import express from "express";
import cors from "cors";
import bcrypt from "bcryptjs";
import jwt from "jsonwebtoken";
import pg from "pg";
import crypto from "crypto"; 

const { Pool } = pg;
const app = express();

app.use(cors());
app.use(express.json());

// VARIABLES DE ENTORNO
const {
  DATABASE_URL,
  JWT_SECRET,
  EVOLUTION_BASE_URL,
  EVOLUTION_API_KEY,
  EVOLUTION_INSTANCE, 
} = process.env;

// --- DIAGNÓSTICO DE INICIO ---
console.log("------------------------------------------------");
console.log("🚀 VERSIÓN COMPLETA - CON AUTOMATISMOS REALES"); 
console.log("------------------------------------------------");
if (!DATABASE_URL) console.error("❌ FALTA: DATABASE_URL");
if (!JWT_SECRET) console.error("❌ FALTA: JWT_SECRET");

if (!EVOLUTION_BASE_URL) console.error("⚠️ AVISO: Falta EVOLUTION_BASE_URL");
else console.log("✅ Evolution URL:", EVOLUTION_BASE_URL);

if (!EVOLUTION_INSTANCE) console.error("⚠️ AVISO: Falta EVOLUTION_INSTANCE");
else console.log("✅ Instancia Notificaciones:", EVOLUTION_INSTANCE);

console.log("------------------------------------------------");

if (!DATABASE_URL || !JWT_SECRET) process.exit(1);

const pool = new Pool({ connectionString: DATABASE_URL, ssl: false });

// ==========================================
// 💰 CONFIGURACIÓN DE PLANES (SAAS)
// ==========================================
const PLAN_LIMITS = {
    'free': { name: 'Básico Gratuito', whatsapp_enabled: false, templates_enabled: false, automation_enabled: false },
    'standard': { name: 'Estándar', whatsapp_enabled: true, templates_enabled: true, automation_enabled: false },
    'pro': { name: 'Profesional', whatsapp_enabled: true, templates_enabled: true, automation_enabled: true }
};

// ==========================================
// 🧠 AUTO-ACTUALIZACIÓN DB
// ==========================================
async function autoUpdateDB() {
  const client = await pool.connect();
  try {
    console.log("🔄 Verificando estructura DB...");

    await client.query(`
      -- USUARIOS
      CREATE TABLE IF NOT EXISTS users (
        id SERIAL PRIMARY KEY,
        full_name TEXT NOT NULL,
        phone TEXT NOT NULL,
        email TEXT NOT NULL,
        dni TEXT,
        address TEXT,
        password_hash TEXT NOT NULL,
        is_verified BOOLEAN DEFAULT FALSE,
        owner_id INT,
        role TEXT DEFAULT 'operario',
        company_slug TEXT UNIQUE,
        plan_tier TEXT DEFAULT 'free', 
        subscription_status TEXT DEFAULT 'active',
        paid_providers_count INT DEFAULT 0,
        zones JSONB DEFAULT '[]',
        status TEXT DEFAULT 'active',
        created_at TIMESTAMP DEFAULT NOW()
      );
      CREATE TABLE IF NOT EXISTS login_codes (
        id SERIAL PRIMARY KEY,
        user_id INT REFERENCES users(id) ON DELETE CASCADE,
        phone TEXT NOT NULL,
        code_hash TEXT NOT NULL,
        purpose TEXT DEFAULT 'register_verify',
        consumed_at TIMESTAMP,
        expires_at TIMESTAMP NOT NULL,
        created_at TIMESTAMP DEFAULT NOW()
      );

      -- CONFIGURACIÓN NEGOCIO
      CREATE TABLE IF NOT EXISTS guilds (
        id SERIAL PRIMARY KEY,
        owner_id INT REFERENCES users(id) ON DELETE CASCADE,
        name TEXT NOT NULL, 
        created_at TIMESTAMP DEFAULT NOW()
      );
      CREATE TABLE IF NOT EXISTS user_guilds (
        user_id INT REFERENCES users(id) ON DELETE CASCADE,
        guild_id INT REFERENCES guilds(id) ON DELETE CASCADE,
        PRIMARY KEY (user_id, guild_id)
      );
      CREATE TABLE IF NOT EXISTS companies (
        id SERIAL PRIMARY KEY,
        owner_id INT REFERENCES users(id) ON DELETE CASCADE,
        name TEXT NOT NULL,
        cif TEXT,
        email TEXT,
        phone TEXT,
        address TEXT,
        created_at TIMESTAMP DEFAULT NOW()
      );
      
      -- CLIENTES (CRM)
      CREATE TABLE IF NOT EXISTS clients (
        id SERIAL PRIMARY KEY,
        owner_id INT REFERENCES users(id) ON DELETE CASCADE,
        full_name TEXT NOT NULL,
        phone TEXT NOT NULL,
        email TEXT,
        addresses JSONB DEFAULT '[]',
        notes TEXT,
        created_at TIMESTAMP DEFAULT NOW()
      );

      -- ESTADOS Y PLANTILLAS
      CREATE TABLE IF NOT EXISTS service_statuses (
        id SERIAL PRIMARY KEY,
        owner_id INT REFERENCES users(id) ON DELETE CASCADE,
        name TEXT NOT NULL,
        color TEXT DEFAULT 'gray',
        is_default BOOLEAN DEFAULT FALSE,
        is_final BOOLEAN DEFAULT FALSE,
        created_at TIMESTAMP DEFAULT NOW()
      );
      CREATE TABLE IF NOT EXISTS message_templates (
        id SERIAL PRIMARY KEY,
        owner_id INT REFERENCES users(id) ON DELETE CASCADE,
        type TEXT NOT NULL,
        content TEXT,
        created_at TIMESTAMP DEFAULT NOW(),
        UNIQUE(owner_id, type)
      );

      -- ZONAS
      CREATE TABLE IF NOT EXISTS zones (
        id SERIAL PRIMARY KEY,
        name TEXT NOT NULL,
        owner_id INT, 
        created_at TIMESTAMP DEFAULT NOW()
      );
      CREATE TABLE IF NOT EXISTS user_zones (
        user_id INT REFERENCES users(id) ON DELETE CASCADE,
        zone_id INT REFERENCES zones(id) ON DELETE CASCADE,
        PRIMARY KEY (user_id, zone_id)
      );

      -- 🤖 ROBOTS / PROVEEDORES
      CREATE TABLE IF NOT EXISTS provider_credentials (
        id SERIAL PRIMARY KEY,
        owner_id INT REFERENCES users(id) ON DELETE CASCADE,
        provider TEXT NOT NULL, 
        username TEXT NOT NULL,
        password_hash TEXT NOT NULL,
        last_sync TIMESTAMP,
        status TEXT DEFAULT 'active',
        UNIQUE(owner_id, provider)
      );
      CREATE TABLE IF NOT EXISTS scraped_services (
        id SERIAL PRIMARY KEY,
        owner_id INT REFERENCES users(id) ON DELETE CASCADE,
        provider TEXT NOT NULL,
        service_ref TEXT NOT NULL,
        raw_data JSONB, 
        status TEXT DEFAULT 'pending',
        automation_status TEXT DEFAULT 'manual',
        created_at TIMESTAMP DEFAULT NOW(),
        UNIQUE(owner_id, provider, service_ref)
      );

      -- 🗺️ TABLA DE MAPEO DE VARIABLES
      CREATE TABLE IF NOT EXISTS variable_mappings (
        id SERIAL PRIMARY KEY,
        owner_id INT REFERENCES users(id) ON DELETE CASCADE,
        provider TEXT NOT NULL, 
        original_key TEXT NOT NULL, 
        target_key TEXT, 
        is_ignored BOOLEAN DEFAULT FALSE,
        created_at TIMESTAMP DEFAULT NOW(),
        UNIQUE(owner_id, provider, original_key)
      );

      -- SERVICIOS (PRINCIPAL)
      CREATE TABLE IF NOT EXISTS services (
        id SERIAL PRIMARY KEY,
        owner_id INT REFERENCES users(id) ON DELETE CASCADE,
        client_id INT REFERENCES clients(id) ON DELETE SET NULL,
        status_id INT REFERENCES service_statuses(id) ON DELETE SET NULL,
        guild_id INT REFERENCES guilds(id) ON DELETE SET NULL,
        assigned_to INT REFERENCES users(id) ON DELETE SET NULL,
        title TEXT,
        description TEXT,
        contact_phone TEXT,
        contact_name TEXT,
        address TEXT,
        email TEXT,
        scheduled_date DATE DEFAULT CURRENT_DATE,
        scheduled_time TIME DEFAULT CURRENT_TIME,
        duration_minutes INT DEFAULT 30,
        is_urgent BOOLEAN DEFAULT FALSE,
        is_company BOOLEAN DEFAULT FALSE,
        company_id INT REFERENCES companies(id) ON DELETE SET NULL,
        company_ref TEXT,
        internal_notes TEXT,
        client_notes TEXT,
        import_source TEXT, 
        provider_data JSONB DEFAULT '{}', 
        closed_at TIMESTAMP,
        created_at TIMESTAMP DEFAULT NOW()
      );
      CREATE TABLE IF NOT EXISTS service_logs (
        id SERIAL PRIMARY KEY,
        service_id INT REFERENCES services(id) ON DELETE CASCADE,
        user_id INT REFERENCES users(id) ON DELETE SET NULL,
        old_status_id INT REFERENCES service_statuses(id),
        new_status_id INT REFERENCES service_statuses(id),
        comment TEXT,
        created_at TIMESTAMP DEFAULT NOW()
      );

