CDN & Edge Caching

import http from "node:http";
import fs from "node:fs";
import path from "node:path";
import crypto from "node:crypto";

// --- Configuration ---
const PORT = parseInt(process.env.PORT || "3000", 10);
const STATIC_DIR = process.env.STATIC_DIR || "./public";
const SIGNING_SECRET = process.env.SIGNING_SECRET || "change-me-in-production";
const PURGE_API_KEY = process.env.PURGE_API_KEY || "purge-secret-key";

// --- Types ---
interface CacheEntry {
  etag: string;
  lastModified: Date;
  contentType: string;
  size: number;
}

interface SignedURLParams {
  filePath: string;
  expiresAt: number;
  signature: string;
}

// --- In-memory cache metadata registry ---
const cacheRegistry = new Map<string, CacheEntry>();
const purgedPaths = new Set<string>();

// --- Content type detection ---
const MIME_TYPES: Record<string, string> = {
  ".html": "text/html",
  ".css": "text/css",
  ".js": "application/javascript",
  ".json": "application/json",
  ".png": "image/png",
  ".jpg": "image/jpeg",
  ".gif": "image/gif",
  ".svg": "image/svg+xml",
  ".woff2": "font/woff2",
  ".mp4": "video/mp4",
};

function getContentType(filePath: string): string {
  const ext = path.extname(filePath).toLowerCase();
  return MIME_TYPES[ext] || "application/octet-stream";
}

// --- ETag generation using file content hash ---
function generateETag(content: Buffer): string {
  const hash = crypto.createHash("sha256").update(content).digest("hex");
  return `"${hash.substring(0, 32)}"`;
}

// --- Cache-Control header based on file type ---
function getCacheControl(filePath: string): string {
  const ext = path.extname(filePath).toLowerCase();
  // Immutable assets (hashed filenames) -- cache for 1 year
  if (filePath.includes(".hash.") || filePath.includes("/immutable/")) {
    return "public, max-age=31536000, immutable";
  }
  // HTML -- always revalidate
  if (ext === ".html") {
    return "public, no-cache, must-revalidate";
  }
  // Images and fonts -- cache 30 days with stale-while-revalidate
  if ([".png", ".jpg", ".gif", ".svg", ".woff2"].includes(ext)) {
    return "public, max-age=2592000, stale-while-revalidate=86400";
  }
  // CSS/JS -- cache 7 days
  if ([".css", ".js"].includes(ext)) {
    return "public, max-age=604800, stale-while-revalidate=3600";
  }
  // Default -- short cache with revalidation
  return "public, max-age=300, must-revalidate";
}

// --- Signed URL generation and validation ---
function generateSignedURL(filePath: string, ttlSeconds: number): string {
  const expiresAt = Math.floor(Date.now() / 1000) + ttlSeconds;
  const payload = `${filePath}:${expiresAt}`;
  const signature = crypto
    .createHmac("sha256", SIGNING_SECRET)
    .update(payload)
    .digest("hex");

  const params = new URLSearchParams({
    file: filePath,
    expires: String(expiresAt),
    sig: signature,
  });
  return `/private?${params.toString()}`;
}

function validateSignedURL(params: URLSearchParams): SignedURLParams | null {
  const filePath = params.get("file");
  const expiresStr = params.get("expires");
  const signature = params.get("sig");

  if (!filePath || !expiresStr || !signature) return null;

  const expiresAt = parseInt(expiresStr, 10);
  if (isNaN(expiresAt)) return null;

  // Check expiration
  const now = Math.floor(Date.now() / 1000);
  if (now > expiresAt) return null;

  // Verify HMAC signature
  const payload = `${filePath}:${expiresAt}`;
  const expected = crypto
    .createHmac("sha256", SIGNING_SECRET)
    .update(payload)
    .digest("hex");

  if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) {
    return null;
  }

  return { filePath, expiresAt, signature };
}

// --- Serve static file with caching headers ---
async function serveStaticFile(
  req: http.IncomingMessage,
  res: http.ServerResponse,
  filePath: string,
  isPrivate: boolean
): Promise<void> {
  const fullPath = path.resolve(STATIC_DIR, filePath);

  // Prevent directory traversal
  if (!fullPath.startsWith(path.resolve(STATIC_DIR))) {
    res.writeHead(403, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "Forbidden" }));
    return;
  }

  let stat: fs.Stats;
  let content: Buffer;
  try {
    stat = await fs.promises.stat(fullPath);
    content = await fs.promises.readFile(fullPath);
  } catch {
    res.writeHead(404, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "File not found" }));
    return;
  }

  const etag = generateETag(content);
  const lastModified = stat.mtime;
  const contentType = getContentType(filePath);

  // Update cache registry
  cacheRegistry.set(filePath, {
    etag,
    lastModified,
    contentType,
    size: stat.size,
  });

  // --- Conditional request: If-None-Match (ETag) ---
  const ifNoneMatch = req.headers["if-none-match"];
  if (ifNoneMatch && ifNoneMatch === etag) {
    res.writeHead(304, {
      ETag: etag,
      "Cache-Control": isPrivate ? "private, no-store" : getCacheControl(filePath),
    });
    res.end();
    return;
  }

  // --- Conditional request: If-Modified-Since ---
  const ifModifiedSince = req.headers["if-modified-since"];
  if (ifModifiedSince) {
    const clientDate = new Date(ifModifiedSince);
    if (lastModified <= clientDate) {
      res.writeHead(304, {
        ETag: etag,
        "Last-Modified": lastModified.toUTCString(),
        "Cache-Control": isPrivate ? "private, no-store" : getCacheControl(filePath),
      });
      res.end();
      return;
    }
  }

