domainRequests.js

Go to the documentation of this file.

/**
 * @file Domain Registration Request Management API Routes
 * @description
 * This module provides API endpoints for managing domain registration requests,
 * supporting full registration workflow from submission to approval/denial, with
 * multi-registrar integration (Moniker, eNom, Cloudflare) and automated DNS zone
 * provisioning.
 *
 * Key features:
 * - **Multi-registrar support**: Moniker, eNom, Cloudflare DNS-only
 * - **Approval workflow**: Submit, review, approve/deny with audit trail
 * - **DNS automation**: Automatic Cloudflare zone creation upon approval
 * - **Contact management**: Full WHOIS contact data (registrant, admin, tech, billing)
 * - **Tenant isolation**: Multi-tenant with MSP/root tenant approval permissions
 * - **Notification system**: Automated notifications for request lifecycle events
 * - **Domain types**: Registration (with registrar APIs) or DNS-only (external registrar)
 *
 * Registrar integration:
 * - **Moniker**: Full domain registration with WHOIS contacts via Moniker API
 * - **eNom**: Full domain registration via eNom reseller API
 * - **Cloudflare**: DNS-only mode (zone creation, customer updates nameservers)
 * - **External**: DNS-only with Cloudflare zone for domains registered elsewhere
 *
 * Security:
 * - All routes require authentication via JWT tokens
 * - Tenant context applied for data isolation
 * - Only root tenant/MSP admins can approve/deny/update requests
 * - Standard users can submit and view their own requests
 *
 * Database tables:
 * - `domain_registration_requests`: Request lifecycle (pending, approved, denied, registered, failed)
 * - `domains`: Registered/active domains linked to customers and contracts
 * - `notifications`: Request status notifications for customers and admins
 * @requires express
 * @requires ../services/db - PostgreSQL database pool
 * @requires ../middleware/auth - JWT authentication
 * @requires ../middleware/tenant - Multi-tenant context and filtering
 * @requires ../services/moniker - Moniker domain registrar API client
 * @requires ../services/enom - eNom domain registrar API client
 * @requires ../services/cloudflare - Cloudflare DNS zone management API client
 * @module routes/domainRequests
 * @see {@link module:services/moniker}
 * @see {@link module:services/enom}
 * @see {@link module:services/cloudflare}
 */
 
const express = require('express');
const router = express.Router();
const pool = require('../services/db');
const authenticateToken = require('../middleware/auth');
const { getTenantFilter, setTenantContext } = require('../middleware/tenant');
const moniker = require('../services/moniker');
const enom = require('../services/enom');
const { createZone, registerDomain: registerCloudflare } = require('../services/cloudflare');
 
// Apply authentication and tenant context to all routes
router.use(authenticateToken, setTenantContext);
 
/**
 * @api {post} /domain-requests Submit Domain Registration Request
 * @apiName SubmitDomainRequest
 * @apiGroup DomainRequests
 * @apiDescription
 * Creates a new domain registration request with complete WHOIS contact information.
 * Automatically sends notification to root tenant admins for approval. Supports both
 * full registration via Moniker/eNom or DNS-only mode for externally-registered domains.
 *
 * Request body example:
 * ```json
 * {
 *   "domain_name": "example.com",
 *   "domain_type": "registration",  // or "dns-only"
 *   "customer_id": 123,
 *   "contract_id": 456,
 *   "years": 1,
 *   "price": 12.99,
 *   "currency": "USD",
 *   "nameservers": ["ns1.example.com", "ns2.example.com"],
 *   "registrant_contact": {
 *     "firstName": "John",
 *     "lastName": "Doe",
 *     "email": "john@example.com",
 *     "phone": "+1.5555551234",
 *     "address": "123 Main St",
 *     "city": "San Francisco",
 *     "state": "CA",
 *     "postalCode": "94105",
 *     "country": "US",
 *     "organization": "Example Corp"
 *   },
 *   "admin_contact": { ... },    // Optional, defaults to registrant_contact
 *   "tech_contact": { ... },     // Optional, defaults to registrant_contact
 *   "billing_contact": { ... }   // Optional, defaults to registrant_contact
 * }
 * ```
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiBody {string} domain_name Domain name to register (e.g., "example.com")
 * @apiBody {String="registration","dns-only"} domain_type Registration type
 * @apiBody {number} customer_id Customer ID from customers table
 * @apiBody {number} [contract_id] Associated contract ID
 * @apiBody {number} years Registration duration (typically 1-10 years)
 * @apiBody {number} price Domain registration/renewal price
 * @apiBody {String="USD","EUR","GBP"} currency Price currency code
 * @apiBody {string[]} [nameservers] Custom nameservers (optional, Cloudflare used if omitted)
 * @apiBody {object} registrant_contact WHOIS registrant contact information
 * @apiBody {object} [admin_contact] WHOIS admin contact (defaults to registrant)
 * @apiBody {Object} [tech_contact] WHOIS technical contact (defaults to registrant)
 * @apiBody {Object} [billing_contact] WHOIS billing contact (defaults to registrant)
 * @apiSuccess {boolean} success Operation success status (true)
 * @apiSuccess {number} request_id Created domain registration request ID
 * @apiSuccess {string} message Success message
 * @apiError {string} error Error message
 * @apiError {string} details Detailed error description
 * @apiError {string} timestamp ISO timestamp of error occurrence
 * @apiExample {curl} Example Request:
 *     curl -X POST https://api.ibghub.com/api/domain-requests \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 *       -H "Content-Type: application/json" \
 *       -d '{"domain_name":"example.com","domain_type":"registration","customer_id":123,"years":1,"price":12.99,"currency":"USD","registrant_contact":{...}}'
 */
 