      -- TABLA PARA ASIGNACIÓN AUTOMÁTICA
      CREATE TABLE IF NOT EXISTS assignment_pings (
        id SERIAL PRIMARY KEY,
        scraped_id INT NOT NULL,
        user_id INT REFERENCES users(id) ON DELETE CASCADE,
        token TEXT UNIQUE NOT NULL,
        status TEXT DEFAULT 'pending', 
        expires_at TIMESTAMP NOT NULL,
        created_at TIMESTAMP DEFAULT NOW()
      );
    `);

    // PARCHE DE ACTUALIZACIÓN
    await client.query(`
      DO $$ BEGIN 
        -- AÑADIDO: Columna física de operario para el panel operativo
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='scraped_services' AND column_name='assigned_to') THEN 
            ALTER TABLE scraped_services ADD COLUMN assigned_to INT REFERENCES users(id); 
        END IF;

        -- ASEGURAR COLUMNA URGENTE EN SCRAPED
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='scraped_services' AND column_name='is_urgent') THEN 
            ALTER TABLE scraped_services ADD COLUMN is_urgent BOOLEAN DEFAULT FALSE; 
        END IF;

        -- AÑADIDO: Columna de palabras clave IA para los gremios
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='guilds' AND column_name='ia_keywords') THEN 
            ALTER TABLE guilds ADD COLUMN ia_keywords JSONB DEFAULT '[]'; 
        END IF;

        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='services' AND column_name='client_id') THEN ALTER TABLE services ADD COLUMN client_id INT REFERENCES clients(id) ON DELETE SET NULL; END IF;
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='services' AND column_name='status_id') THEN ALTER TABLE services ADD COLUMN status_id INT REFERENCES service_statuses(id) ON DELETE SET NULL; END IF;
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='services' AND column_name='contact_phone') THEN ALTER TABLE services ADD COLUMN contact_phone TEXT; END IF;
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='services' AND column_name='contact_name') THEN ALTER TABLE services ADD COLUMN contact_name TEXT; END IF;
        
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='users' AND column_name='plan_tier') THEN ALTER TABLE users ADD COLUMN plan_tier TEXT DEFAULT 'free'; END IF;
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='users' AND column_name='company_slug') THEN ALTER TABLE users ADD COLUMN company_slug TEXT UNIQUE; END IF;
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='users' AND column_name='zones') THEN ALTER TABLE users ADD COLUMN zones JSONB DEFAULT '[]'; END IF;
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='users' AND column_name='status') THEN ALTER TABLE users ADD COLUMN status TEXT DEFAULT 'active'; END IF;

        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='services' AND column_name='provider_data') THEN ALTER TABLE services ADD COLUMN provider_data JSONB DEFAULT '{}'; END IF;
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='services' AND column_name='import_source') THEN ALTER TABLE services ADD COLUMN import_source TEXT; END IF;

        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='scraped_services' AND column_name='automation_status') THEN ALTER TABLE scraped_services ADD COLUMN automation_status TEXT DEFAULT 'manual'; END IF;

        -- AÑADIDO: Token mágico para el Portal del Cliente
        IF NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_name='clients' AND column_name='portal_token') THEN 
            ALTER TABLE clients ADD COLUMN portal_token TEXT UNIQUE; 
            UPDATE clients SET portal_token = substr(md5(random()::text || id::text), 1, 12) WHERE portal_token IS NULL;
            ALTER TABLE clients ALTER COLUMN portal_token SET DEFAULT substr(md5(random()::text || clock_timestamp()::text), 1, 12);
        END IF;

        BEGIN ALTER TABLE users DROP CONSTRAINT IF EXISTS users_phone_key; EXCEPTION WHEN OTHERS THEN NULL; END;
        BEGIN ALTER TABLE users DROP CONSTRAINT IF EXISTS users_email_key; EXCEPTION WHEN OTHERS THEN NULL; END;
      END $$;
    `);

    console.log("✅ DB Sincronizada.");
  } catch (e) { console.error("❌ Error DB:", e); } finally { client.release(); }
}

// HELPERS
function normalizePhone(phone) { let p = String(phone || "").trim().replace(/\s+/g, "").replace(/-/g, ""); if (!p) return ""; if (!p.startsWith("+") && /^[6789]\d{8}/.test(p)) return "+34" + p; return p; }
function signToken(user) { const accountId = user.owner_id || user.id; return jwt.sign({ sub: user.id, email: user.email, phone: user.phone, role: user.role || 'operario', accountId }, JWT_SECRET, { expiresIn: "30d" }); }
function authMiddleware(req, res, next) { const h = req.headers.authorization || ""; const token = h.startsWith("Bearer ") ? h.slice(7) : ""; if (!token) return res.status(401).json({ ok: false, error: "No token" }); try { req.user = jwt.verify(token, JWT_SECRET); next(); } catch { return res.status(401).json({ ok: false, error: "Token inválido" }); } }
function genCode6() { return String(Math.floor(100000 + Math.random() * 900000)); }

// 🛡️ MIDDLEWARE DE PLANES (CORREGIDO)
async function requirePlan(req, res, next, feature) {
    try {
        // Quitamos subscription_status para que no dé error en BD actualizadas
        const q = await pool.query("SELECT plan_tier FROM users WHERE id=$1", [req.user.accountId]);
        
        // ⚠️ TRUCO TEMPORAL: Forzamos a que el sistema te lea como 'pro' para que puedas probar WhatsApp sin bloqueos
        const userPlan = 'pro'; // Cuando quieras restringir planes, cambia esto por: q.rows[0]?.plan_tier || 'free';
        
        const limits = PLAN_LIMITS[userPlan];
        
        if (!limits || !limits[feature]) {
            return res.status(403).json({ ok: false, error: `Función exclusiva del plan Profesional.` });
        }
        next();
    } catch (e) { 
        console.error("Error comprobando plan:", e);
        res.status(500).json({ ok: false, error: "Error interno verificando plan" }); 
    }
}

// --- WHATSAPP UTILS ---
async function sendWhatsAppCode(phone, code) {
    if (!EVOLUTION_BASE_URL || !EVOLUTION_API_KEY || !EVOLUTION_INSTANCE) { console.error("❌ Faltan datos WhatsApp"); return; }
    try {
        await fetch(`${EVOLUTION_BASE_URL.replace(/\/$/, "")}/message/sendText/${EVOLUTION_INSTANCE}`, {
            method: "POST", headers: { "Content-Type": "application/json", "apikey": EVOLUTION_API_KEY },
            body: JSON.stringify({ number: phone.replace("+", ""), text: `🔐 Código: *${code}*` })
        });
    } catch (e) { console.error("Error envío WA:", e.message); }
}

async function sendWhatsAppAuto(phone, text, instanceName, useDelay = true) { 
    if (!EVOLUTION_BASE_URL || !EVOLUTION_API_KEY || !instanceName) {
        console.error("❌ Faltan datos para enviar WhatsApp automático (Revisa URLs o instancia)");
        return;
    }
    
    try {
        console.log(`\n📲 Intentando enviar WA a ${phone} desde la instancia [${instanceName}] | Modo Lento: ${useDelay}...`);
        
        let payloadConEscribiendo;
        const typingTimeMs = Math.min(Math.max(text.length * 30, 1500), 8000);

        if(useDelay) {
            payloadConEscribiendo = {
                number: phone.replace("+", ""), 
                text: text,
                options: { delay: typingTimeMs, presence: "composing" }
            };
        } else {
            payloadConEscribiendo = { number: phone.replace("+", ""), text: text };
        }

        const res = await fetch(`${EVOLUTION_BASE_URL.replace(/\/$/, "")}/message/sendText/${instanceName}`, {
            method: "POST", 
            headers: { "Content-Type": "application/json", "apikey": EVOLUTION_API_KEY },
            body: JSON.stringify(payloadConEscribiendo)
        });

        if (!res.ok && useDelay) {
            const errCode = res.status;
            console.warn(`⚠️ Evolution rechazó el modo "Escribiendo" (Código ${errCode}). Activando Plan B (Modo seguro instantáneo)...`);
            
            const payloadSeguro = { number: phone.replace("+", ""), text: text };
            const res2 = await fetch(`${EVOLUTION_BASE_URL.replace(/\/$/, "")}/message/sendText/${instanceName}`, {
                method: "POST", 
                headers: { "Content-Type": "application/json", "apikey": EVOLUTION_API_KEY },
                body: JSON.stringify(payloadSeguro)
            });

            if (!res2.ok) console.error("❌ Error definitivo en Evolution API:", await res2.text());
            else console.log("✅ WA enviado correctamente (Plan B Seguro).");
        } else if (res.ok) {
            console.log(`✅ WA enviado con éxito (${useDelay ? 'Modo Humano' : 'Modo Rápido'}).`);
        } else {
            console.error("❌ Error en Evolution API:", await res.text());
        }
    } catch (e) { 
        console.error("❌ Error crítico en función WA:", e.message); 
    }
}

async function ensureInstance(instanceName) {
    if (!EVOLUTION_BASE_URL || !EVOLUTION_API_KEY) throw new Error("Faltan variables EVOLUTION");
    const baseUrl = EVOLUTION_BASE_URL.replace(/\/$/, "");
    const headers = { "Content-Type": "application/json", "apikey": EVOLUTION_API_KEY.trim() };
    const checkRes = await fetch(`${baseUrl}/instance/connectionState/${instanceName}`, { headers });
    if (checkRes.status === 404) {
        await fetch(`${baseUrl}/instance/create`, {
            method: 'POST', headers,
            body: JSON.stringify({ instanceName: instanceName, qrcode: true, integration: "WHATSAPP-BAILEYS" })
        });
    }
    return { baseUrl, headers };
}

