"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
var __importDefault = (this && this.__importDefault) || function (mod) {
    return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.pangolinRouter = void 0;
const express_1 = require("express");
const express_rate_limit_1 = __importDefault(require("express-rate-limit"));
const rate_limit_redis_1 = __importDefault(require("rate-limit-redis"));
const fs_1 = require("fs");
const path_1 = require("path");
const yaml_1 = require("yaml");
const auth_middleware_1 = require("../../middleware/auth.middleware");
const rbac_middleware_1 = require("../../middleware/rbac.middleware");
const redis_1 = require("../../config/redis");
const pangolin_client_1 = require("../../services/pangolin.client");
const docker_service_1 = require("../../services/docker.service");
const env_1 = require("../../config/env");
const logger_1 = require("../../utils/logger");
// Rate limiter for expensive Pangolin operations
const pangolinSetupLimiter = (0, express_rate_limit_1.default)({
    windowMs: 5 * 60 * 1000, // 5 minutes
    max: 3, // Max 3 operations per 5 minutes per user
    keyGenerator: (req) => `pangolin-setup:${req.user?.id || req.ip}`,
    standardHeaders: true,
    legacyHeaders: false,
    store: new rate_limit_redis_1.default({
        sendCommand: (command, ...args) => redis_1.redis.call(command, ...args),
        prefix: 'rl:pangolin-setup:',
    }),
    message: {
        error: {
            message: 'Too many Pangolin setup operations. Please wait 5 minutes before trying again.',
            code: 'PANGOLIN_RATE_LIMIT_EXCEEDED',
        },
    },
});
/**
 * Load resource definitions from YAML config file
 */
function loadResourceDefinitions() {
    try {
        const configPath = (0, path_1.join)(__dirname, '../../../configs/pangolin/resources.yml');
        const fileContent = (0, fs_1.readFileSync)(configPath, 'utf8');
        const config = (0, yaml_1.parse)(fileContent);
        if (!config || !Array.isArray(config.resources)) {
            logger_1.logger.error('Invalid resources.yml format');
            return [];
        }
        logger_1.logger.info(`Loaded ${config.resources.length} resource definitions from YAML`);
        return config.resources;
    }
    catch (err) {
        logger_1.logger.error('Failed to load resource definitions:', err);
        return [];
    }
}
/**
 * Validate container is running before creating resource
 * @returns { valid: boolean, warning?: string, shouldSkip: boolean }
 */
async function validateContainer(def) {
    try {
        // Check monitoring profile
        if (def.profile === 'monitoring') {
            const grafanaStatus = await docker_service_1.dockerService.getContainerStatus('grafana-changemaker');
            if (!grafanaStatus.running) {
                return {
                    valid: false,
                    warning: `Monitoring profile not active, skipping ${def.name}`,
                    shouldSkip: true,
                };
            }
        }
        // Check container status
        const status = await docker_service_1.dockerService.getContainerStatus(def.container);
        if (!status.running) {
            if (def.required) {
                return {
                    valid: false,
                    warning: `Required container not running: ${def.container}`,
                    shouldSkip: false,
                };
            }
            else {
                return {
                    valid: false,
                    warning: `Optional container not running: ${def.container}, skipping`,
                    shouldSkip: true,
                };
            }
        }
        return { valid: true, shouldSkip: false };
    }
    catch (err) {
        logger_1.logger.error(`Container validation failed for ${def.container}:`, err);
        return {
            valid: false,
            warning: `Failed to check container status: ${def.container}`,
            shouldSkip: !def.required,
        };
    }
}
/**
 * Check if resource needs update (compare existing vs desired state)
 */
function resourceNeedsUpdate(existing, desired) {
    return (existing.name !== desired.name ||
        existing.ssl !== desired.ssl ||
        existing.proxyPort !== desired.proxyPort ||
        existing.protocol !== desired.protocol ||
        existing.fullDomain !== desired.fullDomain);
}
/**
 * Suggest next available subnet based on existing sites
 * Returns subnet in format "100.89.128.X/30" (increments by 4)
 */
function suggestNextSubnet(sites) {
    if (!sites || sites.length === 0) {
        return '100.89.128.4/30'; // Default first subnet (start at .4, not .0)
    }
    // Extract subnet field from existing sites (NOT address field)
    const subnets = sites
        .map(s => s.subnet) // Use subnet field specifically
        .filter((s) => Boolean(s))
        .map(s => {
        // Parse octet for numeric sorting
        const match = s.match(/^100\.89\.128\.(\d+)\/30$/);
        return { subnet: s, octet: match ? parseInt(match[1], 10) : 0 };
    })
        .sort((a, b) => a.octet - b.octet); // Sort numerically by octet
    if (subnets.length === 0) {
        return '100.89.128.4/30';
    }
    // Get the highest octet value
    const lastSubnet = subnets[subnets.length - 1].subnet;
    if (!lastSubnet) {
        return '100.89.128.4/30';
    }
    // Match format: 100.89.128.X/30
    const match = lastSubnet.match(/^100\.89\.128\.(\d+)\/30$/);
    if (match && match[1]) {
        const lastOctet = parseInt(match[1], 10);
        const nextOctet = lastOctet + 4; // /30 subnets increment by 4
        if (nextOctet <= 252) { // Max is 252 (252-255 is last /30)
            return `100.89.128.${nextOctet}/30`;
        }
    }
    // Fallback if parsing fails
    return '100.89.128.4/30';
}
const router = (0, express_1.Router)();
// --- Internal Endpoints (No Auth Required) ---
// POST /api/pangolin/sync-daemon — Internal sync endpoint for cron job (no auth, no rate limit)