// POST /domain-requests - Submit domain registration request
router.post('/', async (req, res) => {
  const requestTimestamp = new Date().toISOString();
  try {
    // Enhanced debug logging for analysis
    console.log('========================================');
    console.log('[Domain Request] NEW DOMAIN REGISTRATION REQUEST');
    console.log('[Domain Request] Timestamp:', requestTimestamp);
    console.log('[Domain Request] User:', {
      userId: req.user?.user_id,
      email: req.user?.email,
      tenantId: req.user?.tenantId,
      role: req.user?.role
    });
    console.log('[Domain Request] Tenant:', {
      id: req.tenant?.id,
      isMsp: req.tenant?.isMsp,
      subdomain: req.tenant?.subdomain
    });
    console.log('[Domain Request] Request details:', {
      contentType: req.get('Content-Type'),
      ip: req.ip || req.connection.remoteAddress,
      userAgent: req.get('User-Agent')
    });
    console.log('[Domain Request] Body:', JSON.stringify(req.body, null, 2));
    console.log('[Domain Request] Body keys:', req.body ? Object.keys(req.body) : 'undefined');
 
    // Check if body exists
    if (!req.body || Object.keys(req.body).length === 0) {
      return res.status(400).json({ 
        error: 'Request body is required',
        debug: {
          contentType: req.get('Content-Type'),
          hasBody: !!req.body,
          bodyKeys: req.body ? Object.keys(req.body) : []
        }
      });
    }
 
    const {
      customer_id,
      contract_id,
      domain_name,
      domain_type = 'registration',
      years = 1,
      price,
      currency = 'USD',
      nameservers,
      registrant_contact,
      admin_contact,
      tech_contact,
      billing_contact
    } = req.body;
 
    // Validation
    if (!domain_name || !registrant_contact) {
      return res.status(400).json({ error: 'Domain name and registrant contact are required' });
    }
 
    const tenantId = req.tenant?.id;
    const userId = req.user?.user_id;
 
    // Insert domain registration request
    const result = await pool.query(
      `INSERT INTO domain_registration_requests (
        tenant_id, customer_id, contract_id, domain_name, domain_type, years, price, currency,
        nameservers, registrant_contact, admin_contact, tech_contact, billing_contact,
        requested_by
      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)
      RETURNING *`,
      [
        tenantId, customer_id, contract_id, domain_name, domain_type, years, price, currency,
        JSON.stringify(nameservers || []),
        JSON.stringify(registrant_contact),
        JSON.stringify(admin_contact || registrant_contact),
        JSON.stringify(tech_contact || registrant_contact),
        JSON.stringify(billing_contact || registrant_contact),
        userId
      ]
    );
 
    const request = result.rows[0];
 
    console.log('[Domain Request] ✅ Request created successfully:', {
      requestId: request.request_id,
      domainName: request.domain_name,
      status: request.status,
      years: request.years,
      price: request.price,
      currency: request.currency,
      createdAt: request.created_at
    });
 
    // Send notification to root tenant admins
    try {
      // Find root tenant (subdomain = 'admin' or is_msp = true)
      const rootTenantResult = await pool.query(
        `SELECT tenant_id FROM tenants WHERE subdomain = 'admin' OR is_msp = true LIMIT 1`
      );
      
      if (rootTenantResult.rows.length > 0) {
        const rootTenantId = rootTenantResult.rows[0].tenant_id;
        
        // Create notification for root tenant admins
        await pool.query(
          `INSERT INTO notifications (tenant_id, title, message, type, customer_id)
           VALUES ($1, $2, $3, $4, $5)`,
          [
            rootTenantId,
            'New Domain Registration Request',
            `${domain_name} registration requested by ${registrant_contact.firstName} ${registrant_contact.lastName}`,
            'info',
            customer_id
          ]
        );
        console.log('[Domain Request] ✅ Notification sent to root tenant:', rootTenantId);
      } else {
        console.log('[Domain Request] ⚠️ No root tenant found for notification');
      }
    } catch (notifErr) {
      console.error('[Domain Request] ❌ Error sending notification:', notifErr.message);
      // Don't fail the request if notification fails
    }
 
    console.log('[Domain Request] ✅ Request completed successfully');
    console.log('========================================');
    res.status(201).json(request);
  } catch (err) {
    console.error('========================================');
    console.error('[Domain Request] ❌ ERROR creating domain registration request');
    console.error('[Domain Request] Error time:', new Date().toISOString());
    console.error('[Domain Request] Error message:', err.message);
    console.error('[Domain Request] Error stack:', err.stack);
    console.error('[Domain Request] Request body:', JSON.stringify(req.body, null, 2));
    console.error('[Domain Request] Tenant:', req.tenant);
    console.error('[Domain Request] User:', req.user);
    console.error('========================================');
    res.status(500).json({ 
      error: 'Failed to submit domain registration request', 
      details: err.message,
      timestamp: requestTimestamp
    });
  }
});
 
