import express from 'express';
import dotenv from 'dotenv';
import https from 'https';
import axios from 'axios';
import http from 'http';
import { spawn } from 'child_process';
import { Server } from 'socket.io';
import path from 'path';
import fs from 'fs';
import os from 'os';
import crypto from 'crypto';
import { fileURLToPath } from 'url';
import { db } from './db/index.js';
import { ensureDatabaseSchema } from './db/schemaEnsure.js';
import {
  ensureSuperuserFromEnv,
  getSuperuserSummary,
  hasSuperuser,
  registerSuperuser,
  removeSuperuser,
  findUserByIdentifier,
  markUserLogin,
  verifyPassword,
  SUPERUSER_GROUP_NAME
} from './auth/superuser.js';
import {
  logEvent,
  buildEventLogFilter,
  deleteEventLogById,
  deleteEventLogsByFilters,
  exportEventLogsByFilters
} from './logging/eventLogs.js';
import { getSetting, setSetting, deleteSetting } from './db/settings.js';
import { activateMaintenanceMode, deactivateMaintenanceMode, getMaintenanceState, isMaintenanceModeActive } from './maintenance/state.js';
import {
  ensureDefaultsFromEnv,
  getActiveEndpointExternalId,
  getActiveApiKey,
  getActiveServerUrl,
  hasServer,
  hasEndpoint,
  hasApiKey,
  getSetupStatus,
  completeSetup,
  removeEndpoint,
  removeServer,
  setServerApiKey
} from './setup/index.js';
import {
  listUsers,
  getUserById,
  updateUserGroups,
  createUser,
  updateUserDetails,
  deleteUser,
  updateUserActiveStatus,
  getUserSecurityPhrase,
  renewUserSecurityPhrase,
  markSecurityPhraseDownloaded,
  ensureSecurityPhrasesForExistingUsers,
  verifySecurityPhraseForUsername,
  setUserPassword
} from './users/index.js';
import { listGroups, createGroup, getGroupById, updateGroupDetails, deleteGroup } from './groups/index.js';
import {
  getPermissionStructure,
  getPermissionValuesByGroup,
  saveGroupPermissionValues,
  clearGroupPermissionValues,
  getSuperuserPermissionMap,
  getEffectivePermissionsForGroups,
  hasRequiredPermission
} from './permissions/index.js';

dotenv.config();

ensureDatabaseSchema();
ensureSuperuserFromEnv();
ensureDefaultsFromEnv();

try {
  const initializedCount = ensureSecurityPhrasesForExistingUsers();
  if (initializedCount > 0) {
    console.log(`ℹ️ Sicherheitsschlüssel für ${initializedCount} bestehende Benutzer initialisiert`);
  }
} catch (error) {
  console.error('⚠️ Initialisierung der Sicherheitsschlüssel für bestehende Benutzer fehlgeschlagen:', error);
}

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);

const app = express();
app.use(express.json());
app.use(express.static(path.join(__dirname, 'public')));

app.get('*', (req, res, next) => {
  if (req.path.startsWith('/api')) return next();
  res.sendFile(path.join(__dirname, 'public', 'index.html'));
});

const PORT = 4001;

const requireActiveEndpointId = () => {
  const value = getActiveEndpointExternalId();
  if (!value) {
    const error = new Error('ENDPOINT_NOT_CONFIGURED');
    error.code = 'ENDPOINT_NOT_CONFIGURED';
    throw error;
  }
  return value;
};

const agent = new https.Agent({ rejectUnauthorized: false });

const resolvePortainerBaseUrl = () => {
  const envUrl = typeof process.env.PORTAINER_URL === 'string' ? process.env.PORTAINER_URL.trim() : '';
  if (envUrl) return envUrl;
  const activeUrl = getActiveServerUrl();
  return activeUrl ? activeUrl.trim() : '';
};

const axiosInstance = axios.create({
  httpsAgent: agent
});

axiosInstance.interceptors.request.use((config) => {
  const currentBase = typeof config.baseURL === 'string' ? config.baseURL.trim() : '';
  const effectiveBase = currentBase || resolvePortainerBaseUrl();
  if (!effectiveBase) {
    throw new Error('PORTAINER_URL_NOT_CONFIGURED');
  }
  config.baseURL = effectiveBase;

  const apiKey = getActiveApiKey();
  if (apiKey) {
    config.headers = config.headers || {};
    config.headers["X-API-Key"] = apiKey;
  } else if (config.headers?.["X-API-Key"]) {
    delete config.headers["X-API-Key"];
  }
  return config;
});

const REDEPLOY_PHASES = {
  QUEUED: 'queued',
  STARTED: 'started',
  SUCCESS: 'success',
  ERROR: 'error',
  INFO: 'info'
};

const redeployingStacks = new Map();

const AUTH_COOKIE_NAME = process.env.AUTH_COOKIE_NAME || 'sp_auth_token';
const DEFAULT_SESSION_TTL_MS = 1000 * 60 * 60 * 12;
const envSessionTtl = Number(process.env.AUTH_SESSION_TTL_MS);
const AUTH_SESSION_TTL_MS = Number.isFinite(envSessionTtl) && envSessionTtl > 0 ? envSessionTtl : DEFAULT_SESSION_TTL_MS;

const AUTH_COOKIE_OPTIONS = {
  httpOnly: true,
  sameSite: 'lax',
  secure: process.env.NODE_ENV === 'production',
  path: '/'
};

const activeSessions = new Map();
const passwordResetTickets = new Map();
const PASSWORD_RESET_TTL_MS = 1000 * 60 * 15;

const PUBLIC_API_ROUTES = [
  { method: 'GET', matcher: /^\/api\/auth\/superuser\/status$/ },
  { method: 'POST', matcher: /^\/api\/auth\/superuser\/register$/ },
  { method: 'POST', matcher: /^\/api\/auth\/login$/ },
  { method: 'POST', matcher: /^\/api\/auth\/logout$/ },
  { method: 'GET', matcher: /^\/api\/auth\/session$/ },
  { method: 'POST', matcher: /^\/api\/auth\/recover\/verify$/ },
  { method: 'POST', matcher: /^\/api\/auth\/recover\/reset$/ },
  { method: 'GET', matcher: /^\/api\/setup\/status$/ },
  { method: 'POST', matcher: /^\/api\/setup\/complete$/ }
];

const sanitizeUser = (user) => ({
  id: user.id,
  username: user.username,
  email: user.email,
  avatarColor: user.avatar_color || null
});

const buildUserSessionPayload = (userId) => {
  const record = getUserById(userId);
  if (!record || !record.isActive) {
    return null;
  }

  const groups = Array.isArray(record.groups) ? record.groups : [];
  const groupIds = groups
    .map((group) => Number(group.id))
    .filter((groupId) => Number.isFinite(groupId) && groupId > 0);

  const isSuperuser = groups.some(
    (group) => typeof group?.name === 'string' && group.name.toLowerCase() === SUPERUSER_GROUP_NAME
  );

  const permissions = isSuperuser
    ? getSuperuserPermissionMap()
    : getEffectivePermissionsForGroups(groupIds);

  return {
    user: {
      id: record.id,
      username: record.username,
      email: record.email || null,
      avatarColor: record.avatarColor || null,
      groups,
      isSuperuser,
      securityPhraseDownloadedAt: record.securityPhraseDownloadedAt || null,
      requiresSecurityPhraseDownload: !record.securityPhraseDownloadedAt
    },
    permissions
  };
};

const cleanupExpiredSessions = () => {
  const now = Date.now();
  for (const [token, session] of activeSessions.entries()) {
    if (!session || session.expiresAt <= now) {
      activeSessions.delete(token);
    }
  }
};

const removeSessionsForUser = (userId) => {
  if (!userId) return;
  for (const [token, session] of activeSessions.entries()) {
    if (session?.userId === userId) {
      activeSessions.delete(token);
    }
  }
};

const cleanupExpiredPasswordResetTickets = () => {
  const now = Date.now();
  for (const [token, ticket] of passwordResetTickets.entries()) {
    if (!ticket || ticket.expiresAt <= now) {
      passwordResetTickets.delete(token);
    }
  }
};

const removePasswordResetTicketsForUser = (userId) => {
  if (!userId) return;
  for (const [token, ticket] of passwordResetTickets.entries()) {
    if (ticket?.userId === userId) {
      passwordResetTickets.delete(token);
    }
  }
};

const createPasswordResetTicketForUser = (userId) => {
  cleanupExpiredPasswordResetTickets();
  removePasswordResetTicketsForUser(userId);
  const token = crypto.randomBytes(32).toString('hex');
  const expiresAt = Date.now() + PASSWORD_RESET_TTL_MS;
  passwordResetTickets.set(token, { userId, expiresAt });
  return { token, expiresAt };
};

const getPasswordResetTicket = (token) => {
  if (!token) {
    return null;
  }
  cleanupExpiredPasswordResetTickets();
  const record = passwordResetTickets.get(token);
  if (!record) {
    return null;
  }
  if (record.expiresAt <= Date.now()) {
    passwordResetTickets.delete(token);
    return null;
  }
  return record;
};

const createSessionForUser = (user) => {
  cleanupExpiredSessions();
  removeSessionsForUser(user.id);
  const token = crypto.randomBytes(48).toString('hex');
  const expiresAt = Date.now() + AUTH_SESSION_TTL_MS;
  activeSessions.set(token, { userId: user.id, expiresAt });
  return { token, expiresAt };
};

const getSessionRecord = (token) => {
  if (!token) return null;
  cleanupExpiredSessions();
  const record = activeSessions.get(token);
  if (!record) return null;
  if (record.expiresAt <= Date.now()) {
    activeSessions.delete(token);
    return null;
  }
  return record;
};

const touchSession = (token) => {
  if (!token) return;
  const record = activeSessions.get(token);
  if (!record) return;
  record.expiresAt = Date.now() + AUTH_SESSION_TTL_MS;
  activeSessions.set(token, record);
};

const extractAuthToken = (req) => {
  const rawCookie = req.headers?.cookie;
  if (rawCookie && typeof rawCookie === 'string') {
    const parts = rawCookie.split(';');
    for (const part of parts) {
      const [name, ...rest] = part.trim().split('=');
      if (name === AUTH_COOKIE_NAME) {
        return rest.join('=');
      }
    }
  }
  const authHeader = req.headers?.authorization || req.headers?.Authorization;
  if (authHeader && typeof authHeader === 'string') {
    const lower = authHeader.toLowerCase();
    if (lower.startsWith('bearer ')) {
      return authHeader.slice(7).trim();
    }
  }
  return null;
};

const setAuthCookie = (res, token) => {
  if (!token || !res) return;
  if (typeof res.cookie === 'function') {
    res.cookie(AUTH_COOKIE_NAME, token, {
      ...AUTH_COOKIE_OPTIONS,
      maxAge: AUTH_SESSION_TTL_MS
    });
  } else {
    res.setHeader('Set-Cookie', `${AUTH_COOKIE_NAME}=${token}; Path=/; HttpOnly; SameSite=Lax`);
  }
};

const clearAuthCookie = (res) => {
  if (!res) return;
  if (typeof res.clearCookie === 'function') {
    res.clearCookie(AUTH_COOKIE_NAME, {
      ...AUTH_COOKIE_OPTIONS,
      maxAge: 0
    });
  } else {
    res.setHeader('Set-Cookie', `${AUTH_COOKIE_NAME}=; Path=/; Max-Age=0`);
  }
};

const isPublicApiRoute = (req) => {
  return PUBLIC_API_ROUTES.some(({ method, matcher }) => req.method === method && matcher.test(req.path));
};

const isActiveRedeployPhase = (phase) => phase === REDEPLOY_PHASES.QUEUED || phase === REDEPLOY_PHASES.STARTED;

const resolveRedeployPhase = (phase, message) => {
  if (phase) return phase;
  if (message) return REDEPLOY_PHASES.INFO;
  return REDEPLOY_PHASES.SUCCESS;
};

const server = http.createServer(app);
const io = new Server(server, {
  path: "/socket.io",
  cors: { origin: "*" }
});
io.on("connection", (socket) => {
  console.log(`🔌 [Socket] Client verbunden: ${socket.id}`);
});

const broadcastRedeployStatus = ({ stackId, stackName, phase, message }) => {
  if (!stackId) return;

  const resolvedPhase = resolveRedeployPhase(phase, message);
  const isRedeploying = isActiveRedeployPhase(resolvedPhase);

  if (isRedeploying) {
    redeployingStacks.set(String(stackId), {
      phase: resolvedPhase,
      stackName: stackName || null,
      message: message || null,
      updatedAt: Date.now()
    });
  } else if (resolvedPhase === REDEPLOY_PHASES.SUCCESS || resolvedPhase === REDEPLOY_PHASES.ERROR || resolvedPhase === 'idle') {
    redeployingStacks.delete(String(stackId));
  }

  const payload = {
    stackId,
    stackName,
    phase: resolvedPhase,
    message,
    isRedeploying,
    redeployPhase: resolvedPhase
  };

  io.emit("redeployStatus", payload);

  const label = stackName ? `${stackName} (${stackId})` : `Stack ${stackId}`;
  console.log(`🔄 [RedeployStatus] ${label} -> ${resolvedPhase}${message ? `: ${message}` : ""}`);
};

const REDEPLOY_TYPES = {
  SINGLE: 'Einzeln',
  ALL: 'Alle',
  SELECTION: 'Auswahl',
  MAINTENANCE: 'Wartung'
};

const logStackEvent = ({
  stackId,
  stackName,
  status,
  message,
  redeployType = null,
  endpointId = null,
  metadata = {}
}) => {
  const metadataPayload = {
    ...metadata
  };

  if (redeployType) {
    metadataPayload.redeployType = redeployType;
  }

  if (endpointId !== undefined && endpointId !== null) {
    metadataPayload.endpointId = String(endpointId);
  }

  const hasMetadata = Object.keys(metadataPayload).length > 0;

  logEvent({
    category: 'stack',
    eventType: redeployType ?? null,
    action: 'redeploy',
    status: status ?? null,
    entityType: 'stack',
    entityId: stackId !== undefined && stackId !== null ? String(stackId) : null,
    entityName: stackName ?? null,
    contextType: endpointId !== undefined && endpointId !== null ? 'endpoint' : null,
    contextId: endpointId !== undefined && endpointId !== null ? String(endpointId) : null,
    message: message ?? null,
    metadata: hasMetadata ? metadataPayload : null
  });
};

const parseJsonColumn = (value) => {
  if (value === undefined || value === null || value === '') return null;
  try {
    return JSON.parse(value);
  } catch {
    return null;
  }
};

