src/index.js

import 'dotenv/config';
import express from 'express';
import mongoose from 'mongoose';
import cookieSession from 'cookie-session';
import passport from 'passport';
import cors from 'cors';
import helmet from 'helmet';
import { createServer } from 'http'; // REQUIRED for Socket.io

// Config
import connectDB from './config/db.js';
import './config/passport.js'; // Execute passport config
import authRoutes from './routes/authRoutes.js';
import userRoutes from './routes/userRoutes.js';
import friendRoutes from './routes/friendRoutes.js';
import { initSocket } from './services/SocketManager.js';

// Connect to DB
connectDB();

const app = express();

// Security Middleware
app.use(helmet());
app.use(cors({
  origin: process.env.CLIENT_URL || "http://localhost:5173",
  methods: "GET,POST,PUT,DELETE",
  credentials: true // Allow cookies
}));

// Body Parsers
app.use(express.json());

// Session Middleware (Encryption for Cookie)
app.use(
  cookieSession({
    name: 'cragy_session',
    maxAge: 30 * 24 * 60 * 60 * 1000,
    keys: [process.env.COOKIE_KEY],

    sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax', 
    
    // Secure MUST be true if sameSite is 'none'
    secure: process.env.NODE_ENV === 'production', 
    
    // Allow proxy trust (HuggingFace uses a proxy)
    httpOnly: true,
  })
);

// Trust the HuggingFace/Cloudflare proxy so 'secure' cookies work
app.set('trust proxy', 1);

app.use((req, res, next) => {
    if (req.session && !req.session.regenerate) {
        req.session.regenerate = (cb) => {
            cb();
        };
    }
    if (req.session && !req.session.save) {
        req.session.save = (cb) => {
            cb();
        };
    }
    next();
});

// Passport Middleware
app.use(passport.initialize());
app.use(passport.session());

// Routes
app.use('/api/auth', authRoutes);
app.use('/api/user', userRoutes);
app.use('/api/friends', friendRoutes);

app.get('/', (req, res) => {
  res.send({ status: 'Online', user: req.user });
});

const httpServer = createServer(app); // Wrap Express
initSocket(httpServer); // Initialize Socket

const PORT = process.env.PORT || 3000;
httpServer.listen(PORT, () => { // Listen on httpServer, NOT app
  console.log(`🚀 Server + Socket running on port ${PORT}`);
});