server.ts

/**
 * @license
 * SPDX-License-Identifier: Apache-2.0
 */

import express from 'express';
import path from 'path';
import fs from 'fs';
import { createServer as createViteServer } from 'vite';
import { GoogleGenAI, Type } from '@google/genai';
import dotenv from 'dotenv';
import { DEFAULT_DB } from './src/utils/demoData';

dotenv.config();

const app = express();
const PORT = 3000;

// Resolve clean workspace data directory on disk
let DATA_DIR = path.join(process.cwd(), 'db-data');
const OLD_DATA_DIR = path.join(process.cwd(), 'data');
const configPath = path.join(process.cwd(), 'storage_config.json');

// Self-healing migration from legacy 'data' directory to 'db-data'
if (fs.existsSync(OLD_DATA_DIR)) {
  try {
    if (!fs.existsSync(DATA_DIR)) {
      fs.renameSync(OLD_DATA_DIR, DATA_DIR);
      console.log(`Successfully migrated legacy data folder to 'db-data' on disk.`);
    } else {
      // If both exist, copy contents of OLD_DATA_DIR into DATA_DIR to ensure DATA_DIR is fully up-to-date
      const copyRecursive = (src: string, dest: string) => {
        const stats = fs.statSync(src);
        if (stats.isDirectory()) {
          if (!fs.existsSync(dest)) fs.mkdirSync(dest, { recursive: true });
          fs.readdirSync(src).forEach((child) => {
            copyRecursive(path.join(src, child), path.join(dest, child));
          });
        } else {
          // Overwrite always to make sure we get the latest active data
          fs.copyFileSync(src, dest);
        }
      };
      copyRecursive(OLD_DATA_DIR, DATA_DIR);
      console.log(`Successfully copied/synchronized latest active data from 'data' to 'db-data'.`);
    }
  } catch (err) {
    console.error('Migration from legacy data folder failed:', err);
  }
}

if (fs.existsSync(configPath)) {
  try {
    const cfg = JSON.parse(fs.readFileSync(configPath, 'utf8'));
    if (cfg.customDataDir) {
      let resolved = path.resolve(cfg.customDataDir.trim());
      // If storage_config.json refers to the old 'data' directory, migrate it to 'db-data'
      if (resolved === path.resolve(OLD_DATA_DIR)) {
        resolved = path.resolve(DATA_DIR);
        fs.writeFileSync(configPath, JSON.stringify({ customDataDir: resolved }, null, 2), 'utf8');
        console.log(`Successfully updated storage_config.json path to ${resolved}`);
      }
      DATA_DIR = resolved;
    }
  } catch (e) {
    console.error('Failed to parse storage_config.json:', e);
  }
}

if (!fs.existsSync(DATA_DIR)) {
  fs.mkdirSync(DATA_DIR, { recursive: true });
}

/**
 * Ensures that every company folder listed in the folders.json has an actual
 * physical directory created for it on disk, containing its database file (db.json).
 * It also migrates old flat db_*.json files into their respective subdirectories automatically.
 */
function ensureDirectoriesExist() {
  const foldersPath = path.join(DATA_DIR, 'folders.json');
  let foldersList: any[] = [];
  
  if (fs.existsSync(foldersPath)) {
    try {
      foldersList = JSON.parse(fs.readFileSync(foldersPath, 'utf8'));
    } catch (e) {
      console.error('Failed reading folders.json during alignment:', e);
    }
  }

  // If empty or invalid, fall back to defaults
  if (!foldersList || !Array.isArray(foldersList) || foldersList.length === 0) {
    foldersList = [
      {
        id: 'folder-demo-advertising',
        name: 'Avantgarde Creative Agency e.K.',
        color: 'indigo',
        isDemo: true,
        createdAt: new Date().toISOString()
      },
      {
        id: 'folder-my-company',
        name: 'Eigene Unternehmung',
        color: 'emerald',
        isDemo: false,
        createdAt: new Date().toISOString()
      }
    ];
    try {
      fs.writeFileSync(foldersPath, JSON.stringify(foldersList, null, 2), 'utf8');
    } catch (e) {
      console.error('Failed initialization of default folders.json:', e);
    }
  }

  // Double check that folders.json includes its physical directory and db file
  for (const f of foldersList) {
    if (!f.id) continue;
    
    const folderDir = path.join(DATA_DIR, f.id);
    if (!fs.existsSync(folderDir)) {
      try {
        fs.mkdirSync(folderDir, { recursive: true });
        console.log(`Created physical directory for firm: ${folderDir}`);
      } catch (err) {
        console.error(`Failed creating company directory ${folderDir}:`, err);
      }
    }

    const nestedDbPath = path.join(folderDir, 'db.json');
    const legacyFlatDbPath = path.join(DATA_DIR, `db_${f.id}.json`);

    // We check if it is the demo folder and needs seeding or re-seeding
    let needsDemoSeeding = false;
    if (f.id === 'folder-demo-advertising' || f.isDemo) {
      if (!fs.existsSync(nestedDbPath)) {
        needsDemoSeeding = true;
      } else {
        try {
          const content = JSON.parse(fs.readFileSync(nestedDbPath, 'utf8'));
          if (!content.invoices || content.invoices.length === 0) {
            needsDemoSeeding = true; // Seed/restore if empty/partial/wiped
          }
        } catch (e) {
          needsDemoSeeding = true;
        }
      }
    }

    if (needsDemoSeeding) {
      try {
        // Extract and physically save any demo receipt files first
        saveReceiptFiles(f.id, DEFAULT_DB);

