import { z } from "zod/v4";
 
// ALWAYS validate all inputs at the boundary
const createUserSchema = z.object({
  body: z.object({
    email: z.email(),
    name: z.string().min(2).max(100),
    role: z.enum(["admin", "editor", "viewer"]).default("viewer"),
  }),
});
 
// ALWAYS validate environment variables at startup
const envSchema = z.object({
  DATABASE_URL: z.string().url(),
  JWT_SECRET: z.string().min(32),
  REDIS_URL: z.string().url(),
  PORT: z.string().transform(Number).pipe(z.number().int().positive()).default("3000"),
  NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
});
 
export const env = envSchema.parse(process.env);

// ALWAYS use custom error classes with status codes
class AppError extends Error {
  constructor(
    public statusCode: number,
    message: string,
    public code: string,
    public details?: Record<string, unknown>
  ) {
    super(message);
    this.name = "AppError";
  }
}
 
class NotFoundError extends AppError {
  constructor(resource: string, id: string) {
    super(404, `${resource} with id '${id}' not found`, "NOT_FOUND");
  }
}
 
class ConflictError extends AppError {
  constructor(message: string) {
    super(409, message, "CONFLICT");
  }
}
 
class UnauthorizedError extends AppError {
  constructor(message = "Authentication required") {
    super(401, message, "UNAUTHORIZED");
  }
}
 
// ALWAYS return consistent error response shape
interface ErrorResponse {
  error: {
    code: string;
    message: string;
    details?: Record<string, unknown>;
    requestId: string;
  };
}

// ALWAYS use transactions for multi-step operations
async function transferFunds(fromId: string, toId: string, amount: number) {
  return db.transaction(async (tx) => {
    const from = await tx.query.accounts.findFirst({
      where: eq(accounts.id, fromId),
      for: "update", // Lock the row
    });
 
    if (!from || from.balance < amount) {
      throw new AppError(400, "Insufficient funds", "INSUFFICIENT_FUNDS");
    }
 
    await tx.update(accounts).set({ balance: sql`balance - ${amount}` }).where(eq(accounts.id, fromId));
    await tx.update(accounts).set({ balance: sql`balance + ${amount}` }).where(eq(accounts.id, toId));
 
    return { success: true };
  });
}
 
// ALWAYS use parameterized queries (Drizzle does this by default)
// NEVER concatenate user input into SQL strings

import pino from "pino";
 
// ALWAYS use structured logging
const logger = pino({
  level: env.NODE_ENV === "production" ? "info" : "debug",
  formatters: {
    level: (label) => ({ level: label }),
  },
  redact: ["req.headers.authorization", "req.headers.cookie", "body.password"],
});
 
// ALWAYS include request context
logger.info({ userId, action: "user.created", email }, "User created successfully");
 
// NEVER log sensitive data
// BAD: logger.info({ password, token }, "Auth attempt");

// ALWAYS test against a real database (use test containers or test DB)
// ALWAYS test the HTTP layer (request in, response out)
// ALWAYS test error cases and edge cases
// ALWAYS clean up test data (use transactions that rollback)
 
import { describe, it, expect, beforeAll, afterAll } from "vitest";
import { app } from "../app";
 
describe("POST /api/users", () => {
  it("creates a user with valid data", async () => {
    const res = await app.request("/api/users", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ email: "test@example.com", name: "Test User" }),
    });
 
    expect(res.status).toBe(201);
    const body = await res.json();
    expect(body.data).toMatchObject({ email: "test@example.com" });
  });
 
  it("returns 400 for invalid email", async () => {
    const res = await app.request("/api/users", {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ email: "invalid", name: "Test" }),
    });
 
    expect(res.status).toBe(400);
  });
 
  it("returns 409 for duplicate email", async () => {
    // Create first user, then try duplicate
    // ...
    expect(res.status).toBe(409);
  });
});