// ==========================================
// 🚀 RUTAS PÚBLICAS (MÓVIL OPERARIO)
// ==========================================

app.get("/public/assignment/:token", async (req, res) => {
    try {
        const { token } = req.params;
        
        // Comprobación MODO BLINDADO (Extrae todo, exista o no)
        const q = await pool.query(`
            SELECT ap.*, s.raw_data, u.full_name as worker_name, CURRENT_TIMESTAMP as db_now
            FROM assignment_pings ap
            JOIN scraped_services s ON ap.scraped_id = s.id
            JOIN users u ON ap.user_id = u.id
            WHERE ap.token = $1
        `, [token]);
        
        if (q.rowCount === 0) return res.status(404).json({ ok: false, error: "Enlace caducado o inexistente" });

        const data = q.rows[0];
        const isExpired = data.status !== 'pending' || new Date(data.expires_at) <= new Date(data.db_now);

        if (isExpired) {
            return res.status(404).json({ ok: false, error: "Este enlace ha caducado o ha sido reasignado." });
        }

        res.json({ 
            ok: true, 
            service: data.raw_data, 
            worker: data.worker_name,
            debug: { hora_limite_bd: data.expires_at, hora_actual_bd: data.db_now }
        });
    } catch (e) { res.status(500).json({ ok: false }); }
});

app.post("/public/assignment/respond", async (req, res) => {
    const client = await pool.connect();
    try {
        const { token, action } = req.body;
        await client.query('BEGIN');

        // LEEMOS EXACTAMENTE IGUAL QUE EN LA RUTA GET, BLOQUEANDO ERRORES FANTASMA
        const q = await client.query(
            "SELECT *, CURRENT_TIMESTAMP as db_now FROM assignment_pings WHERE token = $1 FOR UPDATE", 
            [token]
        );
        
        if (q.rowCount === 0) throw new Error("Enlace no válido o inexistente");

        const ping = q.rows[0];
        const isExpired = ping.status !== 'pending' || new Date(ping.expires_at) <= new Date(ping.db_now);

        if (isExpired) throw new Error("El tiempo se agotó justo antes de aceptar.");

        if (action === 'accept') {
            await client.query("UPDATE assignment_pings SET status = 'accepted' WHERE id = $1", [ping.id]);

            // AÑADIDO: Guardar ID de operario (Forzamos tipo INT para evitar errores de JSONB)
            await client.query(`
                UPDATE scraped_services 
                SET status = 'imported', 
                    automation_status = 'completed',
                    assigned_to = $1,
                    raw_data = raw_data || jsonb_build_object('assigned_to', $1::int)
                WHERE id = $2
            `, [ping.user_id, ping.scraped_id]);

        } else {
            await client.query("UPDATE assignment_pings SET status = 'rejected', expires_at = CURRENT_TIMESTAMP WHERE id = $1", [ping.id]);
        }

        await client.query('COMMIT');
        res.json({ ok: true });
    } catch (e) { 
        await client.query('ROLLBACK'); 
        console.error("ERROR AL RESPONDER TURNO:", e.message); // Por si acaso hay otro error
        res.status(400).json({ ok: false, error: e.message }); 
    } finally { 
        client.release(); 
    }
});

// ==========================================
// 🌐 RUTAS PÚBLICAS: PORTAL DEL CLIENTE (SIN FRICCIÓN)
// ==========================================

app.get("/public/portal/:token", async (req, res) => {
    try {
        const { token } = req.params;
        // 1. Identificamos al cliente
        const clientQ = await pool.query(`
            SELECT c.id, c.full_name, c.phone, c.addresses, c.owner_id, 
                   u.company_slug, u.full_name as company_name
            FROM clients c
            JOIN users u ON c.owner_id = u.id
            WHERE c.portal_token = $1
        `, [token]);

        if (clientQ.rowCount === 0) return res.status(404).json({ ok: false, error: "Enlace no válido o caducado" });
        const clientData = clientQ.rows[0];

        // 2. Buscamos los expedientes en el Panel Operativo (scraped_services)
        const phoneRaw = clientData.phone.replace('+34', '');
        const scrapedQ = await pool.query(`
            SELECT id, service_ref as title, raw_data->>'Descripción' as description, 
                   raw_data->>'scheduled_date' as scheduled_date, 
                   raw_data->>'scheduled_time' as scheduled_time, 
                   created_at, 
                   raw_data->>'status_operativo' as estado_operativo,
                   is_urgent,
                   (SELECT full_name FROM users WHERE id = scraped_services.assigned_to) as assigned_worker
            FROM scraped_services
            WHERE owner_id = $1 
            AND (raw_data->>'Teléfono' ILIKE $2 OR raw_data->>'TELEFONO' ILIKE $2 OR raw_data->>'TELEFONOS' ILIKE $2)
            ORDER BY created_at DESC
        `, [clientData.owner_id, `%${phoneRaw}%`]);

        // Adaptamos el formato visual de los estados
        const services = scrapedQ.rows.map(s => {
            let statusName = "Pendiente de Asignar"; let color = "gray";
            if (s.estado_operativo === 'asignado_operario') { statusName = "Asignado a Técnico"; color = "blue"; }
            if (s.estado_operativo === 'citado') { statusName = "Visita Agendada"; color = "emerald"; }
            if (s.estado_operativo === 'de_camino') { statusName = "Técnico de Camino"; color = "indigo"; }
            if (s.estado_operativo === 'trabajando') { statusName = "En Reparación"; color = "amber"; }
            if (s.estado_operativo === 'incidencia') { statusName = "Pausado / Incidencia"; color = "red"; }
            if (s.estado_operativo === 'terminado') { statusName = "Terminado"; color = "purple"; }

            return {
                id: s.id,
                title: (s.is_urgent ? "🚨 URGENTE: " : "") + "Expediente #" + s.title,
                description: s.description || "Avería reportada.",
                scheduled_date: s.scheduled_date,
                scheduled_time: s.scheduled_time,
                created_at: s.created_at,
                status_name: statusName,
                status_color: color,
                assigned_worker: s.assigned_worker || "Pendiente"
            };
        });

        res.json({
            ok: true,
            client: { name: clientData.full_name, phone: clientData.phone, addresses: clientData.addresses },
            company: { name: clientData.company_name, slug: clientData.company_slug },
            services: services
        });
    } catch (e) { res.status(500).json({ ok: false, error: "Error de servidor" }); }
});

app.post("/public/portal/:token/request", async (req, res) => {
    const client = await pool.connect();
    try {
        const { token } = req.params;
        const { description, address } = req.body;
        await client.query('BEGIN');
        const clientQ = await client.query("SELECT id, owner_id, full_name, phone FROM clients WHERE portal_token = $1", [token]);
        if (clientQ.rowCount === 0) throw new Error("Token inválido");
        const cData = clientQ.rows[0];
        const statusQ = await client.query("SELECT id FROM service_statuses WHERE owner_id=$1 AND is_default=TRUE LIMIT 1", [cData.owner_id]);
        const statusId = statusQ.rows[0]?.id;
        const insertSvc = await client.query(`
            INSERT INTO services (owner_id, client_id, status_id, contact_name, contact_phone, address, description, title, import_source) 
            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'PORTAL_CLIENTE') RETURNING id
        `, [cData.owner_id, cData.id, statusId, cData.full_name, cData.phone, address, description, "Nuevo Aviso desde App Cliente"]);
        await client.query("INSERT INTO service_logs (service_id, new_status_id, comment) VALUES ($1, $2, 'Aviso reportado por el cliente desde su portal')", [insertSvc.rows[0].id, statusId]);
        await client.query('COMMIT');
        res.json({ ok: true, message: "Aviso recibido", service_id: insertSvc.rows[0].id });
    } catch (e) {
        await client.query('ROLLBACK');
        res.status(500).json({ ok: false, error: e.message });
    } finally { client.release(); }
});