        // Keep database JSON on disk light by removing base64 values
        const dbToSave = JSON.parse(JSON.stringify(DEFAULT_DB));
        if (dbToSave && Array.isArray(dbToSave.expenses)) {
          for (const exp of dbToSave.expenses) {
            if (exp.receiptAttached && exp.receiptFileName) {
              delete exp.receiptBase64;
            }
          }
        }

        fs.writeFileSync(nestedDbPath, JSON.stringify(dbToSave, null, 2), 'utf8');
        console.log(`Successfully seeded the default demo database at: ${nestedDbPath}`);
      } catch (err) {
        console.error(`Could not write default seeded db file for ${f.id}:`, err);
      }
    } else if (!fs.existsSync(nestedDbPath)) {
      if (fs.existsSync(legacyFlatDbPath)) {
        try {
          fs.copyFileSync(legacyFlatDbPath, nestedDbPath);
          fs.unlinkSync(legacyFlatDbPath);
          console.log(`Successfully migrated legacy flat database to nested workspace: ${nestedDbPath}`);
        } catch (err) {
          console.error(`Failed migrating flat database for ${f.id}:`, err);
        }
      } else {
        // Create an empty, initial database shell so that a physical file exists immediately
        const initialDB = {
          settings: {
            companyName: f.name,
            ownerName: 'Admin',
            street: 'Hauptstraße 1',
            zipCode: '10115',
            city: 'Berlin',
            taxPeriod: 'monthly',
            kontenrahmen: 'SKR03',
            isOnboarded: false
          },
          contacts: [],
          invoices: [],
          expenses: [],
          cashbook: [],
          transactions: [],
          articles: [],
          deadlines: []
        };
        try {
          fs.writeFileSync(nestedDbPath, JSON.stringify(initialDB, null, 2), 'utf8');
          console.log(`Established fresh physical database file at: ${nestedDbPath}`);
        } catch (err) {
          console.error(`Could not write default db file for ${f.id}:`, err);
        }
      }
    }
  }
}

// Perform active alignment immediately on launch
ensureDirectoriesExist();

// Set request payload limits high enough to handle base64 receipt uploads
app.use(express.json({ limit: '50mb' }));
app.use(express.urlencoded({ limit: '50mb', extended: true }));

// --- SERVER-SIDE FILE PERSISTENCE API ENDPOINTS ---

/**
 * 1. GET /api/folders
 * Returns folders list from disk folders.json, or sets up defaults. Also aligns physical subfolders if needed.
 */
app.get('/api/folders', (req, res) => {
  ensureDirectoriesExist();
  const foldersPath = path.join(DATA_DIR, 'folders.json');
  if (fs.existsSync(foldersPath)) {
    try {
      const data = fs.readFileSync(foldersPath, 'utf8');
      return res.json(JSON.parse(data));
    } catch (e) {
      console.error('Failed reading folders.json:', e);
    }
  }
  res.json([]);
});

/**
 * 2. POST /api/folders
 * Saves folders configuration to disk folders.json
 */
app.post('/api/folders', (req, res) => {
  const { folders } = req.body;
  if (!folders || !Array.isArray(folders)) {
    return res.status(400).json({ error: 'INVALID_FOLDERS_STRUCT', message: 'Ungültige Ordner-Konfiguration.' });
  }
  const foldersPath = path.join(DATA_DIR, 'folders.json');
  try {
    fs.writeFileSync(foldersPath, JSON.stringify(folders, null, 2), 'utf8');
    // Instantly reflect actual folders on drive
    ensureDirectoriesExist();
    res.json({ success: true });
  } catch (e: any) {
    console.error('Error writing folders.json to disk:', e);
    res.status(500).json({ error: 'DISK_WRITE_ERROR', message: e.message });
  }
});

/**
 * 3. GET /api/active-folder
 * Returns current active folder ID saved on disk active_folder_id.txt
 */
app.get('/api/active-folder', (req, res) => {
  const activePath = path.join(DATA_DIR, 'active_folder_id.txt');
  if (fs.existsSync(activePath)) {
    try {
      const activeId = fs.readFileSync(activePath, 'utf8').trim();
      return res.json({ activeFolderId: activeId });
    } catch (e) {
      console.error('Error reading active_folder_id.txt:', e);
    }
  }
  res.json({ activeFolderId: 'folder-demo-advertising' });
});

/**
 * 4. POST /api/active-folder
 * Saves current active folder ID to disk active_folder_id.txt
 */
app.post('/api/active-folder', (req, res) => {
  const { activeFolderId } = req.body;
  if (!activeFolderId) {
    return res.status(400).json({ error: 'INVALID_ID_VALUE', message: 'activeFolderId muss angegeben werden.' });
  }
  const activePath = path.join(DATA_DIR, 'active_folder_id.txt');
  try {
    fs.writeFileSync(activePath, activeFolderId, 'utf8');
    res.json({ success: true });
  } catch (e: any) {
    console.error('Error saving active_folder_id.txt to disk:', e);
    res.status(500).json({ error: 'DISK_WRITE_ERROR', message: e.message });
  }
});

/**
 * Saves base64 receipt attachments as individual physical files in the folder's 'belege' subdirectory
 */
function saveReceiptFiles(folderId: string, db: any): void {
  if (!db || !Array.isArray(db.expenses)) return;
  const belegeDir = path.join(DATA_DIR, folderId, 'belege');
  if (!fs.existsSync(belegeDir)) {
    fs.mkdirSync(belegeDir, { recursive: true });
  }

  const referencedFiles = new Set<string>();

  for (const exp of db.expenses) {
    if (exp.receiptAttached && exp.receiptFileName) {
      const sanitizedFileName = path.basename(exp.receiptFileName);
      referencedFiles.add(sanitizedFileName);

      if (exp.receiptBase64 && typeof exp.receiptBase64 === 'string') {
        const matches = exp.receiptBase64.match(/^data:([^;]+);base64,(.+)$/);
        try {
          let buffer: Buffer;
          if (matches) {
            buffer = Buffer.from(matches[2], 'base64');
          } else {
            // Raw base64 or other format
            buffer = Buffer.from(exp.receiptBase64, 'base64');
          }
          const filePath = path.join(belegeDir, sanitizedFileName);
          fs.writeFileSync(filePath, buffer);
          console.log(`Saved physical receipt file: ${filePath}`);
        } catch (e) {
          console.error(`Error saving physical receipt file ${sanitizedFileName}:`, e);
        }
      }
    }
  }

