// Pseudo-code for theme compilation
function compileTheme(theme) {
  const cssVariables = generateCSSVariables(theme.colors, theme.typography);
  const compiledCSS = `
    [data-theme="${theme.theme_name}"] {
      ${cssVariables}
    }
    ${theme.custom_css || ''}
  `;

  return minifyCSS(compiledCSS);
}

// Store in compiled_css column
UPDATE whitelabel_themes
SET compiled_css = compileTheme(theme)
WHERE id = theme.id;

function renderEmailTemplate(template, data) {
  let html = template.html_content;
  let text = template.text_content;

  // Replace variables
  Object.keys(data).forEach(key => {
    const regex = new RegExp(`{{${key}}}`, 'g');
    html = html.replace(regex, data[key]);
    text = text.replace(regex, data[key]);
  });

  return { html, text };
}

// Usage
const renderedEmail = renderEmailTemplate(template, {
  'USER_NAME': 'John Doe',
  'BRAND_NAME': 'Acme Corp',
  'ACTION_URL': 'https://acme.yoursaas.com/verify?token=...',
  'LOGO_URL': 'https://cdn.yoursaas.com/brands/acme/logo.png'
});

// Upload logo flow
async function uploadLogo(brandId, file, logoType) {
  // 1. Validate file
  const validation = validateLogoFile(file);
  if (!validation.valid) {
    throw new Error(validation.error);
  }

  // 2. Optimize image
  const optimized = await optimizeImage(file, {
    format: logoType === 'email' ? 'png' : 'svg',
    maxWidth: logoType === 'main' ? 240 : 64,
    quality: 90
  });

  // 3. Upload to MinIO
  const bucketName = `brand-${brandId}`;
  const fileName = `logos/${logoType}-v${Date.now()}.${optimized.ext}`;
  const uploadResult = await minioClient.putObject(
    bucketName,
    fileName,
    optimized.buffer,
    optimized.size,
    {
      'Content-Type': optimized.mimeType,
      'Cache-Control': 'public, max-age=31536000'
    }
  );

  // 4. Create asset record
  const asset = await db.query(`
    INSERT INTO whitelabel_assets (
      brand_id, asset_name, asset_type, asset_category,
      file_name, file_path, file_size, mime_type,
      storage_provider, storage_bucket, storage_key,
      access_url, is_public
    ) VALUES (
      $1, $2, 'logo', $3, $4, $5, $6, $7, 'minio', $8, $9, $10, true
    )
    RETURNING id, access_url
  `, [
    brandId,
    `${logoType}_logo`,
    logoType,
    fileName,
    `/${bucketName}/${fileName}`,
    optimized.size,
    optimized.mimeType,
    bucketName,
    fileName,
    `https://cdn.yoursaas.com/${bucketName}/${fileName}`
  ]);

  // 5. Update brand record
  await db.query(`
    UPDATE whitelabel_brands
    SET logo_${logoType}_id = $1,
        updated_at = NOW()
    WHERE id = $2
  `, [asset.id, brandId]);

  // 6. Invalidate cache
  await redis.del(`brand:${brandId}`);

  return asset;
}

// Generate color variants from base color
function generateColorVariants(baseColor) {
  const base = parseColor(baseColor); // { r, g, b }

  return {
    base: baseColor,
    light: lighten(base, 0.2),   // 20% lighter
    dark: darken(base, 0.2),     // 20% darker
    contrast: getContrastColor(base) // Auto-detect black or white
  };
}

// Example
const primaryVariants = generateColorVariants('#0066cc');
// {
//   base: '#0066cc',
//   light: '#3385d6',
//   dark: '#0052a3',
//   contrast: '#ffffff'
// }

// Load fonts from Google Fonts or self-hosted
async function loadFonts(brand) {
  const fonts = [];

  // Primary font
  if (brand.primary_font) {
    fonts.push({
      family: brand.primary_font,
      weights: [400, 500, 600, 700],
      display: 'swap'
    });
  }

  // Generate font-face CSS
  const fontFacesCSS = fonts.map(font => {
    if (font.source === 'google') {
      return `@import url('https://fonts.googleapis.com/css2?family=${font.family.replace(' ', '+')}:wght@${font.weights.join(';')}&display=${font.display}');`;
    } else {
      // Self-hosted fonts
      return generateFontFaceCSS(font);
    }
  }).join('\n');

  return fontFacesCSS;
}

// Sanitize custom CSS to prevent XSS
function sanitizeCustomCSS(css) {
  // Remove dangerous patterns
  const dangerous = [
    /javascript:/gi,
    /<script/gi,
    /expression\(/gi,
    /import\s+/gi,
    /@import/gi,
    /url\(['"]?javascript:/gi
  ];

  let sanitized = css;
  dangerous.forEach(pattern => {
    sanitized = sanitized.replace(pattern, '/* blocked */');
  });