// ==========================================
// 🔐 RUTAS AUTH Y PRIVADAS ( CRM ORIGINAL )
// ==========================================

app.post("/auth/register", async (req, res) => { const client = await pool.connect(); try { const { fullName, phone, address, dni, email, password } = req.body; const p = normalizePhone(phone); if (!fullName || !p || !email || !password) return res.status(400).json({ ok: false }); const passwordHash = await bcrypt.hash(password, 10); await client.query('BEGIN'); const insert = await client.query("INSERT INTO users (full_name, phone, address, dni, email, password_hash, role, owner_id, plan_tier) VALUES ($1, $2, $3, $4, $5, $6, 'admin', NULL, 'free') RETURNING id", [fullName, p, address, dni, email, passwordHash]); const userId = insert.rows[0].id; const code = genCode6(); const codeHash = await bcrypt.hash(code, 10); const expiresAt = new Date(Date.now() + 10 * 60 * 1000); await client.query("INSERT INTO login_codes (user_id, phone, code_hash, expires_at) VALUES ($1, $2, $3, CURRENT_TIMESTAMP + INTERVAL '10 minutes')", [userId, p, codeHash]); 
    await sendWhatsAppCode(p, code); 
    await client.query('COMMIT'); res.json({ ok: true, phone: p }); } catch (e) { await client.query('ROLLBACK'); res.status(500).json({ ok: false }); } finally { client.release(); } });
app.post("/auth/verify", async (req, res) => { try { const { phone, code } = req.body; const p = normalizePhone(phone); const q = await pool.query(`SELECT lc.*, u.id as uid, u.email, u.role, u.owner_id FROM login_codes lc JOIN users u ON lc.user_id = u.id WHERE lc.phone=$1 AND lc.consumed_at IS NULL AND lc.expires_at > CURRENT_TIMESTAMP ORDER BY lc.created_at DESC LIMIT 1`, [p]); if (q.rowCount === 0) return res.status(400).json({ ok: false }); const row = q.rows[0]; if (!(await bcrypt.compare(String(code), row.code_hash))) return res.status(400).json({ ok: false }); await pool.query("UPDATE login_codes SET consumed_at=CURRENT_TIMESTAMP WHERE id=$1", [row.id]); await pool.query("UPDATE users SET is_verified=TRUE WHERE id=$1", [row.uid]); res.json({ ok: true, token: signToken({ id: row.uid, email: row.email, phone: p, role: row.role, owner_id: row.owner_id }) }); } catch (e) { res.status(500).json({ ok: false }); } });
app.post("/auth/login", async (req, res) => { try { const { email, password } = req.body; const q = await pool.query("SELECT * FROM users WHERE email=$1", [email]); if (q.rowCount === 0) return res.status(401).json({ ok: false }); let user = null; for (const u of q.rows) { if (await bcrypt.compare(password, u.password_hash)) { user = u; break; } } if (!user) return res.status(401).json({ ok: false }); res.json({ ok: true, token: signToken(user) }); } catch(e) { res.status(500).json({ ok: false }); } });

app.get("/whatsapp/status", authMiddleware, (req, res, next) => requirePlan(req, res, next, 'whatsapp_enabled'), async (req, res) => {
    try {
        const instanceName = `cliente_${req.user.accountId}`;
        const { baseUrl, headers } = await ensureInstance(instanceName);
        const stateRes = await fetch(`${baseUrl}/instance/connectionState/${instanceName}`, { headers });
        const stateData = await stateRes.json();
        const state = stateData.instance?.state || "close";
        let qr = null;
        if (state !== "open") {
            const qrRes = await fetch(`${baseUrl}/instance/connect/${instanceName}`, { headers });
            const qrData = await qrRes.json();
            qr = qrData.code || qrData.base64;
        }
        res.json({ ok: true, state, qr, instanceName });
    } catch (e) { res.status(500).json({ ok: false, error: e.message }); }
});

app.get("/providers/credentials", authMiddleware, async (req, res) => {
    try {
        const q = await pool.query("SELECT provider, username, last_sync, status FROM provider_credentials WHERE owner_id=$1", [req.user.accountId]);
        res.json({ ok: true, credentials: q.rows });
    } catch (e) { res.status(500).json({ ok: false }); }
});

app.post("/providers/credentials", authMiddleware, async (req, res) => {
    try {
        const { provider, username, password } = req.body;
        const passwordSafe = Buffer.from(password).toString('base64'); 
        await pool.query(`
            INSERT INTO provider_credentials (owner_id, provider, username, password_hash)
            VALUES ($1, $2, $3, $4)
            ON CONFLICT (owner_id, provider) DO UPDATE SET username = EXCLUDED.username, password_hash = EXCLUDED.password_hash, status = 'active'
        `, [req.user.accountId, provider, username, passwordSafe]);
        res.json({ ok: true });
    } catch (e) { res.status(500).json({ ok: false }); }
});

app.get("/providers/scraped", authMiddleware, async (req, res) => {
    try {
        // Pedimos a Postgres que calcule los SEGUNDOS que faltan y enviamos la cuenta exacta 
        const q = await pool.query(`
            SELECT 
                s.*, 
                ap.token as active_token,
                EXTRACT(EPOCH FROM (ap.expires_at - CURRENT_TIMESTAMP)) as seconds_left,
                u.full_name as current_worker_name,
                (SELECT json_agg(json_build_object('name', u2.full_name, 'phone', u2.phone)) 
                 FROM assignment_pings ap2 
                 JOIN users u2 ON ap2.user_id = u2.id 
                 WHERE ap2.scraped_id = s.id AND ap2.status IN ('expired', 'rejected')) as attempted_workers_data
            FROM scraped_services s
            LEFT JOIN assignment_pings ap ON s.id = ap.scraped_id AND ap.status = 'pending'
            LEFT JOIN users u ON ap.user_id = u.id
            WHERE s.owner_id = $1 
            ORDER BY s.created_at DESC
        `, [req.user.accountId]);
        
        const services = q.rows.map(row => {
            if (row.seconds_left && row.seconds_left > 0) {
                row.token_expires_at = new Date(Date.now() + (row.seconds_left * 1000));
            } else if (row.seconds_left <= 0) {
                row.token_expires_at = new Date(Date.now() - 1000); 
            }
            delete row.seconds_left;
            return row;
        });

        res.json({ ok: true, services });
    } catch (e) { 
        res.status(500).json({ ok: false }); 
    }
});

app.post("/providers/automate/:id", authMiddleware, async (req, res) => {
    try {
        const { id } = req.params;
        const { guild_id, cp, useDelay } = req.body;

        if (!guild_id || !cp) return res.status(400).json({ ok: false, error: "Faltan datos (Gremio o CP)" });

        const serviceQ = await pool.query("SELECT raw_data, provider FROM scraped_services WHERE id = $1", [id]);
        if (serviceQ.rowCount === 0) return res.status(404).json({ ok: false, error: "Expediente no encontrado" });
        
        const raw = serviceQ.rows[0].raw_data;
        const nombreCliente = raw["Nombre Cliente"] || raw["CLIENTE"] || "Cliente";
        const poblacion = raw["Población"] || raw["POBLACION-PROVINCIA"] || "---";
        const gremioNombre = raw["Gremio"] || "Servicio General";
        
        const direccionCompleta = raw["Dirección"] || raw["DOMICILIO"] || "";
        const direccionLimpia = direccionCompleta.split(/[0-9]/)[0].trim();

        const workersQ = await pool.query(`
            SELECT u.id, u.full_name, u.phone 
            FROM users u
            JOIN user_guilds ug ON u.id = ug.user_id
            WHERE u.owner_id = $1 AND u.role = 'operario' AND u.status = 'active'
            AND ug.guild_id = $2 AND u.zones::jsonb @> $3::jsonb
        `, [req.user.accountId, guild_id, JSON.stringify([{ cps: cp.toString() }])]);

        if (workersQ.rowCount === 0) return res.status(404).json({ ok: false, error: "No hay operarios disponibles" });

        await pool.query("UPDATE scraped_services SET automation_status = 'in_progress' WHERE id = $1", [id]);
        
        const worker = workersQ.rows[Math.floor(Math.random() * workersQ.rows.length)];
        const token = crypto.randomBytes(16).toString('hex');

        await pool.query(`
            INSERT INTO assignment_pings (scraped_id, user_id, token, expires_at) 
            VALUES ($1, $2, $3, CURRENT_TIMESTAMP + INTERVAL '5 minutes')
        `, [id, worker.id, token]);

        // CÁLCULO DE HORA 100% FIABLE: Se lo pedimos a Node forzando a España
        // Así siempre saldrá "0:40" en lugar de "23:40" en el texto de WhatsApp
        const horaCaducidad = new Date(Date.now() + 5 * 60 * 1000).toLocaleTimeString('es-ES', { 
            hour: '2-digit', 
            minute: '2-digit',
            timeZone: 'Europe/Madrid' 
        });
        
        const link = `https://web.integrarepara.es/aceptar.html?t=${token}`;
        const mensaje = `🛠️ *NUEVO SERVICIO ASIGNADO A TI*
        
👤 *Operario:* ${worker.full_name}
📋 *Gremio:* ${gremioNombre}

*DATOS DEL CLIENTE:*
👤 *Nombre:* ${nombreCliente}
📍 *Zona:* ${direccionLimpia}
🏙️ *Población:* ${poblacion} (CP: ${cp})

⚠️ *ATENCIÓN:* Tienes hasta las *${horaCaducidad}* para revisar los datos completos y ACEPTAR el servicio en el siguiente enlace:

🔗 ${link}`;

        // SAAS: INSTANCIA DE CLIENTE ESPECÍFICA SIN AWAIT PARA NO BLOQUEAR
        const instanceName = `cliente_${req.user.accountId}`;
        sendWhatsAppAuto(worker.phone, mensaje, instanceName, useDelay).catch(console.error);

        res.json({ ok: true, message: "Automatismo iniciado con " + worker.full_name });
    } catch (e) { 
        console.error("Error Automate:", e.message);
        res.status(500).json({ ok: false, error: e.message }); 
    }
});