  // Delete orphaned physical files in the folder's belegeDir that are no longer referenced in db
  if (fs.existsSync(belegeDir)) {
    try {
      const files = fs.readdirSync(belegeDir);
      for (const file of files) {
        if (!referencedFiles.has(file)) {
          const orphanPath = path.join(belegeDir, file);
          fs.unlinkSync(orphanPath);
          console.log(`Physically deleted orphaned receipt: ${orphanPath}`);
        }
      }
    } catch (e) {
      console.error(`Error cleaning up orphaned files in ${belegeDir}:`, e);
    }
  }
}

/**
 * Loads physical receipt files from the 'belege' subdirectory and populates receiptBase64 for the client
 */
function loadReceiptFiles(folderId: string, db: any): void {
  if (!db || !Array.isArray(db.expenses)) return;
  const belegeDir = path.join(DATA_DIR, folderId, 'belege');
  if (!fs.existsSync(belegeDir)) return;

  for (const exp of db.expenses) {
    if (exp.receiptAttached && exp.receiptFileName) {
      const sanitizedFileName = path.basename(exp.receiptFileName);
      const filePath = path.join(belegeDir, sanitizedFileName);
      if (fs.existsSync(filePath)) {
        try {
          const buffer = fs.readFileSync(filePath);
          const base64Data = buffer.toString('base64');
          const ext = path.extname(sanitizedFileName).toLowerCase();
          let mimeType = 'image/jpeg';
          if (ext === '.pdf') {
            mimeType = 'application/pdf';
          } else if (ext === '.png') {
            mimeType = 'image/png';
          } else if (ext === '.gif') {
            mimeType = 'image/gif';
          } else if (ext === '.webp') {
            mimeType = 'image/webp';
          }
          exp.receiptBase64 = `data:${mimeType};base64,${base64Data}`;
        } catch (e) {
          console.error(`Error loading physical receipt file ${sanitizedFileName}:`, e);
        }
      }
    }
  }
}

/**
 * 5. GET /api/db/load
 * Loads a folder specific database JSON from its corresponding subdirectory (e.g. data/folderId/db.json)
 */
app.get('/api/db/load', (req, res) => {
  const { folderId } = req.query;
  if (!folderId || typeof folderId !== 'string') {
    return res.status(400).json({ error: 'INVALID_FOLDER_ID', message: 'folderId erforderlich.' });
  }

  // Prevent path traversal
  if (folderId.includes('..') || folderId.includes('/') || folderId.includes('\\')) {
    return res.status(400).json({ error: 'PATH_TRAVERSAL_PREVENTED', message: 'Ungültige folderId.' });
  }

  const nestedDbPath = path.join(DATA_DIR, folderId, 'db.json');
  const legacyFlatPath = path.join(DATA_DIR, `db_${folderId}.json`);

  // Try nested database path
  if (fs.existsSync(nestedDbPath)) {
    try {
      const data = fs.readFileSync(nestedDbPath, 'utf8');
      const parsed = JSON.parse(data);
      // Load physical receipt file attachments from the subfolder
      loadReceiptFiles(folderId, parsed);
      return res.json(parsed);
    } catch (e) {
      console.error(`Error loading database file ${nestedDbPath} from disk:`, e);
    }
  }

  // Fallback / Auto-migration during load
  if (fs.existsSync(legacyFlatPath)) {
    try {
      const data = fs.readFileSync(legacyFlatPath, 'utf8');
      const parsed = JSON.parse(data);
      const folderDir = path.join(DATA_DIR, folderId);
      if (!fs.existsSync(folderDir)) {
        fs.mkdirSync(folderDir, { recursive: true });
      }
      fs.writeFileSync(nestedDbPath, JSON.stringify(parsed, null, 2), 'utf8');
      fs.unlinkSync(legacyFlatPath);
      // Save physical receipt files if any legacy ones are present as base64 in the loaded state
      saveReceiptFiles(folderId, parsed);
      return res.json(parsed);
    } catch (e) {
      console.error(`Error migrating legacy database for ${folderId} on-the-fly:`, e);
    }
  }

  res.json({ notFound: true });
});

/**
 * 6. POST /api/db/save
 * Writes standard pretty-printed database JSON content to the nested subdirectory (data/folderId/db.json)
 */
app.post('/api/db/save', (req, res) => {
  const { folderId, db } = req.body;
  if (!folderId || !db) {
    return res.status(400).json({ error: 'INVALID_PAYLOAD_STRUCT', message: 'folderId und db-Objekt fehlen.' });
  }

  // Prevent path traversal
  if (folderId.includes('..') || folderId.includes('/') || folderId.includes('\\')) {
    return res.status(400).json({ error: 'PATH_TRAVERSAL_PREVENTED', message: 'Ungültige folderId.' });
  }

  const folderDir = path.join(DATA_DIR, folderId);
  if (!fs.existsSync(folderDir)) {
    fs.mkdirSync(folderDir, { recursive: true });
  }

  // Extract and save receipt files to the physical subfolder
  saveReceiptFiles(folderId, db);

  // Strip large base64 strings from db.json to keep filesystem clean and fast
  const dbToSave = JSON.parse(JSON.stringify(db));
  if (dbToSave && Array.isArray(dbToSave.expenses)) {
    for (const exp of dbToSave.expenses) {
      if (exp.receiptAttached && exp.receiptFileName) {
        delete exp.receiptBase64;
      }
    }
  }

  const dbPath = path.join(folderDir, 'db.json');
  try {
    fs.writeFileSync(dbPath, JSON.stringify(dbToSave, null, 2), 'utf8');
    res.json({ success: true });
  } catch (e: any) {
    console.error(`Error saving database file ${dbPath} to disk:`, e);
    res.status(500).json({ error: 'DISK_WRITE_ERROR', message: e.message });
  }
});

/**
 * 6c. POST /api/db/save-document
 * Saves a document file physically to a dynamic subdirectory (belege, rechnungen, or dokumente) inside the active folder.
 */
app.post('/api/db/save-document', (req, res) => {
  const { folderId, fileName, base64, subfolder } = req.body;
  if (!folderId || !fileName || !base64 || !subfolder) {
    return res.status(400).json({ error: 'INVALID_PAYLOAD', message: 'Pfad, Dateiname, Inhalt und Unterordner erforderlich.' });
  }