// This endpoint is called by nginx cron job every hour
router.post('/sync-daemon', async (_req, res) => {
    try {
        if (!pangolin_client_1.pangolinClient.configured) {
            res.status(400).json({ error: { message: 'Pangolin not configured', code: 'NOT_CONFIGURED' } });
            return;
        }
        const siteId = env_1.env.PANGOLIN_SITE_ID;
        if (!siteId) {
            // Silently skip if not configured (not an error state)
            logger_1.logger.info('Pangolin sync skipped - PANGOLIN_SITE_ID not set');
            res.json({ success: true, skipped: true, reason: 'not_configured' });
            return;
        }
        const domain = env_1.env.DOMAIN;
        // Load resource definitions from YAML
        const resourceDefs = loadResourceDefinitions();
        if (resourceDefs.length === 0) {
            logger_1.logger.warn('No resource definitions found - check configs/pangolin/resources.yml');
            res.json({ success: false, error: 'No resource definitions found' });
            return;
        }
        // Get existing resources
        const existing = await pangolin_client_1.pangolinClient.listResources();
        const existingByDomain = new Map(existing.map(r => [r.fullDomain || '', r]));
        const created = [];
        const updated = [];
        const skipped = [];
        const warnings = [];
        const errors = [];
        for (const def of resourceDefs) {
            const fullDomain = def.subdomain ? `${def.subdomain}.${domain}` : domain;
            // Validate container before creating/updating resource
            const validation = await validateContainer(def);
            if (!validation.valid) {
                if (validation.shouldSkip) {
                    warnings.push(`${fullDomain}: ${validation.warning}`);
                    continue;
                }
                else {
                    errors.push(`${fullDomain}: ${validation.warning}`);
                    continue;
                }
            }
            const existingResource = existingByDomain.get(fullDomain);
            if (existingResource) {
                // Check if resource needs update
                const desired = {
                    name: def.name,
                    ssl: true,
                    proxyPort: 80,
                    protocol: 'http',
                    fullDomain,
                };
                if (resourceNeedsUpdate(existingResource, desired)) {
                    try {
                        await pangolin_client_1.pangolinClient.updateResource(existingResource.resourceId, {
                            name: desired.name,
                            ssl: desired.ssl,
                            proxyPort: desired.proxyPort,
                            protocol: desired.protocol,
                            fullDomain: desired.fullDomain,
                        });
                        updated.push(fullDomain);
                    }
                    catch (err) {
                        const msg = err instanceof Error ? err.message : 'Unknown error';
                        errors.push(`${fullDomain} (update): ${msg}`);
                    }
                }
                else {
                    skipped.push(fullDomain);
                }
            }
            else {
                // Create new resource
                try {
                    await pangolin_client_1.pangolinClient.createResource({
                        name: def.name,
                        siteId,
                        subdomain: def.subdomain || undefined,
                        fullDomain,
                        ssl: true,
                        http: true,
                        protocol: 'http',
                        proxyPort: 80,
                    });
                    created.push(fullDomain);
                }
                catch (err) {
                    const msg = err instanceof Error ? err.message : 'Unknown error';
                    errors.push(`${fullDomain}: ${msg}`);
                }
            }
        }
        // Log summary
        if (created.length > 0 || updated.length > 0 || errors.length > 0) {
            logger_1.logger.info(`Pangolin sync completed: ${created.length} created, ${updated.length} updated, ${errors.length} errors`);
        }
        res.json({
            success: true,
            created: created.length,
            updated: updated.length,
            skipped: skipped.length,
            warnings: warnings.length,
            errors: errors.length,
            details: { created, updated, skipped, warnings, errors },
        });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        logger_1.logger.error('Pangolin sync daemon failed:', err);
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
// --- Authenticated Endpoints (Require SUPER_ADMIN) ---
router.use(auth_middleware_1.authenticate);
router.use((0, rbac_middleware_1.requireRole)('SUPER_ADMIN'));
// GET /api/pangolin/status — Health + connection info
router.get('/status', async (_req, res) => {
    try {
        const configured = pangolin_client_1.pangolinClient.configured;
        let healthy = false;
        if (configured) {
            healthy = await pangolin_client_1.pangolinClient.healthCheck();
        }
        res.json({
            configured,
            healthy,
            pangolinUrl: env_1.env.PANGOLIN_API_URL || null,
            orgId: env_1.env.PANGOLIN_ORG_ID || null,
            siteId: env_1.env.PANGOLIN_SITE_ID || null,
            newtConfigured: !!(env_1.env.PANGOLIN_NEWT_ID && env_1.env.PANGOLIN_NEWT_SECRET),
        });
    }
    catch (err) {
        logger_1.logger.error('Pangolin status check failed:', err);
        res.status(500).json({ error: { message: 'Failed to check Pangolin status', code: 'PANGOLIN_ERROR' } });
    }
});
// GET /api/pangolin/config — Current env config
router.get('/config', (_req, res) => {
    res.json({
        pangolinApiUrl: env_1.env.PANGOLIN_API_URL || null,