/**
 * @api {get} /domain-requests List Domain Registration Requests
 * @apiName ListDomainRequests
 * @apiGroup DomainRequests
 * @apiDescription
 * Retrieves paginated list of domain registration requests with tenant isolation.
 * MSP/root tenant sees all requests; standard tenants see only their own requests.
 * Supports filtering by status and includes related customer, contract, and user data.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiQuery {String="pending","approved","denied","registered","failed"} [status] Filter by request status
 * @apiQuery {number} [page=1] Page number (1-indexed)
 * @apiQuery {number} [limit=50] Results per page (max 100)
 * @apiSuccess {object[]} requests Array of domain registration requests
 * @apiSuccess {number} requests.request_id Unique request identifier
 * @apiSuccess {number} requests.tenant_id Tenant ID that owns the request
 * @apiSuccess {string} requests.tenant_subdomain Tenant subdomain
 * @apiSuccess {number} requests.customer_id Customer ID
 * @apiSuccess {string} requests.customer_name Customer name
 * @apiSuccess {number} requests.contract_id Associated contract ID
 * @apiSuccess {string} requests.contract_title Contract title
 * @apiSuccess {string} requests.domain_name Requested domain name
 * @apiSuccess {string} requests.domain_type "registration" or "dns-only"
 * @apiSuccess {string} requests.status Request status (pending/approved/denied/registered/failed)
 * @apiSuccess {number} requests.years Registration years
 * @apiSuccess {number} requests.price Domain cost
 * @apiSuccess {string} requests.currency Currency code (USD, EUR, etc.)
 * @apiSuccess {Object} requests.registrant_contact WHOIS registrant contact data
 * @apiSuccess {number} requests.requested_by User ID that submitted request
 * @apiSuccess {String} requests.requested_by_name User name that submitted request
 * @apiSuccess {String} requests.requested_at ISO timestamp of submission
 * @apiSuccess {Number} requests.reviewed_by User ID that reviewed (approved/denied)
 * @apiSuccess {String} requests.reviewed_by_name Reviewer user name
 * @apiSuccess {String} requests.reviewed_at ISO timestamp of review
 * @apiSuccess {String} requests.approval_notes Admin notes/reason for decision
 * @apiSuccess {Number} requests.domain_id Created domain ID (if registered)
 * @apiSuccess {String} requests.registration_error Error message (if failed)
 * @apiSuccess {Number} total Total count of matching requests
 * @apiSuccess {Number} page Current page number
 * @apiSuccess {Number} limit Results per page
 *
 * @apiError {String} error Error message
 * @apiError {String} details Detailed error description
 *
 * @apiExample {curl} Example Request:
 *     curl -X GET "https://api.ibghub.com/api/domain-requests?status=pending&page=1&limit=50" \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 *
 * @apiExample {json} Example Response:
 *     {
 *       "requests": [
 *         {
 *           "request_id": 42,
 *           "tenant_id": 5,
 *           "tenant_subdomain": "acmecorp",
 *           "customer_id": 123,
 *           "customer_name": "ACME Corp",
 *           "domain_name": "example.com",
 *           "domain_type": "registration",
 *           "status": "pending",
 *           "years": 1,
 *           "price": 12.99,
 *           "currency": "USD",
 *           "requested_by": 7,
 *           "requested_by_name": "John Doe",
 *           "requested_at": "2025-01-15T10:30:00Z"
 *         }
 *       ],
 *       "total": 1,
 *       "page": 1,
 *       "limit": 50
 *     }
 */
 
// GET /domain-requests - List domain registration requests
router.get('/', async (req, res) => {
  try {
    const { clause, params, nextParamIndex } = getTenantFilter(req, 'dr');
    const status = req.query.status;
    const page = parseInt(req.query.page, 10) || 1;
    const limit = parseInt(req.query.limit, 10) || 50;
    const offset = (page - 1) * limit;
 
    console.log('[Domain Requests GET] Tenant filter:', { 
      clause, 
      params, 
      isMsp: req.tenant?.isMsp,
      tenantId: req.tenant?.id,
      status,
      userRole: req.user?.role
    });
 
    let query = `
      SELECT dr.*, 
             c.name as customer_name,
             ct.title as contract_title,
             u1.name as requested_by_name,
             u2.name as reviewed_by_name,
             t.subdomain as tenant_subdomain
      FROM domain_registration_requests dr
      LEFT JOIN customers c ON dr.customer_id = c.customer_id
      LEFT JOIN contracts ct ON dr.contract_id = ct.contract_id
      LEFT JOIN users u1 ON dr.requested_by = u1.user_id
      LEFT JOIN users u2 ON dr.reviewed_by = u2.user_id
      LEFT JOIN tenants t ON dr.tenant_id = t.tenant_id
    `;
    let countQuery = 'SELECT COUNT(*) FROM domain_registration_requests dr';
    const where = [];
    let paramIndex = nextParamIndex;
 
