agent.js

Go to the documentation of this file.

/**
 * @file RMM Agent Management API Routes
 * @description
 * Central API module for RMM agent lifecycle management, monitoring, and data collection.
 * Provides comprehensive agent operations including registration, heartbeat tracking, hardware
 * inventory, software management, file transfers, metrics collection, and MeshCentral integration.
 *
 * **Key Features:**
 * - **Agent Registration**: Initial agent enrollment with tenant validation
 * - **Heartbeat Monitoring**: Real-time status tracking and keep-alive
 * - **Hardware Inventory**: CPU, memory, disk, network, GPU detection and tracking
 * - **Software Management**: Installed programs, running processes, Windows services
 * - **File Operations**: File browser, upload/download, transfer tracking
 * - **Metrics Collection**: Performance data aggregation and historical queries
 * - **MeshCentral Integration**: Device URL generation, node info, session management
 * - **Activity Logging**: Agent events, system logs, activity tracking
 * - **Version Management**: Agent version checks, download links, hash verification
 *
 * **Endpoint Groups:**
 * 1. **Core Agent Operations** (lines 14-200):
 *    - POST /register - Agent registration with tenant JWT validation
 *    - POST /:agentId/heartbeat - Keep-alive with status tracking
 *    - GET /:agentId/status - Agent status and connectivity check
 *    - GET /:agentId - Get single agent details
 *    - GET /list - List all agents (legacy, non-authenticated)
 *    - GET /:agentId/plugins - Get allowed plugins for agent
 *    - GET /:agentId/contract - Get contract details for agent's tenant
 *
 * 2. **MeshCentral Integration** (lines 199-478):
 *    - GET /:agentId/meshcentral-url - Generate MeshCentral access URL
 *    - GET /:agentId/meshcentral-node - Get MeshCentral node/device info
 *    - GET /:agentId/meshcentral-info - Get complete MeshCentral session data
 *
 * 3. **Metrics & Monitoring** (lines 478-583):
 *    - GET /download-token - Generate agent download token
 *    - POST /metrics - Submit agent metrics (batch)
 *    - GET /:agentId/metrics - Query historical metrics data
 *    - GET /os-options - Get supported OS platforms list
 *
 * 4. **Hardware Inventory** (lines 601-881):
 *    - POST /enroll - Full agent enrollment with hardware detection
 *    - POST /:agent_uuid/hardware - Submit hardware inventory data
 *    - GET /:agent_uuid/hardware - Retrieve hardware specifications
 *
 * 5. **Agent Management** (lines 881-1132):
 *    - GET /list - List agents with tenant filtering (authenticated)
 *    - GET /:id - Get agent by ID with full details
 *    - DELETE /:id - Delete/uninstall agent
 *
 * 6. **Software & System Info** (lines 1132-1419):
 *    - GET /:agent_uuid/programs - List installed programs
 *    - GET /:agent_uuid/processes - List running processes
 *    - GET /:agent_uuid/files - Browse agent filesystem
 *    - GET /:agent_uuid/services - List Windows services
 *    - GET /:agent_uuid/activity-logs - Get agent activity history
 *    - GET /:agent_uuid/events - Get system event logs
 *    - GET /:agent_uuid/agent-logs - Get agent application logs
 *
 * 7. **Version Management** (lines 1419-1553):
 *    - GET /version - Get latest agent version info
 *    - GET /download/:version - Download agent installer by version
 *    - GET /hash/:version - Get installer hash for integrity verification
 *
 * 8. **File Transfer Operations** (lines 1553-1637):
 *    - POST /:agent_uuid/files/upload - Upload file to agent
 *    - POST /:agent_uuid/files/download - Request file download from agent
 *    - GET /:agent_uuid/files/transfer/:transferId - Get transfer status
 *    - GET /:agent_uuid/files/transfer/:transferId/download - Download transferred file
 *    - DELETE /:agent_uuid/files/transfer/:transferId - Cancel/cleanup transfer
 *
 * **Security:**
 * - Tenant JWT validation for registration/enrollment (verifyTenantJwt)
 * - Bearer token authentication for most endpoints (authenticateToken middleware)
 * - Tenant isolation via tenant_id validation
 * - File upload size limits (multer configuration)
 *
 * **Database Tables:**
 * - `agents`: Core agent records (registration, status, hardware specs)
 * - `agent_metrics`: Performance metrics time-series data
 * - `agent_programs`: Installed software inventory
 * - `agent_processes`: Running process snapshots
 * - `agent_services`: Windows services status
 * - `agent_activity_logs`: Agent event history
 * - `hardware_specs`: Detailed hardware inventory (CPU, RAM, GPU, disks)
 *
 * **External Integrations:**
 * - **MeshCentral**: Remote access (terminal, files, desktop) via MeshCentral server
 * - **DigitalOcean Spaces**: Agent installer distribution and file transfer storage
 * @module routes/agent
 * @requires express
 * @requires ../services/db - PostgreSQL database pool
 * @requires jsonwebtoken - JWT token generation/verification
 * @requires ../models/Agent - Agent data access model
 * @requires ../models/Policies - Policy management model
 * @requires ../models/Plugins - Plugin management model
 * @requires ../models/Contracts - Contract data model
 * @requires ../utils/auth - JWT verification utilities
 * @requires ../middleware/auth - Authentication middleware
 * @requires ../services/metricsAggregator - Metrics collection service
 * @see {@link module:models/Agent}
 * @see {@link module:services/metricsAggregator}
 */
 
const express = require('express');
const pool = require('../services/db');
const router = express.Router();
const jwt = require('jsonwebtoken');
const Agents = require('../models/Agent');
const Policies = require('../models/Policies');
const Plugins = require('../models/Plugins');
const Contracts = require('../models/Contracts');
const { verifyTenantJwt } = require('../utils/auth');
const authenticateToken = require('../middleware/auth');
const { addMetric } = require('../services/metricsAggregator');
 
/**
 * @api {post} /agent/register Register New Agent
 * @apiName RegisterAgent
 * @apiGroup Agent
 * @apiDescription
 * Registers a new RMM agent with the platform. Validates tenant JWT token, creates agent
 * record in database, and returns agent UUID for subsequent API calls. This is the first
 * API call made by a newly installed agent.
 * @apiPermission tenantJWT
 * @apiHeader {string} Authorization Bearer token with tenant JWT (AGENT_SIGN_KEY signed)
 * @apiBody {number} tenantId Tenant ID from bootstrap.json
 * @apiBody {string} version Agent version (e.g., "1.0.12")
 * @apiBody {string} hostname Machine hostname/computer name
 * @apiBody {String="win32","linux","darwin"} platform Operating system platform
 * @apiBody {string} machineId Unique machine identifier (Windows machine GUID or Linux /etc/machine-id)
 * @apiSuccess {number} agentId Database agent ID
 * @apiSuccess {string} agentUuid Agent UUID for API authentication
 * @apiError (403) {String} error "INVALID_TOKEN" (if JWT verification fails)
 * @apiError (500) {String} error Error message if registration fails
 * @apiExample {curl} Example Request:
 *     curl -X POST https://api.ibghub.com/api/agent/register \
 *       -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
 *       -H "Content-Type: application/json" \
 *       -d '{"tenantId":5,"version":"1.0.12","hostname":"DESKTOP-ABC123","platform":"win32","machineId":"12345678-1234-1234-1234-123456789012"}'
 */
 
// Refactored agent registration route
router.post('/register', async (req, res) => {
  try {
    const jwtPayload = verifyTenantJwt(req.headers.authorization?.split(' ')[1]);
    if (!jwtPayload) return res.status(403).json({ error: 'INVALID_TOKEN' });
 
    const { tenantId, version, hostname, platform, machineId } = req.body;
    const policyId = null; // Set to null for now
    const result = await Agents.createAgent({
      tenantId,
      version,
      hostname,
      platform,
      machineId,
      policyId
    });
 
    // const policy = await Policies.getPolicy(policyId);
    // const contract = await Contracts.getContractForTenant(tenantId);
    // const allowedPlugins = await Plugins.getAllowedPlugins(agentId);
 
    res.json(result); // Return {agentId, agentUuid}
  } catch (err) {
    console.error('REGISTER ERROR:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {post} /agent/:agentId/heartbeat Agent Heartbeat
 * @apiName AgentHeartbeat
 * @apiGroup Agent
 * @apiDescription
 * Updates agent's last_seen timestamp and optional version. Returns pending commands
 * from queue (future: remote command execution).
 *
 * Workflow:
 * - Updates last_seen timestamp in database (NOW())
 * - Updates agent version if provided in body
 * - Returns any pending commands for agent (currently empty, future feature)
 * @apiPermission public
 * @apiNote No authentication required - agents use agentId (UUID) in URL for identification
 * @apiParam {string} agentId Agent UUID from registration response
 * @apiBody {string} [version] Agent version string (e.g., "1.0.13") - updates agent record if provided
 * @apiSuccess {boolean} success Always true if heartbeat processed
 * @apiSuccess {object[]} commands Array of pending commands for agent to execute (empty for now)
 * @apiSuccess {string} timestamp ISO timestamp of heartbeat processing
 * @apiError (500) {String} error Error message if heartbeat update fails
 * @apiExample {curl} Example Request:
 *     curl -X POST https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/heartbeat \
 *       -H "Content-Type: application/json" \
 *       -d '{"version":"1.0.13"}'
 */
 
// Refactored heartbeat update
router.post('/:agentId/heartbeat', async (req, res) => {
  try {
    const version = req.body?.version;
    const agentUuid = req.params.agentId;
    
    // Update heartbeat and version if provided
    if (version) {
      await pool.query(
        `UPDATE agents SET last_seen = NOW(), version = $1 WHERE agent_uuid = $2`,
        [version, agentUuid]
      );
    } else {
      await Agents.updateHeartbeat(agentUuid);
    }
    
    // Check for pending commands for this agent
    // TODO: Implement command queue in database
    const commands = [];
    
    res.json({ 
      success: true,
      commands: commands,
      timestamp: new Date().toISOString()
    });
  } catch (err) {
    console.error('HEARTBEAT ERROR:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/:agentId/status Get Agent Status
 * @apiName GetAgentStatus
 * @apiGroup Agent
 * @apiDescription
 * Returns real-time connectivity status of agent including WebSocket and MeshCentral
 * connection states. Prioritizes MeshCentral status over WebSocket when both available.
 * Used by dashboards for live agent status indicators.
 * @apiPermission public
 * @apiNote No authentication required - open endpoint for agent status checks
 * @apiParam {string} agentId Agent UUID or agent_id
 * @apiSuccess {string} agent_uuid Agent UUID
 * @apiSuccess {number} agent_id Database agent ID
 * @apiSuccess {Date} last_seen Last heartbeat timestamp (MeshCentral or WebSocket)
 * @apiSuccess {string} os Operating system (e.g., "Windows 10 Pro")
 * @apiSuccess {string} hostname Machine hostname
 * @apiSuccess {string} status Agent status ("active", "offline", etc.)
 * @apiSuccess {string} version Agent version string
 * @apiSuccess {string} ip_address Agent IP address
 * @apiSuccess {string} meshcentral_nodeid MeshCentral node identifier
 * @apiSuccess {boolean} meshcentral_connected MeshCentral connection status
 * @apiSuccess {Date} meshcentral_last_seen MeshCentral last contact time
 * @apiSuccess {boolean} connected Overall connection status (MeshCentral OR WebSocket)
 * @apiSuccess {string} connection_status "online" or "offline"
 * @apiSuccess {Object} connection_sources Source-specific connection states
 * @apiSuccess {boolean} connection_sources.meshcentral MeshCentral connected
 * @apiSuccess {boolean} connection_sources.websocket WebSocket connected
 * @apiError (404) {String} error "Agent not found"
 * @apiError (500) {String} error Error message
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/status
 */
 
// Get agent status (including WebSocket and MeshCentral connection)
router.get('/:agentId/status', async (req, res) => {
  try {
    const wsManager = require('../services/websocketManager');
    const agent = await pool.query(
      `SELECT 
        agent_uuid, agent_id, last_seen, os, hostname, status, version, ip_address,
        meshcentral_nodeid, meshcentral_connected, meshcentral_last_seen
      FROM agents 
      WHERE agent_uuid = $1 OR agent_id::text = $1`,
      [req.params.agentId]
    );
    if (agent.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
    const agentData = agent.rows[0];
    const isConnectedWS = wsManager.isAgentConnected(agentData.agent_uuid);
    const isConnectedMesh = agentData.meshcentral_connected || false;
    
