Actualizar server.js

server.js

@@ -3,15 +3,16 @@ import cors from "cors";
 import bcrypt from "bcryptjs";
 import jwt from "jsonwebtoken";
 import pg from "pg";
+import fetch from "node-fetch"; // Asegúrate de tener node-fetch si usas Node < 18
 
 const { Pool } = pg;
-
 const app = express();
+
 app.use(cors());
 app.use(express.json());
 
 // =========================
-// ENV (Coolify variables)
+// ENV
 // =========================
 const {
   DATABASE_URL,
@@ -19,36 +20,35 @@ const {
   EVOLUTION_BASE_URL,
   EVOLUTION_API_KEY,
   EVOLUTION_INSTANCE,
-  EVOLUTION_SENDER_NUMBER
 } = process.env;
 
-if (!DATABASE_URL) console.warn("⚠️ DATABASE_URL no definido");
+if (!DATABASE_URL || !JWT_SECRET) {
-if (!JWT_SECRET) console.warn("⚠️ JWT_SECRET no definido");
+  console.error("❌ Faltan variables de entorno críticas (DATABASE_URL o JWT_SECRET)");
+  process.exit(1);
+}
 
 // =========================
-// DB
+// DB CONNECTION
 // =========================
 const pool = new Pool({
   connectionString: DATABASE_URL,
-  ssl: DATABASE_URL?.includes("localhost") ? false : { rejectUnauthorized: false }
+  ssl: DATABASE_URL.includes("localhost") ? false : { rejectUnauthorized: false }
 });
 
 // =========================
-// Helpers
+// HELPERS
 // =========================
 function normalizePhone(phone) {
-  // Ajusta a tu gusto (E.164). Para España: +34XXXXXXXXX
+  let p = String(phone || "").trim().replace(/\s+/g, "").replace(/-/g, "");
-  let p = String(phone || "").trim().replace(/\s+/g, "");
   if (!p) return "";
-  if (!p.startsWith("+")) {
+  // Lógica simple para España
-    // si meten 600..., asumimos España
+  if (!p.startsWith("+") && /^[6789]\d{8}$/.test(p)) {
-    if (/^\d{9}$/.test(p)) p = "+34" + p;
+    return "+34" + p;
   }
   return p;
 }
 
 function genCode6() {
-  // 6 dígitos
   return String(Math.floor(100000 + Math.random() * 900000));
 }
 
@@ -60,6 +60,7 @@ function signToken(user) {
   );
 }
 
+// Middleware de autenticación
 function authMiddleware(req, res, next) {
   const h = req.headers.authorization || "";
   const token = h.startsWith("Bearer ") ? h.slice(7) : "";
@@ -70,37 +71,25 @@ function authMiddleware(req, res, next) {
     req.user = payload;
     next();
   } catch {
-    return res.status(401).json({ ok: false, error: "Token inválido" });
+    return res.status(401).json({ ok: false, error: "Token inválido o expirado" });
   }
 }
 
-// Rate-limit muy simple en memoria (para no freír el WhatsApp)
-const lastSendByPhone = new Map();
-function canSendCode(phone) {
-  const now = Date.now();
-  const last = lastSendByPhone.get(phone) || 0;
-  // 1 envío cada 60s
-  if (now - last < 60_000) return false;
-  lastSendByPhone.set(phone, now);
-  return true;
-}
-
 // =========================
-// Evolution API (WhatsApp)
+// EVOLUTION API (WHATSAPP)
 // =========================
 async function sendWhatsAppCode(phone, code) {
-  if (!EVOLUTION_BASE_URL || !EVOLUTION_API_KEY || !EVOLUTION_INSTANCE) {
+  if (!EVOLUTION_BASE_URL || !EVOLUTION_API_KEY) {
-    console.warn("⚠️ Evolution API env no configuradas, no envío WhatsApp.");
+    console.warn("⚠️ Evolution API no configurada. Código (Log):", code);
-    return { ok: false, skipped: true };
+    return { ok: true, skipped: true }; // Devolvemos true para no romper el flujo en desarrollo
   }
 
-  // OJO: el endpoint exacto puede variar según tu Evolution.
+  try {
-  // Ajustamos a un patrón típico: /message/sendText/{instance}
+    const url = `${EVOLUTION_BASE_URL.replace(/\/$/, "")}/message/sendText/${EVOLUTION_INSTANCE}`;
-  const url = `${EVOLUTION_BASE_URL.replace(/\/$/, "")}/message/sendText/${encodeURIComponent(EVOLUTION_INSTANCE)}`;
     