  // Prevent path traversal
  if (folderId.includes('..') || folderId.includes('/') || folderId.includes('\\') ||
      fileName.includes('..') || fileName.includes('/') || fileName.includes('\\') ||
      subfolder.includes('..') || subfolder.includes('/') || subfolder.includes('\\')) {
    return res.status(400).json({ error: 'PATH_TRAVERSAL_PREVENTED', message: 'Ungültige Pfadangaben.' });
  }

  const targetDir = path.join(DATA_DIR, folderId, subfolder);
  if (!fs.existsSync(targetDir)) {
    fs.mkdirSync(targetDir, { recursive: true });
  }

  const cleanBase64 = base64.replace(/^data:[^;]+;base64,/, '');
  try {
    const buffer = Buffer.from(cleanBase64, 'base64');
    const filePath = path.join(targetDir, fileName);
    fs.writeFileSync(filePath, buffer);
    console.log(`Physically saved document under relevant folder: ${filePath}`);
    res.json({ success: true, path: filePath });
  } catch (e: any) {
    console.error(`Error saving document ${fileName} in ${subfolder}:`, e);
    res.status(500).json({ error: 'DISK_WRITE_ERROR', message: e.message });
  }
});

/**
 * 6d. GET /api/db/get-document
 * Serves or downloads a physical file from the active folder's subdirectories.
 */
app.get('/api/db/get-document', (req, res) => {
  const { folderId, subfolder, fileName } = req.query;
  if (!folderId || !subfolder || !fileName || typeof folderId !== 'string' || typeof subfolder !== 'string' || typeof fileName !== 'string') {
    return res.status(400).json({ error: 'INVALID_PARAMS', message: 'Parameter fehlen.' });
  }

  // Prevent path traversal
  if (folderId.includes('..') || folderId.includes('/') || folderId.includes('\\') ||
      subfolder.includes('..') || subfolder.includes('/') || subfolder.includes('\\') ||
      fileName.includes('..') || fileName.includes('/') || fileName.includes('\\')) {
    return res.status(400).json({ error: 'PATH_TRAVERSAL_PREVENTED', message: 'Ungültige Pfadangaben.' });
  }

  const filePath = path.join(DATA_DIR, folderId, subfolder, fileName);
  if (!fs.existsSync(filePath)) {
    return res.status(404).json({ error: 'FILE_NOT_FOUND', message: 'Datei nicht gefunden.' });
  }

  try {
    const stat = fs.statSync(filePath);
    const fileContent = fs.readFileSync(filePath);
    const ext = path.extname(fileName).toLowerCase();
    let mimeType = 'application/octet-stream';
    if (ext === '.pdf') {
      mimeType = 'application/pdf';
    } else if (ext === '.png') {
      mimeType = 'image/png';
    } else if (ext === '.jpg' || ext === '.jpeg') {
      mimeType = 'image/jpeg';
    } else if (ext === '.gif') {
      mimeType = 'image/gif';
    } else if (ext === '.webp') {
      mimeType = 'image/webp';
    } else if (ext === '.txt') {
      mimeType = 'text/plain';
    } else if (ext === '.json') {
      mimeType = 'application/json';
    }

    res.setHeader('Content-Type', mimeType);
    res.setHeader('Content-Length', stat.size);
    res.setHeader('Content-Disposition', `inline; filename="${encodeURIComponent(fileName)}"`);
    res.send(fileContent);
  } catch (e: any) {
    console.error(`Error serving document ${fileName}:`, e);
    res.status(500).json({ error: 'SERVE_ERROR', message: e.message });
  }
});

/**
 * 6e. POST /api/db/delete-document
 * Deletes a physical file from the active folder's subdirectories.
 */
app.post('/api/db/delete-document', (req, res) => {
  const { folderId, subfolder, fileName } = req.body;
  if (!folderId || !subfolder || !fileName) {
    return res.status(400).json({ error: 'INVALID_PARAMS', message: 'Parameter fehlen.' });
  }

  // Prevent path traversal
  if (folderId.includes('..') || folderId.includes('/') || folderId.includes('\\') ||
      subfolder.includes('..') || subfolder.includes('/') || subfolder.includes('\\') ||
      fileName.includes('..') || fileName.includes('/') || fileName.includes('\\')) {
    return res.status(400).json({ error: 'PATH_TRAVERSAL_PREVENTED', message: 'Ungültige Pfadangaben.' });
  }

  const filePath = path.join(DATA_DIR, folderId, subfolder, fileName);
  if (!fs.existsSync(filePath)) {
    return res.status(404).json({ error: 'FILE_NOT_FOUND', message: 'Datei nicht gefunden.' });
  }

  try {
    fs.unlinkSync(filePath);
    console.log(`Physically deleted document: ${filePath}`);
    res.json({ success: true });
  } catch (e: any) {
    console.error(`Error deleting document ${fileName}:`, e);
    res.status(500).json({ error: 'DELETE_ERROR', message: e.message });
  }
});

/**
 * 6b. POST /api/db/delete-folder
 * Physically deletes a specific folder directory from disk (recursive)
 */
app.post('/api/db/delete-folder', (req, res) => {
  const { folderId } = req.body;
  if (!folderId || typeof folderId !== 'string') {
    return res.status(400).json({ error: 'INVALID_FOLDER_ID', message: 'folderId ist erforderlich.' });
  }
  // Prevent path traversal
  if (folderId.includes('..') || folderId.includes('/') || folderId.includes('\\')) {
    return res.status(400).json({ error: 'INVALID_FOLDER_ID', message: 'Ungültige folderId.' });
  }
  const folderDir = path.join(DATA_DIR, folderId);
  try {
    if (fs.existsSync(folderDir)) {
      fs.rmSync(folderDir, { recursive: true, force: true });
      console.log(`Physically deleted folder subdirectory from disk: ${folderDir}`);
    }
    res.json({ success: true });
  } catch (e: any) {
    console.error(`Error deleting folder ${folderId} from disk:`, e);
    res.status(500).json({ error: 'DISK_DELETE_ERROR', message: e.message });
  }
});