        pangolinEndpoint: env_1.env.PANGOLIN_ENDPOINT || null,
        orgId: env_1.env.PANGOLIN_ORG_ID || null,
        siteId: env_1.env.PANGOLIN_SITE_ID || null,
        newtId: env_1.env.PANGOLIN_NEWT_ID || null,
        newtConfigured: !!(env_1.env.PANGOLIN_NEWT_ID && env_1.env.PANGOLIN_NEWT_SECRET),
        domain: env_1.env.DOMAIN,
    });
});
// GET /api/pangolin/newt-status — Check newt container status
router.get('/newt-status', async (_req, res) => {
    try {
        const containerStatus = await docker_service_1.dockerService.getContainerStatus('newt-changemaker');
        res.json({
            newtConfigured: !!(env_1.env.PANGOLIN_NEWT_ID && env_1.env.PANGOLIN_NEWT_SECRET),
            containerRunning: containerStatus.running,
            containerStatus: containerStatus.status,
            ready: containerStatus.running && !!(env_1.env.PANGOLIN_NEWT_ID && env_1.env.PANGOLIN_NEWT_SECRET),
            error: containerStatus.error,
        });
    }
    catch (err) {
        logger_1.logger.error('Newt status check failed:', err);
        res.status(500).json({
            error: { message: 'Failed to check newt status', code: 'DOCKER_ERROR' }
        });
    }
});
// POST /api/pangolin/newt-restart — Restart/recreate newt container
router.post('/newt-restart', async (_req, res) => {
    try {
        if (!env_1.env.PANGOLIN_NEWT_ID || !env_1.env.PANGOLIN_NEWT_SECRET) {
            res.status(400).json({
                error: {
                    message: 'Newt credentials not configured. Run setup first and update .env file.',
                    code: 'NOT_CONFIGURED'
                },
            });
            return;
        }
        const result = await docker_service_1.dockerService.restartContainer('newt');
        if (!result.success) {
            res.status(500).json({
                error: { message: 'Failed to restart container', code: 'DOCKER_ERROR' },
                details: result.output,
            });
            return;
        }
        res.json({
            success: true,
            message: 'Newt container restarted successfully',
            output: result.output,
        });
    }
    catch (err) {
        logger_1.logger.error('Newt restart failed:', err);
        res.status(500).json({
            error: { message: 'Failed to restart newt container', code: 'DOCKER_ERROR' }
        });
    }
});
// GET /api/pangolin/sites — List sites
router.get('/sites', async (_req, res) => {
    try {
        const sites = await pangolin_client_1.pangolinClient.listSites();
        res.json({ sites });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
// GET /api/pangolin/exit-nodes — List available exit nodes
router.get('/exit-nodes', async (_req, res) => {
    try {
        const exitNodes = await pangolin_client_1.pangolinClient.listExitNodes();
        res.json({ exitNodes });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        logger_1.logger.warn('Failed to list exit nodes:', msg);
        res.status(500).json({
            error: {
                message: 'Failed to retrieve exit nodes from Pangolin API',
                code: 'PANGOLIN_ERROR'
            }
        });
    }
});
// GET /api/pangolin/resources — List resources
router.get('/resources', async (_req, res) => {
    try {
        const resources = await pangolin_client_1.pangolinClient.listResources();
        res.json({ resources });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
// POST /api/pangolin/setup — Create site + all resources
router.post('/setup', pangolinSetupLimiter, async (req, res) => {
    try {
        if (!pangolin_client_1.pangolinClient.configured) {
            res.status(400).json({
                error: { message: 'Pangolin not configured. Set PANGOLIN_API_URL, PANGOLIN_API_KEY, and PANGOLIN_ORG_ID in .env', code: 'NOT_CONFIGURED' },
            });
            return;
        }
        const domain = env_1.env.DOMAIN;
        const siteName = req.body?.siteName || `changemaker-${domain}`;
        const subnet = req.body?.subnet;
        const exitNodeId = req.body?.exitNodeId;
        // Validate subnet format if provided
        if (subnet) {
            // Basic format check
            const cidrRegex = /^(\d{1,3}\.){3}\d{1,3}\/\d{1,2}$/;
            if (!cidrRegex.test(subnet)) {
                res.status(400).json({
                    error: { message: 'Invalid subnet format. Expected CIDR notation (e.g., "100.90.128.0/24")', code: 'INVALID_SUBNET' },
                });
                return;
            }
            // Validate IP octets and prefix
            const [ip, prefixStr] = subnet.split('/');
            const octets = ip.split('.').map(Number);
            const prefix = parseInt(prefixStr, 10);
            // Check octet ranges (0-255)
            if (octets.some((o) => isNaN(o) || o < 0 || o > 255)) {
                res.status(400).json({
                    error: { message: 'Invalid subnet IP address. Octets must be 0-255.', code: 'INVALID_SUBNET' },
                });
                return;
            }
            // Check prefix range (0-32 for IPv4)
            if (isNaN(prefix) || prefix < 0 || prefix > 32) {
                res.status(400).json({
                    error: { message: 'Invalid CIDR prefix. Must be 0-32 for IPv4.', code: 'INVALID_SUBNET' },
                });
                return;
            }
            // Block reserved IP ranges
            const firstOctet = octets[0];
            const isReserved = firstOctet === 0 || // 0.0.0.0/8 - Broadcast
                firstOctet === 127 || // 127.0.0.0/8 - Loopback
                firstOctet >= 224; // 224.0.0.0/4 - Multicast, Reserved
            if (isReserved) {
                res.status(400).json({
                    error: {
                        message: 'Subnet uses reserved IP range (loopback, multicast, or broadcast)',
                        code: 'INVALID_SUBNET'
                    },
                });
                return;
            }
        }