    // Tenant filter
    if (clause) {
      where.push(clause);
    }
 
    // Status filter
    if (status) {
      where.push(`dr.status = $${paramIndex}`);
      params.push(status);
      paramIndex++;
    }
 
    if (where.length > 0) {
      query += ' WHERE ' + where.join(' AND ');
      countQuery += ' WHERE ' + where.join(' AND ');
    }
 
    query += ` ORDER BY dr.requested_at DESC LIMIT $${paramIndex} OFFSET $${paramIndex + 1}`;
    params.push(limit, offset);
 
    console.log('[Domain Requests GET] Final query:', query);
    console.log('[Domain Requests GET] Query params:', params);
 
    const [requestsResult, countResult] = await Promise.all([
      pool.query(query, params),
      pool.query(countQuery, clause || status ? params.slice(0, params.length - 2) : [])
    ]);
 
    console.log('[Domain Requests GET] Found', requestsResult.rows.length, 'requests');
 
    res.json({
      requests: requestsResult.rows,
      total: parseInt(countResult.rows[0].count, 10),
      page,
      limit
    });
  } catch (err) {
    console.error('Error fetching domain registration requests:', err);
    res.status(500).json({ error: 'Server error', details: err.message });
  }
});
 
/**
 * @api {get} /domain-requests/:id Get Domain Registration Request Details
 * @apiName GetDomainRequest
 * @apiGroup DomainRequests
 * @apiDescription
 * Retrieves complete details of a single domain registration request including all
 * contact information, customer/contract data, and review status. Tenant isolation
 * ensures users can only access requests within their tenant scope.
 * @apiPermission authenticated
 * @apiUse AuthHeader
 * @apiParam {number} id Domain registration request ID
 * @apiSuccess {number} request_id Unique request identifier
 * @apiSuccess {number} tenant_id Tenant ID that owns the request
 * @apiSuccess {string} tenant_subdomain Tenant subdomain
 * @apiSuccess {number} customer_id Customer ID
 * @apiSuccess {string} customer_name Customer name
 * @apiSuccess {string} customer_email Customer email address
 * @apiSuccess {number} contract_id Associated contract ID
 * @apiSuccess {string} contract_title Contract title
 * @apiSuccess {string} contract.billing_interval Contract billing frequency
 * @apiSuccess {string} domain_name Requested domain name
 * @apiSuccess {string} domain_type "registration" or "dns-only"
 * @apiSuccess {string} status Request status (pending/approved/denied/registered/failed)
 * @apiSuccess {number} years Registration duration
 * @apiSuccess {number} price Domain cost
 * @apiSuccess {string} currency Currency code
 * @apiSuccess {string[]} nameservers Requested nameservers
 * @apiSuccess {Object} registrant_contact WHOIS registrant contact (firstName, lastName, email, phone, address, city, state, postalCode, country)
 * @apiSuccess {Object} admin_contact WHOIS admin contact
 * @apiSuccess {Object} tech_contact WHOIS technical contact
 * @apiSuccess {Object} billing_contact WHOIS billing contact
 * @apiSuccess {Number} requested_by User ID that submitted request
 * @apiSuccess {String} requested_by_name User name that submitted request
 * @apiSuccess {String} requested_by_email User email that submitted request
 * @apiSuccess {String} requested_at ISO timestamp of submission
 * @apiSuccess {Number} reviewed_by User ID that reviewed (null if pending)
 * @apiSuccess {String} reviewed_by_name Reviewer user name
 * @apiSuccess {String} reviewed_at ISO timestamp of review
 * @apiSuccess {String} approval_notes Admin notes/reason for approval/denial
 * @apiSuccess {Number} domain_id Created domain ID (if status = "registered")
 * @apiSuccess {String} registration_error Error message (if status = "failed")
 *
 * @apiError (404) {String} error "Domain registration request not found"
 * @apiError (500) {String} error "Server error"
 * @apiError (500) {String} details Detailed error description
 *
 * @apiExample {curl} Example Request:
 *     curl -X GET https://api.ibghub.com/api/domain-requests/42 \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 */
 