/**
 * 7. POST /api/db/delete-all
 * Deletes all database assets from disk (reset app)
 */
app.post('/api/db/delete-all', (req, res) => {
  const foldersPath = path.join(DATA_DIR, 'folders.json');
  const activePath = path.join(DATA_DIR, 'active_folder_id.txt');
  try {
    if (fs.existsSync(foldersPath)) fs.unlinkSync(foldersPath);
    if (fs.existsSync(activePath)) fs.unlinkSync(activePath);
    const files = fs.readdirSync(DATA_DIR);
    for (const file of files) {
      const fullPath = path.join(DATA_DIR, file);
      if (fs.statSync(fullPath).isDirectory()) {
        fs.rmSync(fullPath, { recursive: true, force: true });
      } else if (file !== '.gitkeep' && file !== 'folders.json' && file !== 'active_folder_id.txt') {
        fs.unlinkSync(fullPath);
      }
    }
    res.json({ success: true });
  } catch (e: any) {
    console.error('Error clearing data folder:', e);
    res.status(500).json({ error: 'DISK_DELETE_ERROR', message: e.message });
  }
});

/**
 * Helper to recursively crawl data folder and find directories + nested files
 */
function crawlDirectory(basePath: string, relativePath: string = ''): any[] {
  let fileList: any[] = [];
  const activePath = path.join(basePath, relativePath);
  if (!fs.existsSync(activePath)) return [];

  const items = fs.readdirSync(activePath);
  for (const item of items) {
    const relativeName = relativePath ? path.join(relativePath, item) : item;
    const itemFullPath = path.join(basePath, relativeName);
    const stat = fs.statSync(itemFullPath);

    if (stat.isDirectory()) {
      // Add directory node itself
      fileList.push({
        name: relativeName,
        size: 0,
        mtime: stat.mtime,
        type: 'directory'
      });
      // Recurse down
      fileList = fileList.concat(crawlDirectory(basePath, relativeName));
    } else {
      fileList.push({
        name: relativeName,
        size: stat.size,
        mtime: stat.mtime,
        type: relativeName.endsWith('.json') ? 'database' : relativeName.endsWith('.txt') ? 'text' : 'file'
      });
    }
  }
  return fileList;
}

/**
 * 8. GET /api/data-tree
 * Scans the data/ folder recursively and returns details about all subfolders and files
 */
app.get('/api/data-tree', (req, res) => {
  try {
    const crawledFiles = crawlDirectory(DATA_DIR);
    res.json({ success: true, path: DATA_DIR, files: crawledFiles });
  } catch (e: any) {
    console.error('Error scanning nested data/ tree:', e);
    res.status(500).json({ error: 'SCAN_ERROR', message: e.message });
  }
});

/**
 * 9. GET /api/storage-config
 * Returns current dynamic files storage location metadata for offline admin control
 */
app.get('/api/storage-config', (req, res) => {
  res.json({
    success: true,
    currentPath: DATA_DIR,
    absolutePath: path.resolve(DATA_DIR),
    isCustom: DATA_DIR !== path.join(process.cwd(), 'db-data'),
    defaultPath: path.join(process.cwd(), 'db-data')
  });
});

/**
 * 10. POST /api/storage-config
 * Changes the physical directory used for active database storage, optionally copying files
 */
app.post('/api/storage-config', (req, res) => {
  const { customDataDir, copyExisting } = req.body;
  if (!customDataDir) {
    return res.status(400).json({ error: 'MISSING_PATH', message: 'Pfad-Angabe fehlt.' });
  }

  try {
    const resolvedPath = path.resolve(customDataDir.trim());
    
    // Attempt to verify/create directory
    if (!fs.existsSync(resolvedPath)) {
      fs.mkdirSync(resolvedPath, { recursive: true });
    }

    const oldDir = DATA_DIR;

    // Transfer contents if requested
    if (copyExisting && oldDir !== resolvedPath) {
      if (fs.existsSync(oldDir)) {
        const files = fs.readdirSync(oldDir);
        for (const file of files) {
          const src = path.join(oldDir, file);
          const dest = path.join(resolvedPath, file);
          if (fs.statSync(src).isFile()) {
            fs.copyFileSync(src, dest);
          }
        }
      }
    }

    // Save choice locally to survive restarts
    fs.writeFileSync(configPath, JSON.stringify({ customDataDir: resolvedPath }, null, 2), 'utf8');
    
    // Switch dynamic runtime pointer immediately
    DATA_DIR = resolvedPath;

    res.json({
      success: true,
      currentPath: DATA_DIR,
      absolutePath: path.resolve(DATA_DIR),
      isCustom: DATA_DIR !== path.join(process.cwd(), 'db-data')
    });
  } catch (e: any) {
    console.error('Failed to update storage directory:', e);
    res.status(500).json({ error: 'STORAGE_UPDATE_FAILED', message: e.message });
  }
});

// Initialize Google GenAI client
// Initialize Google GenAI client
// User-Agent: 'aistudio-build' is set for telemetry
const ai = new GoogleGenAI({
  apiKey: process.env.GEMINI_API_KEY,
  httpOptions: {
    headers: {
      'User-Agent': 'aistudio-build',
    },
  },
});

// Helper: Get AI client, dynamically using header key if present
function getAiClient(req: express.Request): GoogleGenAI {
  const customKey = req.headers['x-gemini-api-key'] as string;
  if (customKey && customKey !== 'MY_GEMINI_API_KEY' && customKey.trim() !== '') {
    return new GoogleGenAI({
      apiKey: customKey,
      httpOptions: {
        headers: {
          'User-Agent': 'aistudio-build',
        },
      },
    });
  }
  return ai;
}