-  const payload = {
+    const body = {
-    number: phone, // normalmente en formato +34...
+      number: phone.replace("+", ""), // Evolution suele preferir el número sin el +
-    text: `Tu código de verificación es: ${code}\nCaduca en 10 minutos.`
+      text: `🔐 Tu código de verificación IntegraRepara es: *${code}*\n\nNo lo compartas con nadie.`
     };
 
     const res = await fetch(url, {
@@ -109,212 +98,171 @@ async function sendWhatsAppCode(phone, code) {
         "Content-Type": "application/json",
         "apikey": EVOLUTION_API_KEY
       },
-    body: JSON.stringify(payload)
+      body: JSON.stringify(body)
     });
 
-  const text = await res.text();
+    const data = await res.json();
-  let data;
-  try { data = JSON.parse(text); } catch { data = text; }
     
     if (!res.ok) {
-    console.error("❌ Evolution send failed:", res.status, data);
+      console.error("❌ Error Evolution:", data);
-    return { ok: false, status: res.status, data };
+      return { ok: false };
+    }
+    return { ok: true };
+  } catch (error) {
+    console.error("❌ Error enviando WhatsApp:", error);
+    return { ok: false };
   }
-  return { ok: true, data };
 }
 
 // =========================
-// Health
+// RUTAS DE AUTENTICACIÓN
-// =========================
-app.get("/health", async (req, res) => {
-  try {
-    const r = await pool.query("select now() as now");
-    res.json({ ok: true, db: true, now: r.rows[0].now });
-  } catch (e) {
-    res.json({ ok: false, db: false, error: String(e?.message || e) });
-  }
-});
-
-app.get("/", (req, res) => res.send("IntegraRepara API OK"));
-
-// =========================
-// AUTH
 // =========================
 
-// Registro: crea user + manda código WhatsApp
+// 1. REGISTRO
 app.post("/auth/register", async (req, res) => {
+  const client = await pool.connect();
   try {
-    const {
+    const { fullName, phone, address, dni, email, password } = req.body;
-      fullName,
-      phone,
-      address,
-      dni,
-      email,
-      password
-    } = req.body || {};
-
     const p = normalizePhone(phone);
 
-    if (!fullName || !p || !address || !dni || !email || !password) {
+    if (!fullName || !p || !email || !password) {
-      return res.status(400).json({ ok: false, error: "Faltan campos obligatorios" });
+      return res.status(400).json({ ok: false, error: "Faltan datos" });
     }
 
-    if (!canSendCode(p)) {
+    const passwordHash = await bcrypt.hash(password, 10);
-      return res.status(429).json({ ok: false, error: "Espera 1 minuto antes de pedir otro código" });
-    }
     
-    const passwordHash = await bcrypt.hash(String(password), 10);
+    await client.query('BEGIN');
 
-    // intenta crear usuario
+    // Verificamos si existe
-    let user;
+    const checkUser = await client.query("SELECT * FROM users WHERE email = $1 OR phone = $2", [email, p]);
-    try {
+    
-      const q = await pool.query(
+    let userId;
-        `insert into users (full_name, phone, address, dni, email, password_hash, is_verified)
+
-         values ($1,$2,$3,$4,$5,$6,false)
+    if (checkUser.rowCount > 0) {
-         returning id, full_name, phone, email, is_verified`,
+      const existing = checkUser.rows[0];
-        [String(fullName).trim(), p, String(address).trim(), String(dni).trim(), String(email).trim().toLowerCase(), passwordHash]
+      if (existing.is_verified) {
+        await client.query('ROLLBACK');
+        return res.status(409).json({ ok: false, error: "El usuario ya existe y está verificado. Por favor inicia sesión." });
+      } else {
+        // Existe pero NO verificado: Actualizamos datos y reenvíamos código
+        await client.query(
+          `UPDATE users SET full_name=$1, address=$2, dni=$3, password_hash=$4 WHERE id=$5`,
+          [fullName, address, dni, passwordHash, existing.id]
         );
-      user = q.rows[0];
+        userId = existing.id;
-    } catch (e) {
+      }
-      // si ya existe por email o phone
+    } else {
-      return res.status(409).json({ ok: false, error: "Ya existe un usuario con ese teléfono o email" });
+      // Nuevo usuario
+      const insert = await client.query(
+        `INSERT INTO users (full_name, phone, address, dni, email, password_hash) 
+         VALUES ($1, $2, $3, $4, $5, $6) RETURNING id`,
+        [fullName, p, address, dni, email, passwordHash]
+      );
+      userId = insert.rows[0].id;
     }
 
