import express from 'express';
import cors from 'cors';
import helmet from 'helmet';
import path from 'path';
import routes from './routes';
import { errorHandler, notFoundHandler } from './middleware/error.middleware';
import { env } from './config/env';
import { EmbedService } from './services/EmbedService';

const embedService = new EmbedService();

export function createApp() {
  const app = express();

  app.set('trust proxy', 1);

  app.use(helmet({ contentSecurityPolicy: false }));
  app.use(
    cors({
      origin: async (origin, cb) => {
        if (!origin) {
          cb(null, true);
          return;
        }
        const allowed = new Set(env.corsOrigins);
        try {
          const embedOrigins = await embedService.getAllowedOrigins();
          embedOrigins.forEach((o) => allowed.add(o));
        } catch {
          // redis/db unavailable — use static origins
        }
        cb(null, allowed.has(origin));
      },
      credentials: true,
    }),
  );
  app.use(express.json());

  app.use('/v1', routes);
  app.use('/embed', express.static(path.join(process.cwd(), 'public', 'embed')));

  app.use(notFoundHandler);
  app.use(errorHandler);

  return app;
}