index.js

import express from "express";
import crypto from "crypto";
import { runDecisionEngine } from "./engine/decisionEngine.js";
import { enforcePR } from "./engine/enforce.js";
import { saveDecision, readDecisions } from "./engine/decisionStore.js";

const app = express();
app.use(express.json());

const SECRET = process.env.GITHUB_SECRET;

// 🔥 Deduplication store with TTL (memory-safe)
const processedEvents = new Map();
const EVENT_TTL = 10 * 60 * 1000; // 10 minutes

// --- Verify GitHub Webhook Signature ---
function verifySignature(req) {
  const signature = req.headers["x-hub-signature-256"];
  if (!signature || !SECRET) return true;

  const hmac = crypto.createHmac("sha256", SECRET);
  const digest =
    "sha256=" + hmac.update(JSON.stringify(req.body)).digest("hex");

  try {
    return crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(digest)
    );
  } catch {
    return false;
  }
}

// --- Webhook Handler ---
app.post("/webhook", async (req, res) => {
  try {
    // ✅ Signature verification
    if (!verifySignature(req)) {
      console.log("Invalid signature");
      return res.sendStatus(401);
    }

    const deliveryId = req.headers["x-github-delivery"];
    const event = req.headers["x-github-event"];
    const now = Date.now();

    // 🔥 Cleanup old events
    for (const [id, timestamp] of processedEvents.entries()) {
      if (now - timestamp > EVENT_TTL) {
        processedEvents.delete(id);
      }
    }

    // 🔥 Deduplication check
    if (processedEvents.has(deliveryId)) {
      console.log("Duplicate event ignored:", deliveryId);
      return res.sendStatus(200);
    }

    processedEvents.set(deliveryId, now);

    const normalized = {
      event,
      repo: req.body.repository?.full_name || null,
      action: req.body.action || null,
      pr: req.body.pull_request?.number || null,
      timestamp: new Date().toISOString(),
    };

    console.log(
      `EVENT: ${event} | ${normalized.repo} | PR #${normalized.pr}`
    );

    // --- Decision Engine ---
    let decisions = runDecisionEngine(event, req.body);

    // 🔥 Ensure push always produces decision
    if (event === "push") {
      decisions = [
        {
          contract: "MAIN_BRANCH_CHECK",
          decision: "approve",
          reason: "Push event validation"
        }
      ];
      console.log("DECISION: approve (push)");
    }

    // --- v0.3: Save Decision ---
    const record = {
      id: deliveryId,
      event,
      repo: normalized.repo,
      pr: normalized.pr,
      sha: req.body.pull_request?.head?.sha || req.body.after,
      decisions,
      timestamp: new Date().toISOString()
    };

    console.log("SAVING DECISION:", record.id);
    saveDecision(record);

    // --- Enforcement ---
    if (decisions && decisions.length > 0) {
      await enforcePR(decisions, req.body);
    }

    res.sendStatus(200);
  } catch (err) {
    console.error("Webhook error:", err);
    res.sendStatus(500);
  }
});

// --- Health Check ---
app.get("/", (_, res) => {
  res.send("Manthan Webhook Running");
});

// --- Query Decisions (v0.3.1) ---
app.get("/decisions", (req, res) => {
  try {
    const { repo, pr, sha } = req.query;

    const results = readDecisions({ repo, pr, sha });

    res.json({
      count: results.length,
      results
    });
  } catch (err) {
    console.error("Query error:", err);
    res.sendStatus(500);
  }
});

// --- Server Start ---
const PORT = process.env.PORT || 8080;

app.listen(PORT, "0.0.0.0", () => {
  console.log(`🚀 Manthan running on port ${PORT}`);
});