import { Schema, model } from "mongoose";
import bcrypt from "bcryptjs";

const sellerProfileSchema = new Schema({
  identity_document:   { type: String },
  selfie_url:          { type: String },
  verification_status: { type: String, enum: ["pending", "verified", "rejected"], default: "pending" },
  verification_method: { type: String, enum: ["manual", "automatic"] },
  verified_at:         { type: Date },
  verified_by:         { type: Schema.Types.ObjectId, ref: "User" },
  rejection_reason:    { type: String },
  is_verified_badge:   { type: Boolean, default: false },
}, { _id: false });

const userSchema = new Schema({
  email: {
    type: String,
    required: true,
    unique: true,
    lowercase: true,
    match: /^[^\s@]+@[^\s@]+\.[^\s@]+$/
  },
  password_hash: { type: String, required: true },
  role: { type: String, enum: ["admin", "seller"], required: true },
  full_name: { type: String, required: true, trim: true },
  phone: { 
    type: String,
    match: /^\+?[1-9][0-9]{7,14}$/  // International format
  },
  is_email_verified:        { type: Boolean, default: false },
  is_phone_verified:        { type: Boolean, default: false },
  email_verification_token: { type: String },
  profile_picture_url:      { type: String },
  seller_profile:           { type: sellerProfileSchema, default: null },
  is_active:                { type: Boolean, default: true },
  last_login:               { type: Date },
}, {
  timestamps: { createdAt: "created_at", updatedAt: "updated_at" },
});

// Hash password before saving
userSchema.pre("save", async function (next) {
  if (!this.isModified("password_hash")) return;
  const salt = await bcrypt.genSalt(Number(process.env.BCRYPT_SALT_ROUNDS) || 12);
  this.password_hash = await bcrypt.hash(this.password_hash, salt);
});

// Compare password method
userSchema.methods.comparePassword = async function (candidatePassword: string) {
  return bcrypt.compare(candidatePassword, this.password_hash);
};

// Remove sensitive fields from JSON
userSchema.methods.toJSON = function () {
  const obj = this.toObject();
  delete obj.password_hash;
  delete obj.email_verification_token;
  return obj;
};

export const User = model("User", userSchema);

import { Schema, model } from "mongoose";

const photoSchema = new Schema({
  url:         { type: String, required: true },
  caption:     { type: String },
  is_cover:    { type: Boolean, default: false },
  uploaded_at: { type: Date, default: () => new Date() },
});

const videoSchema = new Schema({
  url:         { type: String, required: true },
  embed_url:   { type: String },
  video_type:  { type: String, enum: ["training", "competition", "other"], required: true },
  title:       { type: String },
  description: { type: String },
  recorded_at: { type: Date, required: true },
  uploaded_at: { type: Date, default: () => new Date() },
});

const locationSchema = new Schema({
  country:     { type: String, required: true },
  region:      { type: String, required: true },
  city:        { type: String },
  coordinates: {
    lat: { type: Number },
    lng: { type: Number },
  },
}, { _id: false });

const horseSchema = new Schema({
  seller_id:  { type: Schema.Types.ObjectId, ref: "User", required: true, index: true },
  name:       { type: String, required: true, trim: true },
  age:        { type: Number, required: true, min: 0, max: 40 },
  breed:      { type: String, required: true, trim: true },
  discipline: { type: String, required: true, trim: true },
  pedigree:   { type: String },
  location:   { type: locationSchema, required: true },
  price:      { type: Number, min: 0 },
  currency:   { type: String, enum: ["USD", "EUR", "ARS", "BRL", "MXN"], default: "USD" },
  photos: {
    type: [photoSchema],
    validate: {
      validator: (photos) => photos.length >= 3,
      message: "At least 3 photos are required",
    },
  },
  videos:      { type: [videoSchema], default: [] },
  status:      { type: String, enum: ["active", "sold", "paused", "draft"], default: "draft" },
  views_count: { type: Number, default: 0 },
}, {
  timestamps: { createdAt: "created_at", updatedAt: "updated_at" },
});

// Full-text search index
horseSchema.index(
  { name: "text", breed: "text", discipline: "text", pedigree: "text" },
  { default_language: "spanish" }
);