// Helper: Ensure Gemini API key is configured
function checkApiKey(req: express.Request, res: express.Response): boolean {
  const customKey = req.headers['x-gemini-api-key'] as string;
  if (customKey && customKey !== 'MY_GEMINI_API_KEY' && customKey.trim() !== '') {
    return true;
  }
  if (!process.env.GEMINI_API_KEY || process.env.GEMINI_API_KEY === 'MY_GEMINI_API_KEY') {
    res.status(500).json({
      error: 'GEMINI_API_KEY_MISSING',
      message: 'Der Gemini API Key fehlt. Bitte konfiguriere ihn in den Systemeinstellungen oder im AI Studio Secrets-Panel.',
    });
    return false;
  }
  return true;
}

/**
 * Endpoint: /api/chat
 * Handles conversational queries with Büro Susi, injecting full background company/business context
 * and returning structured chat solutions + structured actionable payloads (proposals).
 */
app.post('/api/chat', async (req, res) => {
  if (!checkApiKey(req, res)) return;

  const { messages, userContext } = req.body;

  if (!messages || !Array.isArray(messages)) {
    res.status(400).json({ error: 'Falsche Eingabedaten', message: 'Nachrichten-Verlauf fehlt.' });
    return;
  }

  // Build high-context system instructions incorporating user's parameters
  const clientStatus = userContext || {};
  const isKlein = clientStatus.isKleinunternehmer ? 'Ja (Umsatzsteuerbefreit nach §19 UStG. Umsatzsteuer darf auf Rechnungen NICHT erhoben werden)' : 'Nein (Regelbesteuert, 19% bzw. 7% MwSt. ist auszuweisen)';
  
  const systemInstruction = `
Du bist Büro Susi – ein smarter, extrem benutzerfreundlicher Büro- und Buchhaltungs-Assistent für Selbstständige, Freiberufler und Kleinunternehmer in Deutschland.
Deine Zielgruppe hat keine tiefen Steuer- oder Buchhaltungskenntnisse. Antworte immer auf Deutsch, verständlich, unterstützend und lösungsorientiert. Unnötiges Steuer-Fachchinesisch ist zu vermeiden.

Aktueller Unternehmenskontext des Nutzers:
- Firmenname: ${clientStatus.companyName || 'Nicht angegeben'}
- Inhaber: ${clientStatus.ownerName || 'Nicht angegeben'}
- Kleinunternehmer-Status nach § 19 UStG: ${isKlein}
- Steuernummer: ${clientStatus.taxId || 'Nicht angegeben'}
- USt-IdNr: ${clientStatus.vatId || 'Nicht angegeben'}
- Zahl der vorhandenen Kunden/Lieferanten: ${clientStatus.contactsCount || 0}
- Zahl der erstellten Rechnungen/Angebote: ${clientStatus.invoicesCount || 0}
- Zahl der Ausgaben: ${clientStatus.expensesCount || 0}

Richtlinien für dein Verhalten:
1. Denke immer GoBD-konform. Belege müssen geordnet und lesbar sein.
2. Wenn der Nutzer Rechnungen erstellen will:
   - Falls Kleinunternehmer, weise ihn freundlich darauf hin, dass keine Umsatzsteuer ausgewiesen wird, sondern der Steuerbefreiungshinweis (§ 19 UStG) Pflicht ist.
   - Falls regelbesteuert, erinnere an 19% oder 7%.
3. Wenn der Nutzer nach Umsätzen oder Steuern fragt, gib präzise, übersichtliche Rückmeldungen. Nutze Markdown-Tabellen für Datenstrukturen.
4. Biete proaktiv Vorschläge an! Wenn der Nutzer sagt "Erstelle eine Rechnung an Sabine Becker über 5 Std Consulting zu je 100€", antworte hilfsbereit und fülle das "actionProposal" im Rückgabe-JSON aus, damit das UI das Formular direkt automatisch laden oder erstellen kann!

Schema für die Aktionstypen im "actionProposal" (falls zutreffend):
- "create_invoice": Erstellung einer Rechnung/eines Angebots. Datenstruktur:
  {
    "type": "invoice" | "quote",
    "customerName": string, 
    "items": [{"name": string, "quantity": number, "unit": string, "unitPrice": number, "vatRate": number}]
  }
- "add_expense": Buchen einer Ausgabe. Datenstruktur:
  {
    "supplierName": string,
    "description": string,
    "netAmount": number,
    "vatRate": number,
    "vatAmount": number,
    "grossAmount": number,
    "category": string
  }
- "add_contact": Neuen Kontakt anlegen. Datenstruktur:
  {
    "type": "customer" | "supplier",
    "name": string,
    "contactPerson": string,
    "email": string,
    "phone": string
  }

Antworte IMMER im spezifizierten JSON-Format mit den Feldern "reply" (Markdown Text) und optional "actionProposal".
`;

  try {
    // We map client messages to Google GenAI structure
    // Translating role 'assistant' to 'model' and 'user' to 'user'
    const contents = messages.map((m: any) => ({
      role: m.sender === 'assistant' ? 'model' : 'user',
      parts: [{ text: m.text }],
    }));

    const dynamicAi = getAiClient(req);
    const response = await dynamicAi.models.generateContent({
      model: 'gemini-3.5-flash',
      contents: contents,
      config: {
        systemInstruction: systemInstruction,
        responseMimeType: 'application/json',
        responseSchema: {
          type: Type.OBJECT,
          properties: {
            reply: {
              type: Type.STRING,
              description: 'Der eigentliche Antworttext auf Deutsch. Nutze Markdown zur Strukturierung (Überschriften, Tabellen, Aufzählungen).',
            },
            actionProposal: {
              type: Type.OBJECT,
              description: 'Wird befüllt, wenn der Benutzer im Chat explizit darum bittet eine Rechnung zu schreiben, Ausgaben zu buchen oder Kontakte anzulegen.',
              properties: {
                type: {
                  type: Type.STRING,
                  description: "Der Aktionstyp: 'create_invoice' | 'create_quote' | 'add_expense' | 'add_contact'",
                },
                data: {
                  type: Type.OBJECT,
                  description: 'Gepolsterte Werte für das Formular laut Spezifikation.',
                },
              },
            },
          },
          required: ['reply'],
        },
      },
    });

    const resultText = response.text || '{}';
    const parsedResult = JSON.parse(resultText);
    res.json(parsedResult);
  } catch (error: any) {
    console.error('Büro Susi Chat Endpoint Error:', error);
    res.status(500).json({
      error: 'GEMINI_API_ERROR',
      message: 'Fehler bei der Kommunikation mit Büro Susi. Bitte versuche es erneut.',
      debug: error.message,
    });
  }
});