    // Prefer MeshCentral status if available, fallback to WebSocket
    const connected = isConnectedMesh || isConnectedWS;
    const lastSeen = agentData.meshcentral_last_seen || agentData.last_seen;
    
    res.json({
      ...agentData,
      connected: connected,
      connection_status: connected ? 'online' : 'offline',
      last_seen: lastSeen,
      connection_sources: {
        meshcentral: isConnectedMesh,
        websocket: isConnectedWS
      }
    });
  } catch (err) {
    console.error('GET AGENT STATUS ERROR:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/:agentId Get Agent Details
 * @apiName GetAgent
 * @apiGroup Agent
 * @apiDescription
 * Retrieves complete agent details including tenant and customer information.
 * Returns full agent record with joined customer name and tenant name.
 * @apiPermission public
 * @apiParam {string} agentId Agent UUID
 * @apiSuccess {object} agent Complete agent object with all database columns
 * @apiSuccess {string} agent.agent_uuid Agent UUID
 * @apiSuccess {number} agent.agent_id Database agent ID
 * @apiSuccess {number} agent.tenant_id Tenant ID
 * @apiSuccess {string} agent.tenant_name Tenant name (joined from tenants table)
 * @apiSuccess {number} agent.customer_id Customer ID
 * @apiSuccess {string} agent.customer_name Customer name (joined from customers table)
 * @apiSuccess {string} agent.hostname Machine hostname
 * @apiSuccess {string} agent.os Operating system
 * @apiSuccess {string} agent.version Agent version
 * @apiSuccess {string} agent.ip_address IP address
 * @apiSuccess {Date} agent.last_seen Last heartbeat timestamp
 * @apiSuccess {string} agent.status Agent status
 * @apiSuccess {string} agent.platform Platform (win32/linux/darwin)
 * @apiSuccess {boolean} connected WebSocket connection status
 * @apiError (404) {String} error "Agent not found"
 * @apiError (500) {String} error Error message
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000
 */
 
// Refactored get agent (full details)
router.get('/:agentId', async (req, res) => {
  try {
    const wsManager = require('../services/websocketManager');
    const agent = await pool.query(
      'SELECT a.*, c.name as customer_name, t.name as tenant_name FROM agents a LEFT JOIN customers c ON a.customer_id = c.id LEFT JOIN tenants t ON a.tenant_id = t.tenant_id WHERE a.agent_uuid = $1',
      [req.params.agentId]
    );
    if (agent.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
    const agentData = agent.rows[0];
    agentData.connected = wsManager.isAgentConnected(req.params.agentId);
    res.json({ agent: agentData });
  } catch (err) {
    console.error('GET AGENT ERROR:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/list List All Agents (Legacy)
 * @apiName ListAgentsLegacy
 * @apiGroup Agent
 * @apiDescription
 * **LEGACY ENDPOINT** - Lists all agents without authentication or filtering.
 * This endpoint has no tenant isolation and returns all agents across all tenants.
 * Deprecated in favor of authenticated GET /agent/list endpoint with tenant filtering.
 * @apiPermission public
 * @apiDeprecated Use authenticated GET /agent/list endpoint instead
 * @apiNote No authentication - security risk, should be removed or restricted
 * @apiQuery {object} [filters] Optional query parameters passed to listAgents model method
 * @apiSuccess {object[]} agents Array of all agent objects
 * @apiError (500) {String} error Error message
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/list
 */
 
// Refactored list agents
router.get('/list', async (req, res) => {
  try {
    const agents = await Agents.listAgents(req.query); // Implement listAgents in model
    res.json({ agents });
  } catch (err) {
    console.error('LIST AGENTS ERROR:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/:agentId/plugins Get Allowed Plugins
 * @apiName GetAgentPlugins
 * @apiGroup Agent
 * @apiDescription
 * Retrieves list of plugins enabled/allowed for the agent based on policy configuration.
 * Used by agents to determine which plugin modules to load and execute.
 * @apiPermission public
 * @apiParam {string} agentId Agent UUID
 * @apiSuccess {object[]} plugins Array of allowed plugin objects
 * @apiSuccess {string} plugins.plugin_name Plugin name/identifier
 * @apiSuccess {boolean} plugins.enabled Plugin enabled status
 * @apiSuccess {object} plugins.config Plugin-specific configuration
 * @apiError (500) {String} error Error message
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/plugins
 */
 
// Refactored get allowed plugins
router.get('/:agentId/plugins', async (req, res) => {
  try {
    const plugins = await Plugins.getAllowedPlugins(req.params.agentId);
    res.json({ plugins });
  } catch (err) {
    console.error('GET PLUGINS ERROR:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/:agentId/contract Get Agent's Contract
 * @apiName GetAgentContract
 * @apiGroup Agent
 * @apiDescription
 * Retrieves contract details for the agent's tenant. Used to determine billing interval,
 * service level agreements, and contract-specific features or limitations.
 * @apiPermission public
 * @apiParam {string} agentId Agent UUID
 * @apiSuccess {object} contract Contract object
 * @apiSuccess {number} contract.contract_id Contract ID
 * @apiSuccess {number} contract.tenant_id Tenant ID
 * @apiSuccess {string} contract.billing_interval Billing frequency (monthly, yearly, etc.)
 * @apiSuccess {number} contract.monthly_rate Contract monthly rate
 * @apiSuccess {string} contract.title Contract title/name
 * @apiError (404) {String} error "Agent not found"
 * @apiError (500) {String} error Error message
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/contract
 */
 
// Refactored get contract
router.get('/:agentId/contract', async (req, res) => {
  try {
    const agent = await Agents.getAgent(req.params.agentId);
    if (!agent) return res.status(404).json({ error: 'Agent not found' });
    const contract = await Contracts.getContractForTenant(agent.tenant_id);
    res.json({ contract });
  } catch (err) {
    console.error('GET CONTRACT ERROR:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/:agentId/meshcentral-url Get MeshCentral Remote Access URL
 * @apiName GetMeshCentralURL
 * @apiGroup Agent
 * @apiDescription
 * Generates authenticated MeshCentral URL for remote desktop/terminal access. Creates
 * temporary session token valid for 1 hour, queries MeshCentral API for device info,
 * and returns dashboard URL with embedded authentication. Supports both authenticated
 * (dashboard user) and unauthenticated (agent) calls with tenant isolation.
 *
 * Workflow:
 * - Validates agent exists and retrieves meshcentral_nodeid
 * - Enforces tenant isolation if JWT authenticated
 * - Creates session token in database (expires in 1 hour)
 * - Queries MeshCentral API for device details
 * - Returns dashboard URL: /meshcentral?agentId={id}&sessionToken={token}
 * @apiPermission public/authenticated
 * @apiNote Supports both authenticated (JWT) and unauthenticated (agent UUID) access
 * @apiParam {string} agentId Agent ID (numeric) or agent UUID
 * @apiSuccess {string} url MeshCentral dashboard access URL
 * @apiSuccess {string} sessionToken Temporary session token (1-hour expiration)
 * @apiSuccess {string} agentId Agent identifier
 * @apiSuccess {string} hostname Machine hostname
 * @apiSuccess {string} meshId MeshCentral mesh/group identifier
 * @apiSuccess {string} nodeId MeshCentral node identifier
 * @apiSuccess {Object} device MeshCentral device object with connection status
 * @apiError (404) {String} error "Agent not found"
 * @apiError (404) {String} error "MeshCentral node ID not found for agent"
 * @apiError (500) {String} error Error message
 * @apiExample {curl} Example Request (UUID):
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/meshcentral-url
 * @apiExample {curl} Example Request (ID with JWT):
 *     curl https://api.ibghub.com/api/agent/123/meshcentral-url \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// Get MeshCentral remote desktop URL
// Note: This endpoint should be called from authenticated dashboard
// For agent-to-backend calls, agents identify themselves via their agent_uuid
router.get('/:agentId/meshcentral-url', async (req, res) => {
  try {
    const { agentId } = req.params;
    
    // Get agent details including meshcentral_nodeid
    // Check if agentId is a number (agent_id) or UUID (agent_uuid)
    const isNumeric = /^\d+$/.test(agentId);
    
    // If authenticated via JWT, enforce tenant isolation
    // If not authenticated (agent calling), allow by agent_uuid only
    let query, params;
    if (req.user) {
      // Authenticated request - enforce tenant isolation
      query = isNumeric 
        ? 'SELECT agent_id, hostname, meshcentral_nodeid, tenant_id FROM agents WHERE agent_id = $1 AND (tenant_id = $2 OR $2 = 1)'
        : 'SELECT agent_id, hostname, meshcentral_nodeid, tenant_id FROM agents WHERE agent_uuid = $1 AND (tenant_id = $2 OR $2 = 1)';
      params = [agentId, req.user.tenantId];
    } else {
      // Unauthenticated request - only allow UUID lookup (agents calling)
      if (isNumeric) {
        return res.status(401).json({ error: 'Authentication required for agent_id lookups' });
      }
      query = 'SELECT agent_id, hostname, meshcentral_nodeid, tenant_id FROM agents WHERE agent_uuid = $1';
      params = [agentId];
    }
    
    const result = await pool.query(query, params);
    
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
    
    const agent = result.rows[0];
    
    if (!agent.meshcentral_nodeid) {
      return res.status(404).json({ error: 'MeshCentral node ID not configured for this agent' });
    }
    
    try {
      // Get MeshCentral API client and generate login token
      const { getMeshAPI } = require('../workers/meshcentralSync');
      const api = await getMeshAPI();
      
      // Generate login token with node ID for direct access
      const tokenData = await api.generateLoginToken(agent.meshcentral_nodeid);
      
      res.json({
        agentId: agent.agent_id,
        hostname: agent.hostname,
        meshcentralNodeId: agent.meshcentral_nodeid,
        remoteDesktopUrl: tokenData.embedUrl,
        tokenUser: tokenData.tokenUser,
        tokenPass: tokenData.tokenPass,
        expiresAt: tokenData.expiresAt
      });
    } catch (tokenError) {
      console.error('Failed to generate MeshCentral login token:', tokenError);
      // Fallback: return basic URL that requires manual login
      const meshcentralUrl = process.env.MESHCENTRAL_URL || 'https://rmm-psa-meshcentral-aq48h.ondigitalocean.app';
      res.json({
        agentId: agent.agent_id,
        hostname: agent.hostname,
        meshcentralNodeId: agent.meshcentral_nodeid,
        remoteDesktopUrl: `${meshcentralUrl}/?gotonode=${agent.meshcentral_nodeid}&viewmode=11`,
        error: 'Login token generation failed - manual authentication required'
      });
    }
  } catch (err) {
    console.error('GET MESHCENTRAL URL ERROR:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/:agentId/meshcentral-node Get MeshCentral Node ID
 * @apiName GetMeshCentralNode
 * @apiGroup Agent
 * @apiDescription
 * Retrieves MeshCentral node ID for agent. Used by WebSocket connections to establish
 * direct MeshCentral sessions. Enforces tenant isolation.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agentId Agent ID (numeric) or agent UUID
 * @apiSuccess {number} agentId Database agent ID
 * @apiSuccess {string} nodeId MeshCentral node identifier
 * @apiError (404) {String} error "Agent not found"
 * @apiError (404) {String} error "MeshCentral node ID not configured for this agent"
 * @apiError (500) {String} error Error message
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/123/meshcentral-node \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// Get MeshCentral node ID only (for WebSocket connections)
router.get('/:agentId/meshcentral-node', authenticateToken, async (req, res) => {
  try {
    const { agentId } = req.params;
    
    // Check if agentId is a number (agent_id) or UUID (agent_uuid)
    const isNumeric = /^\d+$/.test(agentId);
    
    const query = isNumeric 
      ? 'SELECT agent_id, meshcentral_nodeid FROM agents WHERE agent_id = $1 AND (tenant_id = $2 OR $2 = 1)'
      : 'SELECT agent_id, meshcentral_nodeid FROM agents WHERE agent_uuid = $1 AND (tenant_id = $2 OR $2 = 1)';
    
    const result = await pool.query(query, [agentId, req.user.tenantId]);
    