// AÑADIDO: CAPTURA COMPLETA DE DATOS (...EXTRA)
app.post("/providers/import/:id", authMiddleware, async (req, res) => {
    const client = await pool.connect();
    try {
        const scrapedId = req.params.id;
        const { name, phone, address, cp, description, guild_id, assigned_to, internal_notes, client_notes, is_urgent, ...extra } = req.body;
        
        await client.query('BEGIN');
        const scrapedQ = await client.query("SELECT * FROM scraped_services WHERE id=$1 AND owner_id=$2", [scrapedId, req.user.accountId]);
        if (scrapedQ.rowCount === 0) return res.status(404).json({ ok: false });
        
        const raw = scrapedQ.rows[0].raw_data;
        const provider = scrapedQ.rows[0].provider;
        const ref = scrapedQ.rows[0].service_ref;
        
        const phoneClean = normalizePhone(phone);
        let clientId = null;
        if (phoneClean) {
            const cCheck = await client.query("SELECT id FROM clients WHERE phone=$1 AND owner_id=$2", [phoneClean, req.user.accountId]);
            if (cCheck.rowCount > 0) clientId = cCheck.rows[0].id;
        }
        if (!clientId) {
            const newC = await client.query("INSERT INTO clients (owner_id, full_name, phone, addresses) VALUES ($1, $2, $3, $4) RETURNING id", [req.user.accountId, name, phoneClean, JSON.stringify([address])]);
            clientId = newC.rows[0].id;
        }
        
        const statusQ = await client.query("SELECT id FROM service_statuses WHERE owner_id=$1 AND is_default=TRUE LIMIT 1", [req.user.accountId]);
        const finalStatusId = statusQ.rows[0]?.id;

        // Fusión total: datos originales del scraper + todo lo recibido en el body
        const fullProviderData = { ...raw, ...extra, "Nombre Cliente": name, "Teléfono": phone, "Dirección": address, "Código Postal": cp, "Descripción": description };

        const insertSvc = await client.query(`
            INSERT INTO services 
            (owner_id, client_id, status_id, company_ref, title, description, address, contact_phone, contact_name, is_company, import_source, provider_data, guild_id, assigned_to, internal_notes, client_notes, is_urgent) 
            VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17) 
            RETURNING id`, 
            [req.user.accountId, clientId, finalStatusId, ref, `${provider.toUpperCase()} - ${ref}`, description, address, phoneClean, name, true, provider, JSON.stringify(fullProviderData), guild_id || null, assigned_to || null, internal_notes, client_notes, is_urgent]
        );
        
        await client.query("UPDATE scraped_services SET status='imported' WHERE id=$1", [scrapedId]);
        await client.query('COMMIT');
        res.json({ ok: true, serviceId: insertSvc.rows[0].id, assigned: !!assigned_to });
    } catch (e) { 
        await client.query('ROLLBACK'); 
        res.status(500).json({ ok: false }); 
    } finally { client.release(); }
});

// AÑADIDO: CAPTURA COMPLETA DE DATOS (...EXTRA)
app.put('/providers/scraped/:id', authMiddleware, async (req, res) => {
    const { id } = req.params;
    const { automation_status, status, name, phone, address, cp, description, guild_id, assigned_to, assigned_to_name, internal_notes, client_notes, is_urgent, ...extra } = req.body;
    
    try {
        if (automation_status) {
            await pool.query(`UPDATE scraped_services SET automation_status = $1 WHERE id = $2 AND owner_id = $3`, [automation_status, id, req.user.accountId]);
            return res.json({ ok: true });
        }

        if (status === 'archived') {
            await pool.query(`UPDATE scraped_services SET status = 'archived', automation_status = 'manual' WHERE id = $2 AND owner_id = $3`, [id, req.user.accountId]);
            return res.json({ ok: true });
        }

        const current = await pool.query('SELECT raw_data FROM scraped_services WHERE id = $1 AND owner_id = $2', [id, req.user.accountId]);
        if (current.rows.length === 0) return res.status(404).json({ error: 'No encontrado' });
        
        // Fusión total: conservamos los extra para no perder información
        const updatedRawData = { 
            ...current.rows[0].raw_data,
            ...extra,
            "Nombre Cliente": name || current.rows[0].raw_data["Nombre Cliente"], 
            "Teléfono": phone || current.rows[0].raw_data["Teléfono"], 
            "Dirección": address || current.rows[0].raw_data["Dirección"],
            "Código Postal": cp || current.rows[0].raw_data["Código Postal"],
            "Descripción": description || current.rows[0].raw_data["Descripción"],
            "guild_id": guild_id,
            "assigned_to": assigned_to,
            "assigned_to_name": assigned_to_name,
            "internal_notes": internal_notes,
            "client_notes": client_notes,
            "Urgente": is_urgent ? "Sí" : "No"
        };

        // ====== CORRECCIÓN AQUÍ: SINCRONIZACIÓN COLUMNA IS_URGENT ======
        await pool.query(
            `UPDATE scraped_services 
             SET raw_data = $1, 
                 status = 'pending',
                 is_urgent = $2
             WHERE id = $3 AND owner_id = $4`, 
            [JSON.stringify(updatedRawData), is_urgent || false, id, req.user.accountId]
        );
        res.json({ ok: true });
    } catch (error) { res.status(500).json({ error: 'Error' }); }
});

app.get("/discovery/keys/:provider", authMiddleware, async (req, res) => {
    try {
        const { provider } = req.params;
        const rawServices = await pool.query("SELECT raw_data FROM scraped_services WHERE owner_id=$1 AND provider=$2 ORDER BY id DESC LIMIT 1", [req.user.accountId, provider]);
        const mappings = await pool.query("SELECT original_key, target_key, is_ignored FROM variable_mappings WHERE owner_id=$1 AND provider=$2", [req.user.accountId, provider]);
        const mapDict = {}; mappings.rows.forEach(m => { mapDict[m.original_key] = m; });
        const discoverySet = new Set(); const samples = {};
        rawServices.rows.forEach(row => { const data = row.raw_data; if (data && typeof data === 'object') { Object.keys(data).forEach(k => { discoverySet.add(k); if (!samples[k]) samples[k] = data[k]; }); } });
        const result = Array.from(discoverySet).map(key => ({ original: key, sample: samples[key] || "(Vacío)", mappedTo: mapDict[key]?.target_key || "", ignored: mapDict[key]?.is_ignored || false })).sort((a, b) => a.original.localeCompare(b.original));
        res.json({ ok: true, keys: result });
    } catch (e) { res.status(500).json({ ok: false }); }
});

// AÑADIDO: Ruta para el Panel Operativo (Muestra TODOS los activos, incluidos los de Proveedores)
app.get("/services/active", authMiddleware, async (req, res) => {
    try {
        const q = await pool.query(`
            SELECT 
                s.*, 
                u.full_name as assigned_name,
                CASE 
                    WHEN s.assigned_to IS NULL THEN 'sin_asignar'
                    WHEN (s.raw_data->>'scheduled_date') IS NULL OR (s.raw_data->>'scheduled_date') = '' THEN 'asignado_operario'
                    ELSE 'citado'
                END as estado_operativo
            FROM scraped_services s
            LEFT JOIN users u ON s.assigned_to = u.id
            WHERE s.owner_id = $1 
            AND s.status != 'archived'
            ORDER BY s.created_at DESC
        `, [req.user.accountId]);
        res.json({ ok: true, services: q.rows });
    } catch (e) { res.status(500).json({ ok: false }); }
});

// AÑADIDO: Ruta para fijar la cita o el estado operativo (CORREGIDA Y BLINDADA)
app.put("/services/set-appointment/:id", authMiddleware, async (req, res) => {
    try {
        const { id } = req.params;
        const { date, time, status_operativo, ...extra } = req.body;
        
        // 1. Extraemos los datos actuales de forma segura
        const current = await pool.query('SELECT raw_data FROM scraped_services WHERE id = $1 AND owner_id = $2', [id, req.user.accountId]);
        if (current.rowCount === 0) return res.status(404).json({ ok: false, error: 'No encontrado' });
        
        // 2. Fusionamos con JavaScript (100% a prueba de fallos y vacíos)
        const updatedRawData = { 
            ...current.rows[0].raw_data, 
            ...extra, 
            "scheduled_date": date || "", 
            "scheduled_time": time || "", 
            "status_operativo": status_operativo || "citado" 
        };

        // 3. Guardamos el JSON completo de vuelta
        await pool.query('UPDATE scraped_services SET raw_data = $1 WHERE id = $2 AND owner_id = $3', [JSON.stringify(updatedRawData), id, req.user.accountId]);
        
        res.json({ ok: true });
    } catch (e) { 
        console.error("Error agendando cita:", e); 
        res.status(500).json({ ok: false }); 
    }
});