  // Scope all selectors to prevent global pollution
  sanitized = scopeCSS(sanitized, `.brand-${brandId}`);

  return sanitized;
}

function scopeCSS(css, scope) {
  // Prefix all selectors with scope
  return css.replace(/([^\r\n,{}]+)(,(?=[^}]*{)|\s*{)/g, (match, selector, separator) => {
    // Don't scope @-rules
    if (selector.trim().startsWith('@')) {
      return match;
    }
    return `${scope} ${selector.trim()}${separator}`;
  });
}

// Example
const customCSS = `.button { color: red; }`;
const scoped = scopeCSS(customCSS, '.brand-acme');
// Result: .brand-acme .button { color: red; }

// Minify CSS for production
function minifyCSS(css) {
  return css
    .replace(/\/\*[\s\S]*?\*\//g, '') // Remove comments
    .replace(/\s+/g, ' ')              // Collapse whitespace
    .replace(/\s*([{}:;,])\s*/g, '$1') // Remove spaces around punctuation
    .replace(/;}/g, '}')               // Remove last semicolon
    .trim();
}

const dns = require('dns').promises;

async function verifyDomain(domain) {
  // 1. Get verification token from database
  const domainRecord = await db.query(`
    SELECT dns_verification_token, status
    FROM whitelabel_domains
    WHERE domain = $1
  `, [domain]);

  if (!domainRecord) {
    throw new Error('Domain not found');
  }

  const expectedToken = domainRecord.dns_verification_token;

  // 2. Query DNS for TXT record
  try {
    const txtRecords = await dns.resolveTxt(`_nself-verification.${domain}`);

    // 3. Find matching token
    const verified = txtRecords.some(record => {
      const value = Array.isArray(record) ? record.join('') : record;
      return value === expectedToken;
    });

    if (verified) {
      // 4. Update database
      await db.query(`
        UPDATE whitelabel_domains
        SET dns_verified = true,
            dns_verified_at = NOW(),
            status = 'verified',
            updated_at = NOW()
        WHERE domain = $1
      `, [domain]);

      return { success: true, verified: true };
    } else {
      return { success: false, error: 'Token mismatch' };
    }
  } catch (error) {
    return { success: false, error: error.message };
  }
}

async function storeSSLCertificates(domain, certPath, keyPath, chainPath) {
  const brand = await getBrandByDomain(domain);
  const bucketName = `brand-${brand.id}`;

  // 1. Upload to MinIO (encrypted storage)
  const certAsset = await uploadAsset(bucketName, 'ssl/cert.pem', certPath, {
    encrypt: false, // Cert is public
    category: 'certificate'
  });

  const keyAsset = await uploadAsset(bucketName, 'ssl/key.pem', keyPath, {
    encrypt: true,  // Key must be encrypted
    category: 'key'
  });

  const chainAsset = await uploadAsset(bucketName, 'ssl/chain.pem', chainPath, {
    encrypt: false,
    category: 'certificate'
  });

  // 2. Update domain record
  await db.query(`
    UPDATE whitelabel_domains
    SET ssl_enabled = true,
        ssl_provider = 'letsencrypt',
        ssl_cert_id = $1,
        ssl_key_id = $2,
        ssl_chain_id = $3,
        ssl_issued_at = NOW(),
        ssl_expiry_date = NOW() + INTERVAL '90 days',
        status = 'active',
        updated_at = NOW()
    WHERE domain = $4
  `, [certAsset.id, keyAsset.id, chainAsset.id, domain]);
}

// Cron job: Check SSL certificates daily
async function checkSSLRenewal() {
  const expiringDomains = await db.query(`
    SELECT id, domain, ssl_expiry_date
    FROM whitelabel_domains
    WHERE ssl_enabled = true
      AND ssl_auto_renew = true
      AND ssl_expiry_date <= NOW() + INTERVAL '30 days'
      AND status = 'active'
  `);

  for (const domain of expiringDomains) {
    try {
      await renewSSLCertificate(domain.domain);
      console.log(`Renewed SSL for ${domain.domain}`);
    } catch (error) {
      console.error(`Failed to renew SSL for ${domain.domain}:`, error);
      // Send alert to admin
      await sendAlert(`SSL renewal failed for ${domain.domain}`);
    }
  }
}

