Add GraphQL

server.js

@@ -1465,7 +1465,10 @@ const postSchema = new mongoose.Schema({
         userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
         text: String,
         createdAt: { type: Date, default: Date.now },
-        likes: [{ type: mongoose.Schema.Types.ObjectId, ref: 'User' }],
+        likes: [{
+            userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
+            likedAt: { type: Date, default: Date.now }
+         }],
         edited: { type: Boolean, default: false },
         editedAt: Date,
 
@@ -1476,30 +1479,36 @@ const postSchema = new mongoose.Schema({
         }],
         reportCount: { type: Number, default: 0 },
         hidden: { type: Boolean, default: false },
-        replies: [{
-            userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
-            text: String,
-            createdAt: { type: Date, default: Date.now },
-            likes: [{
-                userId: {
-                    type: mongoose.Schema.Types.ObjectId,
-                    ref: 'User'
-                },
-                likedAt: {
-                    type: Date,
-                    default: Date.now
-                }
-            }],
-            edited: { type: Boolean, default: false },
-            editedAt: Date,
-            reports: [{
-                userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
-                reason: { type: String, default: 'No reason provided' },
-                reportedAt: { type: Date, default: Date.now }
-            }],
-            reportCount: { type: Number, default: 0 },
-            hidden: { type: Boolean, default: false }
-        }]
+      replies: [{
+               userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
+               text: String,
+               createdAt: { type: Date, default: Date.now },
+               likes: [{
+                  userId: {
+                     type: mongoose.Schema.Types.ObjectId,
+                     ref: 'User'
+                  },
+                  likedAt: {
+                     type: Date,
+                     default: Date.now
+                  }
+               }],
+               edited: { type: Boolean, default: false },
+               editedAt: Date,
+               reports: [{
+                  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
+                  reason: { type: String, default: 'No reason provided' },
+                  reportedAt: { type: Date, default: Date.now }
+               }],
+               reportCount: { type: Number, default: 0 },
+               hidden: { type: Boolean, default: false },
+               
+               // ✅ ✅ ✅ المفتاح: الردود تحت الردود (Self-Referencing)
+               replies: { 
+                  type: Array, 
+                  default: [] 
+               }
+      }]
 
 
     }],
@@ -1537,6 +1546,7 @@ const postSchema = new mongoose.Schema({
     updatedAt: { type: Date, default: Date.now }
 });
 
+
 // Indexes for performance
 postSchema.index({ userId: 1, createdAt: -1 });
 postSchema.index({ createdAt: -1 });
@@ -1976,8 +1986,7 @@ const storySchema = new mongoose.Schema({
     },
     expiresAt: { 
         type: Date, 
-        default: () => new Date(Date.now() + 24 * 60 * 60 * 1000),
-        index: true
+        default: () => new Date(Date.now() + 24 * 60 * 60 * 1000)
     }
 });
 
@@ -2275,8 +2284,7 @@ const storeSettingsSchema = new mongoose.Schema({
     },
     enabled: { 
         type: Boolean, 
-        default: false,
-        index: true
+        default: false
     },
     
     // ============================================
@@ -7038,10 +7046,31 @@ app.use('/api/login', loginLimiter);
 async function generateTokens(user) {
     user.refreshTokens = user.refreshTokens.filter(t => new Date(t.createdAt) > new Date(Date.now() - 30 * 24 * 60 * 60 * 1000));
     if (user.refreshTokens.length >= 10) {
-        user.refreshTokens.shift(); // إزالة أقدم token لو وصلت للحد الأقصى
+        user.refreshTokens.shift();
     }
-    const token = jwt.sign({ userId: user._id, isAdmin: user.isAdmin }, JWT_SECRET, { expiresIn: '30d' });
-    const refreshToken = jwt.sign({ userId: user._id }, process.env.REFRESH_TOKEN_SECRET, { expiresIn: '90d' });
+    
+    // ✅ ✅ ✅ أضف username و profile.nickname في الـ JWT
+    const token = jwt.sign(
+        { 
+            userId: user._id, 
+            isAdmin: user.isAdmin,
+            username: user.username,
+            'profile.nickname': user.profile?.nickname || user.username
+        }, 
+        JWT_SECRET, 
+        { expiresIn: '30d' }
+    );
+    
+    const refreshToken = jwt.sign(
+        { 
+            userId: user._id,
+            username: user.username,
+            'profile.nickname': user.profile?.nickname || user.username
+        }, 
+        process.env.REFRESH_TOKEN_SECRET, 
+        { expiresIn: '90d' }
+    );
+    
     user.refreshTokens.push({ token: refreshToken, createdAt: new Date() });
     await user.save();
     return { token, refreshToken };
@@ -7470,6 +7499,9 @@ app.post('/api/upload', authenticateToken, upload.single('file'), async (req, re
     }
 });
 
+// ============================================
+// POST /api/login
+// ============================================
 app.post('/api/login', [
     body('email').isEmail().withMessage('Invalid email format'),
     body('password').notEmpty().withMessage('Password is required')
@@ -7487,8 +7519,25 @@ app.post('/api/login', [
         