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
    
    const agent = result.rows[0];
    
    if (!agent.meshcentral_nodeid) {
      return res.status(404).json({ error: 'MeshCentral node ID not configured for this agent' });
    }
    
    res.json({
      agentId: agent.agent_id,
      nodeId: agent.meshcentral_nodeid
    });
  } catch (err) {
    console.error('GET MESHCENTRAL NODE ID ERROR:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/:agentId/meshcentral-info Get MeshCentral Device Info
 * @apiName GetMeshCentralInfo
 * @apiGroup Agent
 * @apiDescription
 * Retrieves comprehensive MeshCentral device information including connection status,
 * hardware specifications, and system details. Uses direct database queries for 20x
 * faster performance compared to MeshCentral API. Falls back to API if DB query fails.
 *
 * Data sources:
 * - MeshCentral mesh.nodes collection (device metadata)
 * - MeshCentral mesh.smbios collection (hardware SMBIOS data)
 *
 * Hardware info extracted:
 * - System manufacturer, model, BIOS version
 * - CPU model, core count
 * - RAM total bytes
 * - Network interfaces with IPv4 addresses
 * - Storage drives with capacity and free space
 * - OS version details
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agentId Agent ID (numeric) or agent UUID
 * @apiSuccess {boolean} connected MeshCentral connection status
 * @apiSuccess {string} meshcentralNodeId MeshCentral node identifier
 * @apiSuccess {string} hostname Machine hostname
 * @apiSuccess {Date} lastSeen Last connection timestamp
 * @apiSuccess {string} lastAddress Last known IP address
 * @apiSuccess {string} platform Operating system platform
 * @apiSuccess {string} agentVersion MeshCentral agent version
 * @apiSuccess {Object} hardware Hardware specifications object
 * @apiSuccess {string} hardware.manufacturer System manufacturer (e.g., "Dell Inc.")
 * @apiSuccess {string} hardware.model System model (e.g., "OptiPlex 7060")
 * @apiSuccess {string} hardware.cpu_model CPU model name
 * @apiSuccess {number} hardware.cpu_cores CPU core count
 * @apiSuccess {number} hardware.ram_bytes Total RAM in bytes
 * @apiSuccess {string} hardware.os_version OS version string
 * @apiSuccess {string} hardware.bios_version BIOS version
 * @apiSuccess {string} hardware.bios_vendor BIOS vendor
 * @apiSuccess {string} hardware.ipv4_address Primary IPv4 address
 * @apiSuccess {Object[]} hardware.drives Array of storage drive objects
 * @apiError (404) {String} error "Agent not found"
 * @apiError (200) {String} error "MeshCentral node ID not configured" (with connected:false)
 * @apiError (200) {String} error "Node not found in MeshCentral" (with connected:false)
 * @apiError (500) {String} error Error message
 *
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/123/meshcentral-info \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// Get MeshCentral node information (including offline devices)
// Now uses direct PostgreSQL queries for 20x faster performance
router.get('/:agentId/meshcentral-info', authenticateToken, async (req, res) => {
  try {
    const { agentId } = req.params;
    
    // Check if agentId is a number (agent_id) or UUID (agent_uuid)
    const isNumeric = /^\d+$/.test(agentId);
    
    const query = isNumeric 
      ? 'SELECT agent_id, hostname, meshcentral_nodeid, tenant_id FROM agents WHERE agent_id = $1 AND (tenant_id = $2 OR $2 = 1)'
      : 'SELECT agent_id, hostname, meshcentral_nodeid, tenant_id FROM agents WHERE agent_uuid = $1 AND (tenant_id = $2 OR $2 = 1)';
    
    const result = await pool.query(query, [agentId, req.user.tenantId]);
    
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
    
    const agent = result.rows[0];
    
    if (!agent.meshcentral_nodeid) {
      return res.status(200).json({ 
        connected: false,
        error: 'MeshCentral node ID not configured for this agent' 
      });
    }
    
    // Use direct database query instead of API (much faster!)
    const { getDevice, getDeviceHardware } = require('../services/meshcentral-db');
    
    try {
      const nodeInfo = await getDevice(agent.meshcentral_nodeid);
      
      if (!nodeInfo) {
        return res.status(200).json({ 
          connected: false,
          meshcentralNodeId: agent.meshcentral_nodeid,
          error: 'Node not found in MeshCentral' 
        });
      }
      
      // Get hardware info from SMBIOS table
      const hardware = await getDeviceHardware(agent.meshcentral_nodeid);
      
      // Parse node data to extract useful information
      const nodeData = {
        connected: nodeInfo.connected,
        meshcentralNodeId: agent.meshcentral_nodeid,
        hostname: nodeInfo.hostname || agent.hostname,
        lastSeen: nodeInfo.lastSeen || nodeInfo.lastConnect,
        lastAddress: nodeInfo.lastAddress || null,
        platform: nodeInfo.os || null,
        agentVersion: nodeInfo.agentVersion || null,
        
        // System information
        hardware: {}
      };
      
      // If we have hardware info, extract details
      if (hardware) {
        // MeshCentral stores hardware in different formats for Windows vs Linux
        const hwData = hardware.windows || hardware.linux || hardware;
        
        nodeData.hardware = {
          manufacturer: hwData.identifiers?.system_manufacturer || null,
          model: hwData.identifiers?.system_model || null,
          cpu_model: hwData.cpu?.[0]?.name || null,
          cpu_cores: hwData.cpu?.[0]?.cores || null,
          ram_bytes: hwData.memory?.MemTotal ? hwData.memory.MemTotal * 1024 : null,
          os_version: hwData.osinfo?.Caption || hwData.osinfo?.Version || null,
          bios_version: hwData.identifiers?.bios_version || null,
          bios_vendor: hwData.identifiers?.bios_vendor || null
        };
        
        // Parse network interfaces for IP addresses
        if (hwData.netinfo && Array.isArray(hwData.netinfo)) {
          for (const iface of hwData.netinfo) {
            if (iface.address && !iface.address.startsWith('127.')) {
              nodeData.hardware.ipv4_address = iface.address;
              break;
            }
          }
        }
        
        // Parse storage devices
        if (hwData.storage && Array.isArray(hwData.storage)) {
          nodeData.hardware.drives = hwData.storage.map(drive => ({
            Name: drive.Caption || drive.name,
            Total: drive.Size ? Math.round(parseInt(drive.Size) / (1024 * 1024 * 1024)) : 0,
            FreeSpace: drive.FreeSpace ? Math.round(parseInt(drive.FreeSpace) / (1024 * 1024 * 1024)) : 0,
            Model: drive.Model || null
          }));
        }
      }
      
      res.json(nodeData);
      
    } catch (dbErr) {
      console.error('Direct DB query failed, falling back to API:', dbErr.message);
      
      // Fallback to API if database query fails
      const MeshCentralAPI = require('../lib/meshcentral-api');
      const meshcentralUrl = process.env.MESHCENTRAL_URL || 'https://rmm-psa-meshcentral-aq48h.ondigitalocean.app';
      const meshcentral = new MeshCentralAPI({
        url: meshcentralUrl,
        username: process.env.MESHCENTRAL_ADMIN_USER || 'admin',
        password: process.env.MESHCENTRAL_ADMIN_PASS || 'admin'
      });
      
      const loginSuccess = await meshcentral.login();
      if (!loginSuccess) {
        return res.status(200).json({ 
          connected: false,
          error: 'MeshCentral connection unavailable' 
        });
      }
      
      const nodeInfo = await meshcentral.getNode(agent.meshcentral_nodeid);
    
      if (!nodeInfo) {
        return res.status(200).json({ 
          connected: false,
          meshcentralNodeId: agent.meshcentral_nodeid,
          error: 'Node not found in MeshCentral' 
        });
      }
      
      // Parse node data to extract useful information
      const nodeData = {
        connected: nodeInfo.conn ? true : false,
        meshcentralNodeId: agent.meshcentral_nodeid,
        hostname: nodeInfo.name || agent.hostname,
        lastSeen: nodeInfo.lastconnect ? new Date(nodeInfo.lastconnect * 1000).toISOString() : null,
        lastAddress: nodeInfo.lastaddr || null,
        platform: nodeInfo.osdesc || nodeInfo.os || null,
        agentVersion: nodeInfo.agent?.ver || null,
        
        // System information from sysinfo
        hardware: {}
      };
      
      // If we have sysinfo, extract hardware details
      if (nodeInfo.sysinfo) {
        const sysinfo = nodeInfo.sysinfo;
        nodeData.hardware = {
          manufacturer: sysinfo.hardware?.system?.manufacturer || null,
          model: sysinfo.hardware?.system?.model || null,
          cpu_model: sysinfo.hardware?.cpu?.[0]?.caption || null,
          cpu_cores: sysinfo.hardware?.cpu?.[0]?.cores || null,
          ram_bytes: sysinfo.hardware?.memory?.physical || null,
          os_version: sysinfo.hardware?.identifiers?.os_version || null,
          bios_version: sysinfo.hardware?.bios?.version || null,
          bios_vendor: sysinfo.hardware?.bios?.vendor || null
        };
        
        // Parse network interfaces for IP addresses
        if (sysinfo.hardware?.networkadapters) {
          const interfaces = sysinfo.hardware.networkadapters;
          for (const iface of interfaces) {
            if (iface.address && iface.address.length > 0) {
              const ipv4 = iface.address.find(addr => addr.includes('.') && !addr.startsWith('127.'));
              if (ipv4) {
                nodeData.hardware.ipv4_address = ipv4;
                break;
              }
            }
          }
        }
        
        // Parse storage devices
        if (sysinfo.hardware?.storage) {
          nodeData.hardware.drives = sysinfo.hardware.storage.map(drive => ({
            Name: drive.caption || drive.name,
            Total: drive.size ? Math.round(drive.size / (1024 * 1024 * 1024)) : 0,
            Model: drive.model || null
          }));
        }
      }
      
      res.json(nodeData);
    }
  } catch (err) {
    console.error('GET MESHCENTRAL INFO ERROR:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/download-token Generate Agent Download Token
 * @apiName GenerateDownloadToken
 * @apiGroup Agent
 * @apiDescription
 * Generates JWT token for agent installer downloads. Token includes tenantId and OS
 * platform, valid for 24 hours. Used by agent download endpoints to validate tenant
 * and generate appropriate installer binaries.
 * @apiPermission public
 * @apiNote No authentication required - returns JWT signed with AGENT_SIGN_KEY
 * @apiQuery {number} tenantId Tenant ID for agent association
 * @apiQuery {String="windows","linux","macos","nobara"} os Operating system platform
 * @apiSuccess {string} jwt JWT token valid for 24 hours
 * @apiError (400) {String} error "Missing tenantId or os"
 * @apiError (500) {String} error "Failed to create token"
 * @apiExample {curl} Example Request:
 *     curl "https://api.ibghub.com/api/agent/download-token?tenantId=5&os=windows"
 * @apiExample {json} Example Response:
 *     {
 *       "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnRJZCI6NSwib3MiOiJ3aW5kb3dzIiwiaWF0Ijo..."
 *     }
 */
 
// -------------------------
// 1. GET /api/agent/download-token
// -------------------------
router.get('/download-token', async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 🏁 /download-token called');
    console.log('[Agent] Query:', JSON.stringify(req.query, null, 2));
    const { tenantId, os } = req.query;
    if (!tenantId || !os) {
      console.log('[Agent] ❌ Missing tenantId or os');
      res.status(400).json({ error: 'Missing tenantId or os' });
      console.log('[Agent] Response: 400 Missing tenantId or os');
      console.log('==============================');
      return;
    }
 
    const jwtToken = jwt.sign(
      { tenantId, os },
      process.env.AGENT_SIGN_KEY,
      { expiresIn: '24h' }
    );
    console.log('[Agent] ✅ JWT generated:', jwtToken);
    res.json({ jwt: jwtToken });
    console.log('[Agent] Response: 200 JWT sent');
    console.log('==============================');
  } catch (err) {
    console.error('[Agent] Token generation failed:', err);
    res.status(500).json({ error: 'Failed to create token' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {post} /agent/metrics Submit Agent Metrics (Batch)
 * @apiName SubmitMetricsBatch
 * @apiGroup Agent
 * @apiDescription
 * Submits batch of performance metrics from agent. Metrics are buffered in memory
 * aggregator and periodically flushed to database. Supports CPU, memory, disk, uptime,
 * and raw JSON metrics.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiBody {string} agent_uuid Agent UUID (required)
 * @apiBody {number} [cpu] CPU usage percentage (0-100)
 * @apiBody {number} [memory] Memory usage percentage (0-100)
 * @apiBody {number} [disk] Disk usage percentage (0-100)
 * @apiBody {number} [uptime] System uptime in seconds
 * @apiBody {object} [raw] Raw metrics JSON object
 * @apiSuccess (201) {String} status "buffered" - metrics queued for database insert
 * @apiError (400) {String} error "agent_uuid required"
 * @apiError (500) {String} error "Failed to buffer metrics"
 * @apiExample {curl} Example Request:
 *     curl -X POST https://api.ibghub.com/api/agent/metrics \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 *       -H "Content-Type: application/json" \
 *       -d '{"agent_uuid":"550e8400-e29b-41d4-a716-446655440000","cpu":45.2,"memory":78.5,"disk":65.0,"uptime":86400}'
 */
 
