import express from "express";

const app = express();
app.use(express.json());

const GATEWAY_SECRET_KEY = process.env.GATEWAY_SECRET_KEY;

app.post("/payments/session", async (req, res) => {
  const { amount, currency, orderId, customer, metadata, publicKey, environment } = req.body;

  if (!GATEWAY_SECRET_KEY) {
    return res.status(500).json({ errorCode: "SERVER_CONFIG_ERROR", message: "Gateway secret is not configured" });
  }

  // Use GATEWAY_SECRET_KEY here to create the payment order/session with your gateway.
  // Never return the secret key to the frontend.
  return res.json({
    paymentSessionId: `SESSION_${orderId}`,
    clientToken: "temporary_client_token_from_gateway",
    paymentId: `PAY_${Date.now()}`,
    checkoutUrl: `https://checkout.example.com/pay?session=${encodeURIComponent(`SESSION_${orderId}`)}`,
    gateway: "custom",
    rawResponse: {
      amount,
      currency,
      orderId,
      customer,
      metadata,
      publicKey,
      environment
    }
  });
});

app.post("/payments/verify", async (req, res) => {
  const { orderId, paymentId, rawResponse } = req.body;

  // Verify the payment signature/status with the gateway using GATEWAY_SECRET_KEY.
  // This endpoint is the source of truth for paid/failed/pending state.
  return res.json({
    status: "success",
    success: true,
    paymentId,
    orderId,
    transactionId: `TXN_${Date.now()}`,
    amount: rawResponse?.amount,
    currency: rawResponse?.currency,
    gateway: "custom",
    message: "Payment completed successfully",
    rawResponse,
    metadata: rawResponse?.metadata ?? {},
    timestamp: new Date().toISOString()
  });
});

app.get("/payments/status", async (req, res) => {
  return res.json({
    status: "pending",
    success: false,
    orderId: String(req.query.orderId ?? ""),
    paymentId: req.query.paymentId ? String(req.query.paymentId) : null,
    transactionId: null,
    gateway: "custom",
    message: "Payment is pending",
    rawResponse: {},
    metadata: {},
    timestamp: new Date().toISOString()
  });
});

app.post("/payments/cancel", async (req, res) => {
  return res.json({
    status: "cancelled",
    success: false,
    paymentId: null,
    orderId: req.body.orderId,
    transactionId: null,
    errorCode: "PAYMENT_CANCELLED",
    message: "Payment cancelled by user",
    rawResponse: {},
    metadata: {},
    timestamp: new Date().toISOString()
  });
});

app.listen(3001, () => {
  console.log("Secure payment backend running on http://localhost:3001");
});