// Run daily at 2 AM
cron.schedule('0 2 * * *', checkSSLRenewal);

// Health check for custom domains
async function checkDomainHealth(domain) {
  const checks = {
    dns: false,
    http: false,
    https: false,
    ssl_valid: false,
    ssl_expiry: null
  };

  try {
    // 1. DNS resolution
    const addresses = await dns.resolve4(domain);
    checks.dns = addresses.length > 0;

    // 2. HTTP accessibility
    try {
      const httpResponse = await fetch(`http://${domain}`, {
        method: 'HEAD',
        timeout: 5000
      });
      checks.http = httpResponse.ok;
    } catch (e) {
      checks.http = false;
    }

    // 3. HTTPS accessibility
    try {
      const httpsResponse = await fetch(`https://${domain}`, {
        method: 'HEAD',
        timeout: 5000
      });
      checks.https = httpsResponse.ok;
    } catch (e) {
      checks.https = false;
    }

    // 4. SSL certificate validity
    if (checks.https) {
      const cert = await getSSLCertificate(domain);
      checks.ssl_valid = new Date(cert.valid_to) > new Date();
      checks.ssl_expiry = cert.valid_to;
    }

    // 5. Determine health status
    let healthStatus = 'healthy';
    if (!checks.dns || !checks.https) {
      healthStatus = 'unhealthy';
    } else if (!checks.ssl_valid) {
      healthStatus = 'degraded';
    }

    // 6. Update database
    await db.query(`
      UPDATE whitelabel_domains
      SET health_status = $1,
          last_health_check_at = NOW(),
          updated_at = NOW()
      WHERE domain = $2
    `, [healthStatus, domain]);

    return { domain, healthStatus, checks };
  } catch (error) {
    await db.query(`
      UPDATE whitelabel_domains
      SET health_status = 'unknown',
          last_health_check_at = NOW()
      WHERE domain = $1
    `, [domain]);

    return { domain, healthStatus: 'unknown', error: error.message };
  }
}

// Generate Nginx server block for custom domain
function generateNginxConfig(domain, brandId) {
  const sslCertPath = `/var/lib/nself/ssl/${domain}/cert.pem`;
  const sslKeyPath = `/var/lib/nself/ssl/${domain}/key.pem`;

  return `
# Custom domain: ${domain}
# Brand ID: ${brandId}
# Generated: ${new Date().toISOString()}

server {
  listen 80;
  server_name ${domain};

  # Redirect to HTTPS
  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl http2;
  server_name ${domain};

  # SSL Configuration
  ssl_certificate ${sslCertPath};
  ssl_certificate_key ${sslKeyPath};
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_ciphers HIGH:!aNULL:!MD5;
  ssl_prefer_server_ciphers on;

  # Security headers
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  add_header X-Frame-Options "SAMEORIGIN" always;
  add_header X-Content-Type-Options "nosniff" always;

  # Brand context injection
  set $brand_id "${brandId}";

  location / {
    # Pass brand context to backend
    proxy_set_header X-Brand-ID $brand_id;
    proxy_set_header X-Domain ${domain};
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;

    # Proxy to application
    proxy_pass http://nself-admin:8080;
  }

  # Static assets (logos, CSS, etc.)
  location /branding/ {
    proxy_pass http://minio:9000/brand-${brandId}/;
    proxy_cache_valid 200 1d;
    add_header Cache-Control "public, max-age=86400";
  }
}
`;
}

const GLOBAL_VARIABLES = {
  // Brand variables (from whitelabel_brands)
  'BRAND_NAME': (brand) => brand.brand_name,
  'LOGO_URL': (brand) => brand.logo_main_url,
  'SUPPORT_EMAIL': (brand) => brand.support_email,
  'COMPANY_ADDRESS': (brand) => brand.company_address,

  // System variables
  'CURRENT_YEAR': () => new Date().getFullYear(),
  'CURRENT_DATE': () => new Date().toISOString().split('T')[0],
  'APP_URL': (brand, domain) => `https://${domain}`,

  // User variables (passed at render time)
  'USER_NAME': (brand, domain, user) => user.name,
  'USER_EMAIL': (brand, domain, user) => user.email,