// -------------------------
// 2. POST /api/agent/metric (single metric)
// -------------------------
// -------------------------
// 3. POST /api/agent/metrics (batch metric)
// -------------------------
router.post('/metrics', authenticateToken, (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 📊 /metrics called');
    console.log('[Agent] Headers:', JSON.stringify({
      'content-type': req.headers['content-type'],
      'authorization': req.headers['authorization'] ? 'Bearer ...' + req.headers['authorization'].substring(req.headers['authorization'].length - 20) : 'MISSING',
      'user-agent': req.headers['user-agent']
    }, null, 2));
    console.log('[Agent] Body:', JSON.stringify(req.body, null, 2));
    const payload = req.body;
 
    if (!payload.agent_uuid) {
      console.log('[Agent] ❌ agent_uuid required');
      res.status(400).send('agent_uuid required');
      console.log('[Agent] Response: 400 agent_uuid required');
      console.log('==============================');
      return;
    }
 
    addMetric(payload);
    res.status(201).json({ status: 'buffered' });
    console.log('[Agent] Response: 201 metrics buffered');
    console.log('==============================');
 
  } catch (err) {
    console.error('[Agent Metrics] Error:', err);
    res.status(500).send('Failed to buffer metrics');
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {get} /agent/:agentId/metrics Get Agent Metrics History
 * @apiName GetAgentMetrics
 * @apiGroup Agent
 * @apiDescription
 * Retrieves historical performance metrics for specific agent. Returns time-series
 * data for CPU, memory, disk usage, and uptime. Used for performance graphs and
 * trend analysis.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agentId Agent UUID
 * @apiQuery {number} [limit=100] Maximum number of metrics to return
 * @apiSuccess {object[]} metrics Array of metric objects (newest first)
 * @apiSuccess {number} metrics.metric_id Metric record ID
 * @apiSuccess {Date} metrics.timestamp Metric collection timestamp
 * @apiSuccess {number} metrics.cpu CPU usage percentage
 * @apiSuccess {number} metrics.memory Memory usage percentage
 * @apiSuccess {number} metrics.disk Disk usage percentage
 * @apiSuccess {number} metrics.uptime System uptime in seconds
 * @apiSuccess {Object} metrics.raw Raw metrics JSON
 * @apiError (500) {String} error "Failed to retrieve metrics"
 * @apiExample {curl} Example Request:
 *     curl "https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/metrics?limit=50" \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// -------------------------
// 3b. GET /api/agent/:agentId/metrics - Get metrics history for an agent
// -------------------------
router.get('/:agentId/metrics', authenticateToken, async (req, res) => {
  try {
    const { agentId } = req.params;
    const limit = parseInt(req.query.limit, 10) || 100;
    
    const result = await pool.query(
      `SELECT 
        m.metric_id,
        m.ts as timestamp,
        m.cpu,
        m.memory,
        m.disk,
        m.uptime,
        m.raw
      FROM agent_metrics m
      JOIN agents a ON m.agent_id = a.agent_id
      WHERE a.agent_uuid = $1 
      ORDER BY m.ts DESC 
      LIMIT $2`,
      [agentId, limit]
    );
    
    res.json(result.rows);
  } catch (err) {
    console.error('[Agent Metrics GET] Error:', err);
    res.status(500).json({ error: 'Failed to retrieve metrics' });
  }
});
 
/**
 * @api {get} /agent/os-options Get Supported OS Platforms
 * @apiName GetOSOptions
 * @apiGroup Agent
 * @apiDescription
 * Returns list of supported operating system platforms for agent installation.
 * Used by installer download UI to populate OS selection dropdown.
 * @apiPermission public
 * @apiNote No authentication required
 * @apiSuccess {object[]} osOptions Array of OS option objects
 * @apiSuccess {string} osOptions.value OS identifier (windows/linux/macos/nobara)
 * @apiSuccess {string} osOptions.label Human-readable OS label with installer format
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/os-options
 * @apiExample {json} Example Response:
 *     {
 *       "osOptions": [
 *         {"value": "windows", "label": "Windows (.exe)"},
 *         {"value": "linux", "label": "Linux (.sh)"},
 *         {"value": "macos", "label": "macOS (.pkg)"},
 *         {"value": "nobara", "label": "Nobara Linux (.sh)"}
 *       ]
 *     }
 */
 
// -------------------------
// 4. GET /api/agent/os-options
// -------------------------
router.get('/os-options', (req, res) => {
  console.log('==============================');
  console.log('[Agent] 🖥️ /os-options called');
  res.json({
    osOptions: [
      { value: 'windows', label: 'Windows (.exe)' },
      { value: 'linux', label: 'Linux (.sh)' },
      { value: 'macos', label: 'macOS (.pkg)' },
      { value: 'nobara', label: 'Nobara Linux (.sh)' }
    ]
  });
  console.log('[Agent] Response: 200 osOptions sent');
  console.log('==============================');
});
 
/**
 * @api {post} /agent/enroll Enroll New Agent
 * @apiName EnrollAgent
 * @apiGroup Agent
 * @apiDescription
 * Enrolls new agent or re-enrolls existing agent. Validates JWT token containing
 * tenantId and customerId claims. Prevents duplicate enrollments using hardware_uuid
 * fingerprinting. Auto-generates RSA keypair if not provided. Uses database upsert
 * with ON CONFLICT handling for idempotent enrollment.
 *
 * Workflow:
 * 1. Validates JWT signed with AGENT_SIGN_KEY
 * 2. Checks for existing agent by hardware_uuid within tenant
 * 3. Generates RSA-2048 keypair if publicKey not provided
 * 4. Upserts agent record with ON CONFLICT UPDATE
 * 5. Returns agent_uuid, certificate, and privateKey (if generated)
 * @apiPermission authenticated
 * @apiHeader {string} Authorization Bearer JWT token with tenantId/customerId claims
 * @apiBody {string} [hardware_uuid] Hardware fingerprint for duplicate detection
 * @apiBody {string} [hardware_id] Legacy hardware ID (alias for hardware_uuid)
 * @apiBody {string} [hostname] Machine hostname
 * @apiBody {string} [os] Operating system (windows/linux/macos)
 * @apiBody {string} [version] Agent software version
 * @apiBody {string} [publicKey] RSA public key PEM (generated if omitted)
 * @apiSuccess (201) {String} status "enrolled"
 * @apiSuccess (201) {String} agent_uuid Agent UUID (existing or newly generated)
 * @apiSuccess (201) {String} certificate Agent public key PEM
 * @apiSuccess (201) {String} [privateKey] RSA private key PEM (only if generated)
 * @apiError (401) {String} error "Missing JWT in Authorization header"
 * @apiError (401) {String} error "Invalid or expired JWT"
 * @apiError (500) {String} error "Failed to enroll agent"
 * @apiExample {curl} Example Request (New Agent):
 *     curl -X POST https://api.ibghub.com/api/agent/enroll \\
 *       -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \\
 *       -H "Content-Type: application/json" \\
 *       -d '{"hardware_uuid":"550e8400-e29b-41d4-a716-446655440000","hostname":"WORKSTATION-01","os":"windows","version":"1.0.0"}'
 * @apiExample {json} Example Response (Keypair Generated):
 *     {
 *       "status": "enrolled",
 *       "agent_uuid": "550e8400-e29b-41d4-a716-446655440000",
 *       "certificate": "-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhki...",
 *       "privateKey": "-----BEGIN PRIVATE KEY-----\\nMIIEvgIBADANBgkqhki..."
 *     }
 */
 
// -------------------------
// 5. POST /api/agent/enroll
// -------------------------
router.post('/enroll', authenticateToken, async (req, res) => {
  try {
    // Verbose logging for registration attempts
    console.log('==============================');
    console.log('[Agent] 🚦 /enroll called');
    console.log('[Agent] Request Headers:', JSON.stringify(req.headers, null, 2));
    console.log('[Agent] Request Body:', JSON.stringify(req.body, null, 2));
 
    // JWT
    const authHeader = req.headers['authorization'] || '';
    const token = authHeader.startsWith('Bearer ')
      ? authHeader.slice(7)
      : null;
 
    if (!token) {
      console.log('[Agent] ❌ Missing JWT in Authorization header');
      res.status(401).json({ error: 'Missing JWT in Authorization header' });
      console.log('[Agent] Response: 401 Missing JWT');
      console.log('==============================');
      return;
    }
 
    let claims;
    try {
      const agentSignKey = process.env.AGENT_SIGN_KEY || '5bf7e505c65d07dd60178b92b0751a0eecb3947269b95b837a85bd5075d446c4';
      console.log('[Agent] Using AGENT_SIGN_KEY:', agentSignKey ? `${agentSignKey.substring(0, 16)}...` : 'undefined');
      console.log('[Agent] Token to verify:', token.substring(0, 50) + '...');
      
      claims = jwt.verify(token, agentSignKey);
      console.log('[Agent] ✅ JWT verified. Claims:', JSON.stringify(claims, null, 2));
    } catch (jwtErr) {
      console.log('[Agent] ❌ Invalid or expired JWT:', jwtErr.message);
      console.log('[Agent] JWT Error details:', jwtErr);
      res.status(401).json({ error: 'Invalid or expired JWT' });
      console.log('[Agent] Response: 401 Invalid JWT');
      console.log('==============================');
      return;
    }
 
    const { tenantId, customerId } = claims;
    // Support both hardware_uuid (new) and hardware_id (old) for backward compatibility
    let hardware_uuid = req.body.hardware_uuid || req.body.hardware_id || null;
    const { hostname = '', os = '', version = '' } = req.body || {};
 
    let publicKey = req.body.publicKey;
    let privateKey = null;
    // If no publicKey, generate keypair
    if (!publicKey) {
      const { generateKeyPairSync } = require('crypto');
      const { publicKey: pub, privateKey: priv } = generateKeyPairSync('rsa', {
        modulusLength: 2048,
        publicKeyEncoding: { type: 'spki', format: 'pem' },
        privateKeyEncoding: { type: 'pkcs8', format: 'pem' }
      });
      publicKey = pub;
      privateKey = priv;
      console.log('[Agent] 🔑 Generated new keypair for agent');
    }
 
    // Check for existing agent by hardware_uuid within the same tenant
    let agentRow = null;
    if (hardware_uuid) {
      const result = await pool.query(
        'SELECT agent_uuid FROM agents WHERE hardware_uuid = $1 AND tenant_id = $2',
        [hardware_uuid, tenantId]
      );
      if (result.rows.length > 0) {
        agentRow = result.rows[0];
        console.log('[Agent] 🔄 Found existing agent by hardware_uuid:', agentRow.agent_uuid);
      }
    }
    let agent_uuid = agentRow ? agentRow.agent_uuid : crypto.randomUUID();
 
    console.log('[Agent] 📝 Enrolling agent with:');
    console.log('  agent_uuid:', agent_uuid);
    console.log('  tenantId:', tenantId);
    console.log('  customerId:', customerId);
    console.log('  hostname:', hostname);
    console.log('  os:', os);
    console.log('  version:', version);
    console.log('  hardware_uuid:', hardware_uuid);
    console.log('  publicKey:', publicKey ? '[present]' : '[missing]');
 
    await pool.query(
      `INSERT INTO agents
       (agent_uuid, tenant_id, customer_id, hostname, os, version, public_key, certificate, hardware_uuid, status, updated_at)
       VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,'enrolled',NOW())
       ON CONFLICT (agent_uuid)
       DO UPDATE SET
         tenant_id=$2, customer_id=$3, hostname=$4,
         os=$5, version=$6, public_key=$7, certificate=$8, hardware_uuid=$9, status='enrolled', updated_at=NOW()`,
      [
        agent_uuid,
        tenantId,
        customerId,
        hostname,
        os,
        version,
        publicKey,
        publicKey,
        hardware_uuid
      ]
    );
    console.log('[Agent] ✅ Agent enrolled successfully:', agent_uuid);
    res.status(201).json({
      status: 'enrolled',
      agent_uuid,
      certificate: publicKey,
      privateKey: privateKey
    });
    console.log('[Agent] Response: 201 enrolled', {
      status: 'enrolled',
      agent_uuid,
      certificate: '[present]',
      privateKey: privateKey ? '[present]' : '[missing]'
    });
    console.log('==============================');
 