// AÑADIDO: Ruta para alta de expedientes manuales (Cola o Directo)
app.post("/services/manual-high", authMiddleware, async (req, res) => {
    try {
        const { phone, name, address, description, guild_id, assigned_to, mode } = req.body;
        const serviceRef = "MAN-" + Date.now().toString().slice(-6);
        const rawData = { "Nombre Cliente": name, "Teléfono": phone, "Dirección": address, "Descripción": description, "guild_id": guild_id };
        await pool.query(`
            INSERT INTO scraped_services (owner_id, provider, service_ref, raw_data, status, automation_status, assigned_to)
            VALUES ($1, 'MANUAL', $2, $3, 'pending', $4, $5)
        `, [req.user.accountId, serviceRef, JSON.stringify(rawData), mode === 'auto' ? 'manual' : 'completed', mode === 'manual' ? assigned_to : null]);
        res.json({ ok: true });
    } catch (e) { res.status(500).json({ ok: false }); }
});


app.get("/discovery/mappings", authMiddleware, async (req, res) => {
    try {
        const q = await pool.query("SELECT provider, original_key, target_key FROM variable_mappings WHERE owner_id = $1", [req.user.accountId]);
        res.json(q.rows); 
    } catch (e) { res.status(500).json({ ok: false }); }
});

app.post("/discovery/save", authMiddleware, async (req, res) => {
    const client = await pool.connect();
    try {
        const { provider, mappings } = req.body; 
        await client.query('BEGIN');
        for (const m of mappings) {
            await client.query(`INSERT INTO variable_mappings (owner_id, provider, original_key, target_key, is_ignored) VALUES ($1, $2, $3, $4, $5) ON CONFLICT (owner_id, provider, original_key) DO UPDATE SET target_key = EXCLUDED.target_key, is_ignored = EXCLUDED.is_ignored`, [req.user.accountId, provider, m.original, m.target, m.ignored]);
        }
        await client.query('COMMIT');
        res.json({ ok: true });
    } catch (e) { await client.query('ROLLBACK'); res.status(500).json({ ok: false }); } finally { client.release(); }
});

// AÑADIDO: Asegura que el cliente exista. Si no existe, lo crea y le asigna un token.
app.post("/clients/ensure", authMiddleware, async (req, res) => {
    try {
        const { phone, name, address } = req.body;
        const p = normalizePhone(phone);
        if(!p) return res.status(400).json({ok: false, error: "Sin teléfono"});
        
        // 1. Buscamos si ya existe
        const q = await pool.query("SELECT * FROM clients WHERE phone=$1 AND owner_id=$2 LIMIT 1", [p, req.user.accountId]);
        if (q.rowCount > 0) return res.json({ ok: true, client: q.rows[0] });

        // 2. Si no existe, lo creamos al vuelo en la agenda para que se genere su portal_token
        const insert = await pool.query(
            "INSERT INTO clients (owner_id, full_name, phone, addresses) VALUES ($1, $2, $3, $4) RETURNING *", 
            [req.user.accountId, name || 'Asegurado', p, JSON.stringify(address ? [address] : [])]
        );
        res.json({ ok: true, client: insert.rows[0] });
    } catch (e) { res.status(500).json({ ok: false }); }
});

app.get("/clients", authMiddleware, async (req, res) => {
    try {
        const { search } = req.query;
        let query = `SELECT c.*, c.portal_token, (SELECT COUNT(*) FROM services s WHERE s.client_id = c.id) as service_count FROM clients c WHERE c.owner_id = $1`;
        const params = [req.user.accountId];
        if (search) { query += ` AND (c.full_name ILIKE $2 OR c.phone ILIKE $2)`; params.push(`%${search}%`); }
        query += ` ORDER BY c.created_at DESC LIMIT 50`;
        const q = await pool.query(query, params);
        res.json({ ok: true, clients: q.rows });
    } catch (e) { res.status(500).json({ ok: false }); }
});

app.get("/clients/:id/details", authMiddleware, async (req, res) => {
    try {
        const clientId = req.params.id;
        const clientQ = await pool.query("SELECT id, full_name, phone, addresses, email, notes, portal_token, created_at FROM clients WHERE id=$1 AND owner_id=$2", [clientId, req.user.accountId]);
        if (clientQ.rowCount === 0) return res.status(404).json({ ok: false });
        const servicesQ = await pool.query(`SELECT s.*, st.name as status_name, st.color as status_color, u.full_name as assigned_name FROM services s LEFT JOIN service_statuses st ON s.status_id = st.id LEFT JOIN users u ON s.assigned_to = u.id WHERE s.client_id = $1 ORDER BY s.created_at DESC`, [clientId]);
        res.json({ ok: true, client: clientQ.rows[0], services: servicesQ.rows });
    } catch (e) { res.status(500).json({ ok: false }); }
});

app.post("/clients", authMiddleware, async (req, res) => {
    try {
        const { full_name, phone, email, address, notes } = req.body;
        const p = normalizePhone(phone);
        const q = await pool.query("INSERT INTO clients (owner_id, full_name, phone, email, addresses, notes) VALUES ($1, $2, $3, $4, $5, $6) RETURNING id", [req.user.accountId, full_name, p, email, JSON.stringify([address]), notes]);
        res.json({ ok: true, id: q.rows[0].id });
    } catch (e) { res.status(500).json({ ok: false }); }
});

app.put("/clients/:id", authMiddleware, async (req, res) => {
    try {
        const { full_name, email, notes, addresses } = req.body;
        await pool.query("UPDATE clients SET full_name=$1, email=$2, notes=$3, addresses=$4 WHERE id=$5 AND owner_id=$6", [full_name, email, notes, JSON.stringify(addresses), req.params.id, req.user.accountId]);
        res.json({ ok: true });
    } catch (e) { res.status(500).json({ ok: false }); }
});

app.get("/statuses", authMiddleware, async (req, res) => { try { let q = await pool.query("SELECT * FROM service_statuses WHERE owner_id=$1 ORDER BY id ASC", [req.user.accountId]); if (q.rowCount === 0) { const defaults = [{name:'Pendiente',c:'gray',d:true,f:false},{name:'En Proceso',c:'blue',d:false,f:false},{name:'Terminado',c:'green',d:false,f:true},{name:'Cancelado',c:'red',d:false,f:true}]; for (const s of defaults) await pool.query("INSERT INTO service_statuses (owner_id,name,color,is_default,is_final) VALUES ($1,$2,$3,$4,$5)", [req.user.accountId,s.name,s.c,s.d,s.f]); q = await pool.query("SELECT * FROM service_statuses WHERE owner_id=$1 ORDER BY id ASC", [req.user.accountId]); } res.json({ ok: true, statuses: q.rows }); } catch (e) { res.status(500).json({ ok: false }); } });
app.post("/statuses", authMiddleware, async (req, res) => { try { const { name, color } = req.body; await pool.query("INSERT INTO service_statuses (owner_id, name, color) VALUES ($1, $2, $3)", [req.user.accountId, name, color || 'gray']); res.json({ ok: true }); } catch(e) { res.status(500).json({ ok: false }); } });
app.delete("/statuses/:id", authMiddleware, async (req, res) => { const client = await pool.connect(); try { const statusId = req.params.id; const check = await client.query("SELECT COUNT(*) FROM services WHERE status_id = $1 AND owner_id = $2", [statusId, req.user.accountId]); if (parseInt(check.rows[0].count) > 0) return res.status(400).json({ ok: false, error: "En uso" }); await client.query("DELETE FROM service_statuses WHERE id=$1 AND owner_id=$2", [statusId, req.user.accountId]); res.json({ ok: true }); } catch(e) { res.status(500).json({ ok: false }); } finally { client.release(); } });

app.get("/clients/search", authMiddleware, async (req, res) => { try { const { phone } = req.query; const p = normalizePhone(phone); if(!p) return res.json({ok:true,client:null}); const q = await pool.query("SELECT * FROM clients WHERE phone=$1 AND owner_id=$2 LIMIT 1", [p, req.user.accountId]); res.json({ ok: true, client: q.rows[0] || null }); } catch (e) { res.status(500).json({ ok: false }); } });
app.get("/companies", authMiddleware, async (req, res) => { try { const q = await pool.query("SELECT * FROM companies WHERE owner_id=$1 ORDER BY name ASC", [req.user.accountId]); res.json({ ok: true, companies: q.rows }); } catch (e) { res.status(500).json({ ok: false }); } });
app.post("/companies", authMiddleware, async (req, res) => { try { const { name } = req.body; await pool.query("INSERT INTO companies (name, owner_id) VALUES ($1, $2)", [name, req.user.accountId]); res.json({ ok: true }); } catch (e) { res.status(500).json({ ok: false }); } });
app.delete("/companies/:id", authMiddleware, async (req, res) => { try { await pool.query("DELETE FROM companies WHERE id=$1 AND owner_id=$2", [req.params.id, req.user.accountId]); res.json({ ok: true }); } catch (e) { res.status(500).json({ ok: false }); } });