+    // Generar código
     const code = genCode6();
     const codeHash = await bcrypt.hash(code, 10);
     const expiresAt = new Date(Date.now() + 10 * 60 * 1000); // 10 min
 
-    await pool.query(
+    // Invalidar códigos anteriores
-      `insert into login_codes (user_id, phone, code_hash, purpose, expires_at)
+    await client.query("DELETE FROM login_codes WHERE user_id = $1", [userId]);
-       values ($1,$2,$3,'register_verify',$4)`,
+    
-      [user.id, p, codeHash, expiresAt]
+    // Insertar nuevo código
+    await client.query(
+      `INSERT INTO login_codes (user_id, phone, code_hash, expires_at) VALUES ($1, $2, $3, $4)`,
+      [userId, p, codeHash, expiresAt]
     );
 
-    await sendWhatsAppCode(p, code);
+    // Enviar WhatsApp (fuera de la transacción para no bloquear DB si tarda)
+    const whatsAppStatus = await sendWhatsAppCode(p, code);
+
+    await client.query('COMMIT');
+
+    res.json({ ok: true, phone: p, msg: "Código enviado" });
 
-    res.json({ ok: true, needsVerify: true, phone: p });
   } catch (e) {
-    res.status(500).json({ ok: false, error: String(e?.message || e) });
+    await client.query('ROLLBACK');
+    console.error(e);
+    res.status(500).json({ ok: false, error: "Error interno del servidor" });
+  } finally {
+    client.release();
   }
 });
 
-// Verificar código de registro: activa user + devuelve token
+// 2. VERIFICACIÓN
 app.post("/auth/verify", async (req, res) => {
   try {
-    const { phone, code } = req.body || {};
+    const { phone, code } = req.body;
     const p = normalizePhone(phone);
 
-    if (!p || !code) return res.status(400).json({ ok: false, error: "Faltan phone o code" });
+    // Buscar código válido
-
+    const codeQuery = await pool.query(
-    const u = await pool.query(`select * from users where phone=$1`, [p]);
+      `SELECT lc.*, u.id as user_id, u.email, u.full_name, u.phone 
-    if (!u.rowCount) return res.status(404).json({ ok: false, error: "Usuario no existe" });
+       FROM login_codes lc
-    const user = u.rows[0];
+       JOIN users u ON lc.user_id = u.id
-
+       WHERE lc.phone = $1 AND lc.consumed_at IS NULL AND lc.expires_at > NOW()
-    // busca último código válido no consumido
+       ORDER BY lc.created_at DESC LIMIT 1`,
-    const c = await pool.query(
-      `select * from login_codes
-       where phone=$1 and purpose='register_verify' and consumed_at is null and expires_at > now()
-       order by created_at desc
-       limit 1`,
       [p]
     );
 
-    if (!c.rowCount) return res.status(400).json({ ok: false, error: "Código inválido o caducado" });
+    if (codeQuery.rowCount === 0) {
+      return res.status(400).json({ ok: false, error: "Código inválido o expirado" });
+    }
 
-    const row = c.rows[0];
+    const row = codeQuery.rows[0];
-    const ok = await bcrypt.compare(String(code).trim(), row.code_hash);
+    const valid = await bcrypt.compare(String(code), row.code_hash);
-    if (!ok) return res.status(400).json({ ok: false, error: "Código incorrecto" });
 
-    await pool.query(`update login_codes set consumed_at=now() where id=$1`, [row.id]);
+    if (!valid) {
-    await pool.query(`update users set is_verified=true where id=$1`, [user.id]);
+      return res.status(400).json({ ok: false, error: "Código incorrecto" });
+    }
 