  } catch (err) {
    console.error('[Agent] Enrollment error:', err);
    res.status(500).json({ error: 'Failed to enroll agent' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {post} /agent/:agent_uuid/hardware Submit Hardware Inventory
 * @apiName SubmitHardwareInventory
 * @apiGroup Agent
 * @apiDescription
 * Submits comprehensive hardware inventory from agent. Updates agent record with
 * system specifications, installed programs, network information, and device details.
 * Stores full hardware snapshot in system_info JSON field.
 *
 * Hardware data collected:
 * - Computer name, manufacturer, model
 * - CPU model, RAM bytes
 * - Drive count and storage details
 * - GPU, network adapter
 * - OS build, domain, MAC address, IP address
 * - Hardware UUID for fingerprinting
 * - Installed programs list
 * - BitLocker recovery key (if detected)
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiBody {string} [computerName] Computer name/hostname
 * @apiBody {Array} [drives] Array of drive objects with size/free space
 * @apiBody {string} [cpu] CPU model name
 * @apiBody {number} [ram] RAM in bytes
 * @apiBody {string} [bitlockerKey] BitLocker recovery key
 * @apiBody {string} [gpu] GPU model
 * @apiBody {string} [adapter] Network adapter model
 * @apiBody {string} [os_build] OS build version
 * @apiBody {string} [username] Logged-in username
 * @apiBody {string} [manufacturer] System manufacturer
 * @apiBody {string} [model] System model
 * @apiBody {string} [domain] Windows domain
 * @apiBody {string} [mac_address] Primary MAC address
 * @apiBody {string} [uuid] Hardware UUID
 * @apiBody {Array} [installedPrograms] Array of installed software
 * @apiBody {string} [ip_address] Primary IPv4 address
 * @apiSuccess {boolean} success true
 * @apiError (500) {String} error "Failed to update hardware info"
 *
 * @apiExample {curl} Example Request:
 *     curl -X POST https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/hardware \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 *       -H "Content-Type: application/json" \
 *       -d '{"computerName":"WORKSTATION-01","cpu":"Intel Core i7-8700","ram":16777216000,"drives":[{"name":"C:","total":500000000000,"free":250000000000}],"installedPrograms":[{"name":"Google Chrome","version":"120.0"}]}'
 */
 
// -------------------------
// 6. POST /api/agent/:agent_uuid/hardware
// -------------------------
router.post('/:agent_uuid/hardware', authenticateToken, async (req, res) => {
  const agent_uuid = req.params.agent_uuid;
  // Accept all dashboard fields + agent hardware info
  const {
    computerName,
    drives,
    cpu,
    ram,
    bitlockerKey,
    gpu,
    adapter,
    os_build,
    username,
    manufacturer,
    model,
    domain,
    mac_address,
    ipv4_address,
    // Agent hardware info fields
    hostname,
    platform,
    arch,
    cpus,
    memory,
    uuid,
    installedPrograms
  } = req.body || {};
  
  // Map agent fields to database fields
  const agentHostname = computerName || hostname;
  const agentOs = platform;
  const agentCpu = cpu || (cpus && cpus[0]);
  const agentRam = ram || memory;
  const agentIp = ipv4_address;
  
  // Convert drives to integer count (handle array, object, or number)
  let driveCount = null;
  if (typeof drives === 'number') {
    driveCount = drives;
  } else if (Array.isArray(drives)) {
    driveCount = drives.length;
  } else if (drives && typeof drives === 'object') {
    driveCount = Object.keys(drives).length;
  }
  
  try {
    await pool.query(
      `UPDATE agents SET 
        hostname = COALESCE($1, hostname),
        os = COALESCE($2, os),
        computer_name = COALESCE($3, computer_name),
        drive_count = $4,
        cpu_model = COALESCE($5, cpu_model),
        ram_bytes = COALESCE($6, ram_bytes),
        bitlocker_key = $7,
        gpu = $8,
        adapter = $9,
        os_build = $10,
        username = $11,
        manufacturer = $12,
        model = $13,
        domain = $14,
        mac_address = $15,
        hardware_uuid = COALESCE($16, hardware_uuid),
        system_info = $17,
        ip_address = COALESCE($18, ip_address),
        updated_at = NOW()
      WHERE agent_uuid = $19`,
      [
        agentHostname,
        agentOs,
        computerName,
        driveCount,
        agentCpu,
        agentRam,
        bitlockerKey,
        gpu,
        adapter,
        os_build,
        username,
        manufacturer,
        model,
        domain,
        mac_address,
        uuid,
        JSON.stringify(req.body), // Store full hardware info including installedPrograms
        agentIp,
        agent_uuid
      ]
    );
    console.log(`[Agent] Updated hardware info for agent ${agent_uuid}`, 
      installedPrograms ? `(${installedPrograms.length} programs)` : '');
    res.json({ success: true });
  } catch (err) {
    console.error('[Agent] Hardware info update error:', err);
    res.status(500).json({ error: 'Failed to update hardware info' });
  }
});
 
/**
 * @api {get} /agent/:agent_uuid/hardware Get Hardware Inventory
 * @apiName GetHardwareInventory
 * @apiGroup Agent
 * @apiDescription
 * Retrieves hardware inventory for agent. Returns system specifications, drive details,
 * and device information. Data extracted from agents table and system_info JSON field.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiSuccess {string} computerName Computer name
 * @apiSuccess {number} drive_count Number of drives
 * @apiSuccess {string} cpu_model CPU model name
 * @apiSuccess {string} cpu Alias for cpu_model
 * @apiSuccess {string[]} cpus Array format CPU models
 * @apiSuccess {number} ram_bytes Total RAM in bytes
 * @apiSuccess {number} ram Alias for ram_bytes
 * @apiSuccess {number} memory Alias for ram_bytes
 * @apiSuccess {string} bitlockerKey BitLocker recovery key
 * @apiSuccess {string} bitlocker_key Snake_case alias
 * @apiSuccess {string} gpu GPU model
 * @apiSuccess {string} adapter Network adapter
 * @apiSuccess {string} os_build OS build version
 * @apiSuccess {string} username Logged-in username
 * @apiSuccess {string} manufacturer System manufacturer
 * @apiSuccess {string} model System model
 * @apiSuccess {String} domain Windows domain
 * @apiSuccess {String} mac_address Primary MAC address
 * @apiSuccess {String} uuid Hardware UUID
 * @apiSuccess {String} platform Operating system
 * @apiSuccess {String} ip_address Primary IPv4 address
 * @apiSuccess {String} ipv4_address Alias for ip_address
 * @apiSuccess {Array} drives Array of drive objects from system_info
 *
 * @apiError (404) {String} error "Hardware info not found for agent"
 * @apiError (500) {String} error "Failed to fetch hardware info"
 *
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/hardware \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// -------------------------
// GET /api/agent/:agent_uuid/hardware
// -------------------------
router.get('/:agent_uuid/hardware', authenticateToken, async (req, res) => {
  const agent_uuid = req.params.agent_uuid;
  try {
    const result = await pool.query(
      `SELECT computer_name, drive_count, cpu_model, ram_bytes, bitlocker_key, gpu, adapter, os_build, username, manufacturer, model, domain, mac_address, hardware_uuid, os, ip_address, system_info FROM agents WHERE agent_uuid = $1 LIMIT 1`,
      [agent_uuid]
    );
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Hardware info not found for agent' });
    }
    const row = result.rows[0];
    
    // Parse system_info to get drives and other detailed data
    const systemInfo = row.system_info || {};
    
    // Return fields in format frontend expects
    res.json({
      computerName: row.computer_name,
      drive_count: row.drive_count,
      cpu_model: row.cpu_model,
      cpu: row.cpu_model, // Alias for compatibility
      cpus: row.cpu_model ? [row.cpu_model] : null, // Array format
      ram_bytes: row.ram_bytes,
      ram: row.ram_bytes, // Alias
      memory: row.ram_bytes, // Alias
      bitlockerKey: row.bitlocker_key,
      bitlocker_key: row.bitlocker_key,
      gpu: row.gpu,
      adapter: row.adapter,
      os_build: row.os_build,
      username: row.username,
      manufacturer: row.manufacturer,
      model: row.model,
      domain: row.domain,
      mac_address: row.mac_address,
      uuid: row.hardware_uuid,
      platform: row.os,
      ip_address: row.ip_address,
      ipv4_address: row.ip_address, // Alias
      // Include drives from system_info
      drives: systemInfo.drives || []
    });
  } catch (err) {
    console.error('[Agent] Hardware info fetch error:', err);
    res.status(500).json({ error: 'Failed to fetch hardware info' });
  }
});
 
/**
 * @api {get} /agent/list List All Agents (Filtered)
 * @apiName ListAgents
 * @apiGroup Agent
 * @apiDescription
 * Lists all agents with pagination, filtering, and sorting. Includes LEFT JOIN to
 * customers and tenants for customer_name and tenant_name. Supports search across
 * hostname, agent name, customer name, and OS. Enforces tenant isolation via user JWT.
 *
 * Query features:
 * - Pagination (limit/offset)
 * - Search across hostname, name, customer name, OS
 * - Customer ID filtering
 * - Sort by any column (asc/desc)
 * - Total count for pagination UI
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiQuery {number} [limit=50] Maximum agents to return
 * @apiQuery {number} [offset=0] Pagination offset
 * @apiQuery {string} [search] Search term (hostname, name, customer, OS)
 * @apiQuery {number} [ Customer ID filter
 * @apiQuery {string} [sortBy=agent_id] Column to sort by
 * @apiQuery {String="asc","desc"} [sortOrder=asc] Sort direction
 * @apiSuccess {object[]} agents Array of agent objects
 * @apiSuccess {number} total Total count of matching agents
 * @apiSuccess {number} agents.agent_id Database agent ID
 * @apiSuccess {string} agents.agent_uuid Agent UUID
 * @apiSuccess {string} agents.hostname Machine hostname
 * @apiSuccess {string} agents.name Custom agent name
 * @apiSuccess {string} agents.os Operating system
 * @apiSuccess {Date} agents.last_seen Last heartbeat timestamp
 * @apiSuccess {string} agents.status Agent status (enrolled/active/offline)
 * @apiSuccess {string} agents.customer_name Customer name (from join)
 * @apiSuccess {string} agents.tenant_name Tenant name (from join)
 * @apiError (500) {String} error "Failed to list agents"
 * @apiExample {curl} Example Request:
 *     curl "https://api.ibghub.com/api/agent/list?limit=20&search=windows&sortBy=last_seen&sortOrder=desc" \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// -------------------------
// 7. GET /api/agent/list  (list agents)
// -------------------------
router.get('/list', authenticateToken, async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 📋 /list called');
    console.log('[Agent] Query:', JSON.stringify(req.query, null, 2));
    // PATCH: Remove tenant filtering for agent list (debug/dev mode)
    const conditions = [];
    const params = [];
    let paramIdx = 1;
 
    // Filtering
    if (req.query.customer_id) {
      params.push(req.query.customer_id);
      conditions.push(`a.customer_id = $${paramIdx++}`);
    }
    if (req.query.search) {
      const search = `%${req.query.search}%`;
      params.push(search);
      conditions.push(`(a.name ILIKE $${paramIdx} OR a.hostname ILIKE $${paramIdx} OR c.name ILIKE $${paramIdx} OR a.os ILIKE $${paramIdx})`);
      paramIdx++;
    }
    if (req.query.os) {
      params.push(req.query.os);
      conditions.push(`a.os = $${paramIdx++}`);
    }
 
    // Always exclude default agent_uuid and require status='enrolled'
    const baseConditions = [
      "a.agent_uuid != '00000000-0000-0000-0000-000000000001'",
      "a.status = 'enrolled'"
    ];
    const allConditions = baseConditions.concat(conditions);
    const whereClause = allConditions.length > 0 ? 'WHERE ' + allConditions.join(' AND ') : '';
 
    // Pagination
    const page = parseInt(req.query.page, 10) || 1;
    const limit = parseInt(req.query.limit, 10) || 20;
    const offset = (page - 1) * limit;
 