// AÑADIDO: Filtro estricto para que solo devuelva operarios que estén en estado 'active'
app.get("/operators", authMiddleware, async (req, res) => { 
    try { 
        // Si nos pasan un guild_id, filtramos también por gremio
        const guildId = req.query.guild_id;
        let query = `
            SELECT u.id, u.full_name, u.zones 
            FROM users u 
            WHERE u.owner_id=$1 AND u.role='operario' AND u.status='active'
        `;
        const params = [req.user.accountId];

        if (guildId) {
            query = `
                SELECT u.id, u.full_name, u.zones 
                FROM users u 
                JOIN user_guilds ug ON u.id = ug.user_id
                WHERE u.owner_id=$1 AND u.role='operario' AND u.status='active' AND ug.guild_id=$2
            `;
            params.push(guildId);
        }
        
        query += ` ORDER BY u.full_name ASC`;
        
        const q = await pool.query(query, params); 
        res.json({ ok: true, operators: q.rows }); 
    } catch (e) { 
        console.error("Error al cargar operarios:", e);
        res.status(500).json({ ok: false }); 
    } 
});

app.get("/zones", authMiddleware, async (req, res) => { try { const q = await pool.query("SELECT * FROM zones WHERE owner_id=$1 ORDER BY name ASC", [req.user.accountId]); res.json({ ok: true, zones: q.rows }); } catch (e) { res.status(500).json({ ok: false }); } });
app.post("/zones", authMiddleware, async (req, res) => { try { const { name } = req.body; await pool.query("INSERT INTO zones (name, owner_id) VALUES ($1, $2)", [name, req.user.accountId]); res.json({ ok: true }); } catch (e) { res.status(500).json({ ok: false }); } });
app.delete("/zones/:id", authMiddleware, async (req, res) => { try { await pool.query("DELETE FROM zones WHERE id=$1 AND owner_id=$2", [req.params.id, req.user.accountId]); res.json({ ok: true }); } catch (e) { res.status(500).json({ ok: false }); } });
app.get("/zones/:id/operators", authMiddleware, async (req, res) => { try { const q = await pool.query("SELECT user_id FROM user_zones WHERE zone_id=$1", [req.params.id]); res.json({ ok: true, assignedIds: q.rows.map(r=>r.user_id) }); } catch (e) { res.status(500).json({ ok: false }); } });
app.post("/zones/:id/assign", authMiddleware, async (req, res) => { const client = await pool.connect(); try { const { operator_ids } = req.body; await client.query('BEGIN'); await client.query("DELETE FROM user_zones WHERE zone_id=$1", [req.params.id]); if(operator_ids) for(const uid of operator_ids) await client.query("INSERT INTO user_zones (user_id, zone_id) VALUES ($1, $2)", [uid, req.params.id]); await client.query('COMMIT'); res.json({ok:true}); } catch(e){ await client.query('ROLLBACK'); res.status(500).json({ok:false}); } finally { client.release(); } });

app.get("/api/geo/municipios/:provincia", authMiddleware, async (req, res) => { try { let { provincia } = req.params; const provClean = provincia.toUpperCase().normalize("NFD").replace(/[\u0300-\u036f]/g, ""); const q = await pool.query("SELECT municipio, codigo_postal FROM master_geo_es WHERE provincia = $1 ORDER BY municipio ASC", [provClean]); res.json({ ok: true, municipios: q.rows }); } catch (e) { res.status(500).json({ ok: false }); } });
app.patch("/admin/users/:id/status", authMiddleware, async (req, res) => { try { const { status } = req.body; await pool.query("UPDATE users SET status = $1 WHERE id = $2 AND owner_id = $3", [status, req.params.id, req.user.accountId]); res.json({ ok: true }); } catch (e) { res.status(500).json({ ok: false }); } });
app.get("/admin/users", authMiddleware, async (req, res) => { try { const q = await pool.query(`SELECT u.id, u.full_name, u.email, u.phone, u.role, u.zones, u.status, COALESCE(json_agg(g.id) FILTER (WHERE g.id IS NOT NULL), '[]') as guilds FROM users u LEFT JOIN user_guilds ug ON u.id=ug.user_id LEFT JOIN guilds g ON ug.guild_id=g.id WHERE u.owner_id=$1 GROUP BY u.id ORDER BY u.id DESC`, [req.user.accountId]); res.json({ ok: true, users: q.rows }); } catch (e) { res.status(500).json({ ok: false }); } });
app.post("/admin/users", authMiddleware, async (req, res) => { const client = await pool.connect(); try { const { fullName, email, password, role, guilds, phone, zones } = req.body; if (!email || !password || !fullName || !phone) return res.status(400).json({ ok: false }); const p = normalizePhone(phone); const hash = await bcrypt.hash(password, 10); const check = await client.query("SELECT id FROM users WHERE (phone=$1 OR email=$2) AND owner_id=$3", [p, email, req.user.accountId]); if (check.rowCount > 0) return res.status(400).json({ ok: false, error: "Duplicado" }); await client.query('BEGIN'); const insert = await client.query("INSERT INTO users (full_name, email, password_hash, role, phone, is_verified, owner_id, zones, status) VALUES ($1, $2, $3, $4, $5, TRUE, $6, $7, 'active') RETURNING id", [fullName, email, hash, role || 'operario', p, req.user.accountId, JSON.stringify(zones || [])]); const uid = insert.rows[0].id; if (guilds) for (const gid of guilds) await client.query("INSERT INTO user_guilds (user_id, guild_id) VALUES ($1, $2)", [uid, gid]); await client.query('COMMIT'); res.json({ ok: true }); } catch (e) { await client.query('ROLLBACK'); res.status(500).json({ ok: false }); } finally { client.release(); } });
app.put("/admin/users/:id", authMiddleware, async (req, res) => { const client = await pool.connect(); try { const userId = req.params.id; const { fullName, email, phone, role, guilds, password, zones } = req.body; const p = normalizePhone(phone); await client.query('BEGIN'); if(password) { const hash = await bcrypt.hash(password, 10); await client.query("UPDATE users SET full_name=$1, email=$2, phone=$3, role=$4, password_hash=$5, zones=$6 WHERE id=$7", [fullName, email, p, role, hash, JSON.stringify(zones || []), userId]); } else { await client.query("UPDATE users SET full_name=$1, email=$2, phone=$3, role=$4, zones=$5 WHERE id=$6", [fullName, email, p, role, JSON.stringify(zones || []), userId]); } if (guilds && Array.isArray(guilds)) { await client.query("DELETE FROM user_guilds WHERE user_id=$1", [userId]); for (const gid of guilds) await client.query("INSERT INTO user_guilds (user_id, guild_id) VALUES ($1, $2)", [userId, gid]); } await client.query('COMMIT'); res.json({ ok: true }); } catch (e) { await client.query('ROLLBACK'); res.status(500).json({ ok: false }); } finally { client.release(); } });
app.delete("/admin/users/:id", authMiddleware, async (req, res) => { try { await pool.query("DELETE FROM users WHERE id=$1 AND owner_id=$2", [req.params.id, req.user.accountId]); res.json({ ok: true }); } catch (e) { res.status(500).json({ ok: false }); } });

app.get("/config/company", authMiddleware, async (req, res) => { try { const q = await pool.query("SELECT company_slug, full_name, plan_tier FROM users WHERE id=$1", [req.user.accountId]); res.json({ ok: true, slug: q.rows[0]?.company_slug, name: q.rows[0]?.full_name, plan: q.rows[0]?.plan_tier }); } catch (e) { res.status(500).json({ ok: false }); } });
app.post("/config/company", authMiddleware, async (req, res) => { const client = await pool.connect(); try { const { slug } = req.body; if (!slug || slug.length < 3) return res.status(400).json({ ok: false, error: "Mínimo 3 caracteres" }); const cleanSlug = slug.toLowerCase().replace(/[^a-z0-9-]/g, ""); if (cleanSlug !== slug) return res.status(400).json({ ok: false, error: "Carácteres inválidos" }); const check = await client.query("SELECT id FROM users WHERE company_slug=$1 AND id != $2", [cleanSlug, req.user.accountId]); if (check.rowCount > 0) return res.status(400).json({ ok: false, error: "Nombre en uso" }); await client.query("UPDATE users SET company_slug=$1 WHERE id=$2", [cleanSlug, req.user.accountId]); res.json({ ok: true, fullUrl: `https://${cleanSlug}.integrarepara.es` }); } catch (e) { res.status(500).json({ ok: false }); } finally { client.release(); } });

// ==========================================
// 🛠️ RUTAS DE GREMIOS E INTELIGENCIA ARTIFICIAL
// ==========================================
app.get("/guilds", authMiddleware, async (req, res) => { 
    try { 
        // AHORA DEVOLVEMOS TAMBIÉN LAS PALABRAS CLAVE
        const q = await pool.query("SELECT id, name, ia_keywords FROM guilds WHERE owner_id=$1 ORDER BY name ASC", [req.user.accountId]); 
        res.json({ ok: true, guilds: q.rows }); 
    } catch (e) { 
        res.status(500).json({ ok: false }); 
    } 
});

app.post("/guilds", authMiddleware, async (req, res) => { 
    try { 
        const { name } = req.body; 
        await pool.query("INSERT INTO guilds (name, owner_id) VALUES ($1, $2)", [name, req.user.accountId]); 
        res.json({ ok: true }); 
    } catch (e) { res.status(500).json({ ok: false }); } 
});

app.delete("/guilds/:id", authMiddleware, async (req, res) => { 
    try { 
        await pool.query("DELETE FROM guilds WHERE id=$1 AND owner_id=$2", [req.params.id, req.user.accountId]); 
        res.json({ ok: true }); 
    } catch (e) { res.status(500).json({ ok: false }); } 
});

// NUEVA RUTA: PARA GUARDAR LAS PALABRAS CLAVE DE LA IA
app.put("/guilds/:id/ia-rules", authMiddleware, async (req, res) => {
    try {
        const { keywords } = req.body; // Viene un array ["grifo", "fuga"]
        const guildId = req.params.id;