        // Validate exit node ID ONLY if provided
        if (exitNodeId !== undefined && exitNodeId !== null && exitNodeId !== '') {
            // Basic format check
            if (typeof exitNodeId !== 'string') {
                res.status(400).json({
                    error: { message: 'Exit node ID must be a string', code: 'INVALID_EXIT_NODE' },
                });
                return;
            }
            // Length validation (IDs should be reasonable length)
            if (exitNodeId.length < 3 || exitNodeId.length > 100) {
                res.status(400).json({
                    error: { message: 'Invalid exit node ID format', code: 'INVALID_EXIT_NODE' },
                });
                return;
            }
            // Verify exit node exists in org's available nodes (only if we can list them)
            try {
                const availableNodes = await pangolin_client_1.pangolinClient.listExitNodes();
                if (availableNodes.length > 0) {
                    // Only validate if exit nodes are available
                    const node = availableNodes.find(n => n.exitNodeId === exitNodeId);
                    if (!node) {
                        res.status(400).json({
                            error: {
                                message: 'Exit node not found in available nodes',
                                code: 'EXIT_NODE_NOT_FOUND'
                            },
                        });
                        return;
                    }
                    if (!node.online) {
                        logger_1.logger.warn(`Creating site with offline exit node: ${exitNodeId} (${node.name})`);
                    }
                }
            }
            catch (err) {
                logger_1.logger.warn('Could not verify exit node (exit-nodes endpoint unavailable)');
                // Don't fail - proceed with site creation
            }
        }
        else {
            logger_1.logger.info('Creating site without exit node (self-hosted mode)');
        }
        // Create site (returns newt credentials)
        logger_1.logger.info(`Creating Pangolin site: ${siteName}${subnet ? ` with subnet ${subnet}` : ''}${exitNodeId ? ` via exit node ${exitNodeId}` : ''}`);
        const site = await pangolin_client_1.pangolinClient.createSite({
            name: siteName,
            type: 'newt',
            ...(subnet && { subnet }),
            ...(exitNodeId && { exitNodeId })
        });
        const siteId = site.siteId;
        logger_1.logger.info(`Site created: ${siteId}`);
        // Load resource definitions from YAML
        const resourceDefs = loadResourceDefinitions();
        if (resourceDefs.length === 0) {
            logger_1.logger.error('No resource definitions found - check configs/pangolin/resources.yml');
        }
        // Create resources for all subdomains
        const created = [];
        const errors = [];
        const warnings = [];
        for (const def of resourceDefs) {
            const fullDomain = def.subdomain ? `${def.subdomain}.${domain}` : domain;
            // Validate container before creating resource
            const validation = await validateContainer(def);
            if (!validation.valid) {
                if (validation.shouldSkip) {
                    warnings.push(`${fullDomain}: ${validation.warning}`);
                    logger_1.logger.warn(validation.warning);
                    continue;
                }
                else {
                    errors.push(`${fullDomain}: ${validation.warning}`);
                    logger_1.logger.error(validation.warning);
                    continue;
                }
            }
            try {
                const resource = await pangolin_client_1.pangolinClient.createResource({
                    name: def.name,
                    siteId,
                    subdomain: def.subdomain || undefined,
                    fullDomain,
                    ssl: true,
                    http: true,
                    protocol: 'http',
                    proxyPort: 80,
                });
                created.push({ subdomain: def.subdomain || '(root)', name: def.name, resourceId: resource.resourceId });
            }
            catch (err) {
                const msg = err instanceof Error ? err.message : 'Unknown error';
                errors.push(`${fullDomain}: ${msg}`);
                logger_1.logger.warn(`Failed to create resource for ${fullDomain}: ${msg}`);
            }
        }
        res.json({
            success: true,
            site: {
                siteId,
                name: siteName,
                newt: site.newt ? {
                    newtId: site.newt.newtId,
                    secret: site.newt.secret,
                } : null,
            },
            resources: {
                created: created.length,
                total: resourceDefs.length,
                items: created,
                errors,
                warnings
            },
            instructions: site.newt ? [
                'Add these to your .env file:',
                `PANGOLIN_SITE_ID=${siteId}`,
                `PANGOLIN_NEWT_ID=${site.newt.newtId}`,
                `PANGOLIN_NEWT_SECRET=${site.newt.secret}`,
                `PANGOLIN_ENDPOINT=${env_1.env.PANGOLIN_ENDPOINT || 'https://api.bnkserve.org'}`,
                `# Assigned subnet: ${site.subnet || subnet || 'auto-assigned'}`,
                'Then restart the newt container: docker compose up -d newt',
            ] : ['Site created but no Newt credentials returned. Check Pangolin dashboard.'],
        });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        logger_1.logger.error('Pangolin setup failed:', err);
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
// POST /api/pangolin/setup-automated — Automated one-command setup (create site, update .env, restart Newt)
router.post('/setup-automated', pangolinSetupLimiter, async (req, res) => {
    try {
