botfights/server/src/routes/auth.ts

import { Hono } from 'hono'
import { nanoid } from 'nanoid'
import { createHash, randomBytes } from 'crypto'
import { db, schema } from '../db/index.js'
import { eq, sql } from 'drizzle-orm'
import { isAllowedWebhookUrl } from '../engine/orchestrator.js'
import { testWebhook } from '../engine/webhook-test.js'
import { rateLimit } from '../middleware/rate-limit.js'

export const authRouter = new Hono()

// Login with Nostr pubkey
authRouter.post('/login', async (c) => {
  const body = await c.req.json()
  const { pubkey } = body

  if (!pubkey || typeof pubkey !== 'string' || pubkey.length !== 64) {
    return c.json({ error: 'Invalid pubkey.' }, 400)
  }

  const rows = await db.select({
    id: schema.bots.id,
    name: schema.bots.name,
    avatarSeed: schema.bots.avatarSeed,
    archetype: schema.bots.archetype,
    profilePicUrl: schema.bots.profilePicUrl,
    eloRating: schema.bots.eloRating,
    wins: schema.bots.wins,
    losses: schema.bots.losses,
    winStreak: schema.bots.winStreak,
    bestStreak: schema.bots.bestStreak,
    tier: schema.bots.tier,
    isActive: schema.bots.isActive,
  }).from(schema.bots).where(eq(schema.bots.publicKey, pubkey)).limit(1)

  if (rows.length === 0) {
    return c.json({ exists: false, pubkey })
  }

  return c.json({ exists: true, bot: rows[0] })
})

// Register a new bot with Nostr pubkey
authRouter.post('/register', rateLimit(3600_000, 5), async (c) => {
  const body = await c.req.json()
  const { pubkey, name, webhookUrl, archetype, profilePicUrl } = body

  if (!pubkey || typeof pubkey !== 'string' || pubkey.length !== 64) {
    return c.json({ error: 'Invalid pubkey.' }, 400)
  }

  if (!name || typeof name !== 'string' || name.length < 2 || name.length > 32) {
    return c.json({ error: 'Name must be 2-32 characters.' }, 400)
  }

  if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
    return c.json({ error: 'Name must be alphanumeric, hyphens, or underscores.' }, 400)
  }

  const normalizedName = name.toLowerCase()

  if (!webhookUrl || typeof webhookUrl !== 'string') {
    return c.json({ error: 'webhookUrl is required.' }, 400)
  }

  try {
    new URL(webhookUrl)
  } catch {
    return c.json({ error: 'webhookUrl must be a valid URL.' }, 400)
  }

  if (!isAllowedWebhookUrl(webhookUrl)) {
    return c.json({ error: 'webhookUrl must not point to private/internal addresses.' }, 400)
  }

  // Check pubkey not already used
  const existingPk = await db.select({ id: schema.bots.id })
    .from(schema.bots)
    .where(eq(schema.bots.publicKey, pubkey))
    .limit(1)

  if (existingPk.length > 0) {
    return c.json({ error: 'This Nostr key already has a bot.' }, 409)
  }

  // Check name not taken (case-insensitive)
  const existingName = await db.select({ id: schema.bots.id })
    .from(schema.bots)
    .where(eq(sql`LOWER(${schema.bots.name})`, normalizedName))
    .limit(1)

  if (existingName.length > 0) {
    return c.json({ error: 'A bot with that name already exists.' }, 409)
  }

  // Test the webhook
  const testResult = await testWebhook(webhookUrl)
  if (!testResult.reachable || !testResult.validResponse) {
    return c.json({
      error: 'Webhook verification failed.',
      details: testResult.error || 'Webhook must return {"answer": "..."} as JSON.',
      latencyMs: testResult.latencyMs,
    }, 422)
  }

  const id = nanoid(12)
  const secret = randomBytes(32).toString('hex')

  await db.insert(schema.bots).values({
    id,
    name: normalizedName,
    webhookUrl,
    avatarSeed: normalizedName,
    archetype: archetype || 'standard',
    secretHash: createHash('sha256').update(secret).digest('hex'),
    publicKey: pubkey,
    profilePicUrl: profilePicUrl || null,
    createdAt: new Date().toISOString(),
  })

  return c.json({
    id,
    name: normalizedName,
    archetype: archetype || 'standard',
    webhookLatencyMs: testResult.latencyMs,
    message: 'Bot registered. Webhook verified.',
  }, 201)
})

// Update bot webhook (requires pubkey match)
authRouter.post('/update', async (c) => {
  const body = await c.req.json()
  const { pubkey, webhookUrl, profilePicUrl } = body

  if (!pubkey || typeof pubkey !== 'string') {
    return c.json({ error: 'Invalid pubkey.' }, 400)
  }

  const rows = await db.select({ id: schema.bots.id })
    .from(schema.bots)
    .where(eq(schema.bots.publicKey, pubkey))
    .limit(1)

  if (rows.length === 0) {
    return c.json({ error: 'No bot found for this key.' }, 404)
  }

  const updates: Record<string, unknown> = {}

  if (webhookUrl) {
    if (!isAllowedWebhookUrl(webhookUrl)) {
      return c.json({ error: 'webhookUrl must not point to private/internal addresses.' }, 400)
    }
    // Test new webhook before accepting
    const testResult = await testWebhook(webhookUrl)
    if (!testResult.reachable || !testResult.validResponse) {
      return c.json({
        error: 'Webhook verification failed.',
        details: testResult.error,
      }, 422)
    }
    updates.webhookUrl = webhookUrl
    updates.consecutiveErrors = 0
    updates.isActive = true
  }

  if (profilePicUrl) updates.profilePicUrl = profilePicUrl

  if (Object.keys(updates).length > 0) {
    await db.update(schema.bots).set(updates).where(eq(schema.bots.id, rows[0].id))
  }

  return c.json({ updated: true })
})