// routes/bookings.js — SYNC booking (confirms immediately)
router.post('/', [...validators], async (req, res) => {
  const { room_id, check_in, check_out } = req.body;
  const user_id = req.user.userId;

  // Do all the work now and return the final result.
  const booking = await createBooking(user_id, room_id, check_in, check_out);

  res.status(201).json({
    success: true,
    booking_id: booking.id,
    status: 'confirmed',
  });
});

// routes/orders.js — async order submission
const axios = require('axios');

router.post('/orders', async (req, res) => {
  const correlation_id = req.headers['x-correlation-id'];

  // Kick off the long-running work (queue a job, call an external system).
  const order = await createPendingOrder(req.body);
  await attachCorrelationId(order.id, correlation_id);

  // Return early.
  res.status(202).json({ success: true, order_id: order.id, status: 'processing' });

  // ... elsewhere, when the work finishes:
  // await axios.post(
  //   `https://${process.env.SAGEION_REGION}.autobot2.sageion.com/prod/webhook/callback`,
  //   {
  //     correlation_id,
  //     data: { success: true, order_id: order.id, status: 'completed' },
  //   }
  // );
});

// routes/auth.js

const SAGEION_APP_ID = process.env.SAGEION_APP_ID;
const SAGEION_CLIENT_SECRET = process.env.SAGEION_CLIENT_SECRET;

router.post('/client-user-token', [
  body('client_id').notEmpty(),
  body('client_secret').notEmpty(),
  body('user_id').notEmpty().isInt(),
  body('session_id').optional().isString(),
], async (req, res) => {
  const { client_id, client_secret, user_id, session_id } = req.body;

  // 1. Verify client credentials
  if (client_id !== SAGEION_APP_ID || client_secret !== SAGEION_CLIENT_SECRET) {
    return res.status(401).json({ error: 'Invalid client credentials' });
  }

  // 2. Verify the user exists
  const check = await pool.query('SELECT id FROM users WHERE id = $1', [user_id]);
  if (check.rows.length === 0) {
    return res.status(404).json({ error: 'User not found' });
  }

  // 3. Issue a scoped, short-lived token
  const scopes = [
    'booking:read', 'booking:create', 'booking:update', 'booking:cancel',
  ];
  const plaintextToken = generateToken(user_id, 'client@system', 'client', {
    scope: scopes,
    client_id,
    session_id,
  });

  // 4. Encrypt before returning — Sageion rejects plaintext JWTs.
  const encryptedToken = encryptToken(plaintextToken);

  res.json({ token: encryptedToken, expires_in: 3600, scope: scopes, user_id });
});

const axios = require('axios');

async function getAgentToken(userId) {
  const { data } = await axios.post(
    `${process.env.API_BASE_URL}/auth/client-user-token`,
    {
      client_id: process.env.SAGEION_APP_ID,
      client_secret: process.env.SAGEION_CLIENT_SECRET,
      user_id: String(userId),
    }
  );
  return data.token; // use as Bearer token for agent-initiated calls
}

// routes/auth.js — send OTP
router.post('/send-otp', [
  body('email').isEmail().normalizeEmail(),
], async (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });

  const { email } = req.body;
  const otp = Math.floor(100000 + Math.random() * 900000).toString();
  const expiresAt = new Date(Date.now() + 5 * 60 * 1000); // 5 min

  try {
    await pool.query(
      `INSERT INTO otps (email, otp, expires_at) VALUES ($1, $2, $3)
       ON CONFLICT (email) DO UPDATE SET otp = $2, expires_at = $3`,
      [email, otp, expiresAt]
    );
    // TODO: send via your email provider
    console.log(`[OTP] Sent OTP ${otp} to ${email}`);
    res.json({ success: true, message: 'OTP sent' });
  } catch (err) {
    console.error(err);
    res.status(500).json({ error: 'Server error' });
  }
});

// routes/auth.js — verify OTP
router.post('/verify-otp', [
  body('email').isEmail().normalizeEmail(),
  body('otp').isLength({ min: 6, max: 6 }).matches(/^\d+$/),
], async (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });

  const { email, otp } = req.body;
  try {
    const result = await pool.query(
      'SELECT otp, expires_at FROM otps WHERE email = $1',
      [email]
    );
    if (result.rows.length === 0) {
      return res.status(400).json({ error: 'No OTP request found' });
    }
    const record = result.rows[0];
    if (record.otp !== otp) {
      return res.status(400).json({ error: 'Invalid OTP' });
    }
    if (new Date() > new Date(record.expires_at)) {
      return res.status(400).json({ error: 'OTP expired' });
    }

    const userResult = await pool.query(
      'SELECT id FROM users WHERE email = $1', [email]
    );
    if (userResult.rows.length === 0) {
      return res.status(404).json({ error: 'User not found' });
    }
    const userId = userResult.rows[0].id;

    await pool.query('DELETE FROM otps WHERE email = $1', [email]);

    res.json({
      success: true,
      message: 'OTP verified successfully',
      user_id: userId.toString(),
    });
  } catch (err) {
    console.error(err);
    res.status(500).json({ error: 'Server error' });
  }
});

{
  "client_id": "MyAppName",
  "client_secret": "the-real-secret-your-server-validates",
  "user_id": "36",
  "session_id": "sess-abc-2"
}

{
  "token": "<encrypted token string>"
}