json(result);
  } catch (error) {
    console.error('Webhook pharmacy import:', error);
    const status = error.message?.includes('HTTP') ? 502 : 400;
    res.status(status).json({
      error: error.message || 'Webhook import failed',
      ...(error.details ? { details: error.details } : {}),
    });
  }
});

// Import from OpenStreetMap (Overpass), or a JSON open-data URL — see /API
app.post('/api/admin/pharmacies/import-external', requireAdmin, async (req, res) => {
  try {
    const body = req.body && typeof req.body === 'object' ? req.body : {};
    const source = body.source;
    if (!['osm', 'openData'].includes(source)) {
      return res
        .status(400)
        .json({ error: 'source must be "osm", or "openData"' });
    }

    const rows = await fetchPharmaciesExternal({
      source,
      lat: body.lat,
      lon: body.lon ?? body.lng,
      lng: body.lng,
      radio: body.radio,
      openDataUrl:
        typeof body.openDataUrl === 'string' ? body.openDataUrl.trim() : undefined,
    });

    if (!rows.length) {
      return res.json({
        inserted: 0,
        skipped: 0,
        invalid: 0,
        errors: [],
        totalReceived: 0,
        source,
        message: 'No pharmacies returned for this query',
      });
    }

    const stats = await importPharmaciesFromRows(dbGet, dbRun, rows);
    res.json({ ...stats, totalReceived: rows.length, source });
  } catch (error) {
    console.error('External pharmacy import:', error);
    res.status(400).json({ error: error.message || 'External import failed' });
  }
});

// Search medicines from CIMA API (para el admin)
app.get('/api/admin/medicines', requireAdmin, async (req, res) => {
  try {
    const query = req.query.q || '';
    
    if (!query.trim()) {
      // Si no hay query, retornar lista vacía o medicamentos populares
      return res.json([]);
    }

    // Usar el servicio de CIMA
    const medicines = await searchMedicines(query);
    res.json(medicines);
  } catch (error) {
    console.error('Error fetching medicines:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Get medicines for a specific pharmacy (usando nregistro)
app.get('/api/admin/pharmacies/:pharmacyId/medicines', requireAdmin, async (req, res) => {
  try {
    const pharmacyId = parseInt(req.params.pharmacyId);

    const medicines = await dbAll(`
      SELECT 
        pm.id,
        pm.pharmacy_id,
        pm.medicine_nregistro,
        pm.medicine_name,
        pm.price,
        pm.stock
      FROM pharmacy_medicines pm
      WHERE pm.pharmacy_id = ?
      ORDER BY pm.medicine_name
    `, [pharmacyId]);

    res.json(medicines);
  } catch (error) {
    console.error('Error fetching pharmacy medicines:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Add medicine to a pharmacy (or update if exists) usando nregistro de CIMA
app.post('/api/admin/pharmacy-medicines', requireAdmin, async (req, res) => {
  try {
    const { pharmacy_id, medicine_nregistro, medicine_name, price, stock } = req.body;

    if (!pharmacy_id || !medicine_nregistro) {
      return res.status(400).json({ error: 'Pharmacy ID and Medicine nregistro are required' });
    }

    // Check if relationship already exists
    const existing = await dbGet(
      'SELECT * FROM pharmacy_medicines WHERE pharmacy_id = ? AND medicine_nregistro = ?',
      [pharmacy_id, medicine_nregistro]
    );

    if (existing) {
      // Update existing relationship
      await dbRun(
        'UPDATE pharmacy_medicines SET medicine_name = ?, price = ?, stock = ? WHERE pharmacy_id = ? AND medicine_nregistro = ?',
        [medicine_name, price || null, stock || 0, pharmacy_id, medicine_nregistro]
      );
    } else {
      // Insert new relationship
      await dbRun(
        'INSERT INTO pharmacy_medicines (pharmacy_id, medicine_nregistro, medicine_name, price, stock) VALUES (?, ?, ?, ?, ?)',
        [pharmacy_id, medicine_nregistro, medicine_name, price || null, stock || 0]
      );
    }

    const relationship = await dbGet(
      `SELECT * FROM pharmacy_medicines
       WHERE pharmacy_id = ? AND medicine_nregistro = ?`,
      [pharmacy_id, medicine_nregistro]
    );

    if (!existing) {
      const pharmacy = await dbGet('SELECT id, name FROM pharmacies WHERE id = ?', [pharmacy_id]);
      sendPushForMedicine({
        medicine_nregistro,
        medicine_name: medicine_name || relationship?.medicine_name || null,
        pharmacy,
      }).catch(err => console.error('[push] fanout error:', err));
    }

    res.status(201).json(relationship);
  } catch (error) {
    console.error('Error adding medicine to pharmacy:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Update pharmacy-medicine relationship
app.put('/api/admin/pharmacy-medicines/:id', requireAdmin, async (req, res) => {
  try {
    const id = parseInt(req.params.id);
    const { price, stock } = req.body;