// GET /domain-requests/:id - Get domain registration request details
router.get('/:id', async (req, res) => {
  const { id } = req.params;
  try {
    const { clause, params } = getTenantFilter(req, 'dr');
    let query = `
      SELECT dr.*,
             c.name as customer_name, c.email as customer_email,
             ct.title as contract_title, ct.billing_interval,
             u1.name as requested_by_name, u1.email as requested_by_email,
             u2.name as reviewed_by_name,
             t.subdomain as tenant_subdomain
      FROM domain_registration_requests dr
      LEFT JOIN customers c ON dr.customer_id = c.customer_id
      LEFT JOIN contracts ct ON dr.contract_id = ct.contract_id
      LEFT JOIN users u1 ON dr.requested_by = u1.user_id
      LEFT JOIN users u2 ON dr.reviewed_by = u2.user_id
      LEFT JOIN tenants t ON dr.tenant_id = t.tenant_id
      WHERE dr.request_id = $1
    `;
    const queryParams = [id];
 
    if (clause) {
      query += ` AND ${clause}`;
      queryParams.push(...params);
    }
 
    const result = await pool.query(query, queryParams);
    
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Domain registration request not found' });
    }
 
    res.json(result.rows[0]);
  } catch (err) {
    console.error('Error fetching domain registration request:', err);
    res.status(500).json({ error: 'Server error', details: err.message });
  }
});
 
/**
 * @api {post} /domain-requests/:id/approve Approve Domain Registration Request
 * @apiName ApproveDomainRequest
 * @apiGroup DomainRequests
 * @apiDescription
 * Approves a pending domain registration request and initiates domain registration or
 * DNS zone creation based on selected registrar. This is the most complex endpoint,
 * handling three registration modes:
 *
 * 1. **Moniker Registration**: Full domain registration via Moniker API with WHOIS contacts
 * 2. **eNom Registration**: Full domain registration via eNom reseller API
 * 3. **Cloudflare DNS-only**: Create Cloudflare zone without registering (customer updates NS)
 * 4. **External DNS-only**: Domain registered elsewhere, just provision Cloudflare zone
 *
 * Workflow:
 * - Validates request is in "pending" status
 * - Updates status to "approved" with admin notes
 * - Routes to appropriate registrar API based on `registrar` parameter
 * - On success: Creates domain record in database, updates status to "registered"
 * - On failure: Updates status to "failed" with error message
 * - Sends notifications to customer and root tenant admins
 * - For Cloudflare/external: Creates DNS zone, provides nameservers to customer
 *
 * Transaction handling:
 * - Uses database transaction for status updates
 * - Separate try/catch blocks for registration API calls
 * - Rolls back approval if registration fails completely
 * @apiPermission rootAdmin
 * @apiUse AuthHeader
 * @apiNote Only root tenant/MSP administrators can approve domain requests
 * @apiParam {number} id Domain registration request ID
 * @apiBody {string} [approval_notes] Admin notes explaining approval decision
 * @apiBody {String="moniker","enom","cloudflare"} [registrar=cloudflare] Registrar to use for registration
 * @apiSuccess {boolean} success Operation success status
 * @apiSuccess {string} message Success message describing action taken
 * @apiSuccess {number} domain_id Created domain record ID
 * @apiSuccess {string} registrar Registrar used (moniker/enom/external for Cloudflare)
 * @apiSuccess {string[]} [nameservers] Cloudflare nameservers (for DNS-only modes)
 * @apiSuccess {string} [zone_id] Cloudflare zone ID (for DNS-only modes)
 * @apiError (400) {String} error "Cannot approve request with status: X" (if not pending)
 * @apiError (400) {String} error "Invalid registrar. Must be cloudflare, enom, or moniker."
 * @apiError (403) {String} error "Only root tenant admins can approve domain registration requests"
 * @apiError (404) {String} error "Domain registration request not found"
 * @apiError (500) {String} error "Domain registration approved but [registrar] registration failed"
 * @apiError (500) {String} details Detailed error from registrar API
 * @apiExample {curl} Example Request (Moniker):
 *     curl -X POST https://api.ibghub.com/api/domain-requests/42/approve \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 *       -H "Content-Type: application/json" \
 *       -d '{"approval_notes":"Approved for Q1 2025 campaign","registrar":"moniker"}'
 * @apiExample {curl} Example Request (Cloudflare DNS-only):
 *     curl -X POST https://api.ibghub.com/api/domain-requests/42/approve \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 *       -H "Content-Type: application/json" \
 *       -d '{"approval_notes":"DNS-only for external domain","registrar":"cloudflare"}'
 * @apiExample {json} Example Response (Cloudflare):
 *     {
 *       "success": true,
 *       "message": "Domain DNS zone created successfully via external",
 *       "domain_id": 789,
 *       "registrar": "external",
 *       "zone_id": "a1b2c3d4e5f6g7h8i9j0",
 *       "nameservers": [
 *         "clara.ns.cloudflare.com",
 *         "ivan.ns.cloudflare.com"
 *       ]
 *     }
 * @apiExample {json} Example Response (Moniker):
 *     {
 *       "success": true,
 *       "message": "Domain registered successfully via moniker",
 *       "domain_id": 790,
 *       "registrar": "moniker"
 *     }
 */
 