  // Action variables (template-specific)
  'ACTION_URL': (brand, domain, user, data) => data.action_url,
  'VERIFICATION_CODE': (brand, domain, user, data) => data.verification_code,
  'RESET_TOKEN': (brand, domain, user, data) => data.reset_token
};

async function renderEmailTemplate(templateName, brandId, userData, actionData = {}) {
  // 1. Load template
  const template = await db.query(`
    SELECT html_content, text_content, variables, from_name, from_email, subject
    FROM whitelabel_email_templates
    WHERE brand_id = $1
      AND template_name = $2
      AND language_code = $3
      AND is_active = true
  `, [brandId, templateName, userData.language || 'en']);

  if (!template) {
    throw new Error(`Template not found: ${templateName}`);
  }

  // 2. Load brand
  const brand = await db.query(`
    SELECT * FROM whitelabel_brands_full WHERE id = $1
  `, [brandId]);

  // 3. Get domain
  const domain = await db.query(`
    SELECT domain FROM whitelabel_domains
    WHERE brand_id = $1 AND is_primary = true
  `, [brandId]);

  // 4. Build variable context
  const context = {
    brand,
    domain: domain.domain,
    user: userData,
    data: actionData
  };

  // 5. Replace variables in HTML
  let html = template.html_content;
  let text = template.text_content;
  let subject = template.subject;

  template.variables.forEach(varName => {
    const resolver = GLOBAL_VARIABLES[varName];
    if (resolver) {
      const value = resolver(brand, domain.domain, userData, actionData);
      const regex = new RegExp(`{{${varName}}}`, 'g');

      html = html.replace(regex, value || '');
      text = text.replace(regex, value || '');
      subject = subject.replace(regex, value || '');
    }
  });

  // 6. Return rendered email
  return {
    from: {
      name: template.from_name || brand.brand_name,
      email: template.from_email || brand.support_email
    },
    to: userData.email,
    subject,
    html,
    text
  };
}

// Send welcome email
const email = await renderEmailTemplate('welcome', brandId, {
  name: 'John Doe',
  email: '[email protected]',
  language: 'en'
}, {
  action_url: 'https://acme.yoursaas.com/verify?token=abc123'
});

await sendEmail(email);

async function getEmailTemplate(brandId, templateName, languageCode) {
  // Try requested language
  let template = await db.query(`
    SELECT * FROM whitelabel_email_templates
    WHERE brand_id = $1
      AND template_name = $2
      AND language_code = $3
      AND is_active = true
  `, [brandId, templateName, languageCode]);

  if (template) {
    return template;
  }

  // Fall back to English
  template = await db.query(`
    SELECT * FROM whitelabel_email_templates
    WHERE brand_id = $1
      AND template_name = $2
      AND language_code = 'en'
      AND is_active = true
  `, [brandId, templateName]);

  if (template) {
    return template;
  }

  // Fall back to system default
  template = await db.query(`
    SELECT * FROM whitelabel_email_templates
    WHERE brand_id IS NULL
      AND template_name = $1
      AND language_code = 'en'
      AND is_system = true
  `, [templateName]);

  return template;
}

// Generate preview with sample data
async function previewEmailTemplate(brandId, templateName, languageCode = 'en') {
  const template = await db.query(`
    SELECT *, sample_data
    FROM whitelabel_email_templates
    WHERE brand_id = $1
      AND template_name = $2
      AND language_code = $3
  `, [brandId, templateName, languageCode]);

  if (!template.sample_data) {
    throw new Error('Template has no sample data');
  }

  // Render with sample data
  const rendered = await renderEmailTemplate(
    templateName,
    brandId,
    template.sample_data.user || {
      name: 'John Doe',
      email: '[email protected]'
    },
    template.sample_data.action || {}
  );

  return {
    subject: rendered.subject,
    html: rendered.html,
    text: rendered.text,
    preview_url: `/email-preview/${template.id}`
  };
}

// Compile theme from JSONB to CSS
function compileTheme(theme) {
  const cssVariables = [];

  // Colors
  Object.entries(theme.colors).forEach(([key, value]) => {
    cssVariables.push(`  --color-${key}: ${value};`);
  });

  // Typography
  Object.entries(theme.typography).forEach(([key, value]) => {
    const cssKey = key.replace(/([A-Z])/g, '-$1').toLowerCase();
    cssVariables.push(`  --${cssKey}: ${value};`);
  });

  // Spacing
  Object.entries(theme.spacing).forEach(([key, value]) => {
    cssVariables.push(`  --spacing-${key}: ${value};`);
  });