const SELF_STACK_ID = process.env.SELF_STACK_ID ? String(process.env.SELF_STACK_ID) : null;
const PORTAINER_SCRIPT_SETTING_KEY = 'portainer_update_script';
const PORTAINER_SSH_CONFIG_KEY = 'portainer_ssh_config';

const DEFAULT_PORTAINER_UPDATE_SCRIPT = [
  'docker stop portainer',
  'docker rm portainer',
  'docker pull portainer/portainer-ee:lts',
  'docker run -d -p 8000:8000 -p 9443:9443 --name=portainer --restart=always -v /var/run/docker.sock:/var/run/docker.sock -v portainer_data:/data portainer/portainer-ee:lts'
].join('\n');

let portainerUpdateState = {
  running: false,
  status: 'idle',
  stage: 'idle',
  startedAt: null,
  finishedAt: null,
  targetVersion: null,
  resultVersion: null,
  scriptSource: null,
  message: null,
  error: null,
  logs: []
};

const addUpdateLog = (message, level = 'info') => {
  const entry = {
    timestamp: new Date().toISOString(),
    level,
    message
  };
  portainerUpdateState = {
    ...portainerUpdateState,
    logs: [...(portainerUpdateState.logs || []).slice(-50), entry]
  };
  console.log(`🛠️ [PortainerUpdate:${level}] ${message}`);
};

const updatePortainerState = (partial = {}) => {
  portainerUpdateState = {
    ...portainerUpdateState,
    ...partial
  };
  return portainerUpdateState;
};

const getPortainerUpdateStatus = () => ({
  ...portainerUpdateState
});

const getCustomPortainerScript = () => {
  const row = getSetting(PORTAINER_SCRIPT_SETTING_KEY);
  if (!row) return null;
  const raw = typeof row.value === 'string' ? row.value : '';
  if (!raw.trim()) return null;
  return {
    script: normalizeScriptText(raw),
    updatedAt: row.updated_at || null
  };
};

const normalizeScriptText = (script) => String(script ?? '').replace(/\r\n/g, '\n');

const saveCustomPortainerScript = (script) => {
  const normalized = normalizeScriptText(script);
  if (!normalized.trim()) {
    deleteSetting(PORTAINER_SCRIPT_SETTING_KEY);
    return null;
  }
  setSetting(PORTAINER_SCRIPT_SETTING_KEY, normalized);
  return normalized;
};

const getEffectivePortainerScript = () => {
  const custom = getCustomPortainerScript();
  if (custom) {
    return {
      script: custom.script,
      source: 'custom',
      updatedAt: custom.updatedAt
    };
  }
  return {
    script: DEFAULT_PORTAINER_UPDATE_SCRIPT,
    source: 'default',
    updatedAt: null
  };
};


const SSH_ENCRYPTION_KEY = crypto.createHash('sha256')
  .update(process.env.PORTAINER_SSH_SECRET || process.env.PORTAINER_API_KEY || 'stackpulse-portainer-ssh-secret')
  .digest();

const encryptSensitive = (value) => {
  if (!value) return null;
  const iv = crypto.randomBytes(12);
  const cipher = crypto.createCipheriv('aes-256-gcm', SSH_ENCRYPTION_KEY, iv);
  const encrypted = Buffer.concat([cipher.update(value, 'utf8'), cipher.final()]);
  const authTag = cipher.getAuthTag();
  return {
    iv: iv.toString('base64'),
    content: encrypted.toString('base64'),
    tag: authTag.toString('base64')
  };
};

const decryptSensitive = (payload) => {
  if (!payload || !payload.content) return '';
  try {
    const iv = Buffer.from(payload.iv, 'base64');
    const content = Buffer.from(payload.content, 'base64');
    const tag = Buffer.from(payload.tag, 'base64');
    const decipher = crypto.createDecipheriv('aes-256-gcm', SSH_ENCRYPTION_KEY, iv);
    decipher.setAuthTag(tag);
    const decrypted = Buffer.concat([decipher.update(content), decipher.final()]);
    return decrypted.toString('utf8');
  } catch (err) {
    console.warn('⚠️ [Maintenance] Konnte privaten SSH Schlüssel nicht entschlüsseln:', err.message);
    return '';
  }
};

const DEFAULT_PORTAINER_SSH_CONFIG = {
  host: '',
  port: 22,
  username: '',
  password: '',
  extraSshArgs: []
};

const normalizeString = (value, fallback = '') => {
  if (value === undefined || value === null) return fallback;
  return String(value).trim();
};

const normalizePort = (value, fallback = DEFAULT_PORTAINER_SSH_CONFIG.port) => {
  const parsed = Number.parseInt(value, 10);
  return Number.isNaN(parsed) ? fallback : parsed;
};

const tokenizeSshArgLine = (line) => {
  if (!line) return [];
  const tokens = [];
  const regex = /"([^"]*)"|'([^']*)'|(\S+)/g;
  let match;
  while ((match = regex.exec(line)) !== null) {
    if (match[1] !== undefined) {
      tokens.push(match[1]);
    } else if (match[2] !== undefined) {
      tokens.push(match[2]);
    } else if (match[3] !== undefined) {
      tokens.push(match[3]);
    }
  }
  return tokens;
};

const normalizeExtraArgs = (value, fallback = []) => {
  if (Array.isArray(value)) {
    return value.map((entry) => String(entry).trim()).filter(Boolean);
  }
  if (typeof value === 'string') {
    return value
      .split(/\r?\n/)
      .map((entry) => entry.trim())
      .filter(Boolean);
  }
  return Array.isArray(fallback) ? [...fallback] : [];
};

const normalizePassword = (value, fallback = DEFAULT_PORTAINER_SSH_CONFIG.password) => {
  if (value === undefined) return fallback;
  if (value === null) return '';
  return String(value);
};

const getPortainerSshConfig = () => {
  const stored = getSetting(PORTAINER_SSH_CONFIG_KEY);
  if (!stored) {
    return { ...DEFAULT_PORTAINER_SSH_CONFIG };
  }
  try {
    const parsed = stored.value ? JSON.parse(stored.value) : {};
    const decryptedPassword = parsed.passwordEncrypted ? decryptSensitive(parsed.passwordEncrypted) : null;
    const fallbackPassword = parsed.password !== undefined ? parsed.password : null;
    return {
      host: normalizeString(parsed.host),
      port: normalizePort(parsed.port),
      username: normalizeString(parsed.username),
      password: normalizePassword(decryptedPassword ?? fallbackPassword),
      extraSshArgs: normalizeExtraArgs(parsed.extraSshArgs)
    };
  } catch (err) {
    console.warn('⚠️ [Maintenance] Konnte Portainer SSH Konfiguration nicht parsen:', err.message);
    return { ...DEFAULT_PORTAINER_SSH_CONFIG };
  }
};

const persistPortainerSshConfig = (config) => {
  const payload = {
    host: config.host,
    port: config.port,
    username: config.username,
    extraSshArgs: config.extraSshArgs,
    passwordEncrypted: config.password ? encryptSensitive(config.password) : null
  };
  setSetting(PORTAINER_SSH_CONFIG_KEY, JSON.stringify(payload));
};

const mergeSshConfig = (base, overrides = {}) => ({
  host: normalizeString(overrides.host, base.host),
  port: normalizePort(overrides.port, base.port),
  username: normalizeString(overrides.username, base.username),
  password: normalizePassword(overrides.password, base.password),
  extraSshArgs: normalizeExtraArgs(overrides.extraSshArgs, base.extraSshArgs)
});

const savePortainerSshConfig = (payload = {}) => {
  const current = getPortainerSshConfig();
  const next = mergeSshConfig(current, payload);
  persistPortainerSshConfig(next);
  return next;
};

const deletePortainerSshConfig = () => {
  deleteSetting(PORTAINER_SSH_CONFIG_KEY);
  return { ...DEFAULT_PORTAINER_SSH_CONFIG };
};

const createTempAskPassScript = (secret) => {
  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'stackpulse-askpass-'));
  const scriptPath = path.join(tmpDir, 'askpass.sh');
  const scriptContent = "#!/bin/sh\nprintf '%s\n' \"$STACKPULSE_SSH_PASS\"\n";
  fs.writeFileSync(scriptPath, scriptContent, { mode: 0o700 });
  return {
    env: {
      SSH_ASKPASS: scriptPath,
      SSH_ASKPASS_REQUIRE: 'force',
      DISPLAY: process.env.DISPLAY || ':9999',
      STACKPULSE_SSH_PASS: secret
    },
    cleanup: () => {
      try {
        fs.unlinkSync(scriptPath);
      } catch (err) { }
      try {
        fs.rmdirSync(tmpDir);
      } catch (err) { }
    }
  };
};

const buildSshCommandArgs = (config) => {
  const sshConfig = mergeSshConfig(DEFAULT_PORTAINER_SSH_CONFIG, config);
  if (!sshConfig.host) {
    throw new Error('SSH Host ist nicht konfiguriert');
  }
  if (!sshConfig.username) {
    throw new Error('SSH Benutzer ist nicht konfiguriert');
  }

  const args = [
    '-p', String(sshConfig.port),
    '-o', 'StrictHostKeyChecking=no',
    '-o', 'PreferredAuthentications=password',
    '-o', 'PubkeyAuthentication=no',
    '-o', 'NumberOfPasswordPrompts=1'
  ];

  const cleanupTasks = [];
  const registerCleanup = (fn) => {
    if (typeof fn === 'function') {
      cleanupTasks.push(fn);
    }
  };

  let envOverrides = {};
  if (sshConfig.password) {
    const { env, cleanup: dispose } = createTempAskPassScript(sshConfig.password);
    envOverrides = { ...envOverrides, ...env };
    registerCleanup(dispose);
    args.push('-o', 'BatchMode=no');
  } else {
    args.push('-o', 'BatchMode=yes');
  }

  if (sshConfig.extraSshArgs.length) {
    const expanded = sshConfig.extraSshArgs.flatMap((entry) => tokenizeSshArgLine(entry));
    if (expanded.length) {
      args.push(...expanded);
    }
  }

  args.push(`${sshConfig.username}@${sshConfig.host}`);

  const cleanup = () => {
    while (cleanupTasks.length) {
      const task = cleanupTasks.pop();
      try {
        task();
      } catch (err) { }
    }
  };

  return { args, sshConfig, cleanup, env: envOverrides };
};

const ensureSshConfigReady = () => getPortainerSshConfig();

const testSshConnection = async (configOverride = null) => {
  const baseConfig = configOverride
    ? mergeSshConfig(getPortainerSshConfig(), configOverride)
    : ensureSshConfigReady();
  const hasHost = Boolean(baseConfig.host && baseConfig.username);
  if (!hasHost) {
    throw new Error('SSH-Konfiguration ist unvollständig (Host/Benutzer erforderlich).');
  }

  const { args, env: envOverrides, cleanup } = buildSshCommandArgs(baseConfig);
  const sshArgs = [...args, 'echo', '__PORTAINER_SSH_TEST__'];

  try {
    return await new Promise((resolve, reject) => {
      const childEnv = { ...process.env, ...envOverrides };
      const child = spawn('ssh', sshArgs, { env: childEnv, stdio: ['ignore', 'pipe', 'pipe'] });
      let output = '';
      let errorOutput = '';
      child.stdout.on('data', (chunk) => { output += chunk.toString(); });
      child.stderr.on('data', (chunk) => { errorOutput += chunk.toString(); });
      child.on('error', reject);
      child.on('close', (code) => {
        if (code === 0 && output.includes('__PORTAINER_SSH_TEST__')) {
          resolve({ success: true, output: output.trim() });
        } else {
          const message = errorOutput.trim() || `SSH Test fehlgeschlagen (Exit-Code ${code})`;
          reject(new Error(message));
        }
      });
    });
  } finally {
    cleanup();
  }
};

const detectPortainerContainer = async () => {
  try {
    const endpointId = requireActiveEndpointId();
    const containersRes = await axiosInstance.get(`/api/endpoints/${endpointId}/docker/containers/json`, {
      params: { all: true }
    });
    const containers = Array.isArray(containersRes.data) ? containersRes.data : [];

    const normalizeName = (value) => (typeof value === 'string' ? value.replace(/^\//, '').toLowerCase() : '');
    const isPortainerContainer = (container = {}) => {
      const names = Array.isArray(container.Names)
        ? container.Names.map(normalizeName)
        : [];
      const image = String(container.Image ?? '').toLowerCase();
      const labels = container.Labels || {};

      if (labels['io.portainer.container']) return true;
      if (labels['io.portainer.role'] === 'instance') return true;
      if (names.includes('portainer') || names.includes('portainer_ce')) return true;
      if (image.includes('portainer/portainer')) return true;
      if (image.includes('portainer-ce')) return true;
      return false;
    };

    const matchedContainer = containers.find((entry) => isPortainerContainer(entry));
    if (!matchedContainer) {
      return { summary: null, error: 'Portainer-Container nicht gefunden' };
    }

    const inspectRes = await axiosInstance.get(`/api/endpoints/${endpointId}/docker/containers/${matchedContainer.Id}/json`);
    const inspect = inspectRes.data ?? {};

    const trimName = (value) => (typeof value === 'string' ? value.replace(/^\//, '') : value);
    const toArray = (value) => {
      if (!value) return [];
      if (Array.isArray(value)) return value.map((item) => String(item));
      return [String(value)];
    };

    const summary = {
      id: inspect.Id ?? matchedContainer.Id ?? null,
      name: trimName(inspect.Name) ?? (matchedContainer.Names?.[0] ? trimName(matchedContainer.Names[0]) : null),
      image: inspect.Config?.Image ?? matchedContainer.Image ?? null,
      created: inspect.Created ?? null,
      entrypoint: toArray(inspect.Config?.Entrypoint),
      command: toArray(inspect.Config?.Cmd),
      args: toArray(inspect.Args),
      env: Array.isArray(inspect.Config?.Env) ? inspect.Config.Env : [],
      binds: Array.isArray(inspect.HostConfig?.Binds) ? inspect.HostConfig.Binds : [],
      mounts: Array.isArray(inspect.Mounts)
        ? inspect.Mounts.map((mount) => ({
            type: mount.Type ?? null,
            source: mount.Source ?? null,
            destination: mount.Destination ?? null,
            mode: mount.Mode ?? null,
            rw: typeof mount.RW === 'boolean' ? mount.RW : null
          }))
        : [],
      labels: inspect.Config?.Labels ?? matchedContainer.Labels ?? {},
      ports: inspect.HostConfig?.PortBindings ?? null,
      networks: inspect.NetworkSettings?.Networks ?? null,
      restartPolicy: inspect.HostConfig?.RestartPolicy ?? null
    };

    return { summary, error: null };
  } catch (err) {
    const message = err.response?.data?.message || err.message;
    return { summary: null, error: message };
  }
};