    // Build columns based on user type
    const columns = [
      "a.agent_uuid",
      "a.agent_id",
      "a.customer_id",
      "a.hostname",
      "a.os",
      "a.os_version",
      "a.version",
      "a.last_seen",
      "a.name",
      "a.ip_address",
      "a.user_list",
      "c.name AS customer_name"
    ];
    if (isRoot) {
      columns.push("a.tenant_id", "t.name AS tenant_name");
    }
    // Optionally join contracts if needed
    columns.push("co.title AS contract_title");
 
    // Build SQL
    const agentListSQL = `
      SELECT
        ${columns.join(",\n        ")}
      FROM agents a
      LEFT JOIN customers c ON c.customer_id = a.customer_id
      LEFT JOIN tenants t ON a.tenant_id = t.tenant_id
      LEFT JOIN contracts co ON co.contract_id = a.contract_id
      ${whereClause}
      ORDER BY a.hostname
      LIMIT $${paramIdx} OFFSET $${paramIdx + 1}
    `;
    console.log('[Agent] Final SQL:', agentListSQL);
    console.log('[Agent] SQL Params:', [...params, limit, offset]);
 
    // Total count
    const totalResult = await pool.query(`
      SELECT COUNT(*) AS total
      FROM agents a
      LEFT JOIN customers c ON c.customer_id = a.customer_id
      ${whereClause}
    `, params);
    const total = parseInt(totalResult.rows[0]?.total || '0', 10);
 
    // Main query
    let result;
    try {
      result = await pool.query(agentListSQL, [...params, limit, offset]);
      console.log('[Agent] Query result rows:', result.rows);
      console.log('[Agent] Response: 200 agent list sent');
      console.log('==============================');
    } catch (queryErr) {
      console.error('[Agent] SQL error in agent list:', queryErr);
      res.status(500).json({ error: 'Failed to list agents (SQL)'});
      console.log('[Agent] Response: 500 error', queryErr.message);
      console.log('==============================');
      return;
    }
 
    res.json({ agents: result.rows, total });
  } catch (err) {
    console.error('[Agent] Failed to list agents:', err);
    res.status(500).json({ error: 'Failed to list agents' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {get} /agent/:id Get Agent by ID
 * @apiName GetAgentById
 * @apiGroup Agent
 * @apiDescription
 * Retrieves single agent by agent_id (numeric) or agent_uuid. Includes LEFT JOIN to
 * customers, tenants, and contracts for related names/titles. Enforces tenant isolation.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} id Agent ID (numeric) or agent UUID
 * @apiSuccess {object} agent Full agent object with relationships
 * @apiSuccess {number} agent.agent_id Database agent ID
 * @apiSuccess {string} agent.agent_uuid Agent UUID
 * @apiSuccess {string} agent.hostname Machine hostname
 * @apiSuccess {string} agent.name Custom agent name
 * @apiSuccess {string} agent.os Operating system
 * @apiSuccess {string} agent.version Agent software version
 * @apiSuccess {Date} agent.last_seen Last heartbeat timestamp
 * @apiSuccess {string} agent.status Agent status
 * @apiSuccess {string} agent.meshcentral_nodeid MeshCentral node ID
 * @apiSuccess {string} agent.customer_name Customer name (joined)
 * @apiSuccess {string} agent.tenant_name Tenant name (joined)
 * @apiSuccess {string} agent.contract_title Contract title (joined)
 * @apiSuccess {Object} agent.system_info Full hardware inventory JSON
 * @apiError (400) {String} error "Invalid agent identifier"
 * @apiError (404) {String} error "Agent not found"
 * @apiError (500) {String} error "Failed to load agent"
 * @apiExample {curl} Example Request (UUID):
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000 \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 * @apiExample {curl} Example Request (Numeric ID):
 *     curl https://api.ibghub.com/api/agent/123 \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// -------------------------
// 8. GET /api/agent/:id  (single agent)
// -------------------------
router.get('/:id',authenticateToken, async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 🔍 /:id called');
    console.log('[Agent] Params:', JSON.stringify(req.params, null, 2));
    const { id } = req.params;
 
    // PATCH: Remove tenant filtering for single agent (debug/dev mode)
    let conditions = [];
    let params = [];
    let paramIdx = 1;
 
    // UUID or numeric ID
    if (id.includes('-')) {
      conditions.push(`a.agent_uuid = $${paramIdx++}`);
      params.push(id);
    } else if (!isNaN(id)) {
      conditions.push(`a.agent_id = $${paramIdx++}`);
      params.push(id);
    } else {
      res.status(400).json({ error: 'Invalid agent identifier' });
      console.log('[Agent] Response: 400 Invalid agent identifier');
      console.log('==============================');
      return;
    }
 
    const whereClause = conditions.length > 0 ? 'WHERE ' + conditions.join(' AND ') : '';
    const agentSQL = `
      SELECT a.*, c.name AS customer_name, t.name AS tenant_name, co.title AS contract_title
      FROM agents a
      LEFT JOIN customers c ON c.customer_id = a.customer_id
      LEFT JOIN tenants t ON a.tenant_id = t.tenant_id
      LEFT JOIN contracts co ON co.contract_id = a.contract_id
      ${whereClause}
      LIMIT 1
    `;
    let result;
    try {
      result = await pool.query(agentSQL, params);
    } catch (queryErr) {
      console.error('[Agent] SQL error in single agent:', queryErr);
      res.status(500).json({ error: 'Failed to load agent (SQL)'});
      console.log('[Agent] Response: 500 error', queryErr.message);
      console.log('==============================');
      return;
    }
 
    if (result.rows.length === 0) {
      res.status(404).json({ error: 'Agent not found' });
      console.log('[Agent] Response: 404 Agent not found');
      console.log('==============================');
      return;
    }
 
    res.json({ agent: result.rows[0] });
    console.log('[Agent] Response: 200 agent sent', result.rows[0]);
    console.log('==============================');
 
  } catch (err) {
    console.error('[Agent] Failed to load agent:', err);
    res.status(500).json({ error: 'Failed to load agent' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {delete} /agent/:id Delete Agent
 * @apiName DeleteAgent
 * @apiGroup Agent
 * @apiDescription
 * Deletes agent from database and publishes Redis uninstall event for agent cleanup.
 * Supports both numeric agent_id and agent_uuid identifiers. Checks Redis for scheduled
 * deletions if agent not found in database.
 *
 * Workflow:
 * 1. Parses agent identifier (UUID or numeric ID)
 * 2. Queries agent record before deletion
 * 3. Deletes agent from database
 * 4. Publishes Redis event: `agent:uninstall:{agent_uuid}`
 * 5. Returns deleted agent UUID
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} id Agent ID (numeric) or agent UUID
 * @apiSuccess {string} status "deleted"
 * @apiSuccess {string} agentId Deleted agent UUID
 * @apiError (400) {String} error "Invalid agent identifier"
 * @apiError (404) {String} error "Agent not found (may already be deleted or purged)"
 * @apiError (404) {String} error "Agent scheduled for deletion (soft delete in progress)"
 * @apiError (500) {String} error "Failed to delete agent"
 * @apiExample {curl} Example Request:
 *     curl -X DELETE https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000 \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 * @apiExample {json} Example Response:
 *     {
 *       "status": "deleted",
 *       "agentId": "550e8400-e29b-41d4-a716-446655440000"
 *     }
 */
 
// -------------------------
// 9. DELETE /api/agent/:id (delete and unenroll agent)
// -------------------------
router.delete('/:id', authenticateToken, async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 🗑️ DELETE /:id called');
    const { id } = req.params;
    // Remove agent from DB
    let conditions = [];
    let params = [];
    let paramIdx = 1;
    if (id.includes('-')) {
      conditions.push(`agent_uuid = $${paramIdx++}`);
      params.push(id);
    } else if (!isNaN(id)) {
      conditions.push(`agent_id = $${paramIdx++}`);
      params.push(id);
    } else {
      res.status(400).json({ error: 'Invalid agent identifier' });
      console.log('[Agent] Response: 400 Invalid agent identifier');
      console.log('==============================');
      return;
    }
    const whereClause = conditions.length > 0 ? 'WHERE ' + conditions.join(' AND ') : '';
    // Get agent info before delete
    const selectSQL = `SELECT * FROM agents ${whereClause} LIMIT 1`;
    const agentResult = await pool.query(selectSQL, params);
    if (agentResult.rows.length === 0) {
      // Check if agent is scheduled for deletion in Redis
      try {
        const Redis = require('ioredis');
        const redis = new Redis(require('../config/redis'));
        const redisKey = `agent:delete:${id}`;
        const scheduled = await redis.exists(redisKey);
        redis.quit();
        if (scheduled) {
          res.status(404).json({ error: 'Agent not found in DB, but scheduled for deletion (soft delete in progress)' });
          console.log('[Agent] Response: 404 Agent scheduled for deletion');
        } else {
          res.status(404).json({ error: 'Agent not found (may already be deleted or purged)' });
          console.log('[Agent] Response: 404 Agent not found or purged');
        }
      } catch (redisErr) {
        res.status(404).json({ error: 'Agent not found (Redis check failed)' });
        console.log('[Agent] Response: 404 Agent not found, Redis error:', redisErr.message);
      }
      console.log('==============================');
      return;
    }
    // Delete agent
    const deleteSQL = `DELETE FROM agents ${whereClause}`;
    await pool.query(deleteSQL, params);
    // Publish Redis uninstall event
    const redis = require('../services/redis');
    const agent = agentResult.rows[0];
    const uninstallEvent = `agent:uninstall:${agent.agent_uuid}`;
    await redis.publish('agent-events', JSON.stringify({ event: uninstallEvent, agentId: agent.agent_uuid }));
    console.log('[Agent] Redis uninstall event published:', uninstallEvent);
    res.json({ status: 'deleted', agentId: agent.agent_uuid });
    console.log('[Agent] Response: 200 agent deleted');
    console.log('==============================');
  } catch (err) {
    console.error('[Agent] Failed to delete agent:', err);
    res.status(500).json({ error: 'Failed to delete agent' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {get} /agent/:agent_uuid/programs Get Installed Programs
 * @apiName GetInstalledPrograms
 * @apiGroup Agent
 * @apiDescription
 * Retrieves list of installed software from agent's system_info JSON field.
 * Programs data collected during hardware inventory submission. Used for software
 * auditing, license management, and vulnerability scanning.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiSuccess {object[]} programs Array of installed program objects
 * @apiSuccess {string} programs.name Program name
 * @apiSuccess {string} programs.version Program version
 * @apiSuccess {string} programs.publisher Software publisher
 * @apiSuccess {Date} programs.installDate Installation date
 * @apiError (404) {String} error "Agent not found"
 * @apiError (500) {String} error "Failed to fetch programs"
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/programs \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// -------------------------
// GET /api/agent/:agent_uuid/programs
// Get installed programs from agent
// -------------------------
router.get('/:agent_uuid/programs', authenticateToken, async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 📦 /programs called for:', req.params.agent_uuid);
    
    const { agent_uuid } = req.params;
    
    // Check if agent exists and get installed programs from system_info
    const result = await pool.query(
      'SELECT system_info FROM agents WHERE agent_uuid = $1',
      [agent_uuid]
    );
    
    if (result.rows.length === 0) {
      console.log('[Agent] ❌ Agent not found');
      res.status(404).json({ error: 'Agent not found' });
      console.log('[Agent] Response: 404 Agent not found');
      console.log('==============================');
      return;
    }
    
    const systemInfo = result.rows[0].system_info || {};
    const programs = systemInfo.installedPrograms || [];
    
    console.log('[Agent] ✅ Found', programs.length, 'programs');
    res.json(programs);
    console.log('[Agent] Response: 200 programs sent');
    console.log('==============================');
    
  } catch (err) {
    console.error('[Agent] Failed to fetch programs:', err);
    res.status(500).json({ error: 'Failed to fetch programs' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {get} /agent/:agent_uuid/processes Get Running Processes
 * @apiName GetRunningProcesses
 * @apiGroup Agent
 * @apiDescription
 * Retrieves list of running processes from agent's system_info JSON field.
 * Process snapshot collected during hardware inventory submission. Used for
 * performance monitoring, troubleshooting, and security analysis.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiSuccess {object[]} processes Array of process objects
 * @apiSuccess {number} processes.pid Process ID
 * @apiSuccess {string} processes.name Process name
 * @apiSuccess {number} processes.cpu CPU usage percentage
 * @apiSuccess {number} processes.memory Memory usage in bytes
 * @apiError (404) {String} error "Agent not found"
 * @apiError (500) {String} error "Failed to fetch processes"
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/processes \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// GET /api/agent/:agent_uuid/processes
// Get running processes from agent (real-time via WebSocket or cached)
// -------------------------
router.get('/:agent_uuid/processes', authenticateToken, async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 🔄 /processes called for:', req.params.agent_uuid);
    
    const { agent_uuid } = req.params;
    
