app.rb

# frozen_string_literal: true

require "sinatra"
require "sinatra/reloader" if development?
require "dotenv/load"
require "faraday"
require "json"
require "securerandom"
require "uri"

# ---------------------------------------------------------------------------
# Config
# ---------------------------------------------------------------------------

SUPERCAST_ENV = ENV.fetch("SUPERCAST_ENV", "development")

BASE_URLS = {
  "production"  => "https://app.supercast.tech",
  "development" => "https://app.supercast.test",
}.freeze

BASE_URL       = BASE_URLS.fetch(SUPERCAST_ENV) { abort "Unknown SUPERCAST_ENV: #{SUPERCAST_ENV}" }
CLIENT_ID      = ENV.fetch("SUPERCAST_CLIENT_ID")  { abort "SUPERCAST_CLIENT_ID is not set" }
CLIENT_SECRET  = ENV.fetch("SUPERCAST_CLIENT_SECRET") { abort "SUPERCAST_CLIENT_SECRET is not set" }
REDIRECT_URI   = ENV.fetch("REDIRECT_URI", "http://localhost:4000/auth/callback")

# ---------------------------------------------------------------------------
# Sinatra settings
# ---------------------------------------------------------------------------

configure do
  set :port, ENV.fetch("PORT", 4000).to_i
  set :bind, "localhost"
  set :views, File.join(__dir__, "views")
  enable :sessions
  set :session_secret, ENV.fetch("SESSION_SECRET", SecureRandom.hex(32))
end

# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------

helpers do
  def authenticated?
    !!session[:access_token]
  end

  def token_expired?
    return false unless session[:token_expires_at]
    Time.now.to_i >= session[:token_expires_at]
  end

  def store_tokens(token_data)
    session[:access_token]  = token_data["access_token"]
    session[:refresh_token] = token_data["refresh_token"]
    if (expires_in = token_data["expires_in"])
      session[:token_expires_at] = Time.now.to_i + expires_in.to_i - 60
    end
  end

  def refresh_token!
    return false unless session[:refresh_token]

    response = supercast.post("/oauth/token") do |req|
      req.body = URI.encode_www_form(
        grant_type:    "refresh_token",
        refresh_token: session[:refresh_token],
        client_id:     CLIENT_ID,
        client_secret: CLIENT_SECRET
      )
    end

    return false unless response.success?

    store_tokens(JSON.parse(response.body))
    true
  end

  def api_call(endpoint, params = {})
    if token_expired?
      unless refresh_token!
        return { error: "Access token expired. Please re-authorize.", status: 401 }
      end
    end

    response = supercast.get("/api/v1#{endpoint}") do |req|
      req.headers["Authorization"] = "Bearer #{session[:access_token]}"
      req.params = params.reject { |_, v| v.nil? || v.to_s.strip.empty? }
    end

    { status: response.status, data: JSON.parse(response.body), ok: response.success? }
  rescue => e
    { error: e.message, status: 0 }
  end

  def flash!(type, message)
    session[:flash] = { "type" => type, "message" => message }
  end

  private

  def supercast
    @supercast ||= Faraday.new(BASE_URL) do |f|
      f.headers["Content-Type"] = "application/x-www-form-urlencoded"
      f.headers["Accept"]       = "application/json"
      f.ssl.verify = false if SUPERCAST_ENV == "development"
    end
  end
end

# ---------------------------------------------------------------------------
# Routes
# ---------------------------------------------------------------------------

get "/" do
  @authenticated = authenticated?
  @expired       = @authenticated && token_expired?
  @subdomain     = session[:subdomain] || ""
  @env_name      = SUPERCAST_ENV
  @base_url      = BASE_URL
  @flash         = session.delete(:flash)
  erb :index
end

# --- OAuth: start authorization code flow -----------------------------------

get "/auth/authorize" do
  state = SecureRandom.hex(16)
  session[:oauth_state] = state

  query = URI.encode_www_form(
    client_id:     CLIENT_ID,
    response_type: "code",
    redirect_uri:  REDIRECT_URI,
    scope:         "public write",
    state:         state
  )

  redirect "#{BASE_URL}/oauth/authorize?#{query}"
end

# --- OAuth: handle callback -------------------------------------------------

get "/auth/callback" do
  if params[:error]
    flash!("error", "Authorization denied: #{params[:error]}")
    redirect "/"
  end

  if params[:state] != session.delete(:oauth_state)
    flash!("error", "Invalid state parameter. Please try again.")
    redirect "/"
  end

  response = supercast.post("/oauth/token") do |req|
    req.body = URI.encode_www_form(
      grant_type:   "authorization_code",
      code:         params[:code],
      redirect_uri: REDIRECT_URI,
      client_id:    CLIENT_ID,
      client_secret: CLIENT_SECRET
    )
  end

  token_data = JSON.parse(response.body)

  if response.success?
    store_tokens(token_data)
    flash!("success", "Successfully connected to Supercast.")
  else
    msg = token_data["error_description"] || token_data["error"] || "Token exchange failed."
    flash!("error", msg)
  end

  redirect "/"
end

# --- Set working subdomain --------------------------------------------------

post "/subdomain" do
  session[:subdomain] = params[:subdomain].to_s.strip
  redirect "/"
end

# --- Logout -----------------------------------------------------------------

post "/auth/logout" do
  session.clear
  redirect "/"
end

# --- API: subscribers -------------------------------------------------------

get "/api/subscribers" do
  redirect "/" unless authenticated?

  page    = (params[:page] || 1).to_i
  @result = api_call("/subscribers", subdomain: session[:subdomain], page: page, per_page: 20)
  @title    = "Subscribers"
  @endpoint = "/api/v1/subscribers?subdomain=#{session[:subdomain]}"
  @page     = page
  @back_path = "/api/subscribers"
  erb :results
end

# --- API: episodes ----------------------------------------------------------

get "/api/episodes" do
  redirect "/" unless authenticated?

  page    = (params[:page] || 1).to_i
  @result = api_call("/episodes", subdomain: session[:subdomain], page: page, per_page: 20)
  @title    = "Episodes"
  @endpoint = "/api/v1/episodes?subdomain=#{session[:subdomain]}"
  @page     = page
  @back_path = "/api/episodes"
  erb :results
end

# --- API: charges -----------------------------------------------------------

get "/api/charges" do
  redirect "/" unless authenticated?

  page    = (params[:page] || 1).to_i
  @result = api_call("/charges", subdomain: session[:subdomain], page: page, per_page: 20)
  @title    = "Charges"
  @endpoint = "/api/v1/charges?subdomain=#{session[:subdomain]}"
  @page     = page
  @back_path = "/api/charges"
  erb :results
end