Crussell/backend/main.go

package main

import (
	"crussell/auth"
	"crussell/internal/dav"
	"crussell/internal/s3"
	"fmt"
	"log"
	"net/http"
	"os"
	"time"

	"github.com/go-chi/chi/v5"
	"github.com/go-chi/chi/v5/middleware"

	"crussell/db"
	"crussell/mw"

	authHandlers "crussell/handlers/auth"
	"crussell/handlers/bookings"
	"crussell/handlers/notifications"
	"crussell/handlers/portfolio"
	"crussell/handlers/scheduling"
	"crussell/handlers/services"
	"crussell/handlers/today"
	"crussell/handlers/user"
)

func init() {
	jwtSecret := os.Getenv("JWT_SECRET_KEY")
	if jwtSecret == "" {
		log.Fatal("FATAL: JWT_SECRET_KEY environment variable not set. Application cannot start.")
	}
	auth.InitJWT(jwtSecret)
}

func initDB() {
	if err := db.Connect(); err != nil {
		log.Fatal("Failed to connect to DB:", err)
	}
	fmt.Println("Connected to DB successfully")
}

func initDav() {
	if dav.Service == nil {
		log.Fatal("Failed to initialize DAV service")
	}
	fmt.Println("DAV Service connected successfully")
}

func initS3() {
	if err := s3.Connect(); err != nil {
		log.Printf("WARNING: Failed to connect to S3: %v", err)
	} else {
		fmt.Println("S3 client initialized")
	}
}

func main() {
	initDB()
	initDav()
	initS3()

	r := chi.NewRouter()

	// --- Global Middleware ---
	r.Use(middleware.RequestID)
	r.Use(middleware.RealIP)
	r.Use(middleware.Logger)
	r.Use(middleware.Recoverer)
	r.Use(middleware.Timeout(15 * time.Second))
	r.Use(func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			w.Header().Set("X-Content-Type-Options", "nosniff")
			w.Header().Set("X-Frame-Options", "DENY")
			w.Header().Set("X-XSS-Protection", "1; mode=block")
			next.ServeHTTP(w, r)
		})
	})

	// All API routes grouped under /api for clarity
	r.Route("/api", func(r chi.Router) {

		// Public read-only (but check auth context if present for eligibility)
		r.Group(func(r chi.Router) {
			r.Use(mw.RateLimit(120, time.Minute))
			r.Get("/services", services.ServicesHandler)
			r.Get("/services/eligible-for/{user_id}", services.ServicesEligibleForUserHandler)
		})

		// Registration: 10/min to prevent spam
		r.With(mw.RateLimit(10, time.Minute)).Post("/register", authHandlers.RegisterHandler)

		// Login: Has its own internal rate limiting
		r.Post("/login", authHandlers.LoginHandler)

		// Email verification
		r.Post("/verify/generate", authHandlers.GenerateVerificationCodeHandler)
		r.Post("/verify/check", authHandlers.VerifyCodeHandler)

		// Public contact info
		r.Get("/contact", user.GetContactInfoHandler)

		// Portfolio
		r.Route("/portfolio", func(r chi.Router) {
			r.Get("/images", portfolio.ListImages)
			r.Get("/tags", portfolio.ListTags)
			r.With(mw.RateLimit(60, time.Minute)).Get("/filters", portfolio.ListFilters)
			r.With(mw.RateLimit(120, time.Minute)).Get("/images/{id}", portfolio.GetImage)

			r.Group(func(r chi.Router) {
				r.Use(mw.RequireAuth)
				r.Use(mw.RequireAdmin)
				r.Use(mw.RateLimit(60, time.Minute))
				r.Post("/images", portfolio.UploadImage)
				r.Delete("/images/{id}", portfolio.DeleteImage)
			})
		})

		// Scheduling
		r.Route("/scheduling", func(r chi.Router) {
			r.Use(mw.RateLimit(120, time.Minute))
			r.Get("/default-hours", scheduling.GetDefaultHours)
			r.Get("/exceptional-groups", scheduling.ListExceptionalGroups)
			r.Get("/working-hours", scheduling.GetWorkingHours)
			r.Get("/available-hours", scheduling.GetAvailableHours)

			r.Group(func(r chi.Router) {
				r.Use(mw.RequireAuth)
				r.Use(mw.RequireAdmin)
				r.Use(mw.RateLimit(60, time.Minute))

				r.Put("/default-hours", scheduling.UpdateDefaultHours)
				r.Post("/exceptional-groups", scheduling.CreateExceptionalGroup)
				r.Delete("/exceptional-groups", scheduling.DeleteExceptionalGroup)
				r.Put("/exceptional-applications", scheduling.UpdateExceptionalApplications)
			})
		})