// Auto-generate embed URLs from YouTube/Vimeo
horseSchema.pre("save", function (next) {
  this.videos = this.videos.map((video) => {
    if (!video.embed_url && video.url) {
      video.embed_url = toEmbedUrl(video.url);
    }
    return video;
  });
  next();
});

function toEmbedUrl(url: string): string {
  // YouTube: youtube.com/watch?v=ID or youtu.be/ID
  const ytMatch = url.match(/(?:youtube\.com\/watch\?v=|youtu\.be\/)([^&\s]+)/);
  if (ytMatch) return `https://www.youtube.com/embed/${ytMatch[1]}`;
  
  // Vimeo: vimeo.com/ID
  const vimeoMatch = url.match(/vimeo\.com\/(\d+)/);
  if (vimeoMatch) return `https://player.vimeo.com/video/${vimeoMatch[1]}`;
  
  return url;
}

export const Horse = model("Horse", horseSchema);

const conversationSchema = new Schema({
  participants: [{ type: Schema.Types.ObjectId, ref: "User", required: true }],
  last_message: {
    text: String,
    sender_id: Schema.Types.ObjectId,
    sent_at: Date,
    is_read: Boolean,
  },
  created_at: { type: Date, default: Date.now },
  updated_at: { type: Date, default: Date.now },
});

const messageSchema = new Schema({
  conversation_id: { type: Schema.Types.ObjectId, ref: "Conversation", required: true },
  sender_id:       { type: Schema.Types.ObjectId, ref: "User", required: true },
  text:            { type: String, required: true },
  is_read:         { type: Boolean, default: false },
  sent_at:         { type: Date, default: Date.now },
});

export const Conversation = model("Conversation", conversationSchema);
export const Message = model("Message", messageSchema);

import express from "express";
import cors from "cors";
import helmet from "helmet";
import morgan from "morgan";
import { rateLimit } from "express-rate-limit";

const app = express();

// Security headers
app.use(helmet());

// CORS configuration
const allowedOrigins = process.env.CORS_ORIGINS.split(",");
app.use(cors({
  origin: (origin, callback) => {
    if (!origin || allowedOrigins.includes(origin)) {
      return callback(null, true);
    }
    callback(new Error("Not allowed by CORS"));
  },
  credentials: true,
}));

// Body parsing
app.use(express.json({ limit: "10mb" }));
app.use(express.urlencoded({ extended: true }));

// Request logging
if (process.env.NODE_ENV !== "test") {
  app.use(morgan("dev"));
}

// Global rate limiter: 100 requests per 15 minutes
const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  message: { success: false, message: "Too many requests" },
});
app.use(limiter);

// Strict auth rate limiter: 10 requests per 15 minutes
const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 10,
  message: { success: false, message: "Too many auth attempts" },
});

// Routes
app.get("/health", (req, res) => {
  res.json({ success: true, message: "Horse Portal API is running" });
});

app.use("/health/db", databaseRoutes);
app.use("/api/auth", authLimiter, authRoutes);
app.use("/api/horses", horseRoutes);
app.use("/api/admin", adminRoutes);
app.use("/api/chat", chatRoutes);

// 404 handler
app.use((req, res) => {
  res.status(404).json({ success: false, message: "Route not found" });
});

// Global error handler
app.use((err, req, res, next) => {
  console.error("Unhandled error:", err.message);
  res.status(500).json({ success: false, message: "Internal server error" });
});

export default app;

import http from "http";
import { Server as SocketServer } from "socket.io";
import jwt from "jsonwebtoken";

const httpServer = http.createServer(app);

const io = new SocketServer(httpServer, {
  cors: {
    origin: process.env.CORS_ORIGINS.split(","),
    credentials: true,
  },
});

// JWT authentication middleware for Socket.io
io.use((socket, next) => {
  const token = socket.handshake.auth?.token;
  if (!token) {
    return next(new Error("Authentication error: no token"));
  }
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    socket.user = decoded;
    next();
  } catch {
    next(new Error("Authentication error: invalid token"));
  }
});

io.on("connection", (socket) => {
  console.log(`Socket connected: userId=${socket.user.userId}`);
  