const waitForPortainerAvailability = async ({ timeoutMs = 5 * 60 * 1000, intervalMs = 5000 } = {}) => {
  const start = Date.now();
  while (Date.now() - start < timeoutMs) {
    try {
      await axiosInstance.get('/api/status');
      return true;
    } catch (err) {
      await new Promise((resolve) => setTimeout(resolve, intervalMs));
    }
  }
  return false;
};

const normalizeVersion = (value) => {
  if (!value) return null;
  return String(value).trim().replace(/^v/i, '');
};

const semverParts = (value) => {
  const normalized = normalizeVersion(value);
  if (!normalized) return null;
  return normalized.split(/[.-]/).map((segment) => {
    const numericPart = segment.replace(/[^0-9].*$/, '');
    const parsed = Number.parseInt(numericPart, 10);
    return Number.isNaN(parsed) ? 0 : parsed;
  });
};

const compareSemver = (a, b) => {
  const partsA = semverParts(a) || [];
  const partsB = semverParts(b) || [];
  const length = Math.max(partsA.length, partsB.length);
  for (let index = 0; index < length; index += 1) {
    const valueA = partsA[index] ?? 0;
    const valueB = partsB[index] ?? 0;
    if (valueA > valueB) return 1;
    if (valueA < valueB) return -1;
  }
  return 0;
};

const fetchPortainerStatusSummary = async () => {
  const statusRes = await axiosInstance.get('/api/status');
  const statusData = statusRes.data ?? {};

  const currentVersion = statusData.Version
    ?? statusData.ServerVersion
    ?? statusData.Server?.Version
    ?? statusData.ServerInfo?.Version
    ?? statusData.ServerVersionNumber
    ?? null;
  const edition = statusData.Edition ?? statusData.Server?.Edition ?? null;
  const build = statusData.BuildNumber ?? statusData.Server?.Build ?? null;

  const errors = {};
  let latestVersion = null;

  const { summary: containerSummary, error: containerError } = await detectPortainerContainer();
  if (containerError) {
    errors.container = containerError;
  }

  try {
    const githubRes = await axios.get('https://api.github.com/repos/portainer/portainer/releases/latest', {
      headers: {
        'Accept': 'application/vnd.github+json',
        'User-Agent': 'StackPulse-Maintenance'
      },
      timeout: 5000
    });
    latestVersion = githubRes.data?.tag_name ?? githubRes.data?.tagName ?? null;
  } catch (err) {
    const message = err.response?.data?.message || err.message;
    console.warn(`⚠️ [Maintenance] Konnte Portainer-Latest-Version nicht ermitteln: ${message}`);
    errors.latestVersion = message;
  }

  if (!currentVersion) {
    errors.currentVersion = 'Portainer-Version konnte nicht ermittelt werden';
  }

  const normalizedCurrent = normalizeVersion(currentVersion);
  const normalizedLatest = normalizeVersion(latestVersion);
  const portainerFlag = typeof statusData.UpdateAvailable === 'boolean'
    ? statusData.UpdateAvailable
    : null;

  let updateAvailable = null;
  if (normalizedCurrent && normalizedLatest) {
    updateAvailable = compareSemver(normalizedCurrent, normalizedLatest) < 0;
  } else if (portainerFlag !== null) {
    updateAvailable = portainerFlag;
  }

  const responsePayload = {
    currentVersion,
    latestVersion,
    normalized: {
      current: normalizedCurrent,
      latest: normalizedLatest
    },
    updateAvailable,
    portainerFlag,
    edition: edition ?? null,
    build: build ?? null,
    fetchedAt: new Date().toISOString(),
    container: containerSummary
  };

  if (Object.keys(errors).length) {
    responsePayload.errors = errors;
  }

  return responsePayload;
};

const maintenanceGuard = (req, res, next) => {
  if (!isMaintenanceModeActive()) {
    return next();
  }

  return res.status(423).json({
    error: 'Wartungsmodus aktiv',
    maintenance: getMaintenanceState(),
    update: getPortainerUpdateStatus()
  });
};

const requirePermission = (permissionKey, requiredLevel = 'full') => (req, res, next) => {
  if (!permissionKey) {
    return next();
  }

  if (req.user?.isSuperuser) {
    return next();
  }

  const permissions = req.userPermissions || {};
  if (hasRequiredPermission(permissions, permissionKey, requiredLevel)) {
    return next();
  }

  return res.status(403).json({
    error: 'INSUFFICIENT_PERMISSIONS',
    permission: permissionKey,
    requiredLevel
  });
};

const requireAnyPermission = (candidates = []) => (req, res, next) => {
  if (!Array.isArray(candidates) || candidates.length === 0) {
    return next();
  }

  if (req.user?.isSuperuser) {
    return next();
  }

  const permissions = req.userPermissions || {};
  const granted = candidates.some(({ key, level }) =>
    typeof key === 'string' && hasRequiredPermission(permissions, key, level || 'full')
  );

  if (granted) {
    return next();
  }

  return res.status(403).json({
    error: 'INSUFFICIENT_PERMISSIONS',
    permission: candidates.map((entry) => entry.key).filter(Boolean),
    requiredLevel: candidates.map((entry) => entry.level || 'full')
  });
};

const logScriptOutput = (data, level) => {
  if (!data) return;
  const text = data.toString();
  text.split(/\r?\n/).map((line) => line.trim()).filter(Boolean).forEach((line) => addUpdateLog(line, level));
};

const executePortainerUpdateScript = async (script) => {
  const normalized = normalizeScriptText(script);
  if (!normalized.trim()) {
    addUpdateLog('Kein Update-Skript definiert. Vorgang wird übersprungen.', 'warning');
    return;
  }

  const scriptWithUnixNewlines = normalized.endsWith('\n') ? normalized : `${normalized}\n`;

  const sshConfig = getPortainerSshConfig();
  const useSsh = Boolean(sshConfig.host && sshConfig.username);

  if (!useSsh) {
    addUpdateLog('Führe Update-Skript lokal auf dem StackPulse-Host aus.', 'info');
    return new Promise((resolve, reject) => {
      const child = spawn('bash', ['-lc', `set -e\n${scriptWithUnixNewlines}`], {
        env: process.env,
        stdio: ['ignore', 'pipe', 'pipe']
      });

      child.stdout.on('data', (chunk) => logScriptOutput(chunk, 'stdout'));
      child.stderr.on('data', (chunk) => logScriptOutput(chunk, 'stderr'));
      child.on('error', (err) => reject(err));
      child.on('close', (code) => {
        if (code === 0) {
          resolve();
        } else {
          reject(new Error(`Update-Skript beendet mit Exit-Code ${code}`));
        }
      });
    });
  }

  const { args, env: envOverrides, cleanup } = buildSshCommandArgs(sshConfig);
  const sshArgs = [...args, 'bash', '-s'];

  addUpdateLog(`Verbinde zu ${sshConfig.username}@${sshConfig.host} für Update-Skript`, 'info');

  const sshPromise = new Promise((resolve, reject) => {
    const childEnv = { ...process.env, ...envOverrides };
    const child = spawn('ssh', sshArgs, {
      env: childEnv,
      stdio: ['pipe', 'pipe', 'pipe']
    });

    child.stdout.on('data', (chunk) => logScriptOutput(chunk, 'stdout'));
    child.stderr.on('data', (chunk) => logScriptOutput(chunk, 'stderr'));
    child.on('error', (err) => reject(err));
    child.on('close', (code) => {
      if (code === 0) {
        resolve();
      } else {
        reject(new Error(`SSH Befehl beendet mit Exit-Code ${code}`));
      }
    });

    child.stdin.write(`set -e
${scriptWithUnixNewlines}`);
    child.stdin.end();
  });

  return sshPromise.finally(() => cleanup());
};


let currentPortainerUpdatePromise = null;

const performPortainerUpdate = async ({ script, scriptSource, targetVersion }) => {
  let maintenanceActivated = false;
  const endpointId = requireActiveEndpointId();

  try {
    addUpdateLog(`Portainer-Update gestartet (Quelle: ${scriptSource})`, 'info');
    updatePortainerState({
      status: 'running',
      stage: 'activating-maintenance',
      message: 'Wartungsmodus wird aktiviert'
    });

    const maintenanceDetails = {
      type: 'portainer-update',
      targetVersion: targetVersion ?? null,
      scriptSource
    };

    const maintenanceState = activateMaintenanceMode({
      message: 'Portainer Update läuft',
      extra: maintenanceDetails
    });
    maintenanceActivated = true;

    logEvent({
      category: 'wartung',
      eventType: 'portainer-update',
      action: 'aktualisieren',
      status: 'gestartet',
      entityType: 'service',
      entityId: 'portainer',
      entityName: 'Portainer',
      contextType: 'endpoint',
      contextId: String(endpointId),
      message: `Portainer Update gestartet (Ziel: ${targetVersion ?? 'unbekannt'})`,
      metadata: {
        targetVersion: targetVersion ?? null,
        scriptSource
      },
      source: 'system'
    });

    logEvent({
      category: 'wartung',
      eventType: 'Wartungsmodus',
      action: 'aktivieren',
      status: 'gestartet',
      entityType: 'system',
      entityId: 'wartung',
      entityName: 'StackPulse Wartung',
      contextType: 'endpoint',
      contextId: String(endpointId),
      message: 'Wartungsmodus aktiviert (Portainer Update)',
      metadata: {
        reason: 'portainer-update',
        scriptSource
      },
      source: 'system'
    });

    updatePortainerState({
      stage: 'executing-script',
      message: 'Update-Skript wird ausgeführt'
    });
    await executePortainerUpdateScript(script);

    addUpdateLog('Update-Skript erfolgreich abgeschlossen', 'info');
    updatePortainerState({
      stage: 'waiting',
      message: 'Warte auf Portainer-Verfügbarkeit'
    });

    const available = await waitForPortainerAvailability({ timeoutMs: 5 * 60 * 1000, intervalMs: 5000 });
    if (!available) {
      throw new Error('Portainer blieb nach dem Update unerreichbar');
    }

    addUpdateLog('Portainer antwortet wieder. Ermittle Version…', 'info');
    const statusAfter = await fetchPortainerStatusSummary().catch(() => null);
    const finalVersion = statusAfter?.currentVersion ?? null;

    logEvent({
      category: 'wartung',
      eventType: 'portainer-update',
      action: 'aktualisieren',
      status: 'erfolgreich',
      entityType: 'service',
      entityId: 'portainer',
      entityName: 'Portainer',
      contextType: 'endpoint',
      contextId: String(endpointId),
      message: `Portainer Update abgeschlossen (Version: ${finalVersion ?? 'unbekannt'})`,
      metadata: {
        resultVersion: finalVersion ?? null
      },
      source: 'system'
    });

    updatePortainerState({
      running: false,
      status: 'success',
      stage: 'completed',
      finishedAt: new Date().toISOString(),
      message: 'Portainer Update abgeschlossen',
      error: null,
      resultVersion: finalVersion
    });

    addUpdateLog('Portainer Update erfolgreich abgeschlossen', 'success');

    if (maintenanceActivated || maintenanceState?.active) {
      deactivateMaintenanceMode({ message: 'Portainer Update abgeschlossen' });
      maintenanceActivated = false;
      logEvent({
        category: 'wartung',
        eventType: 'Wartungsmodus',
        action: 'deaktivieren',
        status: 'erfolgreich',
        entityType: 'system',
        entityId: 'wartung',
        entityName: 'StackPulse Wartung',
        contextType: 'endpoint',
        contextId: String(endpointId),
        message: 'Wartungsmodus deaktiviert',
        metadata: {
          reason: 'portainer-update'
        },
        source: 'system'
      });
    }
  } catch (err) {
    const message = err?.message || 'Portainer Update fehlgeschlagen';
    logEvent({
      category: 'wartung',
      eventType: 'portainer-update',
      action: 'aktualisieren',
      status: 'fehler',
      entityType: 'service',
      entityId: 'portainer',
      entityName: 'Portainer',
      contextType: 'endpoint',
      contextId: String(endpointId),
      message,
      source: 'system'
    });

    updatePortainerState({
      running: false,
      status: 'error',
      stage: 'failed',
      finishedAt: new Date().toISOString(),
      message,
      error: message
    });

    addUpdateLog(message, 'error');

    if (maintenanceActivated || isMaintenanceModeActive()) {
      deactivateMaintenanceMode({ message: 'Portainer Update fehlgeschlagen' });
      logEvent({
        category: 'wartung',
        eventType: 'Wartungsmodus',
        action: 'deaktivieren',
        status: 'fehler',
        entityType: 'system',
        entityId: 'wartung',
        entityName: 'StackPulse Wartung',
        contextType: 'endpoint',
        contextId: String(endpointId),
        message: 'Wartungsmodus deaktiviert (Fehler)',
        metadata: {
          reason: 'portainer-update'
        },
        source: 'system'
      });
    }
  } finally {
    currentPortainerUpdatePromise = null;
  }
};

const fetchPortainerStacks = async () => {
  const endpointId = requireActiveEndpointId();
  const stacksRes = await axiosInstance.get('/api/stacks');
  return stacksRes.data.filter((stack) => String(stack.EndpointId) === String(endpointId));
};

const buildStackCollections = (stacks = []) => {
  const collections = new Map();

  stacks.forEach((stack) => {
    const name = stack.Name || 'Unbenannt';
    const isSelf = SELF_STACK_ID && String(stack.Id) === SELF_STACK_ID;
    const entry = collections.get(name);

    if (!entry) {
      collections.set(name, {
        canonical: stack,
        isSelf,
        members: [stack]
      });
      return;
    }

    entry.members.push(stack);

    if (!entry.isSelf && isSelf) {
      entry.canonical = stack;
      entry.isSelf = true;
    }
  });

  const canonicalStacks = [];
  const duplicates = [];

  collections.forEach((entry, name) => {
    canonicalStacks.push(entry.canonical);

    if (entry.members.length > 1) {
      const seenIds = new Set();
      const duplicateEntries = entry.members.filter((member) => {
        const id = String(member.Id);
        if (id === String(entry.canonical.Id)) {
          return false;
        }
        if (seenIds.has(id)) {
          return false;
        }
        seenIds.add(id);
        return true;
      });

      if (duplicateEntries.length > 0) {
        duplicates.push({
          name,
          canonical: entry.canonical,
          members: duplicateEntries
        });
      }
    }
  });

  return { canonicalStacks, duplicates };
};

const loadStackCollections = async () => {
  const filteredStacks = await fetchPortainerStacks();
  return {
    filteredStacks,
    ...buildStackCollections(filteredStacks)
  };
};

