server.js

/**
 * FleetTrack — Self-hosted device fleet monitor
 * ──────────────────────────────────────────────
 * npm install
 * node server.js
 *
 * First run creates: admin / changeme — change it immediately.
 * Put secrets in a .env file (see .env.example).
 */

// Load .env file if present (for local dev and Railway/Render)
require('dotenv').config();

const express    = require('express');
const session    = require('express-session');
const bcrypt     = require('bcrypt');
const fs         = require('fs');
const path       = require('path');
const nodemailer = require('nodemailer');

const app  = express();
const PORT = process.env.PORT || 3000;

// ── CONFIG ────────────────────────────────────────────────────
const CONFIG = {
  // Minutes before a device is flagged offline
  offlineThresholdMin: 5,

  // How many location history points to keep per device
  maxHistory: 100,

  // Session secret — set SESSION_SECRET in .env
  sessionSecret: process.env.SESSION_SECRET || 'change-this-secret-now',

  // Agent API token — set API_TOKEN in .env, copy to agent scripts
  apiToken: process.env.API_TOKEN || 'change-me-to-a-long-random-string',

  email: {
    enabled: process.env.SMTP_USER ? true : false,
    from:    process.env.SMTP_USER  || 'you@gmail.com',
    to:      process.env.ALERT_TO   || 'you@gmail.com',
    smtp: {
      host:   'smtp.gmail.com',
      port:   587,
      secure: false,
      auth: {
        user: process.env.SMTP_USER || '',
        pass: process.env.SMTP_PASS || '',
      },
    },
  },
};

// ── DATA PATHS ────────────────────────────────────────────────
const DATA_DIR    = path.join(__dirname, 'data');
const DEV_FILE    = path.join(DATA_DIR, 'devices.json');
const USERS_FILE  = path.join(DATA_DIR, 'users.json');
const HIST_FILE   = path.join(DATA_DIR, 'history.json');

if (!fs.existsSync(DATA_DIR)) fs.mkdirSync(DATA_DIR, { recursive: true });

// ── PERSISTENCE HELPERS ───────────────────────────────────────
const load = (file, def) => {
  try { return fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : def; }
  catch(e) { return def; }
};
const save = (file, data) => {
  try { fs.writeFileSync(file, JSON.stringify(data, null, 2)); }
  catch(e) { console.error('Save error:', e.message); }
};

// ── STATE ─────────────────────────────────────────────────────
let devices = load(DEV_FILE,   {});
let history = load(HIST_FILE,  {}); // deviceId → [{lat,lon,ts}]
const alertedOffline = new Set();

// ── USERS ─────────────────────────────────────────────────────
async function ensureDefaultAdmin() {
  const users = load(USERS_FILE, {});
  if (Object.keys(users).length === 0) {
    const hash = await bcrypt.hash('changeme', 12);
    users['admin'] = { username: 'admin', passwordHash: hash, role: 'admin' };
    save(USERS_FILE, users);
    console.log('\n  ⚠  Default admin: username=admin password=changeme');
    console.log('     Change it immediately after first login!\n');
  }
}

// ── MIDDLEWARE ────────────────────────────────────────────────
app.use(express.json());
app.use(express.urlencoded({ extended: true }));

app.use(session({
  secret:            CONFIG.sessionSecret,
  resave:            false,
  saveUninitialized: false,
  cookie: { httpOnly: true, maxAge: 8 * 60 * 60 * 1000, sameSite: 'lax' },
}));

// ── AUTH GUARDS ───────────────────────────────────────────────
const requireLogin   = (req, res, next) =>
  req.session?.user ? next() : res.redirect('/login');

const requireSession = (req, res, next) =>
  req.session?.user ? next() : res.status(401).json({ error: 'Not authenticated' });

const requireToken   = (req, res, next) =>
  req.headers['x-api-token'] === CONFIG.apiToken
    ? next() : res.status(401).json({ error: 'Unauthorized' });