  // Join user-specific room for notifications
  socket.join(`user:${socket.user.userId}`);
  
  // Join conversation room
  socket.on("join_conversation", (conversationId) => {
    socket.join(`conv:${conversationId}`);
  });
  
  // Send message
  socket.on("send_message", async (data, ack) => {
    try {
      // Verify user is participant
      const conversation = await Conversation.findOne({
        _id: data.conversation_id,
        participants: socket.user.userId,
      });
      
      if (!conversation) {
        return ack({ success: false, message: "Conversation not found" });
      }
      
      // Save message to database
      const message = await Message.create({
        conversation_id: data.conversation_id,
        sender_id: socket.user.userId,
        text: data.text,
        is_read: false,
      });
      
      // Update conversation last_message
      await Conversation.findByIdAndUpdate(data.conversation_id, {
        last_message: {
          text: data.text,
          sender_id: socket.user.userId,
          sent_at: message.sent_at,
          is_read: false,
        },
        updated_at: new Date(),
      });
      
      const populated = await message.populate("sender_id", "full_name profile_picture_url");
      
      // Broadcast to conversation room
      io.to(`conv:${data.conversation_id}`).emit("new_message", populated);
      
      // Notify recipient
      const recipientId = conversation.participants.find(
        (p) => p.toString() !== socket.user.userId
      );
      if (recipientId) {
        io.to(`user:${recipientId}`).emit("message_notification", {
          conversation_id: data.conversation_id,
          sender: socket.user.userId,
          preview: data.text.substring(0, 60),
        });
      }
      
      ack({ success: true, data: populated });
    } catch (err) {
      console.error("Socket send_message error:", err);
      ack({ success: false, message: "Error sending message" });
    }
  });
  
  // Typing indicators
  socket.on("typing", (conversationId) => {
    socket.to(`conv:${conversationId}`).emit("user_typing", { userId: socket.user.userId });
  });
  
  socket.on("stop_typing", (conversationId) => {
    socket.to(`conv:${conversationId}`).emit("user_stop_typing", { userId: socket.user.userId });
  });
  
  socket.on("disconnect", () => {
    console.log(`Socket disconnected: userId=${socket.user.userId}`);
  });
});

httpServer.listen(PORT, () => {
  console.log(`Server running on http://localhost:${PORT}`);
  console.log(`Socket.io ready`);
});

import Header from '@/component/layout/Header';
import Footer from '@/component/layout/Footer';

export default function RootLayout({ children }) {
  return (
    <html lang="en">
      <body className="bg-background-light dark:bg-background-dark">
        <Header />
        {children}
        <Footer />
      </body>
    </html>
  );
}

"use server";

import { cookies } from 'next/headers';
import { redirect } from 'next/navigation';
import { apiFetch } from '../utils/apiFetch';

export async function loginUser(email: string, password: string) {
  const res = await apiFetch('/auth/login', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ email, password }),
  });

  const data = await res.json();
  if (!res.ok) throw new Error(data.error);
  
  // Store JWT in HTTP-only cookie
  const cookieStore = await cookies();
  cookieStore.set('horse_trust_token', data.token, { 
    httpOnly: true, 
    secure: process.env.NODE_ENV === 'production',
    maxAge: 60 * 60 * 24 * 7, // 7 days
    path: '/',
  });

  return { success: true, data };
}

export async function apiFetch(endpoint: string, options: RequestInit = {}) {
  const apiUrl = process.env.NEXT_PUBLIC_API_URL;
  const url = `${apiUrl}${endpoint}`;

  try {
    let res = await fetch(url, options);

    // Retry on 5xx errors with DB reconnection
    if (!res.ok && res.status >= 500) {
      console.log(`API failed. Attempting DB reconnect...`);
      
      const reconRes = await fetch(`${apiUrl}/health/reconnect`, { 
        method: 'POST' 
      });
      
      if (reconRes.ok) {
        console.log(`DB reconnected. Retrying...`);
        res = await fetch(url, options);
      }
    }

    return res;
  } catch (error) {
    console.error(`Network error. Reconnecting...`, error);
    await fetch(`${apiUrl}/health/reconnect`, { method: 'POST' });
    return await fetch(url, options);
  }
}