const isStackOutdated = async (stackId) => {
  try {
    const statusRes = await axiosInstance.get(`/api/stacks/${stackId}/images_status?refresh=true`);
    return statusRes.data?.Status === 'outdated';
  } catch (err) {
    console.error(`⚠️ Konnte Update-Status für Stack ${stackId} nicht ermitteln:`, err.message);
    return true;
  }
};

const filterOutdatedStacks = async (stacks = []) => {
  const results = await Promise.all(
    stacks.map(async (stack) => ({
      stack,
      outdated: SELF_STACK_ID && String(stack.Id) === SELF_STACK_ID
        ? false
        : await isStackOutdated(stack.Id)
    }))
  );

  return {
    eligibleStacks: results.filter((entry) => entry.outdated).map((entry) => entry.stack),
    skippedStacks: results.filter((entry) => !entry.outdated).map((entry) => entry.stack),
  };
};

const getRedeployMessages = (type) => {
  switch (type) {
    case REDEPLOY_TYPES.ALL:
      return { started: 'Redeploy ALL gestartet', success: 'Redeploy ALL abgeschlossen' };
    case REDEPLOY_TYPES.SELECTION:
      return { started: 'Redeploy Auswahl gestartet', success: 'Redeploy Auswahl abgeschlossen' };
    case REDEPLOY_TYPES.MAINTENANCE:
      return { started: 'Redeploy (Wartung) gestartet', success: 'Redeploy (Wartung) abgeschlossen' };
    default:
      return { started: 'Redeploy gestartet', success: 'Redeploy erfolgreich abgeschlossen' };
  }
};

const shouldFallbackToStackFile = (message) => {
  if (!message) return false;
  const normalized = String(message).toLowerCase();
  return normalized.includes('not created from git') || normalized.includes('no git configuration');
};

const redeployStackById = async (stackId, redeployType) => {
  let stack;
  const messages = getRedeployMessages(redeployType);
  const endpointId = requireActiveEndpointId();

  try {
    const stackRes = await axiosInstance.get(`/api/stacks/${stackId}`);
    stack = stackRes.data;

    if (String(stack.EndpointId) !== String(endpointId)) {
      throw new Error(`Stack gehört nicht zum Endpoint ${endpointId}`);
    }

    const targetId = stack.Id || stackId;
    const targetName = stack.Name || `Stack ${stackId}`;

    broadcastRedeployStatus({
      stackId: targetId,
      stackName: targetName,
      phase: REDEPLOY_PHASES.STARTED
    });

    logStackEvent({
      stackId: targetId,
      stackName: targetName,
      status: 'started',
      message: messages.started,
      endpointId: stack.EndpointId,
      redeployType
    });

    const redeployViaStackFile = async () => {
      const fileRes = await axiosInstance.get(`/api/stacks/${stack.Id}/file`);
      const stackFileContent = fileRes.data?.StackFileContent;
      if (!stackFileContent) {
        throw new Error('Stack file konnte nicht geladen werden');
      }

      if (stack.Type === 2) {
        const services = fileRes.data?.Config?.services || {};
        for (const serviceName in services) {
          const imageName = services[serviceName].image;
          if (!imageName) continue;
          try {
            console.log(`🖼️ Pulling image "${imageName}" für Service "${serviceName}"`);
            await axiosInstance.post(
              `/api/endpoints/${stack.EndpointId}/docker/images/create?fromImage=${encodeURIComponent(imageName)}`
            );
          } catch (err) {
            console.error(`❌ Fehler beim Pulling von Image "${imageName}":`, err.message);
          }
        }
      }

      const updatePayload = {
        StackFileContent: stackFileContent,
        Prune: false,
        PullImage: true,
        Env: stack.Env || []
      };

      const swarmId = stack.SwarmId || stack.SwarmID || fileRes.data?.SwarmID;
      if (swarmId) {
        updatePayload.SwarmID = swarmId;
      }

      await axiosInstance.put(
        `/api/stacks/${stack.Id}`,
        updatePayload,
        { params: { endpointId: stack.EndpointId } }
      );
    };

    const isGitStack = Boolean(stack.GitConfig?.RepositoryURL);
    let gitRedeploySucceeded = false;

    if (isGitStack) {
      try {
        console.log(`🔄 [Redeploy] Git Stack "${stack.Name}" (${stack.Id}) wird redeployed`);
        await axiosInstance.put(`/api/stacks/${stack.Id}/git/redeploy?endpointId=${stack.EndpointId}`);
        gitRedeploySucceeded = true;
      } catch (err) {
        const gitErrorMessage = err.response?.data?.message || err.message;
        if (shouldFallbackToStackFile(gitErrorMessage)) {
          console.warn(`⚠️ Git Redeploy nicht möglich für Stack "${stack.Name}" (${stack.Id}): ${gitErrorMessage}. Fallback auf Stack-Datei.`);
        } else {
          throw err;
        }
      }
    }

    if (!gitRedeploySucceeded) {
      console.log(`🔄 [Redeploy] Stack "${stack.Name}" (${stack.Id}) wird über Stack-Datei redeployed`);
      await redeployViaStackFile();
    }

    broadcastRedeployStatus({
      stackId: targetId,
      stackName: targetName,
      phase: REDEPLOY_PHASES.SUCCESS
    });

    logStackEvent({
      stackId: targetId,
      stackName: targetName,
      status: 'success',
      message: messages.success,
      endpointId: stack.EndpointId,
      redeployType
    });

    return stack;
  } catch (err) {
    const errorMessage = err.response?.data?.message || err.message;
    const fallbackId = stack?.Id || stackId;
    const fallbackName = stack?.Name || `Stack ${stackId}`;

    broadcastRedeployStatus({
      stackId: fallbackId,
      stackName: fallbackName,
      phase: REDEPLOY_PHASES.ERROR,
      message: errorMessage
    });

    logStackEvent({
      stackId: fallbackId,
      stackName: fallbackName,
      status: 'error',
      message: errorMessage,
      endpointId: stack?.EndpointId || endpointId,
      redeployType
    });

    console.error(`❌ Fehler beim Redeploy von Stack ${fallbackName}:`, errorMessage);
    throw new Error(errorMessage);
  }
};

app.use((req, res, next) => {
  if (!req.path.startsWith('/api')) {
    return next();
  }

  if (req.method === 'OPTIONS' || isPublicApiRoute(req)) {
    return next();
  }

  if (!hasSuperuser()) {
    return res.status(403).json({ error: 'SUPERUSER_REQUIRED' });
  }

  if (!hasServer() || !hasEndpoint() || !hasApiKey()) {
    return res.status(403).json({ error: 'SETUP_REQUIRED' });
  }

  const token = extractAuthToken(req);
  const session = getSessionRecord(token);
  if (!session) {
    clearAuthCookie(res);
    return res.status(401).json({ error: 'UNAUTHORIZED' });
  }

  const userRecord = getUserById(session.userId);
  if (!userRecord || !userRecord.isActive) {
    activeSessions.delete(token);
    clearAuthCookie(res);
    return res.status(401).json({ error: 'UNAUTHORIZED' });
  }

  const userGroups = Array.isArray(userRecord.groups) ? userRecord.groups : [];
  const groupIds = userGroups
    .map((group) => Number(group.id))
    .filter((groupId) => Number.isFinite(groupId) && groupId > 0);

  const isSuperuser = userGroups.some(
    (group) => typeof group?.name === 'string' && group.name.toLowerCase() === SUPERUSER_GROUP_NAME
  );

  const permissionsMap = isSuperuser
    ? getSuperuserPermissionMap()
    : getEffectivePermissionsForGroups(groupIds);

  req.user = {
    id: userRecord.id,
    username: userRecord.username,
    email: userRecord.email,
    avatarColor: userRecord.avatarColor || null,
    groups: userGroups,
    isSuperuser,
    securityPhraseDownloadedAt: userRecord.securityPhraseDownloadedAt || null,
    requiresSecurityPhraseDownload: !userRecord.securityPhraseDownloadedAt
  };
  req.userPermissions = permissionsMap;
  req.authToken = token;
  touchSession(token);
  setAuthCookie(res, token);
  next();
});

// --- API Endpoints ---

app.get('/api/setup/status', (req, res) => {
  try {
    const status = getSetupStatus();
    res.json(status);
  } catch (error) {
    console.error('⚠️ [Setup] Statusabfrage fehlgeschlagen:', error);
    res.status(500).json({ error: 'SETUP_STATUS_FAILED' });
  }
});

app.post('/api/setup/complete', (req, res) => {
  const { superuser: superuserInput, server: serverInput, endpoint: endpointInput, apiKey: apiKeyInput } = req.body ?? {};
  const initialStatus = getSetupStatus();
  const needsSuperuser = initialStatus.requirements.superuser;
  const needsServer = initialStatus.requirements.server;
  const needsEndpoint = initialStatus.requirements.endpoint;
  const needsApiKey = initialStatus.requirements.apiKey;

  const created = {};

  const normalizeServerInput = (input) => {
    if (!input) return null;
    const name = typeof input.name === 'string' ? input.name.trim() : '';
    const url = typeof input.url === 'string' ? input.url.trim() : '';
    if (!url) {
      return { name: name || '', url: '' };
    }
    return {
      name: name || null,
      url
    };
  };

  const normalizeEndpointInput = (input) => {
    if (!input) return null;
    const name = typeof input.name === 'string' ? input.name.trim() : '';
    const externalRaw = input.externalId !== undefined && input.externalId !== null
      ? String(input.externalId).trim()
      : '';
    const serverIdRaw = input.serverId !== undefined && input.serverId !== null ? Number(input.serverId) : null;
    const serverId = Number.isFinite(serverIdRaw) ? serverIdRaw : null;

    return {
      name: name || null,
      externalId: externalRaw || '',
      serverId
    };
  };

  const normalizeApiKeyInput = (input) => {
    if (!input) return null;
    if (typeof input === 'string') {
      const value = input.trim();
      return { value, serverId: null };
    }
    if (typeof input === 'object') {
      const rawValue = typeof input.value === 'string' ? input.value : typeof input.key === 'string' ? input.key : '';
      const value = rawValue.trim();
      const serverIdRaw = input.serverId !== undefined && input.serverId !== null ? Number(input.serverId) : null;
      const serverId = Number.isFinite(serverIdRaw) ? serverIdRaw : null;
      return { value, serverId };
    }
    return null;
  };

  try {
    let serverPayload = normalizeServerInput(serverInput);
    let endpointPayload = normalizeEndpointInput(endpointInput);
    const apiKeyPayload = normalizeApiKeyInput(apiKeyInput);

    if (needsServer && (!serverPayload || !serverPayload.url)) {
      return res.status(400).json({ error: 'SERVER_DETAILS_REQUIRED' });
    }

    if (endpointPayload && !endpointPayload.externalId) {
      endpointPayload.externalId = '';
    }

    if (needsEndpoint && (!endpointPayload || !endpointPayload.externalId)) {
      const fallbackExternal = initialStatus.envDefaults.endpointExternalId?.trim();
      if (fallbackExternal) {
        endpointPayload = endpointPayload || {};
        endpointPayload.externalId = fallbackExternal;
        endpointPayload.name = endpointPayload.name || initialStatus.envDefaults.endpointName || `Endpoint ${fallbackExternal}`;
      } else {
        return res.status(400).json({ error: 'ENDPOINT_DETAILS_REQUIRED' });
      }
    }

    const shouldHandleInfrastructure =
      needsServer ||
      needsEndpoint ||
      (serverPayload && serverPayload.url) ||
      (endpointPayload && endpointPayload.externalId);

    if (shouldHandleInfrastructure) {
      const endpointInputPayload = endpointPayload;
      if (!endpointInputPayload || !endpointInputPayload.externalId) {
        return res.status(400).json({ error: 'ENDPOINT_DETAILS_REQUIRED' });
      }

      const setupResult = completeSetup({
        server: serverPayload && serverPayload.url ? serverPayload : null,
        endpoint: endpointInputPayload
      });

      created.server = setupResult.server;
      created.endpoint = setupResult.endpoint;
      created.defaultEndpoint = setupResult.defaultEndpoint;
    }

    let targetServerId = apiKeyPayload?.serverId ?? created.server?.id ?? endpointPayload?.serverId ?? null;

    if (needsSuperuser) {
      const username = typeof superuserInput?.username === 'string' ? superuserInput.username.trim() : '';
      const email = typeof superuserInput?.email === 'string' ? superuserInput.email.trim() : '';
      const password = typeof superuserInput?.password === 'string' ? superuserInput.password : '';

      if (!username || !email || !password) {
        return res.status(400).json({ error: 'SUPERUSER_DETAILS_REQUIRED' });
      }

      const user = registerSuperuser({ username, email, password });
      created.superuser = user;
    }

    const statusSnapshot = getSetupStatus();

    if (!targetServerId) {
      targetServerId = statusSnapshot.servers.items?.[0]?.id ?? null;
    }

    if (apiKeyPayload && apiKeyPayload.value) {
      if (!targetServerId) {
        return res.status(400).json({ error: 'SERVER_DETAILS_REQUIRED' });
      }
      const apiKeyResult = setServerApiKey({ serverId: targetServerId, apiKey: apiKeyPayload.value });
      created.apiKey = apiKeyResult;
    } else if (needsApiKey) {
      return res.status(400).json({ error: 'API_KEY_REQUIRED' });
    }

    const finalStatus = getSetupStatus();
    created.defaultEndpoint = finalStatus.endpoints.default;
    res.status(201).json({
      success: finalStatus.setupComplete,
      status: finalStatus,
      created
    });
  } catch (error) {
    const code = error.code || error.message;
    switch (code) {
      case 'SERVER_URL_REQUIRED':
      case 'SERVER_NAME_REQUIRED':
      case 'SERVER_DETAILS_REQUIRED':
      case 'ENDPOINT_DETAILS_REQUIRED':
      case 'ENDPOINT_EXTERNAL_ID_REQUIRED':
      case 'USERNAME_REQUIRED':
      case 'EMAIL_INVALID':
      case 'PASSWORD_TOO_SHORT':
      case 'INVALID_PASSWORD':
      case 'API_KEY_REQUIRED':
        return res.status(400).json({ error: code });
      case 'API_KEY_ENCRYPT_FAILED':
        console.error('⚠️ [Setup] API-Key Verschlüsselung fehlgeschlagen:', error);
        return res.status(500).json({ error: 'API_KEY_ENCRYPT_FAILED' });
      case 'SERVER_NOT_FOUND':
        return res.status(404).json({ error: 'SERVER_NOT_FOUND' });
      case 'SUPERUSER_ALREADY_EXISTS':
        return res.status(409).json({ error: 'SUPERUSER_EXISTS' });
      default:
        console.error('⚠️ [Setup] Fehler beim Abschluss:', error);
        return res.status(500).json({ error: 'SETUP_FAILED' });
    }
  }
});