/**
 * Endpoint: /api/analyze-receipt
 * Uses Gemini-3.5-Flash to visually parse images of business receipts / bills
 * and automatically proposes highly accurate tax booking values in German standards.
 */
app.post('/api/analyze-receipt', async (req, res) => {
  if (!checkApiKey(req, res)) return;

  const { imageBase64, mimeType } = req.body;

  if (!imageBase64 || !mimeType) {
    res.status(400).json({ error: 'Falsche Eingabedaten', message: 'Bitte lade ein gültiges Belegbild hoch.' });
    return;
  }

  const prompt = `
Analysiere diesen Beleg / diese Quittung im Detail für die deutsche Buchhaltung (GoBD-konform).
Extrahiere alle relevanten Daten für eine Steuerausgabe.

Prüfe außerdem ausdrücklich, ob auf der Rechnung ein QR-Code vorhanden ist:
- Dies kann ein EPC-QR-Code (Girocode) für SEPA-Zahlungen sein (beginnt typischerweise mit dem Service-Tag "BCD", gefolgt von Version, BIC, Name des Empfängers, IBAN, Betrag, Verwendungszweck).
- Oder ein ZUGFeRD / Factur-X QR-Code, der Rechnungsdaten kodiert.
Falls ein solcher QR-Code zu sehen ist, lies dessen Werte aus (bzw. die danebenstehenden Bank-/Zahlungsdetails, falls sie direkt damit verknüpft sind) und befülle das Objekt "qrCodeData".

Regeln für die Extraktion:
1. "supplierName": Finde den Namen des Ausstellers (Supermarkt, Tankstelle, Softwarefirma, Dienstleister, etc.).
2. "date": Finde das Belegdatum und gib es im ISO-Format (YYYY-MM-DD) aus (z.B. "2026-06-15").
3. "grossAmount": Der vollständige Zahlbetrag inklusive Umsatzsteuer.
4. "vatRate": Finde den Steuersatz in Prozent (üblicherweise 19 oder 7, in manchen Fällen 0 oder 5). Wenn verschiedene Sätze vorhanden sind, wähle den Hauptsatz oder berechne den Durchschnitt, bzw. nimm den höchsten Anteil.
5. "netAmount" & "vatAmount": Berechne oder extrahiere die Nettosumme und Steuerbeträge. Falls nicht lesbar, berechne ausgehend vom Bruttobetrag und dem Steuersatz (z.B. netAmount = grossAmount / (1 + vatRate/100)).
6. "category": Ordne diesen Beleg einer dieser deutschen Standard-Betriebsausgabenkategorien zu:
   - "Bürobedarf" (für Papier, Schreibwaren, Möbel, kleinere Elektronik)
   - "Software & Lizenzen" (Cloud-Hosting, SaaS-Tools, Software)
   - "Fremdleistungen" (Dienstleister, Freelancer-Rechnungen)
   - "Reisekosten" (Hotel, Bahn, ÖPNV, Flug)
   - "Bewirtungskosten" (Restaurantbelege, Geschäftsessen)
   - "Telekommunikation" (Internet, Handyvertrag, Telefon)
   - "Werbungs- und Marketingkosten" (Anzeigen, Visitenkarten)
   - "Miete & Raumkosten" (Büromiete, Strom, Heizung)
   - "Kfz-Kosten" (Tanken, Reparatur, Autowäsche)
   - "Versicherungen" (Haftpflicht, Rechtschutz)
   - "Sonstige Betriebsausgaben" (alles andere)
7. "description": Eine kurze, aussagekräftige Beschreibung der gekauften Produkte/Leistungen auf Deutsch.

Erstelle ein absolut valides JSON laut dem vorgegebenen Schema. Rechnen muss korrekt aufgehen!
`;

  try {
    const cleanBase64 = imageBase64.replace(/^data:[^;]+;base64,/, '');

    const imagePart = {
      inlineData: {
        data: cleanBase64,
        mimeType: mimeType,
      },
    };

    const textPart = {
      text: prompt,
    };

    const dynamicAi = getAiClient(req);
    const response = await dynamicAi.models.generateContent({
      model: 'gemini-3.5-flash',
      contents: { parts: [imagePart, textPart] },
      config: {
        responseMimeType: 'application/json',
        responseSchema: {
          type: Type.OBJECT,
          properties: {
            supplierName: { type: Type.STRING, description: 'Der Name des Verkäufers / Ausstellers' },
            date: { type: Type.STRING, description: 'Das Belegdatum (Format: YYYY-MM-DD)' },
            netAmount: { type: Type.NUMBER, description: 'Nettobetrag in Euro' },
            vatRate: { type: Type.NUMBER, description: 'Umsatzsteuersatz in % (z.B. 19 oder 7)' },
            vatAmount: { type: Type.NUMBER, description: 'Umsatzsteuerbetrag in Euro' },
            grossAmount: { type: Type.NUMBER, description: 'Bruttobetrag (Zahlbetrag) in Euro' },
            category: { type: Type.STRING, description: 'Vorgeschlagene Kategorie nach deutscher EÜR' },
            description: { type: Type.STRING, description: 'Deutsche Beschreibung, was eingekauft wurde' },
            qrCodeData: {
              type: Type.OBJECT,
              description: 'Strukturierte Daten, falls ein EPC-QR-Code (Girocode) oder ZUGFeRD-QR-Code auf der Rechnung erkannt wurde',
              properties: {
                detected: { type: Type.BOOLEAN, description: 'True, falls ein QR-Code erkannt wurde' },
                type: { type: Type.STRING, description: 'Z.B. "Girocode (EPC)", "ZUGFeRD-Zahlung", "Anderer"' },
                iban: { type: Type.STRING, description: 'Die ausgelesene IBAN des Zahlungsempfängers' },
                bic: { type: Type.STRING, description: 'Die ausgelesene BIC der Bank des Empfängers' },
                recipient: { type: Type.STRING, description: 'Der Name des Empfängers / Rechnungsstellers' },
                amount: { type: Type.NUMBER, description: 'Der im QR-Code kodierte Rechnungsbetrag' },
                reference: { type: Type.STRING, description: 'Der Verwendungszweck (z.B. Rechnungsnummer)' },
                rawContent: { type: Type.STRING, description: 'Der ungefilterte Text-Rohinhalt des QR-Codes (z.B. Beginnend mit BCD...)' }
              },
              required: ['detected']
            }
          },
          required: ['supplierName', 'date', 'grossAmount', 'vatRate', 'netAmount', 'vatAmount', 'category', 'description'],
        },
      },
    });