        if (!pangolin_client_1.pangolinClient.configured) {
            res.status(400).json({
                error: { message: 'Pangolin not configured. Set PANGOLIN_API_URL, PANGOLIN_API_KEY, and PANGOLIN_ORG_ID in .env', code: 'NOT_CONFIGURED' },
            });
            return;
        }
        const domain = req.body?.domain || env_1.env.DOMAIN;
        const siteName = req.body?.siteName || `changemaker-${domain}`;
        logger_1.logger.info(`Starting automated Pangolin setup for domain: ${domain}`);
        // --- Step 1: Check for existing site ---
        let siteId;
        let newtId;
        let newtSecret;
        let siteCreated = false;
        const existingSites = await pangolin_client_1.pangolinClient.listSites();
        // Debug: log existing sites subnets
        logger_1.logger.info(`Existing sites: ${existingSites.map(s => `${s.name} (subnet: ${s.subnet || s.address})`).join(', ')}`);
        // Auto-allocate subnet if not provided
        let subnet = req.body?.subnet;
        if (!subnet) {
            subnet = suggestNextSubnet(existingSites);
            logger_1.logger.info(`Auto-allocated subnet: ${subnet}`);
        }
        // Auto-select exit node if not provided
        let exitNodeId = req.body?.exitNodeId;
        if (!exitNodeId) {
            // Try to get exit nodes from dedicated endpoint
            const exitNodes = await pangolin_client_1.pangolinClient.listExitNodes();
            if (exitNodes && exitNodes.length > 0) {
                // Prefer online exit nodes, fallback to any available
                const onlineNode = exitNodes.find(n => n.online);
                const selectedNode = onlineNode || exitNodes[0];
                exitNodeId = selectedNode.exitNodeId;
                logger_1.logger.info(`Auto-selected exit node: ${exitNodeId} (${selectedNode.name || 'unnamed'})`);
            }
            else {
                // Fallback: reuse exit node from existing site (self-hosted mode)
                logger_1.logger.info('No dedicated exit nodes endpoint, checking existing sites for exit node ID');
                if (existingSites.length > 0) {
                    // Find a site with an exit node configured
                    const siteWithExitNode = existingSites.find(s => s.exitNodeId);
                    if (siteWithExitNode && siteWithExitNode.exitNodeId) {
                        exitNodeId = siteWithExitNode.exitNodeId;
                        logger_1.logger.info(`Reusing exit node from existing site: ${exitNodeId}`);
                    }
                    else {
                        logger_1.logger.warn('Existing sites found but none have exitNodeId configured');
                        // Last resort: try creating without exitNodeId (might work for self-hosted)
                        logger_1.logger.info('Attempting site creation without exitNodeId (self-hosted mode)');
                        exitNodeId = undefined;
                    }
                }
                else {
                    logger_1.logger.warn('No existing sites to reuse exit node from');
                    // Try without exitNodeId for self-hosted mode
                    exitNodeId = undefined;
                }
            }
        }
        // Ensure existingSites is an array (handle API errors gracefully)
        if (!Array.isArray(existingSites)) {
            logger_1.logger.error('listSites did not return an array:', existingSites);
            res.status(500).json({
                error: {
                    message: 'Failed to retrieve existing sites from Pangolin API',
                    code: 'PANGOLIN_ERROR'
                }
            });
            return;
        }
        const existingSite = existingSites.find(s => s.name === siteName);
        if (existingSite && existingSite.siteId) {
            logger_1.logger.info(`Using existing site: ${existingSite.siteId}`);
            siteId = existingSite.siteId;
            // Use existing credentials if available
            if (env_1.env.PANGOLIN_NEWT_ID && env_1.env.PANGOLIN_NEWT_SECRET) {
                newtId = env_1.env.PANGOLIN_NEWT_ID;
                newtSecret = env_1.env.PANGOLIN_NEWT_SECRET;
            }
        }
        else {
            // Create new site
            const logMsg = exitNodeId
                ? `Creating new site: ${siteName} with subnet ${subnet} and exit node ${exitNodeId}`
                : `Creating new site: ${siteName} with subnet ${subnet} (no exit node - self-hosted mode)`;
            logger_1.logger.info(logMsg);
            const payload = {
                name: siteName,
                type: 'newt',
                subnet,
                ...(exitNodeId && { exitNodeId: String(exitNodeId) }) // Ensure exitNodeId is a string
            };
            logger_1.logger.info(`Pangolin createSite payload: ${JSON.stringify(payload)}`);
            const site = await pangolin_client_1.pangolinClient.createSite(payload);
            siteId = site.siteId;
            newtId = site.newt?.newtId;
            newtSecret = site.newt?.secret;
            siteCreated = true;
            logger_1.logger.info(`Site created: ${siteId}`);
        }
        // --- Step 2: Load resource definitions and create resources ---
        const resourceDefs = loadResourceDefinitions();
        if (resourceDefs.length === 0) {
            logger_1.logger.warn('No resource definitions found - check configs/pangolin/resources.yml');
        }
        const created = [];
        const updated = [];
        const skipped = [];
        const warnings = [];
        const errors = [];
        // Get domain ID for the domain
        const domains = await pangolin_client_1.pangolinClient.listDomains();
        logger_1.logger.info(`Fetched ${domains.length} domains from Pangolin: ${domains.map(d => d.baseDomain).join(', ')}`);
        const matchingDomain = domains.find(d => domain.endsWith(d.baseDomain));
        if (!matchingDomain) {