// POST /domain-requests/:id/approve - Approve domain registration request
router.post('/:id/approve', async (req, res) => {
  const { id } = req.params;
  const { approval_notes, registrar = 'cloudflare' } = req.body;
  const userId = req.user?.user_id;
 
  console.log('[Domain Approve] Auth check:', {
    subdomain: req.tenant?.subdomain,
    is_msp: req.tenant?.is_msp,
    isMsp: req.tenant?.isMsp,
    userRole: req.user?.role,
    userId: req.user?.user_id,
    tenantId: req.tenant?.id,
    selectedRegistrar: registrar
  });
 
  // Only root tenant admins can approve
  const isRootAdmin = req.tenant?.subdomain === 'admin' || req.tenant?.isMsp === true || req.user?.is_msp === true;
  console.log('[Domain Approve] isRootAdmin:', isRootAdmin);
  
  if (!isRootAdmin) {
    return res.status(403).json({ error: 'Only root tenant admins can approve domain registration requests' });
  }
 
  const client = await pool.connect();
  try {
    await client.query('BEGIN');
 
    // Get request details
    const requestResult = await client.query(
      'SELECT * FROM domain_registration_requests WHERE request_id = $1 FOR UPDATE',
      [id]
    );
 
    if (requestResult.rows.length === 0) {
      await client.query('ROLLBACK');
      return res.status(404).json({ error: 'Domain registration request not found' });
    }
 
    const request = requestResult.rows[0];
 
    if (request.status !== 'pending') {
      await client.query('ROLLBACK');
      return res.status(400).json({ error: `Cannot approve request with status: ${request.status}` });
    }
 
    // Update request to approved status (pre-registration)
    await client.query(
      `UPDATE domain_registration_requests 
       SET status = 'approved', reviewed_by = $1, reviewed_at = NOW(), approval_notes = $2, updated_at = NOW()
       WHERE request_id = $3`,
      [userId, approval_notes, id]
    );
 
    await client.query('COMMIT');
 
    console.log('[Domain Approve] Request approved, starting domain creation for:', request.domain_name);
    console.log('[Domain Approve] Domain type:', request.domain_type);
 
    // Handle DNS-only domains differently (no registration, just Cloudflare zone creation)
    if (request.domain_type === 'dns-only') {
      console.log('[Domain Approve] DNS-ONLY mode: Creating Cloudflare zone without registration');
      
      try {
        // Create Cloudflare zone
        console.log('[Domain Approve] Creating Cloudflare zone for:', request.domain_name);
        const zoneResult = await createZone(request.domain_name);
        
        if (!zoneResult || !zoneResult.id) {
          throw new Error('Failed to create Cloudflare zone');
        }
 
        console.log('[Domain Approve] Cloudflare zone created:', zoneResult.id);
 
        // Extract nameservers from Cloudflare response
        const cloudflareNameservers = zoneResult.name_servers || [];
 
        // Create domain record in database
        const domainResult = await pool.query(
          `INSERT INTO public.domains (
            tenant_id, customer_id, contract_id, domain_name, registrar, 
            status, registration_date, nameservers, dns_provider,
            purchase_price, currency, notes
          ) VALUES ($1, $2, $3, $4, $5, $6, NOW(), $7, $8, $9, $10, $11)
          RETURNING domain_id`,
          [
            request.tenant_id,
            request.customer_id,
            request.contract_id,
            request.domain_name,
            'external', // Registrar is external for DNS-only domains
            'active',
            JSON.stringify(cloudflareNameservers),
            'cloudflare',
            request.price || 0,
            request.currency || 'USD',
            `DNS-only domain. Cloudflare Zone ID: ${zoneResult.id}. Nameservers: ${cloudflareNameservers.join(', ')}`
          ]
        );
 
        const domainId = domainResult.rows[0].domain_id;
 
        // Update request to registered status
        await pool.query(
          `UPDATE domain_registration_requests 
           SET status = 'registered', domain_id = $1, updated_at = NOW()
           WHERE request_id = $2`,
          [domainId, id]
        );
 
        // Notify customer of success
        if (request.customer_id) {
          await pool.query(
            `INSERT INTO notifications (tenant_id, customer_id, title, message, type)
             VALUES ($1, $2, $3, $4, $5)`,
            [
              request.tenant_id,
              request.customer_id,
              'DNS-Only Domain Approved',
              `Your domain ${request.domain_name} has been added to Cloudflare. Update nameservers to: ${cloudflareNameservers.join(', ')}`,
              'success'
            ]
          );
        }
 
        return res.json({ 
          success: true, 
          message: 'DNS-only domain approved and Cloudflare zone created successfully',
          domain_id: domainId,
          zone_id: zoneResult.id,
          nameservers: cloudflareNameservers
        });
 