  // Borders
  Object.entries(theme.borders).forEach(([key, value]) => {
    cssVariables.push(`  --border-${key}: ${value};`);
  });

  // Shadows
  Object.entries(theme.shadows).forEach(([key, value]) => {
    cssVariables.push(`  --shadow-${key}: ${value};`);
  });

  // Build CSS
  const css = `
/* Theme: ${theme.theme_name} */
/* Mode: ${theme.mode} */
/* Generated: ${new Date().toISOString()} */

[data-theme="${theme.theme_name}"],
.theme-${theme.theme_name} {
${cssVariables.join('\n')}
}

${theme.custom_css || ''}
`;

  return css;
}

async function saveCompiledTheme(themeId) {
  // 1. Load theme
  const theme = await db.query(`
    SELECT * FROM whitelabel_themes WHERE id = $1
  `, [themeId]);

  // 2. Compile
  const compiledCSS = compileTheme(theme);
  const minifiedCSS = minifyCSS(compiledCSS);

  // 3. Save to database
  await db.query(`
    UPDATE whitelabel_themes
    SET compiled_css = $1,
        updated_at = NOW()
    WHERE id = $2
  `, [minifiedCSS, themeId]);

  // 4. Upload to MinIO for CDN serving
  const brandId = theme.brand_id;
  const fileName = `themes/${theme.theme_name}.css`;
  await uploadAsset(`brand-${brandId}`, fileName, Buffer.from(minifiedCSS), {
    mimeType: 'text/css',
    cacheControl: 'public, max-age=31536000'
  });

  // 5. Invalidate cache
  await redis.del(`theme:${themeId}`);

  return { themeId, cssUrl: `https://cdn.yoursaas.com/brand-${brandId}/${fileName}` };
}

// Generate dark mode variant from light theme
function generateDarkMode(lightTheme) {
  const darkColors = {
    // Invert backgrounds
    background: invertColor(lightTheme.colors.background),
    surface: invertColor(lightTheme.colors.surface),

    // Invert text
    text: invertColor(lightTheme.colors.text),

    // Keep brand colors but adjust brightness
    primary: adjustBrightness(lightTheme.colors.primary, 1.2),
    secondary: adjustBrightness(lightTheme.colors.secondary, 1.2),

    // Adjust borders
    border: adjustBrightness(lightTheme.colors.border, 0.6)
  };

  return {
    ...lightTheme,
    theme_name: `${lightTheme.theme_name}-dark`,
    mode: 'dark',
    colors: darkColors
  };
}

// Live theme preview in admin UI
function previewTheme(themeId) {
  const iframe = document.createElement('iframe');
  iframe.src = `/theme-preview?theme=${themeId}`;
  iframe.style.width = '100%';
  iframe.style.height = '600px';
  iframe.style.border = '1px solid #e5e7eb';

  document.getElementById('theme-preview-container').appendChild(iframe);
}

// Server-side theme preview route
app.get('/theme-preview', async (req, res) => {
  const theme = await loadTheme(req.query.theme);

  res.send(`
    <!DOCTYPE html>
    <html data-theme="${theme.theme_name}">
    <head>
      <style>${theme.compiled_css}</style>
    </head>
    <body>
      <div class="preview-container">
        <!-- Theme preview components -->
        <h1>Heading 1</h1>
        <p>Body text with <a href="#">link</a></p>
        <button class="btn-primary">Primary Button</button>
        <button class="btn-secondary">Secondary Button</button>
        <!-- More preview components -->
      </div>
    </body>
    </html>
  `);
});

// CSS minification for production
const CleanCSS = require('clean-css');

function minifyCSS(css) {
  const output = new CleanCSS({
    level: 2,
    returnPromise: false
  }).minify(css);

  return output.styles;
}

// Load brand with inheritance from platform default
async function loadBrandWithInheritance(tenantId) {
  // 1. Load tenant-specific brand
  const tenantBrand = await db.query(`
    SELECT * FROM whitelabel_brands
    WHERE tenant_id = $1
  `, [tenantId]);

  // 2. Load platform default brand
  const platformBrand = await db.query(`
    SELECT * FROM whitelabel_brands
    WHERE tenant_id = 'default'
  `);

  // 3. Merge (tenant overrides platform)
  const mergedBrand = {
    ...platformBrand,
    ...tenantBrand,

    // Specific merge logic for complex fields
    colors: {
      ...platformBrand.colors,
      ...tenantBrand.colors
    },