            logger_1.logger.error(`Domain not found in Pangolin: ${domain}. Available domains: ${domains.map(d => d.baseDomain).join(', ')}`);
            res.status(400).json({
                error: {
                    message: `Domain "${domain}" not registered in Pangolin. Please register it first in the Pangolin dashboard under Domains.`,
                    code: 'DOMAIN_NOT_FOUND',
                    availableDomains: domains.map(d => d.baseDomain)
                }
            });
            return;
        }
        logger_1.logger.info(`Using domain: ${matchingDomain.baseDomain} (ID: ${matchingDomain.domainId})`);
        // Get existing resources
        const existingResources = await pangolin_client_1.pangolinClient.listResources();
        const existingByDomain = new Map(existingResources.map(r => [r.fullDomain || '', r]));
        for (const def of resourceDefs) {
            const fullDomain = def.subdomain ? `${def.subdomain}.${domain}` : domain;
            // Validate container before creating/updating resource
            const validation = await validateContainer(def);
            if (!validation.valid) {
                if (validation.shouldSkip) {
                    warnings.push(`${fullDomain}: ${validation.warning}`);
                    logger_1.logger.warn(validation.warning);
                    continue;
                }
                else {
                    errors.push(`${fullDomain}: ${validation.warning}`);
                    logger_1.logger.error(validation.warning);
                    continue;
                }
            }
            const existingResource = existingByDomain.get(fullDomain);
            if (existingResource) {
                // Check if resource needs update
                const desired = {
                    name: def.name,
                    ssl: true,
                    proxyPort: 80,
                    protocol: 'http',
                    fullDomain,
                };
                if (resourceNeedsUpdate(existingResource, desired)) {
                    try {
                        await pangolin_client_1.pangolinClient.updateResource(existingResource.resourceId, {
                            name: desired.name,
                            ssl: desired.ssl,
                            proxyPort: desired.proxyPort,
                            protocol: desired.protocol,
                            fullDomain: desired.fullDomain,
                        });
                        updated.push(fullDomain);
                        logger_1.logger.info(`Updated resource: ${fullDomain}`);
                    }
                    catch (err) {
                        const msg = err instanceof Error ? err.message : 'Unknown error';
                        errors.push(`${fullDomain} (update): ${msg}`);
                        logger_1.logger.error(`Failed to update resource ${fullDomain}:`, err);
                    }
                }
                else {
                    skipped.push(fullDomain);
                }
            }
            else {
                // Create new HTTP resource
                try {
                    const resource = await pangolin_client_1.pangolinClient.createResource({
                        name: def.name,
                        type: 'http',
                        domainId: matchingDomain.domainId,
                        subdomain: def.subdomain,
                        http: true,
                        ssl: true,
                        enabled: true,
                    });
                    // Add target after resource creation
                    try {
                        await pangolin_client_1.pangolinClient.createTarget(resource.resourceId, {
                            method: def.protocol === 'https' ? 'https' : 'http',
                            host: 'nginx', // All resources proxy through nginx
                            port: def.port,
                        });
                        created.push(fullDomain);
                        logger_1.logger.info(`Created resource and target: ${fullDomain} -> nginx:${def.port}`);
                    }
                    catch (targetErr) {
                        const msg = targetErr instanceof Error ? targetErr.message : 'Unknown error';
                        warnings.push(`${fullDomain}: Resource created but target failed: ${msg}`);
                        logger_1.logger.warn(`Failed to add target for ${fullDomain}:`, targetErr);
                    }
                }
                catch (err) {
                    const msg = err instanceof Error ? err.message : 'Unknown error';
                    errors.push(`${fullDomain}: ${msg}`);
                    logger_1.logger.error(`Failed to create resource ${fullDomain}:`, err);
                }
            }
        }
        // --- Step 3: Update .env file atomically (only if new site with credentials) ---
        let envUpdated = false;
        if (siteCreated && newtId && newtSecret) {
            try {
                const { readFileSync, writeFileSync } = await Promise.resolve().then(() => __importStar(require('fs')));
                const { join } = await Promise.resolve().then(() => __importStar(require('path')));
                const envPath = join(process.cwd(), '.env');
                const backupPath = join(process.cwd(), `.env.backup.${Date.now()}`);
                // Read current .env
                let envContent = readFileSync(envPath, 'utf8');
                // Create backup
                writeFileSync(backupPath, envContent, 'utf8');
                logger_1.logger.info(`Created .env backup: ${backupPath}`);
                // Helper to update or add env var
                const updateEnvVar = (content, key, value) => {
                    const regex = new RegExp(`^${key}=.*$`, 'm');
                    if (regex.test(content)) {
                        return content.replace(regex, `${key}=${value}`);
                    }
                    else {