    await dbRun(
      'UPDATE pharmacy_medicines SET price = ?, stock = ? WHERE id = ?',
      [price || null, stock || 0, id]
    );

    const updated = await dbGet(
      'SELECT * FROM pharmacy_medicines WHERE id = ?',
      [id]
    );

    if (!updated) {
      return res.status(404).json({ error: 'Relationship not found' });
    }

    res.json(updated);
  } catch (error) {
    console.error('Error updating pharmacy-medicine:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Delete pharmacy-medicine relationship
app.delete('/api/admin/pharmacy-medicines/:id', requireAdmin, async (req, res) => {
  try {
    const id = parseInt(req.params.id);
    await dbRun('DELETE FROM pharmacy_medicines WHERE id = ?', [id]);
    res.json({ message: 'Medicine removed from pharmacy successfully' });
  } catch (error) {
    console.error('Error deleting pharmacy-medicine:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Push notifications

app.get('/api/notifications/vapid-public-key', (req, res) => {
  if (!PUSH_ENABLED) {
    return res.status(503).json({ error: 'Push notifications are not configured on this server' });
  }
  res.json({ publicKey: VAPID_PUBLIC_KEY });
});

app.post('/api/notifications/subscribe', requireAuth, async (req, res) => {
  try {
    if (!PUSH_ENABLED) {
      return res.status(503).json({ error: 'Push notifications are not configured on this server' });
    }
    const { medicine_nregistro, medicine_name, subscription, pharmacy_id } = req.body || {};
    const endpoint = subscription?.endpoint;
    const p256dh = subscription?.keys?.p256dh;
    const auth = subscription?.keys?.auth;
    const userId = req.session.userId;

    if (!medicine_nregistro || !endpoint || !p256dh || !auth) {
      return res.status(400).json({ error: 'medicine_nregistro and a full PushSubscription are required' });
    }

    if (pharmacy_id) {
      const existing = await dbGet(
        'SELECT id FROM push_subscriptions_pharmacy WHERE medicine_nregistro = ? AND pharmacy_id = ? AND endpoint = ?',
        [medicine_nregistro, pharmacy_id, endpoint]
      );
      if (existing) {
        await dbRun(
          'UPDATE push_subscriptions_pharmacy SET medicine_name = ?, p256dh = ?, auth = ?, user_id = ? WHERE id = ?',
          [medicine_name || null, p256dh, auth, userId, existing.id]
        );
      } else {
        await dbRun(
          'INSERT INTO push_subscriptions_pharmacy (medicine_nregistro, medicine_name, pharmacy_id, endpoint, p256dh, auth, user_id) VALUES (?, ?, ?, ?, ?, ?, ?)',
          [medicine_nregistro, medicine_name || null, pharmacy_id, endpoint, p256dh, auth, userId]
        );
      }
    } else {
      const existing = await dbGet(
        'SELECT id FROM push_subscriptions WHERE medicine_nregistro = ? AND endpoint = ?',
        [medicine_nregistro, endpoint]
      );
      if (existing) {
        await dbRun(
          'UPDATE push_subscriptions SET medicine_name = ?, p256dh = ?, auth = ?, user_id = ? WHERE id = ?',
          [medicine_name || null, p256dh, auth, userId, existing.id]
        );
      } else {
        await dbRun(
          'INSERT INTO push_subscriptions (medicine_nregistro, medicine_name, endpoint, p256dh, auth, user_id) VALUES (?, ?, ?, ?, ?, ?)',
          [medicine_nregistro, medicine_name || null, endpoint, p256dh, auth, userId]
        );
      }
    }

    res.status(201).json({ ok: true });
  } catch (error) {
    console.error('Error subscribing to push:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