// ── AUTH ROUTES ───────────────────────────────────────────────
app.get('/login', (req, res) => {
  if (req.session?.user) return res.redirect('/');
  res.sendFile(path.join(__dirname, 'public', 'login.html'));
});

app.post('/login', async (req, res) => {
  const { username, password } = req.body;
  const users = load(USERS_FILE, {});
  const user  = users[username];
  const dummy = '$2b$12$invalidhashfortimingprotection000000000000000000000';
  const match = await bcrypt.compare(password || '', user ? user.passwordHash : dummy);

  if (!user || !match) {
    console.log(`[${new Date().toISOString()}] FAILED LOGIN: ${username}`);
    return res.redirect('/login?error=1');
  }

  req.session.regenerate(err => {
    if (err) return res.redirect('/login?error=1');
    req.session.user = { username: user.username, role: user.role };
    console.log(`[${new Date().toISOString()}] LOGIN: ${username}`);
    res.redirect('/');
  });
});

app.post('/logout', (req, res) => {
  const who = req.session?.user?.username || 'unknown';
  req.session.destroy(() => {
    console.log(`[${new Date().toISOString()}] LOGOUT: ${who}`);
    res.redirect('/login');
  });
});

app.post('/api/change-password', requireSession, async (req, res) => {
  const { currentPassword, newPassword } = req.body;
  if (!newPassword || newPassword.length < 8)
    return res.status(400).json({ error: 'Min 8 characters' });

  const users = load(USERS_FILE, {});
  const user  = users[req.session.user.username];
  if (!user) return res.status(404).json({ error: 'User not found' });

  const match = await bcrypt.compare(currentPassword || '', user.passwordHash);
  if (!match) return res.status(403).json({ error: 'Current password is incorrect' });

  user.passwordHash = await bcrypt.hash(newPassword, 12);
  save(USERS_FILE, users);
  console.log(`[${new Date().toISOString()}] PASSWORD CHANGED: ${user.username}`);
  res.json({ ok: true });
});

app.get('/api/me', requireSession, (req, res) => {
  res.json({ username: req.session.user.username, role: req.session.user.role });
});

// ── DASHBOARD ─────────────────────────────────────────────────
app.get('/', requireLogin, (req, res) => {
  res.sendFile(path.join(__dirname, 'public', 'index.html'));
});

// ── AGENT CHECK-IN ────────────────────────────────────────────
app.post('/checkin', requireToken, (req, res) => {
  const { deviceId, name, os, battery, ipLocal, notes, lat, lon } = req.body;
  if (!deviceId) return res.status(400).json({ error: 'deviceId required' });

  const now   = Date.now();
  const ipWan = req.ip.replace('::ffff:', '');
  const prev  = devices[deviceId] || {};

  // Parse and validate coordinates
  const parsedLat = lat != null ? parseFloat(lat) : null;
  const parsedLon = lon != null ? parseFloat(lon) : null;
  const validLat  = parsedLat !== null && !isNaN(parsedLat) && parsedLat >= -90  && parsedLat <= 90;
  const validLon  = parsedLon !== null && !isNaN(parsedLon) && parsedLon >= -180 && parsedLon <= 180;
  const newLat    = validLat ? parsedLat : (prev.lat || null);
  const newLon    = validLon ? parsedLon : (prev.lon || null);

  devices[deviceId] = {
    deviceId,
    name:      name    || prev.name    || deviceId,
    os:        os      || prev.os      || 'Unknown',
    battery:   battery != null ? Number(battery) : (prev.battery ?? null),
    ipLocal:   ipLocal || prev.ipLocal || null,
    ipWan,
    lat:       newLat,
    lon:       newLon,
    notes:     notes   || prev.notes   || '',
    lastSeen:  now,
    firstSeen: prev.firstSeen || now,
    checkins:  (prev.checkins || 0) + 1,
  };