app.delete('/api/setup/endpoints/:id', requirePermission('maintenance-server-delete', 'full'), (req, res) => {
  const { id } = req.params;
  const numericId = Number(id);
  if (!Number.isFinite(numericId)) {
    return res.status(400).json({ error: 'ENDPOINT_ID_INVALID' });
  }

  try {
    const result = removeEndpoint(numericId);
    const status = getSetupStatus();
    res.json({ success: true, removed: result, status });
  } catch (error) {
    const code = error.code || error.message;
    switch (code) {
      case 'ENDPOINT_ID_INVALID':
        return res.status(400).json({ error: 'ENDPOINT_ID_INVALID' });
      case 'ENDPOINT_NOT_FOUND':
        return res.status(404).json({ error: 'ENDPOINT_NOT_FOUND' });
      default:
        console.error('⚠️ [Setup] Endpoint konnte nicht gelöscht werden:', error);
        return res.status(500).json({ error: 'ENDPOINT_DELETE_FAILED' });
    }
  }
});

app.delete('/api/setup/servers/:id', requirePermission('maintenance-server-delete', 'full'), (req, res) => {
  const { id } = req.params;
  const numericId = Number(id);
  if (!Number.isFinite(numericId)) {
    return res.status(400).json({ error: 'SERVER_ID_INVALID' });
  }

  try {
    const result = removeServer(numericId);
    const status = getSetupStatus();
    res.json({ success: true, removed: result, status });
  } catch (error) {
    const code = error.code || error.message;
    switch (code) {
      case 'SERVER_ID_INVALID':
        return res.status(400).json({ error: 'SERVER_ID_INVALID' });
      case 'SERVER_NOT_FOUND':
        return res.status(404).json({ error: 'SERVER_NOT_FOUND' });
      default:
        console.error('⚠️ [Setup] Server konnte nicht gelöscht werden:', error);
        return res.status(500).json({ error: 'SERVER_DELETE_FAILED' });
    }
  }
});

app.put('/api/setup/servers/:id/api-key', requirePermission('maintenance-server-manage', 'full'), (req, res) => {
  const { id } = req.params;
  const numericId = Number(id);
  if (!Number.isFinite(numericId)) {
    return res.status(400).json({ error: 'SERVER_ID_INVALID' });
  }

  const rawValue = typeof req.body?.apiKey === 'string' ? req.body.apiKey : typeof req.body?.key === 'string' ? req.body.key : '';

  try {
    const result = setServerApiKey({ serverId: numericId, apiKey: rawValue });
    const status = getSetupStatus();
    res.json({ success: true, updated: result, status });
  } catch (error) {
    const code = error.code || error.message;
    switch (code) {
      case 'SERVER_ID_INVALID':
        return res.status(400).json({ error: 'SERVER_ID_INVALID' });
      case 'SERVER_NOT_FOUND':
        return res.status(404).json({ error: 'SERVER_NOT_FOUND' });
      case 'API_KEY_REQUIRED':
        return res.status(400).json({ error: 'API_KEY_REQUIRED' });
      case 'API_KEY_ENCRYPT_FAILED':
        console.error('⚠️ [Setup] API-Key Verschlüsselung fehlgeschlagen:', error);
        return res.status(500).json({ error: 'API_KEY_ENCRYPT_FAILED' });
      default:
        console.error('⚠️ [Setup] API-Key konnte nicht aktualisiert werden:', error);
        return res.status(500).json({ error: 'API_KEY_UPDATE_FAILED' });
    }
  }
});

app.post('/api/auth/login', (req, res) => {
  if (!hasSuperuser()) {
    return res.status(403).json({ error: 'SUPERUSER_REQUIRED' });
  }

  if (!hasServer() || !hasEndpoint() || !hasApiKey()) {
    return res.status(403).json({ error: 'SETUP_REQUIRED' });
  }

  const { identifier, password } = req.body ?? {};
  if (!identifier || !password) {
    return res.status(400).json({ error: 'MISSING_CREDENTIALS' });
  }

  const user = findUserByIdentifier(identifier);
  if (!user) {
    return res.status(401).json({ error: 'INVALID_CREDENTIALS' });
  }

  if (!user.is_active) {
    return res.status(403).json({ error: 'USER_INACTIVE' });
  }

  const passwordValid = verifyPassword(password, user.password_hash, user.password_salt);
  if (!passwordValid) {
    return res.status(401).json({ error: 'INVALID_CREDENTIALS' });
  }

  const session = createSessionForUser(user);
  markUserLogin(user.id);
  setAuthCookie(res, session.token);

  const payload = buildUserSessionPayload(user.id);
  if (payload) {
    res.json(payload);
  } else {
    res.json({ user: sanitizeUser(user), permissions: {} });
  }
});

app.post('/api/auth/logout', (req, res) => {
  const token = extractAuthToken(req);
  if (token) {
    activeSessions.delete(token);
  }
  clearAuthCookie(res);
  res.json({ success: true });
});

app.post('/api/auth/recover/verify', (req, res) => {
  const { username, phrase, words } = req.body ?? {};

  try {
    const candidate = typeof phrase === 'string' && phrase.trim() ? phrase : words;
    const verification = verifySecurityPhraseForUsername(username, candidate);
    const ticket = createPasswordResetTicketForUser(verification.userId);
    res.json({ token: ticket.token, expiresIn: PASSWORD_RESET_TTL_MS });
  } catch (error) {
    if (error.code === 'USERNAME_REQUIRED' || error.code === 'PHRASE_REQUIRED') {
      return res.status(400).json({ error: error.code });
    }
    if (error.code === 'USER_NOT_FOUND') {
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    if (error.code === 'PHRASE_NOT_INITIALIZED') {
      return res.status(409).json({ error: 'PHRASE_NOT_INITIALIZED' });
    }
    if (error.code === 'PHRASE_MISMATCH') {
      return res.status(401).json({ error: 'PHRASE_MISMATCH' });
    }
    if (error.code === 'INVALID_PASSWORD') {
      return res.status(400).json({ error: 'INVALID_PASSWORD' });
    }
    console.error('⚠️ [Auth] Sicherheitsphrase-Überprüfung fehlgeschlagen:', error);
    res.status(500).json({ error: 'RECOVERY_VERIFY_FAILED' });
  }
});

app.post('/api/auth/recover/reset', (req, res) => {
  const { token, password, confirmPassword } = req.body ?? {};

  if (!token || typeof token !== 'string' || !token.trim()) {
    return res.status(400).json({ error: 'TOKEN_REQUIRED' });
  }

  if (typeof password !== 'string' || !password.trim()) {
    return res.status(400).json({ error: 'PASSWORD_REQUIRED' });
  }

  if (typeof confirmPassword === 'string' && password !== confirmPassword) {
    return res.status(400).json({ error: 'PASSWORD_MISMATCH' });
  }

  const trimmedToken = token.trim();
  const ticket = getPasswordResetTicket(trimmedToken);
  if (!ticket) {
    return res.status(410).json({ error: 'TOKEN_INVALID_OR_EXPIRED' });
  }

  try {
    setUserPassword(ticket.userId, password, { resetMethod: 'security-phrase' });
    passwordResetTickets.delete(trimmedToken);
    removeSessionsForUser(ticket.userId);
    res.json({ success: true });
  } catch (error) {
    if (error.code === 'INVALID_PASSWORD' || error.code === 'PASSWORD_TOO_SHORT') {
      return res.status(400).json({ error: error.code });
    }
    if (error.code === 'USER_NOT_FOUND') {
      passwordResetTickets.delete(trimmedToken);
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    console.error('⚠️ [Auth] Passwort-Zurücksetzung fehlgeschlagen:', error);
    res.status(500).json({ error: 'RECOVERY_RESET_FAILED' });
  }
});

app.get('/api/auth/session', (req, res) => {
  if (!hasSuperuser()) {
    return res.status(403).json({ error: 'SUPERUSER_REQUIRED' });
  }

  if (!hasServer() || !hasEndpoint() || !hasApiKey()) {
    return res.status(403).json({ error: 'SETUP_REQUIRED' });
  }

  const token = extractAuthToken(req);
  const session = getSessionRecord(token);
  if (!session) {
    clearAuthCookie(res);
    return res.status(401).json({ error: 'UNAUTHORIZED' });
  }

  const payload = buildUserSessionPayload(session.userId);
  if (!payload) {
    activeSessions.delete(token);
    clearAuthCookie(res);
    return res.status(401).json({ error: 'UNAUTHORIZED' });
  }

  touchSession(token);
  setAuthCookie(res, token);
  res.json(payload);
});

app.get('/api/users', requirePermission('users-access', 'read'), (req, res) => {
  try {
    const users = listUsers();
    res.json({ items: users, total: users.length });
  } catch (error) {
    console.error('⚠️ [Users] Abruf der Benutzerliste fehlgeschlagen:', error);
    res.status(500).json({ error: 'USERS_FETCH_FAILED' });
  }
});

app.post('/api/users', requirePermission('users-edit', 'full'), (req, res) => {
  const { username, email, password, groupId, avatarColor } = req.body ?? {};

  try {
    const user = createUser({ username, email, password, groupId, avatarColor }, { actor: req.user });
    res.status(201).json({ item: user });
  } catch (error) {
    if (error.code === 'USERNAME_REQUIRED' || error.code === 'INVALID_GROUP_ID') {
      return res.status(400).json({ error: error.code });
    }
    if (error.code === 'GROUP_NOT_FOUND') {
      return res.status(400).json({ error: 'GROUP_NOT_FOUND' });
    }
    if (error.code === 'INVALID_EMAIL') {
      return res.status(400).json({ error: 'INVALID_EMAIL' });
    }
    if (error.code === 'INVALID_PASSWORD' || error.code === 'PASSWORD_TOO_SHORT') {
      return res.status(400).json({ error: error.code });
    }
    if (error.code === 'USERNAME_TAKEN' || error.code === 'EMAIL_TAKEN') {
      return res.status(409).json({ error: error.code });
    }
    console.error('⚠️ [Users] Anlegen eines Benutzers fehlgeschlagen:', error);
    res.status(500).json({ error: 'USER_CREATE_FAILED' });
  }
});

app.get('/api/users/me/security-phrase', (req, res) => {
  const userId = req.user?.id;
  if (!userId) {
    return res.status(401).json({ error: 'UNAUTHORIZED' });
  }

  try {
    const phrase = getUserSecurityPhrase(userId, { actor: req.user });
    if (phrase.downloadedAt) {
      return res.status(409).json({
        error: 'SECURITY_PHRASE_ALREADY_DOWNLOADED',
        downloadedAt: phrase.downloadedAt
      });
    }
    res.json({
      item: {
        userId: phrase.userId,
        words: phrase.words,
        downloadedAt: phrase.downloadedAt
      }
    });
  } catch (error) {
    if (error.code === 'USER_NOT_FOUND') {
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    console.error(`⚠️ [Users] Sicherheitsschlüssel konnte für Benutzer ${userId} nicht geladen werden:`, error);
    res.status(500).json({ error: 'USER_SECURITY_PHRASE_FETCH_FAILED' });
  }
});

app.post('/api/users/me/security-phrase/downloaded', (req, res) => {
  const userId = req.user?.id;
  if (!userId) {
    return res.status(401).json({ error: 'UNAUTHORIZED' });
  }

  try {
    const result = markSecurityPhraseDownloaded(userId, { actor: req.user });
    const sessionPayload = buildUserSessionPayload(userId);
    res.json({
      item: {
        userId: result.userId,
        downloadedAt: result.downloadedAt
      },
      session: sessionPayload
    });
  } catch (error) {
    if (error.code === 'USER_NOT_FOUND') {
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    console.error(`⚠️ [Users] Sicherheits-Download konnte nicht vermerkt werden (${userId}):`, error);
    res.status(500).json({ error: 'USER_SECURITY_PHRASE_DOWNLOAD_FAILED' });
  }
});

app.get('/api/users/:userId', requirePermission('users-access', 'read'), (req, res) => {
  const { userId } = req.params;
  const numericId = Number(userId);

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_USER_ID' });
  }

  try {
    const user = getUserById(numericId);
    if (!user) {
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    res.json({ item: user });
  } catch (error) {
    console.error(`⚠️ [Users] Abruf der Benutzerdetails fehlgeschlagen (${userId}):`, error);
    res.status(500).json({ error: 'USER_FETCH_FAILED' });
  }
});

app.get('/api/users/:userId/security-phrase', requirePermission('users-security-phrase', 'read'), (req, res) => {
  const { userId } = req.params;
  const numericId = Number(userId);

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_USER_ID' });
  }

  try {
    const phrase = getUserSecurityPhrase(numericId, { actor: req.user });
    res.json({ item: phrase });
  } catch (error) {
    if (error.code === 'INVALID_USER_ID') {
      return res.status(400).json({ error: 'INVALID_USER_ID' });
    }
    if (error.code === 'USER_NOT_FOUND') {
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    console.error(`⚠️ [Users] Sicherheitsschlüssel konnte nicht geladen werden (${userId}):`, error);
    res.status(500).json({ error: 'USER_SECURITY_PHRASE_FETCH_FAILED' });
  }
});

app.post('/api/users/:userId/security-phrase/renew', requirePermission('users-security-phrase', 'full'), (req, res) => {
  const { userId } = req.params;
  const numericId = Number(userId);

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_USER_ID' });
  }

  try {
    const renewed = renewUserSecurityPhrase(numericId, { actor: req.user });
    res.json({ item: renewed });
  } catch (error) {
    if (error.code === 'INVALID_USER_ID') {
      return res.status(400).json({ error: 'INVALID_USER_ID' });
    }
    if (error.code === 'USER_NOT_FOUND') {
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    console.error(`⚠️ [Users] Sicherheitsschlüssel konnte nicht erneuert werden (${userId}):`, error);
    res.status(500).json({ error: 'USER_SECURITY_PHRASE_RENEW_FAILED' });
  }
});

app.put('/api/users/:userId', requirePermission('users-edit', 'full'), (req, res) => {
  const { userId } = req.params;
  const numericId = Number(userId);