      } catch (cloudflareErr) {
        console.error('[Domain Approve] Cloudflare zone creation error:', cloudflareErr);
        
        // Update request with error
        await pool.query(
          `UPDATE domain_registration_requests 
           SET status = 'failed', registration_error = $1, updated_at = NOW()
           WHERE request_id = $2`,
          [cloudflareErr.message, id]
        );
 
        // Notify customer of failure
        if (request.customer_id) {
          await pool.query(
            `INSERT INTO notifications (tenant_id, customer_id, title, message, type)
             VALUES ($1, $2, $3, $4, $5)`,
            [
              request.tenant_id,
              request.customer_id,
              'DNS-Only Domain Setup Failed',
              `Failed to set up DNS for ${request.domain_name}: ${cloudflareErr.message}`,
              'error'
            ]
          );
        }
 
        return res.status(500).json({ 
          error: 'DNS-only domain approved but Cloudflare zone creation failed', 
          details: cloudflareErr.message 
        });
      }
    }
 
    // Handle regular domain registration based on selected registrar
    let registrationResult;
    let actualRegistrar = registrar;
 
    // Route to appropriate registrar API
    if (registrar === 'cloudflare-registrar') {
      console.log('[Domain Approve] CLOUDFLARE REGISTRAR MODE: Registering domain via Cloudflare');
      
      try {
        const registrant = request.registrant_contact;
        
        // Call Cloudflare registrar API
        registrationResult = await registerCloudflare({
          domain: request.domain_name,
          years: request.years,
          privacy: true,
          auto_renew: true,
          registrant_contact: {
            first_name: registrant.firstName,
            last_name: registrant.lastName,
            organization: registrant.organization || '',
            email: registrant.email,
            phone: registrant.phone,
            address: registrant.address,
            city: registrant.city,
            state: registrant.state,
            postal_code: registrant.postalCode,
            country: registrant.country
          }
        });
 
        console.log('[Domain Approve] Cloudflare registration result:', registrationResult);
        
        // Mark as successful
        registrationResult.success = true;
        actualRegistrar = 'cloudflare';
        
        console.log('[Domain Approve] ✅ Cloudflare registration successful');
      } catch (cloudflareErr) {
        console.error('[Domain Approve] Cloudflare registration error:', cloudflareErr);
        
        // Check if it's API not available
        if (cloudflareErr.code === 'API_NOT_AVAILABLE') {
          return res.status(503).json({ 
            error: 'Cloudflare Registrar API not available',
            message: cloudflareErr.message
          });
        }
        
        registrationResult = {
          success: false,
          error: cloudflareErr.message
        };
      }
    } else if (registrar === 'cloudflare') {
      console.log('[Domain Approve] CLOUDFLARE MODE: Creating DNS zone only (no registration)');
      
      try {
        // Create Cloudflare zone
        console.log('[Domain Approve] Creating Cloudflare zone for:', request.domain_name);
        const zoneResult = await createZone(request.domain_name);
        
        if (!zoneResult || !zoneResult.id) {
          throw new Error('Failed to create Cloudflare zone');
        }
 
        console.log('[Domain Approve] Cloudflare zone created:', zoneResult.id);
 
        // Extract nameservers from Cloudflare response
        const cloudflareNameservers = zoneResult.name_servers || [];
 
        registrationResult = {
          success: true,
          domainId: null,
          expirationDate: null, // No expiry for DNS-only
          nameservers: cloudflareNameservers,
          zoneId: zoneResult.id,
          message: 'Cloudflare DNS zone created - customer must update nameservers at their registrar'
        };
        actualRegistrar = 'external'; // Mark as external since we don't register
      } catch (cloudflareErr) {
        console.error('[Domain Approve] Cloudflare error:', cloudflareErr);
        registrationResult = {
          success: false,
          error: cloudflareErr.message
        };
      }
    } else if (registrar === 'enom') {
      console.log('[Domain Approve] ENOM MODE: Registering domain via eNom API');
      
      // Check if eNom API credentials are configured
      if (!process.env.ENOM_UID || !process.env.ENOM_PASSWORD) {
        return res.status(500).json({ 
          error: 'eNom API credentials not configured',
          message: 'Please set ENOM_UID and ENOM_PASSWORD environment variables'
        });
      }
 
      try {
        // Prepare registrant contact for eNom
        const registrant = request.registrant_contact;
 
        // Call eNom registration
        registrationResult = await enom.registerDomain({
          domain: request.domain_name,
          years: request.years,
          nameservers: request.nameservers || [],
          registrantFirstName: registrant.firstName,
          registrantLastName: registrant.lastName,
          registrantEmail: registrant.email,
          registrantPhone: registrant.phone,
          registrantAddress1: registrant.address,
          registrantCity: registrant.city,
          registrantStateProvince: registrant.state,
          registrantPostalCode: registrant.postalCode,
          registrantCountry: registrant.country
        });
 
        console.log('[Domain Approve] eNom registration result:', registrationResult);
        