  // Append to location history if we have valid coords
  if (validLat && validLon) {
    if (!history[deviceId]) history[deviceId] = [];
    history[deviceId].push({ lat: parsedLat, lon: parsedLon, ts: now });
    // Keep only last N points
    if (history[deviceId].length > CONFIG.maxHistory)
      history[deviceId] = history[deviceId].slice(-CONFIG.maxHistory);
    save(HIST_FILE, history);
  }

  // Clear offline alert if device is back
  if (alertedOffline.has(deviceId)) {
    alertedOffline.delete(deviceId);
    sendAlert(
      `✅ Back Online: ${devices[deviceId].name}`,
      `${devices[deviceId].name} is back online.\nTime: ${new Date().toISOString()}`
    );
  }

  save(DEV_FILE, devices);
  console.log(`[${new Date().toISOString()}] CHECK-IN: ${devices[deviceId].name} (${ipWan}) lat=${newLat} lon=${newLon}`);
  res.json({ ok: true, serverTime: now });
});

// ── DEVICE API ────────────────────────────────────────────────
app.get('/api/devices', requireSession, (req, res) => {
  const now       = Date.now();
  const threshold = CONFIG.offlineThresholdMin * 60 * 1000;

  const list = Object.values(devices).map(d => ({
    ...d,
    online:  (now - d.lastSeen) < threshold,
    secsAgo: Math.floor((now - d.lastSeen) / 1000),
    minsAgo: Math.floor((now - d.lastSeen) / 60000),
  })).sort((a, b) => a.online !== b.online ? (a.online ? -1 : 1) : b.lastSeen - a.lastSeen);

  res.json(list);
});

// Location history for a single device
app.get('/api/history/:id', requireSession, (req, res) => {
  res.json(history[req.params.id] || []);
});

app.delete('/api/devices/:id', requireSession, (req, res) => {
  const { id } = req.params;
  if (!devices[id]) return res.status(404).json({ error: 'Not found' });
  const name = devices[id].name;
  delete devices[id];
  delete history[id];
  save(DEV_FILE, devices);
  save(HIST_FILE, history);
  console.log(`[${new Date().toISOString()}] REMOVED: ${name}`);
  res.json({ ok: true });
});

// ── OFFLINE CHECKER (every 60s) ───────────────────────────────
setInterval(() => {
  const now       = Date.now();
  const threshold = CONFIG.offlineThresholdMin * 60 * 1000;
  for (const d of Object.values(devices)) {
    const offline = (now - d.lastSeen) >= threshold;
    if (offline && !alertedOffline.has(d.deviceId)) {
      alertedOffline.add(d.deviceId);
      const mins = Math.floor((now - d.lastSeen) / 60000);
      console.warn(`[ALERT] OFFLINE: ${d.name} — ${mins}min ago`);
      sendAlert(
        `⚠️ Offline: ${d.name}`,
        `${d.name} hasn't checked in for ${mins} minutes.\nLast IP: ${d.ipWan}\nLast seen: ${new Date(d.lastSeen).toISOString()}`
      );
    }
  }
}, 60 * 1000);

// ── EMAIL ─────────────────────────────────────────────────────
async function sendAlert(subject, body) {
  if (!CONFIG.email.enabled) { console.log(`[ALERT — email off] ${subject}`); return; }
  try {
    await nodemailer.createTransport(CONFIG.email.smtp)
      .sendMail({ from: CONFIG.email.from, to: CONFIG.email.to, subject, text: body });
    console.log(`[ALERT SENT] ${subject}`);
  } catch(e) { console.error(`[ALERT FAILED] ${e.message}`); }
}

// ── BOOT ─────────────────────────────────────────────────────
ensureDefaultAdmin().then(() => {
  app.listen(PORT, () => {
    console.log(`\n  FleetTrack → http://localhost:${PORT}`);
    console.log(`  API Token  : ${CONFIG.apiToken}`);
    console.log(`  Threshold  : ${CONFIG.offlineThresholdMin} min`);
    console.log(`  Devices    : ${Object.keys(devices).length}`);
    console.log(`  Email      : ${CONFIG.email.enabled ? 'ON' : 'OFF'}\n`);
  });
});