app.delete('/api/notifications/unsubscribe', requireAuth, async (req, res) => {
  try {
    const { medicine_nregistro, endpoint, pharmacy_id } = req.body || {};
    if (!endpoint) {
      return res.status(400).json({ error: 'endpoint is required' });
    }
    if (pharmacy_id) {
      await dbRun(
        'DELETE FROM push_subscriptions_pharmacy WHERE medicine_nregistro = ? AND pharmacy_id = ? AND endpoint = ?',
        [medicine_nregistro, pharmacy_id, endpoint]
      );
    } else if (medicine_nregistro) {
      await dbRun(
        'DELETE FROM push_subscriptions WHERE medicine_nregistro = ? AND endpoint = ?',
        [medicine_nregistro, endpoint]
      );
    } else {
      await dbRun('DELETE FROM push_subscriptions WHERE endpoint = ?', [endpoint]);
    }
    res.status(204).end();
  } catch (error) {
    console.error('Error unsubscribing from push:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// List the current user's saved notifications across all their devices
app.get('/api/notifications/mine', requireAuth, async (req, res) => {
  try {
    const userId = req.session.userId;
    const globalRows = await dbAll(
      `SELECT id, medicine_nregistro, medicine_name, created_at
         FROM push_subscriptions
        WHERE user_id = ?
        ORDER BY created_at DESC`,
      [userId]
    );
    const pharmacyRows = await dbAll(
      `SELECT ps.id, ps.medicine_nregistro, ps.medicine_name, ps.pharmacy_id,
              ps.created_at, p.name AS pharmacy_name, p.address AS pharmacy_address
         FROM push_subscriptions_pharmacy ps
         LEFT JOIN pharmacies p ON p.id = ps.pharmacy_id
        WHERE ps.user_id = ?
        ORDER BY ps.created_at DESC`,
      [userId]
    );
    res.json({
      global: globalRows.map(r => ({ ...r, scope: 'global' })),
      pharmacy: pharmacyRows.map(r => ({ ...r, scope: 'pharmacy' })),
    });
  } catch (error) {
    console.error('Error listing user notifications:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Delete one of the user's saved notifications by row id + scope
app.delete('/api/notifications/mine', requireAuth, async (req, res) => {
  try {
    const userId = req.session.userId;
    const { scope, id } = req.body || {};
    const rowId = Number(id);
    if (!Number.isInteger(rowId) || rowId <= 0) {
      return res.status(400).json({ error: 'id must be a positive integer' });
    }
    if (scope === 'pharmacy') {
      await dbRun(
        'DELETE FROM push_subscriptions_pharmacy WHERE id = ? AND user_id = ?',
        [rowId, userId]
      );
    } else if (scope === 'global') {
      await dbRun(
        'DELETE FROM push_subscriptions WHERE id = ? AND user_id = ?',
        [rowId, userId]
      );
    } else {
      return res.status(400).json({ error: "scope must be 'global' or 'pharmacy'" });
    }
    res.status(204).end();
  } catch (error) {
    console.error('Error deleting user notification:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
});

async function sendPushForMedicine({ medicine_nregistro, medicine_name, pharmacy }) {
  if (!PUSH_ENABLED) return { sent: 0, failed: 0, pruned: 0 };

  const globalSubs = await dbAll(
    'SELECT id, endpoint, p256dh, auth FROM push_subscriptions WHERE medicine_nregistro = ?',
    [medicine_nregistro]
  );
  const pharmacySubs = pharmacy?.id ? await dbAll(
    'SELECT id, endpoint, p256dh, auth FROM push_subscriptions_pharmacy WHERE medicine_nregistro = ? AND pharmacy_id = ?',
    [medicine_nregistro, pharmacy.id]
  ) : [];

  // Deduplicate by endpoint; pharmacy-specific overrides global so one notification per browser
  const endpointMap = new Map();
  for (const sub of (globalSubs || [])) endpointMap.set(sub.endpoint, { ...sub, _pharmSub: false });
  for (const sub of (pharmacySubs || [])) endpointMap.set(sub.endpoint, { ...sub, _pharmSub: true });
  const subs = [...endpointMap.values()];

  if (subs.length === 0) return { sent: 0, failed: 0, pruned: 0 };

  const payload = JSON.stringify({
    title: 'Medicine available',
    body: `${medicine_name || medicine_nregistro} is now available at ${pharmacy?.name || 'a pharmacy near you'}`,
    url: `/?nregistro=${encodeURIComponent(medicine_nregistro)}`,
    medicine_nregistro,
    medicine_name: medicine_name || null,
    pharmacy_id: pharmacy?.id ?? null,
    pharmacy_name: pharmacy?.name ?? null,
  });

  let sent = 0;
  let failed = 0;
  let pruned = 0;

  await Promise.all(subs.map(async (sub) => {
    try {
      await webpush.sendNotification(
        { endpoint: sub.endpoint, keys: { p256dh: sub.p256dh, auth: sub.auth } },
        payload
      );
      sent++;
    } catch (err) {
      failed++;
      const status = err?.statusCode;
      if (status === 404 || status === 410) {
        try {
          const deleteQuery = sub._pharmSub
            ? 'DELETE FROM push_subscriptions_pharmacy WHERE id = ?'
            : 'DELETE FROM push_subscriptions WHERE id = ?';
          await dbRun(deleteQuery, [sub.id]);
          pruned++;
        } catch {}
      } else {
        console.error('[push] send failed:', status, err?.body || err?.message);
      }
    }
  }));

  return { sent, failed, pruned };
}

export { app, initDatabase, db };

if (process.env.NODE_ENV !== 'test') {
  initDatabase().then(() => {
    app.listen(PORT, () => {
      console.log(`Server running on http://localhost:${PORT}`);
    });
  });
}