-    // settings por defecto
+    // Consumir código y verificar usuario
-    await pool.query(
+    await pool.query("UPDATE login_codes SET consumed_at = NOW() WHERE id = $1", [row.id]);
-      `insert into user_settings (user_id, company_name)
+    await pool.query("UPDATE users SET is_verified = TRUE WHERE id = $1", [row.user_id]);
-       values ($1,$2)
-       on conflict (user_id) do nothing`,
-      [user.id, user.full_name]
-    );
 
+    const user = { id: row.user_id, email: row.email, phone: row.phone };
     const token = signToken(user);
+
     res.json({ ok: true, token });
+
   } catch (e) {
-    res.status(500).json({ ok: false, error: String(e?.message || e) });
+    console.error(e);
+    res.status(500).json({ ok: false, error: "Error verificando código" });
   }
 });
 
-// Login normal (email+password). Si quieres 2FA por WhatsApp también, lo hacemos luego.
+// 3. LOGIN
 app.post("/auth/login", async (req, res) => {
   try {
-    const { email, password } = req.body || {};
+    const { email, password } = req.body;
-    if (!email || !password) return res.status(400).json({ ok: false, error: "Faltan email o password" });
     
-    const q = await pool.query(`select * from users where email=$1`, [String(email).trim().toLowerCase()]);
+    const u = await pool.query("SELECT * FROM users WHERE email = $1", [email]);
-    if (!q.rowCount) return res.status(401).json({ ok: false, error: "Credenciales incorrectas" });
+    if (u.rowCount === 0) return res.status(401).json({ ok: false, error: "Credenciales inválidas" });
 
-    const user = q.rows[0];
+    const user = u.rows[0];
+    const match = await bcrypt.compare(password, user.password_hash);
 
-    const ok = await bcrypt.compare(String(password), user.password_hash);
+    if (!match) return res.status(401).json({ ok: false, error: "Credenciales inválidas" });
-    if (!ok) return res.status(401).json({ ok: false, error: "Credenciales incorrectas" });
 
-    if (!user.is_verified) return res.status(403).json({ ok: false, error: "Cuenta no verificada por WhatsApp" });
+    if (!user.is_verified) {
+      return res.status(403).json({ ok: false, error: "Cuenta no verificada. Regístrate de nuevo para recibir el código." });
+    }
 
     const token = signToken(user);
     res.json({ ok: true, token });
+
   } catch (e) {
-    res.status(500).json({ ok: false, error: String(e?.message || e) });
+    res.status(500).json({ ok: false, error: "Error en login" });
   }
 });
 
-// =========================
+// 4. DATOS PROTEGIDOS (Dashboard)
-// SERVICES (multi-tenant)
-// =========================
 app.get("/services", authMiddleware, async (req, res) => {
-  try {
+    const q = await pool.query("SELECT * FROM services WHERE user_id = $1 ORDER BY created_at DESC", [req.user.sub]);
-    const userId = req.user.sub;
+    res.json({ ok: true, services: q.rows });
-    const q = await pool.query(
-      `select * from services where user_id=$1 order by created_at desc`,
-      [userId]
-    );
-    res.json({ ok: true, count: q.rowCount, services: q.rows });
-  } catch (e) {
-    res.status(500).json({ ok: false, error: String(e?.message || e) });
-  }
 });
 
-app.post("/services", authMiddleware, async (req, res) => {
-  try {
-    const userId = req.user.sub;
-    const body = req.body || {};
-    const title = body.title;
-    const clientName = body.clientName ?? body.client ?? "";
-
-    if (!title) return res.status(400).json({ ok: false, error: "Falta title" });
-
-    const q = await pool.query(
-      `insert into services (user_id, title, client_name, phone, address, notes)
-       values ($1,$2,$3,$4,$5,$6)
-       returning *`,
-      [
-        userId,
-        String(title).trim(),
-        clientName ? String(clientName).trim() : null,
-        body.phone ? String(body.phone).trim() : null,
-        body.address ? String(body.address).trim() : null,
-        body.notes ? String(body.notes).trim() : null
-      ]
-    );
-
-    res.status(201).json({ ok: true, service: q.rows[0] });
-  } catch (e) {
-    res.status(500).json({ ok: false, error: String(e?.message || e) });
-  }
-});
-
-// =========================
-// STATIC (HTML)
-// =========================
-app.use(express.static("public"));
-
 const port = process.env.PORT || 3000;
-app.listen(port, () => console.log(`🚀 API listening on :${port}`));
+app.listen(port, () => console.log(`🚀 Server en puerto ${port}`));