    // Use tenant logo if set, otherwise platform logo
    logo_main_url: tenantBrand.logo_main_url || platformBrand.logo_main_url,
    logo_icon_url: tenantBrand.logo_icon_url || platformBrand.logo_icon_url,

    // Use tenant theme if active, otherwise platform theme
    active_theme_id: tenantBrand.active_theme_id || platformBrand.active_theme_id
  };

  return mergedBrand;
}

// Bucket naming convention
const bucketName = `brand-${brandId}`;

// Folder structure within bucket
const assetPaths = {
  logos: 'logos/',
  fonts: 'fonts/',
  css: 'css/',
  themes: 'themes/',
  ssl: 'ssl/',          // SSL certificates
  email: 'email/',      // Email attachments
  uploads: 'uploads/'   // User uploads
};

// Example storage paths
// brand-550e8400.../logos/main-v1.svg
// brand-550e8400.../themes/acme-light.css
// brand-550e8400.../ssl/cert.pem

async function uploadAsset(brandId, file, category) {
  // 1. Validate file
  const validation = validateFile(file, {
    maxSize: 10 * 1024 * 1024, // 10 MB
    allowedTypes: ['image/png', 'image/jpeg', 'image/svg+xml', 'text/css']
  });

  if (!validation.valid) {
    throw new Error(validation.error);
  }

  // 2. Optimize if image
  let processedFile = file;
  if (file.mimetype.startsWith('image/')) {
    processedFile = await optimizeImage(file, {
      maxWidth: category === 'logo' ? 600 : 1200,
      format: 'webp',
      quality: 90
    });
  }

  // 3. Generate unique filename
  const timestamp = Date.now();
  const ext = processedFile.originalname.split('.').pop();
  const fileName = `${category}/${timestamp}.${ext}`;

  // 4. Upload to MinIO
  const bucketName = `brand-${brandId}`;
  await minioClient.putObject(
    bucketName,
    fileName,
    processedFile.buffer,
    processedFile.size,
    {
      'Content-Type': processedFile.mimetype,
      'Cache-Control': 'public, max-age=31536000',
      'X-Brand-ID': brandId
    }
  );

  // 5. Generate access URL
  const accessUrl = `https://cdn.yoursaas.com/${bucketName}/${fileName}`;

  // 6. Create asset record
  const asset = await db.query(`
    INSERT INTO whitelabel_assets (
      brand_id, asset_name, asset_type, asset_category,
      file_name, file_path, file_size, mime_type,
      storage_provider, storage_bucket, storage_key,
      cdn_url, access_url, is_public
    ) VALUES (
      $1, $2, $3, $4, $5, $6, $7, $8, 'minio', $9, $10, $11, $12, true
    )
    RETURNING id, access_url
  `, [
    brandId,
    file.originalname,
    getAssetType(file.mimetype),
    category,
    file.originalname,
    `/${bucketName}/${fileName}`,
    processedFile.size,
    processedFile.mimetype,
    bucketName,
    fileName,
    accessUrl,
    accessUrl
  ]);

  return asset;
}

const sharp = require('sharp');

async function optimizeImage(file, options = {}) {
  const {
    maxWidth = 1200,
    maxHeight = null,
    format = 'webp',
    quality = 85
  } = options;

  let image = sharp(file.buffer);

  // Get metadata
  const metadata = await image.metadata();

  // Resize if needed
  if (metadata.width > maxWidth) {
    image = image.resize(maxWidth, maxHeight, {
      fit: 'inside',
      withoutEnlargement: true
    });
  }

  // Convert format
  if (format === 'webp') {
    image = image.webp({ quality });
  } else if (format === 'jpeg') {
    image = image.jpeg({ quality, progressive: true });
  } else if (format === 'png') {
    image = image.png({ compressionLevel: 9 });
  }

  // Get optimized buffer
  const buffer = await image.toBuffer();

  return {
    buffer,
    size: buffer.length,
    mimetype: `image/${format}`,
    originalname: file.originalname.replace(/\.[^.]+$/, `.${format}`)
  };
}

// CDN URL generation
function getCDNUrl(assetPath, brandId) {
  const cdnDomain = process.env.CDN_DOMAIN || 'cdn.yoursaas.com';
  const bucketName = `brand-${brandId}`;

  return `https://${cdnDomain}/${bucketName}/${assetPath}`;
}

// Cache invalidation
async function invalidateCDNCache(assetPath, brandId) {
  const cdnUrl = getCDNUrl(assetPath, brandId);