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_USER_ID' });
  }

  const { username, email, password, avatarColor, groupId, groupIds } = req.body ?? {};

  try {
    const updatedUser = updateUserDetails(numericId, {
      username,
      email,
      password,
      avatarColor,
      groupId,
      groupIds
    });
    res.json({ item: updatedUser });
  } catch (error) {
    if (error.code === 'INVALID_USER_ID') {
      return res.status(400).json({ error: 'INVALID_USER_ID' });
    }
    if (error.code === 'USER_NOT_FOUND') {
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    if (error.code === 'USERNAME_REQUIRED') {
      return res.status(400).json({ error: 'USERNAME_REQUIRED' });
    }
    if (error.code === 'INVALID_EMAIL') {
      return res.status(400).json({ error: 'INVALID_EMAIL' });
    }
    if (error.code === 'USERNAME_TAKEN') {
      return res.status(409).json({ error: 'USERNAME_TAKEN' });
    }
    if (error.code === 'EMAIL_TAKEN') {
      return res.status(409).json({ error: 'EMAIL_TAKEN' });
    }
    if (error.code === 'INVALID_PASSWORD' || error.code === 'PASSWORD_TOO_SHORT') {
      return res.status(400).json({ error: error.code });
    }
    if (error.code === 'INVALID_AVATAR_COLOR') {
      return res.status(400).json({ error: 'INVALID_AVATAR_COLOR' });
    }
    if (error.code === 'GROUP_NOT_FOUND') {
      return res.status(400).json({ error: 'GROUP_NOT_FOUND', details: error.missingGroupIds || [] });
    }
    if (error.code === 'GROUP_SUPERUSER_PROTECTED') {
      return res.status(403).json({ error: 'GROUP_SUPERUSER_PROTECTED' });
    }

    console.error(`⚠️ [Users] Aktualisierung der Benutzerdaten fehlgeschlagen (${userId}):`, error);
    res.status(500).json({ error: 'USER_UPDATE_FAILED' });
  }
});

app.put('/api/users/:userId/groups', requirePermission('users-edit', 'full'), (req, res) => {
  const { userId } = req.params;
  const numericId = Number(userId);
  const { groupIds } = req.body ?? {};

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_USER_ID' });
  }

  try {
    const updatedUser = updateUserGroups(numericId, Array.isArray(groupIds) ? groupIds : []);
    res.json({ item: updatedUser });
  } catch (error) {
    if (error.code === 'INVALID_USER_ID') {
      return res.status(400).json({ error: 'INVALID_USER_ID' });
    }
    if (error.code === 'USER_NOT_FOUND') {
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    if (error.code === 'GROUP_NOT_FOUND') {
      return res.status(400).json({ error: 'GROUP_NOT_FOUND', details: error.missingGroupIds || [] });
    }
    console.error(`⚠️ [Users] Aktualisierung der Gruppenzuordnung fehlgeschlagen (${userId}):`, error);
    res.status(500).json({ error: 'USER_GROUPS_UPDATE_FAILED' });
  }
});

app.delete('/api/users/:userId', requirePermission('users-delete', 'full'), (req, res) => {
  const { userId } = req.params;
  const numericId = Number(userId);

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_USER_ID' });
  }

  try {
    deleteUser(numericId);
    res.json({ success: true });
  } catch (error) {
    if (error.code === 'INVALID_USER_ID') {
      return res.status(400).json({ error: 'INVALID_USER_ID' });
    }
    if (error.code === 'USER_NOT_FOUND') {
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    if (error.code === 'USER_SUPERUSER_PROTECTED') {
      return res.status(403).json({ error: 'USER_SUPERUSER_PROTECTED' });
    }

    console.error(`⚠️ [Users] Löschen fehlgeschlagen (${userId}):`, error);
    res.status(500).json({ error: 'USER_DELETE_FAILED' });
  }
});

app.put('/api/users/:userId/active', requirePermission('users-edit', 'full'), (req, res) => {
  const { userId } = req.params;
  const numericId = Number(userId);
  const { isActive } = req.body ?? {};

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_USER_ID' });
  }

  try {
    const updatedUser = updateUserActiveStatus(numericId, Boolean(isActive));
    res.json({ item: updatedUser });
  } catch (error) {
    if (error.code === 'INVALID_USER_ID') {
      return res.status(400).json({ error: 'INVALID_USER_ID' });
    }
    if (error.code === 'USER_NOT_FOUND') {
      return res.status(404).json({ error: 'USER_NOT_FOUND' });
    }
    if (error.code === 'USER_SUPERUSER_PROTECTED') {
      return res.status(403).json({ error: 'USER_SUPERUSER_PROTECTED' });
    }

    console.error(`⚠️ [Users] Aktualisierung des Aktivstatus fehlgeschlagen (${userId}):`, error);
    res.status(500).json({ error: 'USER_STATUS_UPDATE_FAILED' });
  }
});

app.get(
  '/api/groups',
  requireAnyPermission([
    { key: 'user-groups-access', level: 'read' },
    { key: 'users-edit', level: 'read' }
  ]),
  (req, res) => {
  try {
    const groups = listGroups();
    res.json({ items: groups, total: groups.length });
  } catch (error) {
    console.error('⚠️ [Groups] Abruf der Benutzergruppenliste fehlgeschlagen:', error);
    res.status(500).json({ error: 'GROUPS_FETCH_FAILED' });
  }
  }
);

app.get(
  '/api/groups/:groupId',
  requireAnyPermission([
    { key: 'user-groups-access', level: 'read' },
    { key: 'users-edit', level: 'read' }
  ]),
  (req, res) => {
  const { groupId } = req.params;
  const numericId = Number(groupId);

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_GROUP_ID' });
  }

  try {
    const group = getGroupById(numericId);
    if (!group) {
      return res.status(404).json({ error: 'GROUP_NOT_FOUND' });
    }
    res.json({ item: group });
  } catch (error) {
    console.error(`⚠️ [Groups] Abruf der Gruppendetails fehlgeschlagen (${groupId}):`, error);
    res.status(500).json({ error: 'GROUP_FETCH_FAILED' });
  }
  }
);

app.get('/api/groups/:groupId/permissions', requirePermission('user-groups-edit', 'read'), (req, res) => {
  const { groupId } = req.params;
  const numericId = Number(groupId);

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_GROUP_ID' });
  }

  try {
    const group = getGroupById(numericId);
    if (!group) {
      return res.status(404).json({ error: 'GROUP_NOT_FOUND' });
    }

    const sections = getPermissionStructure();
    const isSuperuser = (group.name || '').toLowerCase() === SUPERUSER_GROUP_NAME;
    let values = {};

    if (isSuperuser) {
      clearGroupPermissionValues(numericId);
    } else {
      values = getPermissionValuesByGroup(numericId);
    }

    res.json({ sections, values });
  } catch (error) {
    console.error(`⚠️ [Groups] Abruf der Gruppenberechtigungen fehlgeschlagen (${groupId}):`, error);
    res.status(500).json({ error: 'GROUP_PERMISSIONS_FETCH_FAILED' });
  }
});

app.put('/api/groups/:groupId/permissions', requirePermission('user-groups-edit', 'full'), (req, res) => {
  const { groupId } = req.params;
  const numericId = Number(groupId);

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_GROUP_ID' });
  }

  try {
    const group = getGroupById(numericId);
    if (!group) {
      return res.status(404).json({ error: 'GROUP_NOT_FOUND' });
    }

    const isSuperuser = (group.name || '').toLowerCase() === SUPERUSER_GROUP_NAME;
    if (isSuperuser) {
      clearGroupPermissionValues(numericId);
      return res.status(403).json({ error: 'GROUP_SUPERUSER_PROTECTED' });
    }

    const valuesPayload = req.body?.values ?? {};
    const savedValues = saveGroupPermissionValues(numericId, valuesPayload);

    res.json({ success: true, values: savedValues });
  } catch (error) {
    const serverError = error?.code;
    if (serverError === 'GROUP_NOT_FOUND') {
      return res.status(404).json({ error: 'GROUP_NOT_FOUND' });
    }
    if (serverError === 'PERMISSION_INVALID_PAYLOAD') {
      return res.status(400).json({ error: 'PERMISSION_INVALID_PAYLOAD' });
    }
    if (serverError === 'PERMISSION_INVALID_LEVEL') {
      return res.status(400).json({ error: 'PERMISSION_INVALID_LEVEL', permissionKey: error.permissionKey, level: error.level });
    }
    if (serverError === 'PERMISSION_UNKNOWN_KEY') {
      return res.status(400).json({ error: 'PERMISSION_UNKNOWN_KEY', permissionKey: error.permissionKey });
    }
    if (serverError === 'INVALID_GROUP_ID') {
      return res.status(400).json({ error: 'INVALID_GROUP_ID' });
    }

    console.error(`⚠️ [Groups] Aktualisierung der Berechtigungen fehlgeschlagen (${groupId}):`, error);
    res.status(500).json({ error: 'GROUP_PERMISSIONS_UPDATE_FAILED' });
  }
});

app.post('/api/groups', requirePermission('user-groups-edit', 'full'), (req, res) => {
  const { name, description } = req.body ?? {};
  try {
    const group = createGroup({ name, description });
    res.status(201).json({ item: group });
  } catch (error) {
    if (error.code === 'GROUP_NAME_REQUIRED') {
      return res.status(400).json({ error: 'GROUP_NAME_REQUIRED' });
    }
    if (error.code === 'GROUP_NAME_TAKEN') {
      return res.status(409).json({ error: 'GROUP_NAME_TAKEN' });
    }
    console.error('⚠️ [Groups] Anlegen der Benutzergruppe fehlgeschlagen:', error);
    res.status(500).json({ error: 'GROUP_CREATE_FAILED' });
  }
});

app.put('/api/groups/:groupId', requirePermission('user-groups-edit', 'full'), (req, res) => {
  const { groupId } = req.params;
  const numericId = Number(groupId);

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_GROUP_ID' });
  }

  const { name, description, avatarColor } = req.body ?? {};

  try {
    const updatedGroup = updateGroupDetails(numericId, { name, description, avatarColor });
    res.json({ item: updatedGroup });
  } catch (error) {
    if (error.code === 'INVALID_GROUP_ID') {
      return res.status(400).json({ error: 'INVALID_GROUP_ID' });
    }
    if (error.code === 'GROUP_NOT_FOUND') {
      return res.status(404).json({ error: 'GROUP_NOT_FOUND' });
    }
    if (error.code === 'GROUP_NAME_REQUIRED') {
      return res.status(400).json({ error: 'GROUP_NAME_REQUIRED' });
    }
    if (error.code === 'GROUP_NAME_TAKEN') {
      return res.status(409).json({ error: 'GROUP_NAME_TAKEN' });
    }
    if (error.code === 'INVALID_AVATAR_COLOR') {
      return res.status(400).json({ error: 'INVALID_AVATAR_COLOR' });
    }
    if (error.code === 'GROUP_SUPERUSER_PROTECTED') {
      return res.status(403).json({ error: 'GROUP_SUPERUSER_PROTECTED' });
    }

    console.error(`⚠️ [Groups] Aktualisierung der Gruppendaten fehlgeschlagen (${groupId}):`, error);
    res.status(500).json({ error: 'GROUP_UPDATE_FAILED' });
  }
});

app.delete('/api/groups/:groupId', requirePermission('user-groups-delete', 'full'), (req, res) => {
  const { groupId } = req.params;
  const numericId = Number(groupId);

  if (!Number.isFinite(numericId) || numericId <= 0) {
    return res.status(400).json({ error: 'INVALID_GROUP_ID' });
  }

  try {
    deleteGroup(numericId);
    res.json({ success: true });
  } catch (error) {
    if (error.code === 'INVALID_GROUP_ID') {
      return res.status(400).json({ error: 'INVALID_GROUP_ID' });
    }
    if (error.code === 'GROUP_NOT_FOUND') {
      return res.status(404).json({ error: 'GROUP_NOT_FOUND' });
    }
    if (error.code === 'GROUP_HAS_MEMBERS') {
      return res.status(409).json({ error: 'GROUP_HAS_MEMBERS', memberCount: error.memberCount || 0 });
    }
    if (error.code === 'GROUP_SUPERUSER_PROTECTED') {
      return res.status(403).json({ error: 'GROUP_SUPERUSER_PROTECTED' });
    }

    console.error(`⚠️ [Groups] Löschen der Gruppe fehlgeschlagen (${groupId}):`, error);
    res.status(500).json({ error: 'GROUP_DELETE_FAILED' });
  }
});

// Superuser Setup
app.get('/api/auth/superuser/status', (req, res) => {
  const exists = hasSuperuser();
  const user = exists ? getSuperuserSummary() : null;
  res.json({ exists, user });
});

app.post('/api/auth/superuser/register', (req, res) => {
  if (hasSuperuser()) {
    return res.status(409).json({ error: 'SUPERUSER_EXISTS' });
  }

  const { username, email, password } = req.body || {};

  if (!username || !email || !password) {
    return res.status(400).json({ error: 'MISSING_FIELDS' });
  }

  try {
    const user = registerSuperuser({ username, email, password });
    res.status(201).json({ user });
  } catch (error) {
    switch (error.code) {
      case 'USERNAME_REQUIRED':
        return res.status(400).json({ error: 'USERNAME_REQUIRED' });
      case 'EMAIL_INVALID':
        return res.status(400).json({ error: 'EMAIL_INVALID' });
      case 'PASSWORD_TOO_SHORT':
        return res.status(400).json({ error: 'PASSWORD_TOO_SHORT' });
      case 'SUPERUSER_ALREADY_EXISTS':
        return res.status(409).json({ error: 'SUPERUSER_EXISTS' });
      default:
        console.error('⚠️ Fehler beim Registrieren des Superusers:', error);
        return res.status(500).json({ error: 'INTERNAL_ERROR' });
    }
  }
});

app.delete('/api/auth/superuser', (req, res) => {
  if (!hasSuperuser()) {
    return res.status(404).json({ error: 'SUPERUSER_NOT_FOUND' });
  }

  try {
    const result = removeSuperuser();
    res.json({ success: true, usersRemoved: result.usersRemoved, groupRemoved: result.groupRemoved });
  } catch (error) {
    if (error.code === 'SUPERUSER_NOT_FOUND') {
      return res.status(404).json({ error: 'SUPERUSER_NOT_FOUND' });
    }
    console.error('⚠️ Fehler beim Löschen des Superusers:', error);
    res.status(500).json({ error: 'INTERNAL_ERROR' });
  }
});