		// Authenticated users
		r.Group(func(r chi.Router) {
			r.Use(mw.RequireAuth)
			r.Use(mw.RateLimit(120, time.Minute))

			r.Post("/refresh-token", authHandlers.RefreshTokenHandler)

			r.Get("/user/profile", user.GetProfileHandler)
			r.Put("/user/profile", user.UpdateProfileHandler)
			r.Post("/user/profile-picture", user.UploadProfilePictureHandler)
			r.Put("/user/change-password", user.ChangePasswordHandler)
			r.Delete("/user/account", user.DeleteAccountHandler)
			r.Get("/user/loyalty", user.GetLoyaltyHandler)

			r.Route("/bookings", func(r chi.Router) {
				r.Post("/", bookings.CreateBookingHandler)
				r.Get("/", bookings.GetAllUserBookingsHandler)
				r.Get("/{id}", bookings.GetBookingHandler)
				r.Get("/{id}/calendar", bookings.GetBookingCalendarHandler)
				r.Put("/{id}", bookings.EditBookingHandler)
				r.Delete("/{id}", bookings.DeleteBookingHandler)
				// Edit request endpoints
				r.Post("/{id}/edit-request", bookings.RequestEditHandler)
				r.Delete("/{id}/edit-request", bookings.DeleteEditRequestHandler)
			})
		})

		// Admin-only (no rate limit - trusted users with authenticated sessions)
		r.Group(func(r chi.Router) {
			r.Use(mw.RequireAuth)
			r.Use(mw.RequireAdmin)

			r.Route("/admin/services", func(r chi.Router) {
				r.Post("/", services.CreateServiceHandler)
				r.Delete("/{id}", services.DeleteServiceHandler)
				r.Get("/", services.AllServicesHandler)
				r.Put("/{id}/toggle", services.ToggleService)
			})

			r.Route("/admin/bookings", func(r chi.Router) {
				r.Get("/", bookings.GetAllAdminBookingsHandler)
				r.Post("/", bookings.AdminCreateBookingForUserHandler)
				r.With(mw.RateLimit(60, time.Minute)).Get("/search", bookings.SearchAdminBookingsHandler)
				r.Get("/user/{user_id}", bookings.GetAllBookingsByUserHandler)
				r.Get("/{id}", bookings.GetAdminBookingHandler)
				r.Get("/{id}/overlapping", bookings.GetOverlappingBookingsHandler)
				r.Put("/{id}/progress", bookings.ProgressBookingHandler)
				r.Post("/{id}/confirm", bookings.ConfirmBookingHandler)
				r.Post("/{id}/cancel", bookings.CancelBookingHandler)
				// Edit request endpoints
				r.Get("/{id}/edit-requests", bookings.AdminListEditRequestsHandler)
				r.Post("/{id}/edit-requests/{request_id}/approve", bookings.AdminApproveEditRequestHandler)
				r.Post("/{id}/edit-requests/{request_id}/deny", bookings.AdminRejectEditRequestHandler)
			})

			r.Route("/admin/users", func(r chi.Router) {
				r.Get("/", user.ListAdminUsersHandler)
				r.Get("/{id}", user.GetAdminUserHandler)
				r.Get("/{id}/patch-tests/eligible", user.GetEligiblePatchTestServicesHandler)
				r.Post("/{id}/patch-tests", user.AddPatchTestHandler)
			})

			r.Route("/admin/today", func(r chi.Router) {
				r.Get("/current-next", today.GetCurrentAndNextHandler)
				r.Get("/appointments", today.GetTodayAppointmentsHandler)
				r.Get("/pending-approvals", today.GetPendingApprovalsHandler)
			})

			r.Route("/admin/notifications", func(r chi.Router) {
				r.Get("/", notifications.GetNotifications)
				r.Post("/{id}/acknowledge", notifications.AcknowledgeNotification)
			})
		})
	})

	fmt.Println("Server is listening on :8080")
	http.ListenAndServe(":8080", r)
}