  // CloudFlare example
  if (process.env.CDN_PROVIDER === 'cloudflare') {
    await fetch(`https://api.cloudflare.com/client/v4/zones/${process.env.CLOUDFLARE_ZONE_ID}/purge_cache`, {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${process.env.CLOUDFLARE_API_TOKEN}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        files: [cdnUrl]
      })
    });
  }
}

// Version assets to prevent cache issues
async function versionAsset(assetId) {
  // 1. Load current asset
  const current = await db.query(`
    SELECT * FROM whitelabel_assets WHERE id = $1
  `, [assetId]);

  // 2. Create new version
  const newAsset = await db.query(`
    INSERT INTO whitelabel_assets (
      brand_id, asset_name, asset_type, asset_category,
      file_name, file_path, file_size, mime_type,
      storage_provider, storage_bucket, storage_key,
      version, previous_version_id
    )
    SELECT
      brand_id, asset_name, asset_type, asset_category,
      file_name, file_path, file_size, mime_type,
      storage_provider, storage_bucket, storage_key,
      version + 1, id
    FROM whitelabel_assets
    WHERE id = $1
    RETURNING id, version
  `, [assetId]);

  // 3. Update references to point to new version
  // (e.g., update whitelabel_brands.logo_main_id)

  return newAsset;
}

const cssTree = require('css-tree');

function sanitizeCSS(css) {
  try {
    // Parse CSS
    const ast = cssTree.parse(css);

    // Remove dangerous patterns
    cssTree.walk(ast, {
      visit: 'Declaration',
      enter(node) {
        // Block javascript: URLs
        if (node.value && node.value.type === 'Url') {
          const url = cssTree.generate(node.value);
          if (url.match(/javascript:|data:/i)) {
            this.remove();
          }
        }

        // Block expression()
        if (cssTree.generate(node).match(/expression\(/i)) {
          this.remove();
        }

        // Block imports
        if (node.property === 'import' || node.property === '@import') {
          this.remove();
        }
      }
    });

    // Generate sanitized CSS
    return cssTree.generate(ast);
  } catch (error) {
    throw new Error('Invalid CSS syntax');
  }
}

// Verification token generation
function generateVerificationToken() {
  const crypto = require('crypto');
  return crypto.randomBytes(32).toString('hex');
}

// Token expiry (24 hours)
async function checkVerificationTokenExpiry(domain) {
  const result = await db.query(`
    SELECT created_at
    FROM whitelabel_domains
    WHERE domain = $1
      AND dns_verified = false
  `, [domain]);

  if (!result) return false;

  const createdAt = new Date(result.created_at);
  const now = new Date();
  const hoursSinceCreation = (now - createdAt) / (1000 * 60 * 60);

  return hoursSinceCreation <= 24;
}

// Verification with rate limiting
const verificationAttempts = new Map();

async function verifyDomainWithRateLimit(domain) {
  const attempts = verificationAttempts.get(domain) || 0;

  if (attempts >= 5) {
    throw new Error('Too many verification attempts. Please wait 1 hour.');
  }

  const result = await verifyDomain(domain);

  if (!result.success) {
    verificationAttempts.set(domain, attempts + 1);

    // Clear after 1 hour
    setTimeout(() => {
      verificationAttempts.delete(domain);
    }, 60 * 60 * 1000);
  } else {
    verificationAttempts.delete(domain);
  }

  return result;
}

const crypto = require('crypto');

// Encryption key from environment
const ENCRYPTION_KEY = Buffer.from(process.env.SSL_KEY_ENCRYPTION_KEY, 'hex');

function encryptPrivateKey(privateKey) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv('aes-256-gcm', ENCRYPTION_KEY, iv);

  let encrypted = cipher.update(privateKey, 'utf8', 'hex');
  encrypted += cipher.final('hex');

  const authTag = cipher.getAuthTag();

  return {
    encrypted,
    iv: iv.toString('hex'),
    authTag: authTag.toString('hex')
  };
}

function decryptPrivateKey(encrypted, iv, authTag) {
  const decipher = crypto.createDecipheriv(
    'aes-256-gcm',
    ENCRYPTION_KEY,
    Buffer.from(iv, 'hex')
  );

  decipher.setAuthTag(Buffer.from(authTag, 'hex'));