// Stacks abrufen
app.get('/api/stacks', maintenanceGuard, async (req, res) => {
  console.log("ℹ️ [API] GET /api/stacks: Abruf gestartet");
  try {
    const { canonicalStacks, duplicates } = await loadStackCollections();
    const duplicateNames = duplicates.map((entry) => entry.name);
    const duplicateNameSet = new Set(duplicateNames);

    if (duplicateNames.length) {
      console.warn(`⚠️ [API] GET /api/stacks: Doppelte Stack-Namen erkannt: ${duplicateNames.join(', ')}`);
    }

    const stacksWithStatus = await Promise.all(
      canonicalStacks.map(async (stack) => {
        try {
          const statusRes = await axiosInstance.get(
            `/api/stacks/${stack.Id}/images_status?refresh=true`
          );
          const statusEmoji = statusRes.data.Status === 'outdated' ? '⚠️' : '✅';
          const redeployMeta = redeployingStacks.get(String(stack.Id));
          const redeployPhase = redeployMeta?.phase || null;
          return {
            ...stack,
            updateStatus: statusEmoji,
            redeploying: redeployPhase === REDEPLOY_PHASES.STARTED || redeployPhase === REDEPLOY_PHASES.QUEUED,
            redeployPhase,
            redeployQueued: redeployPhase === REDEPLOY_PHASES.QUEUED,
            redeployDisabled: SELF_STACK_ID ? String(stack.Id) === SELF_STACK_ID : false,
            duplicateName: duplicateNameSet.has(stack.Name)
          };
        } catch (err) {
          console.error(`❌ Fehler beim Abrufen des Status für Stack ${stack.Id}:`, err.message);
          const redeployMeta = redeployingStacks.get(String(stack.Id));
          const redeployPhase = redeployMeta?.phase || null;
          return {
            ...stack,
            updateStatus: '❌',
            redeploying: redeployPhase === REDEPLOY_PHASES.STARTED || redeployPhase === REDEPLOY_PHASES.QUEUED,
            redeployPhase,
            redeployQueued: redeployPhase === REDEPLOY_PHASES.QUEUED,
            redeployDisabled: SELF_STACK_ID ? String(stack.Id) === SELF_STACK_ID : false,
            duplicateName: duplicateNameSet.has(stack.Name)
          };
        }
      })
    );

    stacksWithStatus.sort((a, b) => a.Name.localeCompare(b.Name));
    console.log(`✅ GET /api/stacks: Abruf erfolgreich, ${stacksWithStatus.length} Stacks geladen`);
    res.json(stacksWithStatus);
  } catch (err) {
    console.error(`❌ Fehler beim Abrufen der Stacks:`, err.message);
    if (err.message === 'PORTAINER_URL_NOT_CONFIGURED') {
      return res.status(503).json({ error: 'PORTAINER_URL_NOT_CONFIGURED' });
    }
    res.status(500).json({ error: err.message });
  }
});

app.get('/api/maintenance/portainer-status', requirePermission('maintenance-portainer', 'read'), async (req, res) => {
  console.log("🧭 [Maintenance] GET /api/maintenance/portainer-status: Prüfung gestartet");
  try {
    const payload = await fetchPortainerStatusSummary();
    res.json(payload);
  } catch (err) {
    const message = err.response?.data?.message || err.message || 'Unbekannter Fehler';
    console.error(`❌ [Maintenance] Fehler beim Prüfen des Portainer-Status: ${message}`);
    if (message === 'PORTAINER_URL_NOT_CONFIGURED') {
      return res.status(503).json({ error: 'PORTAINER_URL_NOT_CONFIGURED' });
    }
    res.status(500).json({ error: message });
  }
});

app.post('/api/maintenance/mode', requirePermission('maintenance-access', 'full'), (req, res) => {
  try {
    const { active, message } = req.body ?? {};
    const normalizedMessage = typeof message === 'string' && message.trim() ? message.trim() : null;
    const nextState = active
      ? activateMaintenanceMode({ message: normalizedMessage })
      : deactivateMaintenanceMode({ message: normalizedMessage });

    res.json({
      success: true,
      maintenance: nextState
    });
  } catch (err) {
    const errorMessage = err.response?.data?.error || err.message || 'Fehler beim Aktualisieren des Wartungsmodus';
    console.error('❌ [Maintenance] Fehler beim Ändern des Wartungsmodus:', errorMessage);
    res.status(500).json({ error: errorMessage });
  }
});

app.get('/api/maintenance/config', requirePermission('maintenance-server-manage', 'read'), (req, res) => {
  const custom = getCustomPortainerScript();
  const effective = getEffectivePortainerScript();
  const ssh = getPortainerSshConfig();

  res.json({
    maintenance: getMaintenanceState(),
    update: getPortainerUpdateStatus(),
    script: {
      default: DEFAULT_PORTAINER_UPDATE_SCRIPT,
      custom: custom?.script ?? null,
      customUpdatedAt: custom?.updatedAt ?? null,
      effective: effective.script,
      source: effective.source,
      updatedAt: effective.updatedAt
    },
    ssh: {
      host: ssh.host,
      port: ssh.port,
      username: ssh.username,
      extraSshArgs: ssh.extraSshArgs,
      passwordStored: Boolean(ssh.password)
    }
  });
});

app.put('/api/maintenance/ssh-config', requirePermission('maintenance-ssh-update', 'full'), (req, res) => {
  try {
    const config = savePortainerSshConfig(req.body || {});
    res.json({
      success: true,
      ssh: {
        host: config.host,
        port: config.port,
        username: config.username,
        extraSshArgs: config.extraSshArgs,
        passwordStored: Boolean(config.password)
      }
    });
  } catch (err) {
    console.error('❌ [Maintenance] Fehler beim Speichern der SSH-Konfiguration:', err.message);
    res.status(400).json({ error: err.message || 'Ungültige SSH-Konfiguration' });
  }
});

app.delete('/api/maintenance/ssh-config', requirePermission('maintenance-ssh-update', 'full'), (req, res) => {
  const config = deletePortainerSshConfig();
  res.json({
    success: true,
    ssh: {
      host: config.host,
      port: config.port,
      username: config.username,
      extraSshArgs: config.extraSshArgs,
      passwordStored: false
    }
  });
});

app.post('/api/maintenance/test-ssh', requirePermission('maintenance-ssh-update', 'full'), async (req, res) => {
  try {
    const override = req.body && Object.keys(req.body).length ? req.body : null;
    const result = await testSshConnection(override);
    res.json({ success: true, result });
  } catch (err) {
    console.error('❌ [Maintenance] SSH Test fehlgeschlagen:', err.message);
    res.status(500).json({ error: err.message || 'SSH Test fehlgeschlagen' });
  }
});

app.put('/api/maintenance/update-script', requirePermission('maintenance-ssh-update', 'full'), (req, res) => {
  if (portainerUpdateState.running) {
    return res.status(409).json({
      error: 'Aktualisierung läuft. Skript kann derzeit nicht geändert werden.',
      update: getPortainerUpdateStatus()
    });
  }

  const incoming = req.body?.script;
  if (typeof incoming !== 'string') {
    return res.status(400).json({ error: 'Feld "script" (string) wird benötigt.' });
  }

  saveCustomPortainerScript(incoming);

  const custom = getCustomPortainerScript();
  const effective = getEffectivePortainerScript();

  res.json({
    success: true,
    script: {
      default: DEFAULT_PORTAINER_UPDATE_SCRIPT,
      custom: custom?.script ?? null,
      customUpdatedAt: custom?.updatedAt ?? null,
      effective: effective.script,
      source: effective.source,
      updatedAt: effective.updatedAt
    }
  });
});

app.delete('/api/maintenance/update-script', requirePermission('maintenance-ssh-update', 'full'), (req, res) => {
  if (portainerUpdateState.running) {
    return res.status(409).json({
      error: 'Aktualisierung läuft. Skript kann derzeit nicht geändert werden.',
      update: getPortainerUpdateStatus()
    });
  }

  saveCustomPortainerScript('');
  const effective = getEffectivePortainerScript();

  res.json({
    success: true,
    script: {
      default: DEFAULT_PORTAINER_UPDATE_SCRIPT,
      custom: null,
      customUpdatedAt: null,
      effective: effective.script,
      source: effective.source,
      updatedAt: effective.updatedAt
    }
  });
});

app.get('/api/maintenance/update-status', requirePermission('maintenance-update', 'read'), (req, res) => {
  res.json({
    maintenance: getMaintenanceState(),
    update: getPortainerUpdateStatus()
  });
});

app.post('/api/maintenance/portainer-update', requirePermission('maintenance-update', 'full'), async (req, res) => {
  if (portainerUpdateState.running) {
    return res.status(409).json({
      error: 'Ein Portainer-Update läuft bereits.',
      update: getPortainerUpdateStatus()
    });
  }

  if (isMaintenanceModeActive()) {
    return res.status(423).json({
      error: 'Wartungsmodus ist bereits aktiv.',
      maintenance: getMaintenanceState()
    });
  }

  const overrideScript = typeof req.body?.script === 'string' ? req.body.script : null;
  let scriptSource = 'default';
  let scriptToRun = DEFAULT_PORTAINER_UPDATE_SCRIPT;

  if (overrideScript && overrideScript.trim().length) {
    scriptSource = 'override';
    scriptToRun = overrideScript.replace(/\r?\n/g, '\n');
  } else {
    const effective = getEffectivePortainerScript();
    scriptSource = effective.source;
    scriptToRun = effective.script;
  }

  let targetVersion = null;
  try {
    const statusBefore = await fetchPortainerStatusSummary();
    targetVersion = statusBefore?.latestVersion ?? statusBefore?.currentVersion ?? null;
  } catch (err) {
    console.warn('⚠️ [Maintenance] Konnte Portainer-Status vor Update nicht ermitteln:', err.message);
  }

  updatePortainerState({
    running: true,
    status: 'running',
    stage: 'initializing',
    startedAt: new Date().toISOString(),
    finishedAt: null,
    targetVersion,
    scriptSource,
    message: 'Portainer Update wird vorbereitet',
    error: null,
    logs: []
  });

  addUpdateLog('Vorbereitung abgeschlossen, Update wird gestartet', 'info');

  res.json({
    success: true,
    maintenance: getMaintenanceState(),
    update: getPortainerUpdateStatus()
  });

  currentPortainerUpdatePromise = performPortainerUpdate({
    script: scriptToRun,
    scriptSource,
    targetVersion
  }).catch((err) => {
    console.error('❌ [Maintenance] Portainer Update Fehler:', err.message);
  });
});

app.get(
  '/api/maintenance/duplicates',
  maintenanceGuard,
  requirePermission('maintenance-duplicates', 'read'),
  async (req, res) => {
  console.log("🧹 [Maintenance] GET /api/maintenance/duplicates: Abruf gestartet");
  try {
    const { duplicates } = await loadStackCollections();

    const payload = duplicates
      .sort((a, b) => a.name.localeCompare(b.name))
      .map((entry) => ({
        name: entry.name,
        canonical: {
          Id: entry.canonical.Id,
          Name: entry.canonical.Name,
          EndpointId: entry.canonical.EndpointId,
          Type: entry.canonical.Type,
          Created: entry.canonical.Created
        },
        duplicates: entry.members.map((stack) => ({
          Id: stack.Id,
          Name: stack.Name,
          EndpointId: stack.EndpointId,
          Type: stack.Type,
          Created: stack.Created
        }))
      }));

    res.json({
      total: payload.length,
      items: payload
    });
  } catch (err) {
    console.error(`❌ [Maintenance] Fehler beim Abrufen der Duplikate:`, err.message);
    res.status(500).json({ error: 'Fehler beim Abrufen der doppelten Stacks' });
  }
});

app.post(
  '/api/maintenance/duplicates/cleanup',
  maintenanceGuard,
  requirePermission('maintenance-duplicates', 'full'),
  async (req, res) => {
  const canonicalId = req.body?.canonicalId;
  const duplicateIdsInput = Array.isArray(req.body?.duplicateIds) ? req.body.duplicateIds : [];
  const duplicateIds = duplicateIdsInput
    .map((value) => String(value).trim())
    .filter((value) => value.length > 0);

  if (!canonicalId) {
    return res.status(400).json({ error: 'canonicalId ist erforderlich' });
  }

  if (!duplicateIds.length) {
    return res.status(400).json({ error: 'duplicateIds ist erforderlich' });
  }

  const canonicalIdStr = String(canonicalId);
  console.log(`🧹 [Maintenance] Bereinigung angefordert für Stack ${canonicalIdStr}. Ziel-IDs: ${duplicateIds.join(', ')}`);

  try {
    const { duplicates } = await loadStackCollections();
    const target = duplicates.find((entry) => String(entry.canonical.Id) === canonicalIdStr);

    if (!target) {
      return res.status(404).json({ error: 'Kein doppelter Stack für diese ID gefunden' });
    }

    const duplicatesToDelete = target.members.filter((stack) => duplicateIds.includes(String(stack.Id)));

    if (!duplicatesToDelete.length) {
      return res.status(400).json({ error: 'Keine passenden Duplikate gefunden' });
    }

    logStackEvent({
      stackId: target.canonical.Id,
      stackName: target.canonical.Name,
      status: 'started',
      message: `Bereinigung doppelter Stacks gestartet (${duplicatesToDelete.length} Einträge)`,
      endpointId: target.canonical.EndpointId,
      redeployType: REDEPLOY_TYPES.MAINTENANCE,
      metadata: {
        duplicateIds: duplicateIds
      }
    });

    const results = [];
    const errors = [];

    for (const stack of duplicatesToDelete) {
      try {
        await axiosInstance.delete(`/api/stacks/${stack.Id}`, {
          params: { endpointId: stack.EndpointId }
        });
        console.log(`🧹 [Maintenance] Stack entfernt: ${stack.Name} (${stack.Id})`);
        results.push({
          id: stack.Id,
          name: stack.Name,
          endpointId: stack.EndpointId,
          status: 'deleted'
        });
      } catch (err) {
        const message = err.response?.data?.message || err.message;
        console.error(`❌ [Maintenance] Fehler beim Entfernen von Stack ${stack.Id}:`, message);
        errors.push({ id: stack.Id, message });
        results.push({
          id: stack.Id,
          name: stack.Name,
          endpointId: stack.EndpointId,
          status: 'error',
          message
        });
      }
    }

    if (errors.length) {
      const failedIds = errors.map((entry) => entry.id).join(', ');
      logStackEvent({
        stackId: target.canonical.Id,
        stackName: target.canonical.Name,
        status: 'error',
        message: `Bereinigung fehlgeschlagen für IDs: ${failedIds}`,
        endpointId: target.canonical.EndpointId,
        redeployType: REDEPLOY_TYPES.MAINTENANCE,
        metadata: {
          duplicateIds: duplicateIds
        }
      });

      return res.status(500).json({
        success: false,
        canonical: {
          id: target.canonical.Id,
          name: target.canonical.Name,
          endpointId: target.canonical.EndpointId
        },
        results
      });
    }

    logStackEvent({
      stackId: target.canonical.Id,
      stackName: target.canonical.Name,
      status: 'success',
      message: `Bereinigung abgeschlossen. Entfernte IDs: ${results.map((entry) => entry.id).join(', ')}`,
      endpointId: target.canonical.EndpointId,
      redeployType: REDEPLOY_TYPES.MAINTENANCE,
      metadata: {
        removedDuplicates: results.filter((entry) => entry.status === 'deleted').map((entry) => entry.id)
      }
    });

    res.json({
      success: true,
      canonical: {
        id: target.canonical.Id,
        name: target.canonical.Name,
        endpointId: target.canonical.EndpointId
      },
      removed: results.length,
      results
    });
  } catch (err) {
    const message = err.response?.data?.message || err.message;
    console.error(`❌ [Maintenance] Fehler bei der Bereinigung:`, message);
    res.status(500).json({ error: message || 'Fehler bei der Bereinigung' });
  }
});