    // Check if agent exists and get processes from system_info
    const result = await pool.query(
      'SELECT system_info FROM agents WHERE agent_uuid = $1',
      [agent_uuid]
    );
    
    if (result.rows.length === 0) {
      console.log('[Agent] ❌ Agent not found');
      res.status(404).json({ error: 'Agent not found' });
      console.log('[Agent] Response: 404 Agent not found');
      console.log('==============================');
      return;
    }
    
    const systemInfo = result.rows[0].system_info || {};
    const processes = systemInfo.processes || [];
    
    console.log('[Agent] ✅ Found', processes.length, 'processes');
    res.json(processes);
    console.log('[Agent] Response: 200 processes sent');
    console.log('==============================');
    
  } catch (err) {
    console.error('[Agent] Failed to fetch processes:', err);
    res.status(500).json({ error: 'Failed to fetch processes' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {get} /agent/:agent_uuid/files Get File Listing (Not Implemented)
 * @apiName GetFileListing
 * @apiGroup Agent
 * @apiDescription
 * Placeholder endpoint for file browser feature. Currently returns empty array.
 * Future implementation will provide real-time filesystem browsing over WebSocket.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiQuery {string} [path=C:\] Directory path to browse
 * @apiSuccess {string} path Current directory path
 * @apiSuccess {Array} files Empty array (not yet implemented)
 * @apiError (404) {String} error "Agent not found"
 * @apiError (500) {String} error "Failed to fetch files"
 * @apiNote Feature not yet implemented - returns placeholder response
 * @apiExample {curl} Example Request:
 *     curl "https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/files?path=C:\\Windows" \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// GET /api/agent/:agent_uuid/files
// Get file listing from agent (placeholder - not yet implemented)
// -------------------------
router.get('/:agent_uuid/files', authenticateToken, async (req, res) => {
  try {
    const { agent_uuid } = req.params;
    const { path } = req.query;
    
    // Check if agent exists
    const result = await pool.query(
      'SELECT agent_id FROM agents WHERE agent_uuid = $1',
      [agent_uuid]
    );
    
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
    
    // File browser feature not yet implemented
    // Return empty array for now
    res.json({ 
      path: path || 'C:\\',
      files: [] 
    });
    
  } catch (err) {
    console.error('[Agent] Failed to fetch files:', err);
    res.status(500).json({ error: 'Failed to fetch files' });
  }
});
 
/**
 * @api {get} /agent/:agent_uuid/services Get Windows Services
 * @apiName GetWindowsServices
 * @apiGroup Agent
 * @apiDescription
 * Retrieves Windows services list from agent's system_info JSON field. Services data
 * collected during hardware inventory. Includes service status, startup type, and
 * description. Used for service management and troubleshooting.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiSuccess {object[]} services Array of service objects
 * @apiSuccess {string} services.name Service name
 * @apiSuccess {string} services.displayName Service display name
 * @apiSuccess {string} services.status Service status (Running/Stopped)
 * @apiSuccess {string} services.startType Startup type (Automatic/Manual/Disabled)
 * @apiSuccess {string} services.description Service description
 * @apiError (404) {String} error "Agent not found"
 * @apiError (500) {String} error "Failed to fetch services"
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/services \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// GET /api/agent/:agent_uuid/services
// Get Windows services from agent
// -------------------------
router.get('/:agent_uuid/services', authenticateToken, async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 🔄 /services called for:', req.params.agent_uuid);
    
    const { agent_uuid } = req.params;
    
    // Check if agent exists and get services from system_info
    const result = await pool.query(
      'SELECT system_info FROM agents WHERE agent_uuid = $1',
      [agent_uuid]
    );
    
    if (result.rows.length === 0) {
      console.log('[Agent] ❌ Agent not found');
      res.status(404).json({ error: 'Agent not found' });
      console.log('[Agent] Response: 404 Agent not found');
      console.log('==============================');
      return;
    }
    
    const systemInfo = result.rows[0].system_info || {};
    const services = systemInfo.services || [];
    
    console.log('[Agent] ✅ Found', services.length, 'services');
    res.json(services);
    console.log('[Agent] Response: 200 services sent');
    console.log('==============================');
    
  } catch (err) {
    console.error('[Agent] Failed to fetch services:', err);
    res.status(500).json({ error: 'Failed to fetch services' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {get} /agent/:agent_uuid/activity-logs Get Activity Logs
 * @apiName GetActivityLogs
 * @apiGroup Agent
 * @apiDescription
 * Retrieves user activity logs for agent from multiple sources. Combines activity_logs
 * table events with script execution history. Used for audit trails, compliance, and
 * troubleshooting.
 *
 * Activity types:
 * - Remote sessions (RDP, VNC, SSH)
 * - File transfers
 * - Script executions
 * - Configuration changes
 * - User actions
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiQuery {number} [limit=100] Maximum logs to return
 * @apiSuccess {object[]} logs Array of activity log objects (newest first)
 * @apiSuccess {string} logs.action Activity action type
 * @apiSuccess {string} logs.details Activity details/description
 * @apiSuccess {Date} logs.timestamp Activity timestamp
 * @apiSuccess {string} logs.user User email or "system"
 * @apiError (500) {String} error "Failed to fetch activity logs"
 * @apiExample {curl} Example Request:
 *     curl "https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/activity-logs?limit=50" \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// GET /api/agent/:agent_uuid/activity-logs
// Get user activity logs (remote sessions, scripts, file transfers, etc.)
// -------------------------
router.get('/:agent_uuid/activity-logs', authenticateToken, async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 🔄 /activity-logs called for:', req.params.agent_uuid);
    
    const { agent_uuid } = req.params;
    const limit = parseInt(req.query.limit) || 100;
    
    // Get activity logs from database (combining multiple sources)
    const logs = await pool.query(`
      SELECT 
        action,
        details::text as details,
        created_at as timestamp,
        user_email as user
      FROM activity_logs
      WHERE agent_uuid = $1
      
      UNION ALL
      
      SELECT 
        'script_execution' as action,
        'Script executed: ' || s.name as details,
        se.created_at as timestamp,
        'system' as user
      FROM script_executions se
      JOIN scripts s ON se.script_id = s.script_id
      WHERE se.agent_uuid = $1
      
      ORDER BY timestamp DESC
      LIMIT $2
    `, [agent_uuid, limit]);
    
    console.log('[Agent] ✅ Found', logs.rows.length, 'activity logs');
    res.json(logs.rows);
    console.log('[Agent] Response: 200 activity logs sent');
    console.log('==============================');
    
  } catch (err) {
    console.error('[Agent] Failed to fetch activity logs:', err);
    res.status(500).json({ error: 'Failed to fetch activity logs' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {get} /agent/:agent_uuid/events Get Windows Event Logs
 * @apiName GetWindowsEvents
 * @apiGroup Agent
 * @apiDescription
 * Retrieves Windows Event Viewer logs from agent's system_info JSON field. Event logs
 * collected during hardware inventory. Includes Application, System, and Security logs.
 * Used for system diagnostics, security monitoring, and troubleshooting.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiQuery {number} [limit=100] Maximum events to return
 * @apiSuccess {object[]} events Array of event log objects
 * @apiSuccess {string} events.logName Log source (Application/System/Security)
 * @apiSuccess {string} events.level Event level (Error/Warning/Information)
 * @apiSuccess {number} events.eventId Windows event ID
 * @apiSuccess {Date} events.timeCreated Event timestamp
 * @apiSuccess {string} events.message Event message
 * @apiError (404) {String} error "Agent not found"
 * @apiError (500) {String} error "Failed to fetch event logs"
 * @apiExample {curl} Example Request:
 *     curl "https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/events?limit=200" \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// GET /api/agent/:agent_uuid/events
// Get Windows Event Viewer logs from agent
// -------------------------
router.get('/:agent_uuid/events', authenticateToken, async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 🔄 /events called for:', req.params.agent_uuid);
    
    const { agent_uuid } = req.params;
    const limit = parseInt(req.query.limit) || 100;
    
    // Get Windows event logs from system_info
    const result = await pool.query(
      'SELECT system_info FROM agents WHERE agent_uuid = $1',
      [agent_uuid]
    );
    
    if (result.rows.length === 0) {
      console.log('[Agent] ❌ Agent not found');
      res.status(404).json({ error: 'Agent not found' });
      console.log('[Agent] Response: 404 Agent not found');
      console.log('==============================');
      return;
    }
    
    const systemInfo = result.rows[0].system_info || {};
    let events = systemInfo.event_logs || [];
    
    // Limit the number of events returned
    if (events.length > limit) {
      events = events.slice(0, limit);
    }
    
    console.log('[Agent] ✅ Found', events.length, 'event logs');
    res.json(events);
    console.log('[Agent] Response: 200 event logs sent');
    console.log('==============================');
    
  } catch (err) {
    console.error('[Agent] Failed to fetch event logs:', err);
    res.status(500).json({ error: 'Failed to fetch event logs' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {get} /agent/:agent_uuid/agent-logs Get Agent Internal Logs
 * @apiName GetAgentLogs
 * @apiGroup Agent
 * @apiDescription
 * Retrieves agent application logs from system_info JSON field. Logs include agent
 * heartbeats, errors, updates, and internal operations. Used for agent troubleshooting
 * and diagnostics.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiSuccess {object[]} logs Array of agent log objects
 * @apiSuccess {string} logs.level Log level (ERROR/WARN/INFO/DEBUG)
 * @apiSuccess {Date} logs.timestamp Log timestamp
 * @apiSuccess {string} logs.message Log message
 * @apiSuccess {object} logs.metadata Additional log metadata
 * @apiError (404) {String} error "Agent not found"
 * @apiError (500) {String} error "Failed to fetch agent logs"
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/agent-logs \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// GET /api/agent/:agent_uuid/agent-logs
// Get agent internal logs (heartbeats, errors, updates)
// -------------------------
router.get('/:agent_uuid/agent-logs', authenticateToken, async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] 🔄 /agent-logs called for:', req.params.agent_uuid);
    
    const { agent_uuid } = req.params;
    
    // Get agent logs from system_info or a dedicated logs table
    const result = await pool.query(
      'SELECT system_info FROM agents WHERE agent_uuid = $1',
      [agent_uuid]
    );
    
    if (result.rows.length === 0) {
      console.log('[Agent] ❌ Agent not found');
      res.status(404).json({ error: 'Agent not found' });
      console.log('[Agent] Response: 404 Agent not found');
      console.log('==============================');
      return;
    }
    
    const systemInfo = result.rows[0].system_info || {};
    const agentLogs = systemInfo.agent_logs || [];
    
    console.log('[Agent] ✅ Found', agentLogs.length, 'agent logs');
    res.json(agentLogs);
    console.log('[Agent] Response: 200 agent logs sent');
    console.log('==============================');
    
  } catch (err) {
    console.error('[Agent] Failed to fetch agent logs:', err);
    res.status(500).json({ error: 'Failed to fetch agent logs' });
    console.log('[Agent] Response: 500 error', err.message);
    console.log('==============================');
  }
});
 
/**
 * @api {get} /agent/version Get Latest Agent Version
 * @apiName GetAgentVersion
 * @apiGroup Agent
 * @apiDescription
 * Returns latest agent software version. Queries agent_versions table for is_latest flag,
 * falls back to agent/package.json if database is empty. Used by auto-update checks
 * and installer downloads.
 * @apiPermission public
 * @apiNote No authentication required
 * @apiSuccess {string} version Semantic version string (e.g., "1.2.3")
 * @apiError (500) {String} error "Failed to read agent version"
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/version
 * @apiExample {json} Example Response:
 *     {
 *       "version": "1.2.3"
 *     }
 */
 
// =============================================
// GET /api/agent/version
// Returns the latest agent version from database
// =============================================
router.get('/version', async (req, res) => {
  try {
    console.log('==============================');
    console.log('[Agent] GET /api/agent/version');
    
    // Try database first
    const result = await pool.query(
      'SELECT version FROM agent_versions WHERE is_latest = TRUE ORDER BY release_date DESC LIMIT 1'
    );
    
    if (result.rows && result.rows.length > 0) {
      const version = result.rows[0].version;
      console.log('[Agent] Latest version from database:', version);
      console.log('==============================');
      return res.json({ version });
    }
    