  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
  decrypted += decipher.final('utf8');

  return decrypted;
}

// Store encrypted in database
async function storeSSLKey(domain, privateKey) {
  const { encrypted, iv, authTag } = encryptPrivateKey(privateKey);

  await db.query(`
    INSERT INTO whitelabel_assets (
      brand_id, asset_type, asset_category,
      file_name, storage_provider,
      encrypted_content, encryption_iv, encryption_auth_tag
    ) VALUES ($1, 'key', 'ssl', $2, 'database', $3, $4, $5)
  `, [brandId, `${domain}.key`, encrypted, iv, authTag]);
}

function generateSignedURL(assetId, expiresIn = 3600) {
  const crypto = require('crypto');

  const payload = {
    asset_id: assetId,
    expires: Date.now() + (expiresIn * 1000)
  };

  const signature = crypto
    .createHmac('sha256', process.env.ASSET_SIGNING_KEY)
    .update(JSON.stringify(payload))
    .digest('hex');

  const token = Buffer.from(JSON.stringify({ ...payload, signature })).toString('base64');

  return `/assets/${assetId}?token=${token}`;
}

// Verify signed URL
function verifySignedURL(assetId, token) {
  try {
    const payload = JSON.parse(Buffer.from(token, 'base64').toString());

    // Check expiry
    if (Date.now() > payload.expires) {
      return false;
    }

    // Verify signature
    const expectedSignature = crypto
      .createHmac('sha256', process.env.ASSET_SIGNING_KEY)
      .update(JSON.stringify({ asset_id: payload.asset_id, expires: payload.expires }))
      .digest('hex');

    return payload.signature === expectedSignature && payload.asset_id === assetId;
  } catch (error) {
    return false;
  }
}

// Cache TTLs
const CACHE_TTL = {
  brand: 3600,          // 1 hour
  domain: 3600,         // 1 hour
  theme: 86400,         // 24 hours
  email_template: 3600, // 1 hour
  asset_metadata: 86400 // 24 hours
};

// Cache keys
const CACHE_KEYS = {
  brand: (brandId) => `brand:${brandId}`,
  domain: (domain) => `domain:${domain}`,
  theme: (themeId) => `theme:${themeId}`,
  emailTemplate: (brandId, name, lang) => `email:${brandId}:${name}:${lang}`,
  asset: (assetId) => `asset:${assetId}`
};

// Cache with fallback
async function getCachedBrand(brandId) {
  const cacheKey = CACHE_KEYS.brand(brandId);

  // 1. Try cache
  const cached = await redis.get(cacheKey);
  if (cached) {
    return JSON.parse(cached);
  }

  // 2. Query database
  const brand = await db.query(`
    SELECT * FROM whitelabel_brands_full WHERE id = $1
  `, [brandId]);

  if (!brand) {
    return null;
  }

  // 3. Cache result
  await redis.setex(cacheKey, CACHE_TTL.brand, JSON.stringify(brand));

  return brand;
}

// Minify and gzip CSS
const zlib = require('zlib');

async function compileAndCompressTheme(themeId) {
  const theme = await loadTheme(themeId);

  // 1. Compile
  const compiledCSS = compileTheme(theme);

  // 2. Minify
  const minified = minifyCSS(compiledCSS);

  // 3. Gzip
  const gzipped = await new Promise((resolve, reject) => {
    zlib.gzip(minified, { level: 9 }, (err, result) => {
      if (err) reject(err);
      else resolve(result);
    });
  });

  // 4. Store both versions
  await db.query(`
    UPDATE whitelabel_themes
    SET compiled_css = $1,
        compiled_css_size = $2,
        compiled_css_gzip_size = $3
    WHERE id = $4
  `, [minified, Buffer.byteLength(minified), gzipped.length, themeId]);

  return { minified, gzipped };
}

// Express.js routes
const express = require('express');
const router = express.Router();

// Get brand by domain
router.get('/api/brand/by-domain/:domain', async (req, res) => {
  const { domain } = req.params;

  const brand = await getBrandByDomain(domain);

  if (!brand) {
    return res.status(404).json({ error: 'Brand not found' });
  }

  res.json(brand);
});

// Upload logo
router.post('/api/brand/:id/logo', upload.single('file'), async (req, res) => {
  const { id } = req.params;
  const { file } = req;
  const logoType = req.body.type || 'main';

  const asset = await uploadLogo(id, file, logoType);

  res.json(asset);
});

// Update theme
router.put('/api/brand/:id/theme/:themeId', async (req, res) => {
  const { id, themeId } = req.params;
  const { colors, typography, custom_css } = req.body;

  const updated = await updateTheme(id, themeId, {
    colors,
    typography,
    custom_css
  });

  res.json(updated);
});