        // Asegurarnos de que el array es válido
        const safeKeywords = Array.isArray(keywords) ? keywords : [];

        await pool.query(
            "UPDATE guilds SET ia_keywords = $1 WHERE id = $2 AND owner_id = $3",
            [JSON.stringify(safeKeywords), guildId, req.user.accountId]
        );

        res.json({ ok: true });
    } catch (e) {
        console.error("Error guardando IA:", e);
        res.status(500).json({ ok: false, error: e.message });
    }
});


app.get("/services", authMiddleware, async (req, res) => { try { const q = await pool.query(`SELECT s.*, st.name as status_name, st.color as status_color, c.name as company_name, g.name as guild_name, u.full_name as assigned_name FROM services s LEFT JOIN service_statuses st ON s.status_id = st.id LEFT JOIN companies c ON s.company_id = c.id LEFT JOIN guilds g ON s.guild_id = g.id LEFT JOIN users u ON s.assigned_to = u.id WHERE s.owner_id=$1 ORDER BY s.created_at DESC`, [req.user.accountId]); res.json({ ok: true, services: q.rows }); } catch (e) { res.status(500).json({ ok: false }); } });
app.get("/services/:id", authMiddleware, async (req, res) => { try { const q = await pool.query(`SELECT * FROM services WHERE id=$1 AND owner_id=$2`, [req.params.id, req.user.accountId]); res.json({ ok: true, service: q.rows[0] }); } catch (e) { res.status(500).json({ ok: false }); } });
app.get("/services/:id/logs", authMiddleware, async (req, res) => { try { const q = await pool.query(`SELECT l.*, u.full_name as user_name, s2.name as new_status, s2.color as new_color FROM service_logs l LEFT JOIN users u ON l.user_id=u.id LEFT JOIN service_statuses s2 ON l.new_status_id=s2.id WHERE l.service_id=$1 ORDER BY l.created_at DESC`, [req.params.id]); res.json({ ok: true, logs: q.rows }); } catch (e) { res.status(500).json({ ok: false }); } });
app.put("/services/:id/status", authMiddleware, async (req, res) => { const client = await pool.connect(); try { const { status_id, comment } = req.body; await client.query('BEGIN'); const curr = await client.query("SELECT status_id FROM services WHERE id=$1", [req.params.id]); const old = curr.rows[0].status_id; await client.query("UPDATE services SET status_id=$1 WHERE id=$2", [status_id, req.params.id]); await client.query("INSERT INTO service_logs (service_id, user_id, old_status_id, new_status_id, comment) VALUES ($1, $2, $3, $4, $5)", [req.params.id, req.user.sub, old, status_id, comment]); await client.query('COMMIT'); res.json({ ok: true }); } catch (e) { await client.query('ROLLBACK'); res.status(500).json({ ok: false }); } finally { client.release(); } });
app.post("/services", authMiddleware, async (req, res) => { const client = await pool.connect(); try { const { phone, name, address, email, description, scheduled_date, scheduled_time, duration, is_urgent, is_company, company_id, company_ref, internal_notes, client_notes, status_id, guild_id, assigned_to } = req.body; const p = normalizePhone(phone); await client.query('BEGIN'); let finalStatus = status_id; if (!finalStatus) { const def = await client.query("SELECT id FROM service_statuses WHERE owner_id=$1 AND is_default=TRUE LIMIT 1", [req.user.accountId]); finalStatus = def.rows[0]?.id; } let clientId; const cCheck = await client.query("SELECT id, addresses FROM clients WHERE phone=$1 AND owner_id=$2", [p, req.user.accountId]); if (cCheck.rowCount > 0) { clientId = cCheck.rows[0].id; let addrs = cCheck.rows[0].addresses || []; if(!addrs.includes(address)) { addrs.push(address); await client.query("UPDATE clients SET addresses=$1 WHERE id=$2", [JSON.stringify(addrs), clientId]); } } else { const newC = await client.query("INSERT INTO clients (owner_id, full_name, phone, email, addresses) VALUES ($1, $2, $3, $4, $5) RETURNING id", [req.user.accountId, name, p, email, JSON.stringify([address])]); clientId = newC.rows[0].id; } const insert = await client.query(`INSERT INTO services (owner_id, client_id, status_id, contact_phone, contact_name, address, email, description, scheduled_date, scheduled_time, duration_minutes, is_urgent, is_company, company_id, company_ref, internal_notes, client_notes, title, guild_id, assigned_to) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20) RETURNING id`, [req.user.accountId, clientId, finalStatus, p, name, address, email, description, scheduled_date || 'NOW()', scheduled_time || 'NOW()', (duration || 30), (is_urgent || false), (is_company || false), (company_id || null), company_ref, internal_notes, client_notes, name + " - Svc", (guild_id || null), (assigned_to || null)]); await client.query("INSERT INTO service_logs (service_id, user_id, new_status_id, comment) VALUES ($1, $2, $3, 'Servicio Creado')", [insert.rows[0].id, req.user.sub, finalStatus]); await client.query('COMMIT'); res.json({ ok: true }); } catch (e) { await client.query('ROLLBACK'); console.error(e); res.status(500).json({ ok: false, error: e.message }); } finally { client.release(); } });
app.put("/services/:id", authMiddleware, async (req, res) => { const client = await pool.connect(); try { const { name, address, email, description, scheduled_date, scheduled_time, duration, is_urgent, is_company, company_id, company_ref, internal_notes, client_notes, guild_id, assigned_to } = req.body; await client.query('BEGIN'); await client.query(`UPDATE services SET contact_name=$1, address=$2, email=$3, description=$4, scheduled_date=$5, scheduled_time=$6, duration_minutes=$7, is_urgent=$8, is_company=$9, company_id=$10, company_ref=$11, internal_notes=$12, client_notes=$13, guild_id=$14, assigned_to=$15 WHERE id=$16 AND owner_id=$17`, [name, address, email, description, scheduled_date, scheduled_time, (duration || 30), (is_urgent || false), (is_company || false), (company_id || null), company_ref, internal_notes, client_notes, (guild_id || null), (assigned_to || null), req.params.id, req.user.accountId]); await client.query("INSERT INTO service_logs (service_id, user_id, new_status_id, comment) VALUES ($1, $2, (SELECT status_id FROM services WHERE id=$1), 'Datos editados')", [req.params.id, req.user.sub]); await client.query('COMMIT'); res.json({ ok: true }); } catch (e) { await client.query('ROLLBACK'); res.status(500).json({ ok: false }); } finally { client.release(); } });
app.delete("/services/:id", authMiddleware, async (req, res) => { try { await pool.query("DELETE FROM services WHERE id=$1 AND owner_id=$2", [req.params.id, req.user.accountId]); res.json({ ok: true }); } catch (e) { res.status(500).json({ ok: false }); } });

// ==========================================
// 🕒 EL RELOJ DEL SISTEMA (Ejecutar cada minuto)
// ==========================================
setInterval(async () => {
    try {
       const expiredPings = await pool.query(`
            SELECT ap.id, ap.scraped_id, ap.user_id, s.owner_id, s.raw_data
            FROM assignment_pings ap
            JOIN scraped_services s ON ap.scraped_id = s.id
            WHERE ap.status = 'pending' 
            AND EXTRACT(EPOCH FROM (ap.expires_at - CURRENT_TIMESTAMP)) <= 0
            AND s.automation_status = 'in_progress'
        `); 

        for (const ping of expiredPings.rows) {
            await pool.query("UPDATE assignment_pings SET status = 'expired' WHERE id = $1", [ping.id]);
            const nextWorkerQ = await pool.query(`
                SELECT u.id, u.phone, u.full_name 
                FROM users u
                JOIN user_guilds ug ON u.id = ug.user_id
                WHERE u.owner_id = $1 AND u.status = 'active'
                AND u.id NOT IN (SELECT user_id FROM assignment_pings WHERE scraped_id = $2)
                LIMIT 1
            `, [ping.owner_id, ping.scraped_id]);

            if (nextWorkerQ.rowCount > 0) {
                const nextW = nextWorkerQ.rows[0];
                const newToken = crypto.randomBytes(16).toString('hex');
                await pool.query(`INSERT INTO assignment_pings (scraped_id, user_id, token, expires_at) VALUES ($1, $2, $3, CURRENT_TIMESTAMP + INTERVAL '5 minutes')`, [ping.scraped_id, nextW.id, newToken]);
                
                const mensaje = `🛠️ *SERVICIO DISPONIBLE*\nEl anterior compañero no respondió. Es tu turno:\n🔗 https://integrarepara.es/aceptar.html?t=${newToken}`;
                const instanceName = `cliente_${ping.owner_id}`;
                sendWhatsAppAuto(nextW.phone, mensaje, instanceName).catch(console.error);
            } else {
                await pool.query("UPDATE scraped_services SET automation_status = 'failed' WHERE id = $1", [ping.scraped_id]);
            }
        }
    } catch (e) { console.error("Reloj:", e); }
}, 60000);

const port = process.env.PORT || 3000;
autoUpdateDB().then(() => { app.listen(port, "0.0.0.0", () => console.log(`🚀 Server OK en puerto ${port}`)); });