                        return content + `\n${key}=${value}`;
                    }
                };
                // Update all Pangolin credentials
                envContent = updateEnvVar(envContent, 'PANGOLIN_SITE_ID', siteId);
                envContent = updateEnvVar(envContent, 'PANGOLIN_NEWT_ID', newtId);
                envContent = updateEnvVar(envContent, 'PANGOLIN_NEWT_SECRET', newtSecret);
                envContent = updateEnvVar(envContent, 'PANGOLIN_ENDPOINT', env_1.env.PANGOLIN_ENDPOINT || 'https://api.bnkserve.org');
                envContent = updateEnvVar(envContent, 'DOMAIN', domain);
                // Atomic write
                writeFileSync(envPath, envContent, 'utf8');
                envUpdated = true;
                logger_1.logger.info('.env file updated with Newt credentials');
            }
            catch (err) {
                logger_1.logger.error('Failed to update .env file:', err);
                errors.push('Failed to update .env file - manual update required');
            }
        }
        // --- Step 4: Restart Newt container (only if credentials updated) ---
        let containerRestarted = false;
        if (envUpdated) {
            try {
                const result = await docker_service_1.dockerService.restartContainer('newt');
                if (result.success) {
                    containerRestarted = true;
                    logger_1.logger.info('Newt container restarted successfully');
                }
                else {
                    logger_1.logger.error('Failed to restart Newt container:', result.output);
                    errors.push('Failed to restart Newt container - manual restart required');
                }
            }
            catch (err) {
                logger_1.logger.error('Failed to restart Newt container:', err);
                errors.push('Failed to restart Newt container - manual restart required');
            }
        }
        // --- Step 5: Verify tunnel operational (only if container restarted) ---
        let tunnelReady = false;
        if (containerRestarted) {
            // Wait a few seconds for container to start
            await new Promise(resolve => setTimeout(resolve, 5000));
            try {
                const testUrl = `https://app.${domain}/api/health`;
                const controller = new AbortController();
                const timeoutId = setTimeout(() => controller.abort(), 10000); // 10s timeout
                const response = await fetch(testUrl, {
                    method: 'GET',
                    signal: controller.signal,
                });
                clearTimeout(timeoutId);
                tunnelReady = response.ok;
                if (tunnelReady) {
                    logger_1.logger.info('Tunnel verification successful');
                }
                else {
                    logger_1.logger.warn('Tunnel verification failed - may still be initializing');
                }
            }
            catch (err) {
                logger_1.logger.warn('Tunnel verification failed - may still be initializing:', err);
            }
        }
        // --- Return full status ---
        res.json({
            success: true,
            site: {
                siteId,
                name: siteName,
                created: siteCreated,
                credentials: newtId && newtSecret ? {
                    newtId: `${newtId.substring(0, 8)}...`, // Masked for security
                    secretMasked: `${newtSecret.substring(0, 8)}...`,
                } : null,
            },
            resources: {
                created: created.length,
                updated: updated.length,
                skipped: skipped.length,
                total: resourceDefs.length,
                warnings: warnings.length,
                errors: errors.length,
                details: { created, updated, skipped, warnings, errors },
            },
            automation: {
                envUpdated,
                containerRestarted,
                tunnelReady,
            },
            instructions: !envUpdated ? [
                'Site already exists. To update credentials:',
                '1. Check .env file for existing PANGOLIN_NEWT_ID and PANGOLIN_NEWT_SECRET',
                '2. If missing, retrieve from Pangolin dashboard',
                '3. Restart Newt container: docker compose up -d newt',
            ] : [
                '✓ Site created',
                '✓ Resources synced',
                '✓ .env updated automatically',
                '✓ Newt container restarted',
                tunnelReady ? '✓ Tunnel verified operational' : '⚠ Tunnel initializing (check status in a few minutes)',
            ],
        });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        logger_1.logger.error('Automated Pangolin setup failed:', err);
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
// POST /api/pangolin/sync — Sync resources (create missing, update changed, report status)
router.post('/sync', pangolinSetupLimiter, async (_req, res) => {
    try {
        if (!pangolin_client_1.pangolinClient.configured) {
            res.status(400).json({ error: { message: 'Pangolin not configured', code: 'NOT_CONFIGURED' } });
            return;
        }
        const siteId = env_1.env.PANGOLIN_SITE_ID;
        if (!siteId) {
            res.status(400).json({ error: { message: 'PANGOLIN_SITE_ID not set. Run setup first.', code: 'NO_SITE' } });
            return;
        }
        const domain = env_1.env.DOMAIN;
        // Load resource definitions from YAML
        const resourceDefs = loadResourceDefinitions();
        if (resourceDefs.length === 0) {
            res.status(500).json({
                error: { message: 'No resource definitions found. Check configs/pangolin/resources.yml', code: 'NO_CONFIG' }
            });
            return;
        }
        // Get existing resources
        const existing = await pangolin_client_1.pangolinClient.listResources();