// Event-Logs abrufen
app.get('/api/logs', requirePermission('logs-access', 'read'), (req, res) => {
  const perPageParam = req.query.perPage ?? req.query.limit;
  const perPage = perPageParam === 'all' ? 'all' : Math.min(parseInt(perPageParam, 10) || 50, 500);
  const page = Math.max(parseInt(req.query.page, 10) || 1, 1);

  const limit = perPage === 'all' ? undefined : perPage;
  const offset = perPage === 'all' ? 0 : (page - 1) * perPage;

  const { whereClause, params } = buildEventLogFilter(req.query);
  const baseQuery = `
    SELECT
      id,
      timestamp,
      category,
      event_type AS eventType,
      action,
      status,
      severity,
      entity_type AS entityType,
      entity_id AS entityId,
      entity_name AS entityName,
      actor_type AS actorType,
      actor_id AS actorId,
      actor_name AS actorName,
      source,
      context_type AS contextType,
      context_id AS contextId,
      context_label AS contextLabel,
      message,
      metadata
    FROM event_logs
    ${whereClause}
    ORDER BY datetime(timestamp) DESC
  `;

  const countQuery = `
    SELECT COUNT(*) as total
    FROM event_logs
    ${whereClause}
  `;

  const query = limit !== undefined
    ? `${baseQuery} LIMIT @limit OFFSET @offset`
    : baseQuery;

  if (limit !== undefined) {
    params.limit = limit;
    params.offset = offset;
  }

  try {
    const stmt = db.prepare(query);
    const rawLogs = stmt.all(params);
    const logs = rawLogs.map((row) => {
      const metadata = parseJsonColumn(row.metadata);
      const legacyStack = row.entityType === 'stack' ? (row.entityId ?? null) : null;
      const legacyStackName = row.entityType === 'stack' ? (row.entityName ?? row.entityId ?? null) : null;
      const legacyEndpoint = row.contextType === 'endpoint' ? (row.contextId ?? null) : null;

      return {
        ...row,
        entityId: row.entityId ?? null,
        actorId: row.actorId ?? null,
        contextId: row.contextId ?? null,
        metadata,
        stackId: legacyStack,
        stackName: legacyStackName,
        redeployType: row.eventType ?? null,
        endpoint: legacyEndpoint
      };
    });
    const total = db.prepare(countQuery).get(params)?.total ?? logs.length;

    res.json({
      total,
      items: logs,
      page,
      perPage: perPage === 'all' ? 'all' : limit
    });
  } catch (err) {
    console.error('❌ Fehler beim Abrufen der Event-Logs:', err.message);
    res.status(500).json({ error: 'Fehler beim Abrufen der Logs' });
  }
});

app.delete('/api/logs/:id', requirePermission('logs-delete', 'full'), (req, res) => {
  const id = Number(req.params.id);
  if (Number.isNaN(id)) {
    return res.status(400).json({ error: 'Ungültige ID' });
  }

  try {
    const changes = deleteEventLogById(id);
    if (!changes) {
      return res.status(404).json({ error: 'Eintrag nicht gefunden' });
    }
    res.json({ success: true, deleted: changes });
  } catch (err) {
    console.error('❌ Fehler beim Löschen des Event-Logs:', err.message);
    res.status(500).json({ error: 'Fehler beim Löschen des Logs' });
  }
});

app.delete('/api/logs', requirePermission('logs-delete', 'full'), (req, res) => {
  try {
    const deleted = deleteEventLogsByFilters(req.query);
    res.json({ success: true, deleted });
  } catch (err) {
    console.error('❌ Fehler beim Löschen der Event-Logs:', err.message);
    res.status(500).json({ error: 'Fehler beim Löschen der Logs' });
  }
});

app.get('/api/logs/export', requirePermission('logs-export', 'full'), (req, res) => {
  const format = (req.query.format || 'txt').toLowerCase();
  if (!['txt', 'sql'].includes(format)) {
    return res.status(400).json({ error: 'Ungültiges Export-Format' });
  }

  try {
    const payload = exportEventLogsByFilters(req.query, format);
    res.setHeader('Content-Type', payload.contentType);
    res.setHeader('Content-Disposition', `attachment; filename="${payload.filename}"`);
    res.send(payload.content);
  } catch (err) {
    console.error('❌ Fehler beim Export der Event-Logs:', err.message);
    res.status(500).json({ error: 'Fehler beim Export der Logs' });
  }
});

// Einzel-Redeploy
app.put('/api/stacks/:id/redeploy', requirePermission('stacks-redeploy-single', 'full'), async (req, res) => {
  const { id } = req.params;
  console.log(`🔄 PUT /api/stacks/${id}/redeploy: Redeploy gestartet`);

  try {
    await redeployStackById(id, REDEPLOY_TYPES.SINGLE);
    console.log(`✅ PUT /api/stacks/${id}/redeploy: Redeploy erfolgreich abgeschlossen`);
    res.json({ success: true, message: 'Stack redeployed' });
  } catch (err) {
    const errorMessage = err.message || 'Unbekannter Fehler beim Redeploy';
    console.error(`❌ Fehler beim Redeploy von Stack ${id}:`, errorMessage);
    res.status(500).json({ error: errorMessage });
  }
});

// Redeploy ALL
app.put(
  '/api/stacks/redeploy-all',
  maintenanceGuard,
  requirePermission('stacks-redeploy-all', 'full'),
  async (req, res) => {
  console.log(`🚀 PUT /api/stacks/redeploy-all: Redeploy ALL gestartet`);

  let endpointId;

  try {
    endpointId = requireActiveEndpointId();
    const stacksRes = await axiosInstance.get('/api/stacks');
    const filteredStacks = stacksRes.data.filter(stack => String(stack.EndpointId) === String(endpointId));

    console.log("📦 Redeploy ALL für folgende Stacks:");
    filteredStacks.forEach(s => console.log(`   - ${s.Name}`));

    const { eligibleStacks, skippedStacks } = await filterOutdatedStacks(filteredStacks);

    if (skippedStacks.length) {
      skippedStacks.forEach((stack) => {
        console.log(`⏭️ Übersprungen (aktuell): ${stack.Name} (${stack.Id})`);
      });
    }

    const stackSummaryList = eligibleStacks.map((stack) => `${stack.Name} (${stack.Id})`);
    const stackSummary = stackSummaryList.length ? stackSummaryList.join(', ') : 'keine Stacks';
    logEvent({
      category: 'stack',
      eventType: REDEPLOY_TYPES.ALL,
      action: 'redeploy-alle',
      status: 'gestartet',
      entityType: 'bulk-operation',
      entityId: 'redeploy-alle',
      entityName: 'Redeploy ALLE',
      contextType: 'endpoint',
      contextId: String(endpointId),
      message: `Redeploy ALLE gestartet für: ${stackSummary}`,
      metadata: {
        stacks: stackSummaryList
      },
      source: 'system'
    });

    if (!eligibleStacks.length) {
      console.log('ℹ️ Keine veralteten Stacks für Redeploy ALL vorhanden');
      return res.json({ success: true, message: 'Keine veralteten Stacks gefunden' });
    }

    eligibleStacks.forEach((stack) => {
      broadcastRedeployStatus({
        stackId: stack.Id,
        stackName: stack.Name,
        phase: REDEPLOY_PHASES.QUEUED
      });
    });

    for (const stack of eligibleStacks) {
      try {
        await redeployStackById(stack.Id, REDEPLOY_TYPES.ALL);
        console.log(`✅ Redeploy ALL -> Stack ${stack.Name} (${stack.Id}) erfolgreich`);
      } catch (err) {
        console.error(`❌ Redeploy ALL -> Stack ${stack.Name} (${stack.Id}) fehlgeschlagen:`, err.message);
      }
    }

    logEvent({
      category: 'stack',
      eventType: REDEPLOY_TYPES.ALL,
      action: 'redeploy-alle',
      status: 'erfolgreich',
      entityType: 'bulk-operation',
      entityId: 'redeploy-alle',
      entityName: 'Redeploy ALLE',
      contextType: 'endpoint',
      contextId: String(endpointId),
      message: 'Redeploy ALLE abgeschlossen',
      metadata: {
        processedStacks: stackSummaryList
      },
      source: 'system'
    });

    res.json({ success: true, message: 'Redeploy ALL abgeschlossen' });
  } catch (err) {
    const message = err.response?.data?.message || err.message;
    logEvent({
      category: 'stack',
      eventType: REDEPLOY_TYPES.ALL,
      action: 'redeploy-alle',
      status: 'error',
      entityType: 'bulk-operation',
      entityId: 'redeploy-alle',
      entityName: 'Redeploy ALLE',
      contextType: endpointId !== undefined && endpointId !== null ? 'endpoint' : null,
      contextId: endpointId !== undefined && endpointId !== null ? String(endpointId) : null,
      message,
      source: 'system'
    });
    console.error('❌ Fehler bei Redeploy ALLE:', message);
    res.status(500).json({ error: message });
  }
});

// Redeploy selection
app.put(
  '/api/stacks/redeploy-selection',
  maintenanceGuard,
  requirePermission('stacks-redeploy-selection', 'full'),
  async (req, res) => {
  const { stackIds } = req.body || {};
  const totalCount = Array.isArray(stackIds) ? stackIds.length : 0;
  console.log(`🚀 PUT /api/stacks/redeploy-selection: Redeploy Auswahl gestartet (${totalCount} Stacks)`);

  if (!Array.isArray(stackIds) || stackIds.length === 0) {
    return res.status(400).json({ error: 'stackIds muss eine nicht leere Array sein' });
  }

  let endpointId;

  try {
    endpointId = requireActiveEndpointId();
    const normalizedIds = stackIds.map((id) => String(id));
    const { filteredStacks } = await loadStackCollections();
    const stacksById = new Map(filteredStacks.map((stack) => [String(stack.Id), stack]));

    const missingIds = normalizedIds.filter((id) => !stacksById.has(id));
    if (missingIds.length) {
      return res.status(400).json({ error: `Ungültige Stack-IDs: ${missingIds.join(', ')}` });
    }

    const selectedStacks = normalizedIds.map((id) => stacksById.get(id)).filter(Boolean);
    if (!selectedStacks.length) {
      return res.status(400).json({ error: 'Keine gültigen Stacks für Redeploy Auswahl gefunden' });
    }

    const { eligibleStacks, skippedStacks } = await filterOutdatedStacks(selectedStacks);

    if (skippedStacks.length) {
      skippedStacks.forEach((stack) => {
        console.log(`⏭️ Redeploy Auswahl übersprungen (aktuell): ${stack.Name} (${stack.Id})`);
      });
    }

    const summaryList = eligibleStacks.map((stack) => `${stack.Name} (${stack.Id})`);
    const summaryText = summaryList.length ? summaryList.join(', ') : 'keine Stacks';

    logEvent({
      category: 'stack',
      eventType: REDEPLOY_TYPES.SELECTION,
      action: 'redeploy-auswahl',
      status: 'gestartet',
      entityType: 'bulk-operation',
      entityId: 'redeploy-auswahl',
      entityName: `Redeploy Auswahl (${stackIds.length})`,
      contextType: 'endpoint',
      contextId: String(endpointId),
      message: `Redeploy Auswahl gestartet für: ${summaryText}`,
      metadata: {
        requestedStackIds: normalizedIds
      },
      source: 'system'
    });

    if (!eligibleStacks.length) {
      logEvent({
        category: 'stack',
        eventType: REDEPLOY_TYPES.SELECTION,
        action: 'redeploy-auswahl',
        status: 'erfolgreich',
        entityType: 'bulk-operation',
        entityId: 'redeploy-auswahl',
        entityName: `Redeploy Auswahl (${stackIds.length})`,
        contextType: 'endpoint',
        contextId: String(endpointId),
        message: 'Redeploy Auswahl übersprungen: keine veralteten Stacks',
        metadata: {
          requestedStackIds: normalizedIds,
          skipped: true
        },
        source: 'system'
      });
      return res.json({ success: true, message: 'Keine veralteten Stacks in der Auswahl' });
    }

    eligibleStacks.forEach((stack) => {
      broadcastRedeployStatus({
        stackId: stack.Id,
        stackName: stack.Name,
        phase: REDEPLOY_PHASES.QUEUED
      });
    });

    for (const stack of eligibleStacks) {
      try {
        await redeployStackById(stack.Id, REDEPLOY_TYPES.SELECTION);
        console.log(`✅ Redeploy Auswahl -> Stack ${stack.Name} (${stack.Id}) erfolgreich`);
      } catch (err) {
        console.error(`❌ Redeploy Auswahl -> Stack ${stack.Name} (${stack.Id}) fehlgeschlagen:`, err.message);
      }
    }

    logEvent({
      category: 'stack',
      eventType: REDEPLOY_TYPES.SELECTION,
      action: 'redeploy-auswahl',
      status: 'erfolgreich',
      entityType: 'bulk-operation',
      entityId: 'redeploy-auswahl',
      entityName: `Redeploy Auswahl (${stackIds.length})`,
      contextType: 'endpoint',
      contextId: String(endpointId),
      message: 'Redeploy Auswahl abgeschlossen',
      metadata: {
        processedStackIds: eligibleStacks.map((stack) => String(stack.Id))
      },
      source: 'system'
    });

    res.json({ success: true, message: 'Redeploy Auswahl abgeschlossen' });
  } catch (err) {
    const message = err.response?.data?.message || err.message;
    const normalized = Array.isArray(stackIds) ? stackIds.map((id) => String(id)) : [];
    logEvent({
      category: 'stack',
      eventType: REDEPLOY_TYPES.SELECTION,
      action: 'redeploy-auswahl',
      status: 'fehler',
      entityType: 'bulk-operation',
      entityId: 'redeploy-auswahl',
      entityName: `Redeploy Auswahl (${Array.isArray(stackIds) ? stackIds.length : 0})`,
      contextType: endpointId !== undefined && endpointId !== null ? 'endpoint' : null,
      contextId: endpointId !== undefined && endpointId !== null ? String(endpointId) : null,
      message,
      metadata: {
        requestedStackIds: normalized
      },
      source: 'system'
    });
    console.error('❌ Fehler bei Redeploy Auswahl:', message);
    res.status(500).json({ error: message });
  }
});

server.listen(PORT, () => {
  console.log(`🚀 Server läuft auf Port ${PORT}`);
});