         // ✅ لو كان أدمن → تخطي OTP
         if (user.isAdmin) {
-            const token = jwt.sign({ userId: user._id, isAdmin: user.isAdmin }, JWT_SECRET, { expiresIn: '30d' });
-            const refreshToken = jwt.sign({ userId: user._id }, JWT_SECRET, { expiresIn: '90d' });
+            const token = jwt.sign(
+                { 
+                    userId: user._id, 
+                    isAdmin: user.isAdmin,
+                    username: user.username,
+                    'profile.nickname': user.profile?.nickname || user.username
+                }, 
+                JWT_SECRET, 
+                { expiresIn: '30d' }
+            );
+            const refreshToken = jwt.sign(
+                { 
+                    userId: user._id,
+                    username: user.username,
+                    'profile.nickname': user.profile?.nickname || user.username
+                }, 
+                JWT_SECRET, 
+                { expiresIn: '90d' }
+            );
             user.refreshTokens.push({ token: refreshToken });
             await user.save();
             logger.info(`Admin login: ${email} - Token issued without OTP`);
@@ -7502,7 +7551,6 @@ app.post('/api/login', [
             user.otpExpires = Date.now() + 10 * 60 * 1000;
             await user.save();
             
-            // نرسل الـ response على طول
             res.status(403).json({ 
                 error: 'Email not verified', 
                 requiresVerification: true,
@@ -7510,7 +7558,6 @@ app.post('/api/login', [
                 message: 'Verification code sent to your email'
             });
             
-            // إرسال الإيميل عبر Brevo في الخلفية
             setTimeout(async () => {
                 try {
                     await sendEmailWithBrevo(
@@ -7540,8 +7587,25 @@ app.post('/api/login', [
         }
         
         // ✅ الإيميل مفعل → توكن مباشر
-        const token = jwt.sign({ userId: user._id, isAdmin: user.isAdmin }, JWT_SECRET, { expiresIn: '30d' });
-        const refreshToken = jwt.sign({ userId: user._id }, JWT_SECRET, { expiresIn: '90d' });
+        const token = jwt.sign(
+            { 
+                userId: user._id, 
+                isAdmin: user.isAdmin,
+                username: user.username,
+                'profile.nickname': user.profile?.nickname || user.username
+            }, 
+            JWT_SECRET, 
+            { expiresIn: '30d' }
+        );
+        const refreshToken = jwt.sign(
+            { 
+                userId: user._id,
+                username: user.username,
+                'profile.nickname': user.profile?.nickname || user.username
+            }, 
+            JWT_SECRET, 
+            { expiresIn: '90d' }
+        );
         user.refreshTokens.push({ token: refreshToken });
         await user.save();
         res.json({ token, refreshToken });
@@ -7552,6 +7616,7 @@ app.post('/api/login', [
     }
 });
 
+
 // ============================================
 // POST /api/verify-email - التحقق من البريد الإلكتروني
 // ============================================
@@ -7572,15 +7637,30 @@ app.post('/api/verify-email', [
             return res.status(400).json({ error: 'Invalid or expired verification code' });
         }
         
-        // ✅ تفعيل الحساب
         user.emailVerified = true;
         user.otp = null;
         user.otpExpires = null;
         await user.save();
         
-        // ✅ إصدار توكن للمستخدم
-        const token = jwt.sign({ userId: user._id, isAdmin: user.isAdmin }, JWT_SECRET, { expiresIn: '30d' });
-        const refreshToken = jwt.sign({ userId: user._id }, process.env.REFRESH_TOKEN_SECRET, { expiresIn: '90d' });
+        const token = jwt.sign(
+            { 
+                userId: user._id, 
+                isAdmin: user.isAdmin,
+                username: user.username,
+                'profile.nickname': user.profile?.nickname || user.username
+            }, 
+            JWT_SECRET, 
+            { expiresIn: '30d' }
+        );
+        const refreshToken = jwt.sign(
+            { 
+                userId: user._id,
+                username: user.username,
+                'profile.nickname': user.profile?.nickname || user.username
+            }, 
+            process.env.REFRESH_TOKEN_SECRET, 
+            { expiresIn: '90d' }
+        );
         user.refreshTokens.push({ token: refreshToken });
         await user.save();
         
@@ -7683,8 +7763,25 @@ app.post('/api/login/verify-otp', otpVerifyLimiter, async (req, res) => {
         if (!user) {
             return res.status(401).json({ error: 'Invalid or expired OTP' });
         }
-        const token = jwt.sign({ userId: user._id, isAdmin: user.isAdmin }, JWT_SECRET, { expiresIn: '1h' });
-        const refreshToken = jwt.sign({ userId: user._id }, JWT_SECRET, { expiresIn: '7d' });
+        const token = jwt.sign(
+            { 
+                userId: user._id, 
+                isAdmin: user.isAdmin,
+                username: user.username,
+                'profile.nickname': user.profile?.nickname || user.username
+            }, 
+            JWT_SECRET, 
+            { expiresIn: '1h' }
+        );
+        const refreshToken = jwt.sign(
+            { 
+                userId: user._id,
+                username: user.username,
+                'profile.nickname': user.profile?.nickname || user.username
+            }, 
+            JWT_SECRET, 
+            { expiresIn: '7d' }
+        );
         user.refreshTokens.push({ token: refreshToken });
         user.otp = null;
         user.otpExpires = null;