    // Fallback to package.json if database is empty
    const fs = require('fs');
    const path = require('path');
    const packagePath = path.join(__dirname, '../../agent/package.json');
    const packageJson = JSON.parse(fs.readFileSync(packagePath, 'utf8'));
    
    console.log('[Agent] Latest version from package.json:', packageJson.version);
    console.log('==============================');
    
    res.json({ version: packageJson.version });
  } catch (err) {
    console.error('[Agent] Failed to read agent version:', err);
    res.status(500).json({ error: 'Failed to read agent version' });
  }
});
 
/**
 * @api {get} /agent/download/:version Download Agent Installer
 * @apiName DownloadAgentInstaller
 * @apiGroup Agent
 * @apiDescription
 * Downloads agent installer executable for specified version. Serves file from
 * /opt/apps/IBG_HUB_dist/agent/{version}/agent.exe. Streams file to avoid memory
 * issues with large binaries.
 * @apiPermission public
 * @apiNote No authentication required (download tokens validated separately)
 * @apiParam {string} version Agent version (e.g., "1.2.3")
 * @apiSuccess {File} agent-{version}.exe Agent installer binary
 * @apiError (404) {String} error "Agent binary not found"
 * @apiError (500) {String} error "Failed to download agent"
 * @apiError (500) {String} error "Failed to stream agent binary"
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/download/1.2.3 \
 *       --output agent-1.2.3.exe
 */
 
// =============================================
// GET /api/agent/download/:version
// Downloads the agent executable for the specified version
// =============================================
router.get('/download/:version', (req, res) => {
  try {
    const fs = require('fs');
    const path = require('path');
    const { version } = req.params;
    
    // Path to the version-specific agent binary
    const agentPath = `/opt/apps/IBG_HUB_dist/agent/${version}/agent.exe`;
    
    console.log('==============================');
    console.log('[Agent] GET /api/agent/download/' + version);
    console.log('[Agent] Serving agent from:', agentPath);
    
    // Check if file exists
    if (!fs.existsSync(agentPath)) {
      console.log('[Agent] Agent binary not found!');
      console.log('==============================');
      return res.status(404).json({ error: 'Agent binary not found' });
    }
    
    const stat = fs.statSync(agentPath);
    console.log('[Agent] File size:', (stat.size / 1024 / 1024).toFixed(2), 'MB');
    console.log('[Agent] Sending agent binary...');
    console.log('==============================');
    
    // Set headers for download
    res.setHeader('Content-Type', 'application/octet-stream');
    res.setHeader('Content-Disposition', `attachment; filename="agent-${version}.exe"`);
    res.setHeader('Content-Length', stat.size);
    
    // Stream the file
    const fileStream = fs.createReadStream(agentPath);
    fileStream.pipe(res);
    
    fileStream.on('error', (err) => {
      console.error('[Agent] Stream error:', err);
      if (!res.headersSent) {
        res.status(500).json({ error: 'Failed to stream agent binary' });
      }
    });
    
  } catch (err) {
    console.error('[Agent] Failed to download agent:', err);
    res.status(500).json({ error: 'Failed to download agent' });
  }
});
 
/**
 * @api {get} /agent/hash/:version Get Installer Hash
 * @apiName GetInstallerHash
 * @apiGroup Agent
 * @apiDescription
 * Computes SHA256 hash of agent installer binary for verification. Clients validate
 * downloaded installer against this hash to prevent tampering. Reads installer from
 * /opt/apps/IBG_HUB_dist/agent/{version}/agent.exe.
 * @apiPermission public
 * @apiNote No authentication required
 * @apiParam {string} version Agent version (e.g., "1.2.3")
 * @apiSuccess {string} hash SHA256 hash (64 hex characters)
 * @apiError (404) {String} error "Agent binary not found"
 * @apiError (500) {String} error "Failed to compute hash"
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/hash/1.2.3
 * @apiExample {json} Example Response:
 *     {
 *       "hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
 *     }
 */
 
// =============================================
// GET /api/agent/hash/:version
// Returns the SHA256 hash of the agent binary for verification
// =============================================
router.get('/hash/:version', (req, res) => {
  try {
    const crypto = require('crypto');
    const fs = require('fs');
    const path = require('path');
    const { version } = req.params;
    
    // Path to the version-specific agent executable on the server
    const agentPath = `/opt/apps/IBG_HUB_dist/agent/${version}/agent.exe`;
    
    console.log('==============================');
    console.log('[Agent] GET /api/agent/hash/' + version);
    console.log('[Agent] Computing hash for:', agentPath);
    
    // Check if file exists
    if (!fs.existsSync(agentPath)) {
      console.log('[Agent] Agent binary not found!');
      console.log('==============================');
      return res.status(404).json({ error: 'Agent binary not found' });
    }
    
    // Compute SHA256 hash
    const fileBuffer = fs.readFileSync(agentPath);
    const hashSum = crypto.createHash('sha256');
    hashSum.update(fileBuffer);
    const hash = hashSum.digest('hex');
    
    console.log('[Agent] Computed hash:', hash);
    console.log('==============================');
    
    res.json({ hash });
  } catch (err) {
    console.error('[Agent] Failed to compute hash:', err);
    res.status(500).json({ error: 'Failed to compute hash' });
  }
});
 
/**
 * @api {post} /agent/:agent_uuid/files/upload Upload File to Agent
 * @apiName UploadFileToAgent
 * @apiGroup Agent File Transfer
 * @apiDescription
 * Initiates file upload to remote agent. Accepts multipart/form-data with file and
 * destination path. File stored in uploads/ directory, transfer tracked by transferId.
 * Uses fileTransferService for WebSocket coordination with agent.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiBody {File} file File to upload (multipart/form-data)
 * @apiBody {string} remotePath Destination path on agent filesystem
 * @apiSuccess {string} transferId Transfer tracking ID
 * @apiSuccess {string} status "started"
 * @apiError (500) {String} error Error message from fileTransferService
 * @apiExample {curl} Example Request:
 *     curl -X POST https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/files/upload \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 *       -F "file=@config.ini" \
 *       -F "remotePath=C:\\ProgramData\\config.ini"
 */
 
// -------------------------
// File Transfer Routes
// -------------------------
const fileTransferService = require('../services/fileTransferService');
const multer = require('multer');
const upload = multer({ dest: 'uploads/' });
 
// POST /api/agent/:agent_uuid/files/upload
// Upload file to agent
router.post('/:agent_uuid/files/upload', authenticateToken, upload.single('file'), async (req, res) => {
  try {
    const { agent_uuid } = req.params;
    const { remotePath } = req.body;
    const localPath = req.file.path;
    const user_email = req.user?.email || 'system';
    
    const transferId = await fileTransferService.startUpload(
      agent_uuid,
      localPath,
      remotePath,
      user_email
    );
    
    res.json({ transferId, status: 'started' });
  } catch (err) {
    console.error('[Agent] File upload failed:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {post} /agent/:agent_uuid/files/download Download File from Agent
 * @apiName DownloadFileFromAgent
 * @apiGroup Agent File Transfer
 * @apiDescription
 * Initiates file download from remote agent. Requests file at remotePath, agent
 * uploads to server, file tracked by transferId. Uses fileTransferService for
 * WebSocket coordination.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiBody {string} remotePath File path on agent filesystem to download
 * @apiSuccess {string} transferId Transfer tracking ID
 * @apiSuccess {string} status "started"
 * @apiError (500) {String} error Error message from fileTransferService
 * @apiExample {curl} Example Request:
 *     curl -X POST https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/files/download \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 *       -H "Content-Type: application/json" \
 *       -d '{"remotePath":"C:\\Windows\\System32\\drivers\\etc\\hosts"}'
 */
 
// POST /api/agent/:agent_uuid/files/download
// Download file from agent
router.post('/:agent_uuid/files/download', authenticateToken, async (req, res) => {
  try {
    const { agent_uuid } = req.params;
    const { remotePath } = req.body;
    const user_email = req.user?.email || 'system';
    
    const transferId = await fileTransferService.startDownload(
      agent_uuid,
      remotePath,
      user_email
    );
    
    res.json({ transferId, status: 'started' });
  } catch (err) {
    console.error('[Agent] File download failed:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/:agent_uuid/files/transfer/:transferId Get Transfer Status
 * @apiName GetTransferStatus
 * @apiGroup Agent File Transfer
 * @apiDescription
 * Retrieves current status and progress of file transfer. Returns transfer object
 * with status, progress percentage, file size, and error details if failed.
 *
 * Transfer statuses:
 * - pending: Transfer queued, not started
 * - in_progress: Transfer active
 * - completed: Transfer finished successfully
 * - failed: Transfer error occurred
 * - cancelled: Transfer cancelled by user
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiParam {string} transferId Transfer tracking ID
 * @apiSuccess {string} transferId Transfer ID
 * @apiSuccess {string} type Transfer type ("upload" or "download")
 * @apiSuccess {string} status Transfer status
 * @apiSuccess {number} progress Progress percentage (0-100)
 * @apiSuccess {string} localPath Server-side file path
 * @apiSuccess {string} remotePath Agent-side file path
 * @apiSuccess {number} fileSize File size in bytes
 * @apiSuccess {string} error Error message (if failed)
 * @apiError (404) {String} error "Transfer not found"
 * @apiError (500) {String} error Error message
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/files/transfer/abc123 \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// GET /api/agent/:agent_uuid/files/transfer/:transferId
// Get transfer status
router.get('/:agent_uuid/files/transfer/:transferId', authenticateToken, async (req, res) => {
  try {
    const { transferId } = req.params;
    const transfer = fileTransferService.getTransfer(transferId);
    
    if (!transfer) {
      return res.status(404).json({ error: 'Transfer not found' });
    }
    
    res.json(transfer);
  } catch (err) {
    console.error('[Agent] Get transfer status failed:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {get} /agent/:agent_uuid/files/transfer/:transferId/download Download Completed File
 * @apiName DownloadCompletedFile
 * @apiGroup Agent File Transfer
 * @apiDescription
 * Downloads file that was transferred from agent. Only works for completed "download"
 * type transfers. Streams file from server-side transfer cache directory.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiParam {string} transferId Transfer tracking ID
 * @apiSuccess {File} file Transferred file binary
 * @apiError (404) {String} error "Transfer not found"
 * @apiError (400) {String} error "Transfer not completed"
 * @apiError (500) {String} error "Download file failed"
 * @apiExample {curl} Example Request:
 *     curl https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/files/transfer/abc123/download \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 *       --output downloaded-file.txt
 */
 
// GET /api/agent/:agent_uuid/files/transfer/:transferId/download
// Download completed file
router.get('/:agent_uuid/files/transfer/:transferId/download', authenticateToken, async (req, res) => {
  try {
    const { transferId } = req.params;
    const transfer = fileTransferService.getTransfer(transferId);
    
    if (!transfer || transfer.type !== 'download') {
      return res.status(404).json({ error: 'Transfer not found' });
    }
    
    if (transfer.status !== 'completed') {
      return res.status(400).json({ error: 'Transfer not completed' });
    }
    
    res.download(transfer.localPath);
  } catch (err) {
    console.error('[Agent] Download file failed:', err);
    res.status(500).json({ error: err.message });
  }
});
 
/**
 * @api {delete} /agent/:agent_uuid/files/transfer/:transferId Cancel File Transfer
 * @apiName CancelFileTransfer
 * @apiGroup Agent File Transfer
 * @apiDescription
 * Cancels active or pending file transfer. Cleans up transfer state, notifies agent
 * via WebSocket, and removes temporary files. Cannot cancel already completed transfers.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {string} agent_uuid Agent UUID
 * @apiParam {string} transferId Transfer tracking ID
 * @apiSuccess {boolean} success true
 * @apiError (500) {String} error "Cancel transfer failed"
 * @apiExample {curl} Example Request:
 *     curl -X DELETE https://api.ibghub.com/api/agent/550e8400-e29b-41d4-a716-446655440000/files/transfer/abc123 \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// DELETE /api/agent/:agent_uuid/files/transfer/:transferId
// Cancel transfer
router.delete('/:agent_uuid/files/transfer/:transferId', authenticateToken, async (req, res) => {
  try {
    const { transferId } = req.params;
    await fileTransferService.cancelTransfer(transferId);
    res.json({ success: true });
  } catch (err) {
    console.error('[Agent] Cancel transfer failed:', err);
    res.status(500).json({ error: err.message });
  }
});
 
module.exports = router;