  // --- Full response ---
  const headers: Record<string, string> = {
    "Content-Type": contentType,
    "Content-Length": String(content.length),
    ETag: etag,
    "Last-Modified": lastModified.toUTCString(),
    "Cache-Control": isPrivate ? "private, no-store" : getCacheControl(filePath),
    "Accept-Ranges": "bytes",
    Vary: "Accept-Encoding",
  };

  // Add CDN-specific headers
  if (!isPrivate) {
    headers["CDN-Cache-Control"] = getCacheControl(filePath);
    headers["Surrogate-Control"] = getCacheControl(filePath);
  }

  res.writeHead(200, headers);
  res.end(content);
}

// --- Cache purge handler ---
function handlePurge(
  req: http.IncomingMessage,
  res: http.ServerResponse,
  body: string
): void {
  // Verify API key
  const apiKey = req.headers["x-purge-key"];
  if (apiKey !== PURGE_API_KEY) {
    res.writeHead(401, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "Unauthorized" }));
    return;
  }

  let parsed: { paths?: string[] };
  try {
    parsed = JSON.parse(body);
  } catch {
    res.writeHead(400, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "Invalid JSON body" }));
    return;
  }

  if (!Array.isArray(parsed.paths) || parsed.paths.length === 0) {
    res.writeHead(400, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "paths array is required" }));
    return;
  }

  const purged: string[] = [];
  for (const p of parsed.paths) {
    cacheRegistry.delete(p);
    purgedPaths.add(p);
    purged.push(p);
  }

  console.log(`[PURGE] Purged ${purged.length} paths: ${purged.join(", ")}`);

  res.writeHead(200, {
    "Content-Type": "application/json",
    "Surrogate-Control": "no-store",
    "Cache-Control": "no-store",
  });
  res.end(JSON.stringify({ purged, count: purged.length }));
}

// --- Signed URL generation endpoint ---
function handleGenerateSignedURL(
  req: http.IncomingMessage,
  res: http.ServerResponse,
  body: string
): void {
  const apiKey = req.headers["x-api-key"];
  if (apiKey !== PURGE_API_KEY) {
    res.writeHead(401, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "Unauthorized" }));
    return;
  }

  let parsed: { path?: string; ttl?: number };
  try {
    parsed = JSON.parse(body);
  } catch {
    res.writeHead(400, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "Invalid JSON" }));
    return;
  }

  const filePath = parsed.path;
  const ttl = parsed.ttl || 3600; // Default 1 hour

  if (!filePath) {
    res.writeHead(400, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "path is required" }));
    return;
  }

  const signedURL = generateSignedURL(filePath, ttl);
  res.writeHead(200, { "Content-Type": "application/json" });
  res.end(JSON.stringify({ url: signedURL, expiresIn: ttl }));
}

// --- Request body reader ---
function readBody(req: http.IncomingMessage): Promise<string> {
  return new Promise((resolve, reject) => {
    const chunks: Buffer[] = [];
    let size = 0;
    req.on("data", (chunk: Buffer) => {
      size += chunk.length;
      if (size > 1024 * 1024) {
        reject(new Error("Body too large"));
        req.destroy();
        return;
      }
      chunks.push(chunk);
    });
    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
    req.on("error", reject);
  });
}

// --- Router ---
async function router(
  req: http.IncomingMessage,
  res: http.ServerResponse
): Promise<void> {
  const url = new URL(req.url || "/", `http://${req.headers.host}`);
  const method = req.method || "GET";

  try {
    // Serve private content via signed URL
    if (url.pathname === "/private" && method === "GET") {
      const validated = validateSignedURL(url.searchParams);
      if (!validated) {
        res.writeHead(403, { "Content-Type": "application/json" });
        res.end(JSON.stringify({ error: "Invalid or expired signed URL" }));
        return;
      }
      await serveStaticFile(req, res, validated.filePath, true);
      return;
    }

    // Cache purge API
    if (url.pathname === "/api/purge" && method === "POST") {
      const body = await readBody(req);
      handlePurge(req, res, body);
      return;
    }

    // Generate signed URL
    if (url.pathname === "/api/sign" && method === "POST") {
      const body = await readBody(req);
      handleGenerateSignedURL(req, res, body);
      return;
    }

    // Cache registry status
    if (url.pathname === "/api/cache-status" && method === "GET") {
      const entries = Object.fromEntries(cacheRegistry);
      res.writeHead(200, { "Content-Type": "application/json" });
      res.end(JSON.stringify({ cached: entries, count: cacheRegistry.size }));
      return;
    }

    // Serve static files from /assets/*
    if (url.pathname.startsWith("/assets/") && method === "GET") {
      const filePath = url.pathname.slice(1); // Remove leading /
      await serveStaticFile(req, res, filePath, false);
      return;
    }

    res.writeHead(404, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "Not found" }));
  } catch (err) {
    console.error(`[ERROR] ${method} ${url.pathname}:`, err);
    res.writeHead(500, { "Content-Type": "application/json" });
    res.end(JSON.stringify({ error: "Internal server error" }));
  }
}

// --- Server with graceful shutdown ---
const server = http.createServer(router);

server.listen(PORT, () => {
  console.log(`CDN origin server listening on http://localhost:${PORT}`);
  console.log(`Serving static files from: ${path.resolve(STATIC_DIR)}`);
});

function shutdown(signal: string): void {
  console.log(`\n${signal} received. Shutting down...`);
  server.close(() => {
    console.log("Server closed.");
    process.exit(0);
  });
  setTimeout(() => process.exit(1), 10_000);
}

process.on("SIGTERM", () => shutdown("SIGTERM"));
process.on("SIGINT", () => shutdown("SIGINT"));