import crypto from "node:crypto";
import express from "express";

const app = express();
app.use("/api", express.json());

const BASE = (process.env.PILOT_API_BASE || "https://pilotstatus.com.br").replace(/\/$/, "");
const TENANT_KEY = process.env.PILOT_TENANT_KEY; // tenant-scoped ps_... — server ONLY

// In production, store it in your database with the customer's order. Here, in memory.
const purchases = new Map(); // purchaseId -> { idempotencyKey, numbers }

async function buy(numbers, idempotencyKey) {
  return fetch(`${BASE}/v1/phone-lines`, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "x-api-key": TENANT_KEY,
      "Idempotency-Key": idempotencyKey,
    },
    body: JSON.stringify({ numbers }),
    signal: AbortSignal.timeout(60_000), // generous: numbers are processed one after the other
  });
}

// Which of the requested numbers are already your lines — the answer to "bought or not?".
async function ownedLines() {
  const r = await fetch(`${BASE}/v1/phone-lines`, { headers: { "x-api-key": TENANT_KEY } });
  const { lines } = await r.json();
  return new Map(lines.map((l) => [l.number, l.id]));
}

// A repeat answers REQUEST_ALREADY_PROCESSED without saying whether the first attempt bought.
// The list of lines does: replace those items with what the list shows.
async function settle(results) {
  if (!results.some((i) => i.code === "REQUEST_ALREADY_PROCESSED")) return results;
  const owned = await ownedLines();
  return results.map((i) =>
    i.code === "REQUEST_ALREADY_PROCESSED" && owned.has(i.number)
      ? { number: i.number, ok: true, lineId: owned.get(i.number) }
      : i,
  );
}

// POST /api/purchase { purchaseId, numbers }
app.post("/api/purchase", async (req, res) => {
  const { purchaseId = crypto.randomUUID(), numbers } = req.body || {};

  // The key is born ONCE per purchase and is stored: a repeated click reuses the same one.
  let purchase = purchases.get(purchaseId);
  if (!purchase) {
    purchase = { idempotencyKey: crypto.randomUUID(), numbers };
    purchases.set(purchaseId, purchase);
  }

  for (let attempt = 1; attempt <= 3; attempt++) {
    try {
      const r = await buy(purchase.numbers, purchase.idempotencyKey);
      const data = await r.json();
      if (r.status < 500) {
        // 200: one result per number. 4xx: nothing was tried — fix it and resend with the same key.
        if (!r.ok) return res.status(r.status).json(data);
        return res.json({ purchaseId, results: await settle(data.results) });
      }
      // 5xx: some numbers may have been charged. Repeat with the SAME key.
    } catch {
      // Timeout or network error: the same case. Repeat with the SAME key.
    }
  }

  // Still no answer: tell the customer what is already theirs, without risking a second charge.
  // They can try again later with the same purchaseId — the same key.
  const owned = await ownedLines();
  res.status(502).json({
    purchaseId,
    owned: purchase.numbers.filter((n) => owned.has(n)).map((n) => ({ number: n, lineId: owned.get(n) })),
  });
});

app.listen(process.env.PORT || 8789);

curl -X DELETE "https://pilotstatus.com.br/v1/phone-lines/cmg5k2l1n0001pl8example9x" \
  -H "x-api-key: ps_your_tenant_key"