    const resultText = response.text || '{}';
    const parsedResult = JSON.parse(resultText);
    res.json(parsedResult);
  } catch (error: any) {
    console.error('Büro Susi Receipt Analysis Error:', error);
    res.status(500).json({
      error: 'ANALYSIS_ERROR',
      message: 'Der Beleg konnte nicht visuell ausgewertet werden. Bitte trage die Daten manuell ein.',
      debug: error.message,
    });
  }
});

/**
 * Endpoint: /api/analyze-business-card
 * Uses Gemini-3.5-Flash to visually parse images of business cards
 * and automatically extracts contact details (Name, Position, Firma, Telefonnummer, E-Mail, etc.).
 */
app.post('/api/analyze-business-card', async (req, res) => {
  if (!checkApiKey(req, res)) return;

  const { imageBase64, mimeType } = req.body;

  if (!imageBase64 || !mimeType) {
    res.status(400).json({ error: 'Falsche Eingabedaten', message: 'Bitte lade ein gültiges Bild einer Visitenkarte hoch.' });
    return;
  }

  const prompt = `
Analysiere diese Visitenkarte im Detail.
Extrahiere alle relevanten Daten für einen geschäftlichen Kontakt (Kunde oder Lieferant).

Regeln für die Extraktion:
1. "name": Der vollständige Name der Person (Vorname und Nachname, z.B. "Dr. Maximiliane Weber"). Falls kein Name gefunden wird, lasse das Feld leer oder trage "Unbekannt" ein.
2. "companyName": Name des Unternehmens / der Organisation (z.B. "Weber Design GmbH").
3. "title": Die Berufsbezeichnung / Position / Titel der Person (z.B. "Creative Director" oder "Geschäftsführer").
4. "email": Die E-Mail-Adresse (z.B. "m.weber@weber-design.de").
5. "phone": Die Telefonnummer (z.B. "+49 89 2345678").
6. "street": Die Straße und Hausnummer (z.B. "Theresienstr. 12").
7. "cityZip": Die Postleitzahl und der Ort kombiniert (z.B. "80333 München").
8. "notes": Eventuelle Notizen, Slogans, Webseiten oder zusätzlicher CRM Kontext, der auf der Karte zu finden ist.
9. "type": Versuche anhand des Kontextes zu schätzen, ob es sich eher um einen Kunden ("customer") oder Lieferanten/Partner ("supplier") handelt. Standardmäßig "customer".

Erstelle ein absolut valides JSON laut dem vorgegebenen Schema.
`;

  try {
    const cleanBase64 = imageBase64.replace(/^data:[^;]+;base64,/, '');

    const imagePart = {
      inlineData: {
        data: cleanBase64,
        mimeType: mimeType,
      },
    };

    const textPart = {
      text: prompt,
    };

    const dynamicAi = getAiClient(req);
    const response = await dynamicAi.models.generateContent({
      model: 'gemini-3.5-flash',
      contents: { parts: [imagePart, textPart] },
      config: {
        responseMimeType: 'application/json',
        responseSchema: {
          type: Type.OBJECT,
          properties: {
            name: { type: Type.STRING, description: 'Der Name der Person' },
            companyName: { type: Type.STRING, description: 'Name des Unternehmens' },
            title: { type: Type.STRING, description: 'Position oder Titel' },
            email: { type: Type.STRING, description: 'E-Mail-Adresse' },
            phone: { type: Type.STRING, description: 'Telefonnummer' },
            street: { type: Type.STRING, description: 'Straße und Hausnummer' },
            cityZip: { type: Type.STRING, description: 'PLZ und Ort (z.B. 80333 München)' },
            notes: { type: Type.STRING, description: 'Zusatzinformationen / CRM-Kontext' },
            type: { type: Type.STRING, description: 'Die geschätzte Rolle: customer oder supplier' },
          },
          required: ['name', 'companyName', 'title', 'email', 'phone', 'street', 'cityZip', 'notes', 'type'],
        },
      },
    });

    const resultText = response.text || '{}';
    const parsedResult = JSON.parse(resultText);
    res.json(parsedResult);
  } catch (error: any) {
    console.error('Büro Susi Business Card Analysis Error:', error);
    res.status(500).json({
      error: 'ANALYSIS_ERROR',
      message: 'Die Visitenkarte konnte nicht visuell ausgewertet werden. Bitte trage die Daten manuell ein.',
      debug: error.message,
    });
  }
});

// Serve frontend assets in production or establish Vite dev server middleware
async function setupServer() {
  if (process.env.NODE_ENV !== 'production') {
    const vite = await createViteServer({
      server: { middlewareMode: true },
      appType: 'spa',
    });
    app.use(vite.middlewares);
    console.log('Vite middleware mounted in Development mode.');
  } else {
    const distPath = path.join(process.cwd(), 'dist');
    app.use(express.static(distPath));
    app.get('*', (req, res) => {
      res.sendFile(path.join(distPath, 'index.html'));
    });
    console.log('Static serving configured using dist/ folder.');
  }

  app.listen(PORT, '0.0.0.0', () => {
    console.log(`Büro Susi Server running securely on port ${PORT}`);
  });
}

setupServer().catch((err) => {
  console.error('Vite fullstack initialization crash:', err);
});