        const existingByDomain = new Map(existing.map(r => [r.fullDomain || '', r]));
        const created = [];
        const updated = [];
        const skipped = [];
        const warnings = [];
        const errors = [];
        for (const def of resourceDefs) {
            const fullDomain = def.subdomain ? `${def.subdomain}.${domain}` : domain;
            // Validate container before creating/updating resource
            const validation = await validateContainer(def);
            if (!validation.valid) {
                if (validation.shouldSkip) {
                    warnings.push(`${fullDomain}: ${validation.warning}`);
                    logger_1.logger.warn(validation.warning);
                    continue;
                }
                else {
                    errors.push(`${fullDomain}: ${validation.warning}`);
                    logger_1.logger.error(validation.warning);
                    continue;
                }
            }
            const existingResource = existingByDomain.get(fullDomain);
            if (existingResource) {
                // Check if resource needs update
                const desired = {
                    name: def.name,
                    ssl: true,
                    proxyPort: 80,
                    protocol: 'http',
                    fullDomain,
                };
                if (resourceNeedsUpdate(existingResource, desired)) {
                    try {
                        await pangolin_client_1.pangolinClient.updateResource(existingResource.resourceId, {
                            name: desired.name,
                            ssl: desired.ssl,
                            proxyPort: desired.proxyPort,
                            protocol: desired.protocol,
                            fullDomain: desired.fullDomain,
                        });
                        updated.push(fullDomain);
                        logger_1.logger.info(`Updated resource: ${fullDomain}`);
                    }
                    catch (err) {
                        const msg = err instanceof Error ? err.message : 'Unknown error';
                        errors.push(`${fullDomain} (update): ${msg}`);
                        logger_1.logger.error(`Failed to update resource ${fullDomain}:`, err);
                    }
                }
                else {
                    skipped.push(fullDomain);
                }
            }
            else {
                // Create new resource
                try {
                    await pangolin_client_1.pangolinClient.createResource({
                        name: def.name,
                        siteId,
                        subdomain: def.subdomain || undefined,
                        fullDomain,
                        ssl: true,
                        http: true,
                        protocol: 'http',
                        proxyPort: 80,
                    });
                    created.push(fullDomain);
                    logger_1.logger.info(`Created resource: ${fullDomain}`);
                }
                catch (err) {
                    const msg = err instanceof Error ? err.message : 'Unknown error';
                    errors.push(`${fullDomain}: ${msg}`);
                    logger_1.logger.error(`Failed to create resource ${fullDomain}:`, err);
                }
            }
        }
        res.json({
            success: true,
            created: created.length,
            updated: updated.length,
            skipped: skipped.length,
            warnings: warnings.length,
            errors: errors.length,
            details: { created, updated, skipped, warnings, errors },
        });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        logger_1.logger.error('Pangolin sync failed:', err);
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
// DELETE /api/pangolin/resource/:id — Delete a resource
router.delete('/resource/:id', async (req, res) => {
    try {
        const resourceId = req.params.id;
        await pangolin_client_1.pangolinClient.deleteResource(resourceId);
        res.json({ success: true });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
// PUT /api/pangolin/resource/:id — Update a resource
router.put('/resource/:id', async (req, res) => {
    try {
        const resourceId = req.params.id;
        const resource = await pangolin_client_1.pangolinClient.updateResource(resourceId, req.body);
        res.json({ success: true, resource });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        logger_1.logger.error('Pangolin resource update failed:', err);
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
// GET /api/pangolin/certificate/:domainId/:domain — Get certificate info
router.get('/certificate/:domainId/:domain', async (req, res) => {
    try {
        const { domainId, domain } = req.params;
        const certificate = await pangolin_client_1.pangolinClient.getCertificate(domainId, domain);
        res.json({ certificate });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
// POST /api/pangolin/certificate/:certId — Update certificate
router.post('/certificate/:certId', async (req, res) => {
    try {
        const certId = req.params.certId;
        const certificate = await pangolin_client_1.pangolinClient.updateCertificate(certId, req.body);
        res.json({ success: true, certificate });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
// GET /api/pangolin/resource/:id/clients — List connected clients for a resource
router.get('/resource/:id/clients', async (req, res) => {
    try {
        const resourceId = req.params.id;
        const clients = await pangolin_client_1.pangolinClient.listClients(resourceId);
        res.json({ clients });
    }
    catch (err) {
        const msg = err instanceof Error ? err.message : 'Unknown error';
        res.status(500).json({ error: { message: msg, code: 'PANGOLIN_ERROR' } });
    }
});
exports.pangolinRouter = router;
//# sourceMappingURL=pangolin.routes.js.map