        // Verify registration was successful (check for order_id)
        if (registrationResult && registrationResult.order_id) {
          registrationResult.success = true;
          console.log('[Domain Approve] ✅ eNom registration successful, Order ID:', registrationResult.order_id);
        } else {
          console.error('[Domain Approve] ❌ eNom registration returned without Order ID:', registrationResult);
          throw new Error('eNom registration did not return a valid Order ID - registration may have failed');
        }
      } catch (enumErr) {
        console.error('[Domain Approve] eNom registration error:', enumErr);
        registrationResult = {
          success: false,
          error: enumErr.message
        };
      }
    } else if (registrar === 'moniker') {
      console.log('[Domain Approve] MONIKER MODE: Registering domain via Moniker API');
      
      // Check if Moniker API credentials are configured
      const isTestMode = !process.env.MONIKER_USER_KEY || 
                         !process.env.MONIKER_API_PASSWORD ||
                         process.env.MONIKER_USER_KEY === 'monikerapi' ||
                         process.env.MONIKER_API_PASSWORD === 'monikerpass' ||
                         process.env.MONIKER_BASE_URL?.includes('testapi');
 
      if (isTestMode) {
        console.log('[Domain Approve] TEST MODE: Skipping Moniker API, creating domain directly');
        // In test mode, simulate successful registration
        registrationResult = {
          success: true,
          domainId: null,
          expirationDate: new Date(Date.now() + request.years * 365 * 24 * 60 * 60 * 1000),
          message: 'Test mode - domain created without actual registration'
        };
      } else {
        try {
          // Prepare contacts (use admin/tech/billing = registrant if not specified)
          const registrant = request.registrant_contact;
          const admin = request.admin_contact || registrant;
          const tech = request.tech_contact || registrant;
          const billing = request.billing_contact || registrant;
 
          // Call Moniker registration
          registrationResult = await moniker.registerDomain({
          domain: request.domain_name,
          years: request.years,
          nameservers: request.nameservers || [],
          ownercontact: {
            FirstName: registrant.firstName,
            LastName: registrant.lastName,
            Organization: registrant.organization || '',
            Email: registrant.email,
            Phone: registrant.phone,
            Address: registrant.address,
            City: registrant.city,
            State: registrant.state,
            PostalCode: registrant.postalCode,
            Country: registrant.country
          },
          admincontact: admin ? {
            FirstName: admin.firstName,
            LastName: admin.lastName,
            Organization: admin.organization || '',
            Email: admin.email,
            Phone: admin.phone,
            Address: admin.address,
            City: admin.city,
            State: admin.state,
            PostalCode: admin.postalCode,
            Country: admin.country
          } : null,
          techcontact: tech ? {
            FirstName: tech.firstName,
            LastName: tech.lastName,
            Organization: tech.organization || '',
            Email: tech.email,
            Phone: tech.phone,
            Address: tech.address,
            City: tech.city,
            State: tech.state,
            PostalCode: tech.postalCode,
            Country: tech.country
          } : null,
          billingcontact: billing ? {
            FirstName: billing.firstName,
            LastName: billing.lastName,
            Organization: billing.organization || '',
            Email: billing.email,
            Phone: billing.phone,
            Address: billing.address,
            City: billing.city,
            State: billing.state,
            PostalCode: billing.postalCode,
            Country: billing.country
          } : null
        });
 
        console.log('[Domain Approve] Moniker registration result:', registrationResult);
        registrationResult.success = registrationResult.status !== 'FAILURE';
        } catch (monikerErr) {
          console.error('[Domain Approve] Moniker registration error:', monikerErr);
          registrationResult = {
            success: false,
            error: monikerErr.message
          };
        }
      }
    } else {
      return res.status(400).json({ error: 'Invalid registrar. Must be cloudflare, cloudflare-registrar, enom, or moniker.' });
    }
 
    // Process registration result (works for all registrars)
    try {
      // If successful, create domain record
      if (registrationResult.success) {
        const registrant = request.registrant_contact;
        
        // Prepare domain notes based on registrar
        let domainNotes = '';
        if (actualRegistrar === 'external') {
          domainNotes = `Cloudflare DNS-only. Zone ID: ${registrationResult.zoneId}. Nameservers: ${registrationResult.nameservers?.join(', ')}`;
        }
 
        const domainResult = await pool.query(
          `INSERT INTO public.domains (
            tenant_id, customer_id, contract_id, domain_name, registrar, registrar_domain_id,
            status, registration_date, expiration_date, nameservers, registrant_contact,
            purchase_price, currency, dns_provider, notes
          ) VALUES ($1, $2, $3, $4, $5, $6, $7, NOW(), $8, $9, $10, $11, $12, $13, $14)
          RETURNING domain_id`,
          [
            request.tenant_id,
            request.customer_id,
            request.contract_id,
            request.domain_name,
            actualRegistrar,
            registrationResult.domainId || registrationResult.order_id || null,
            'active',
            registrationResult.expirationDate || (actualRegistrar !== 'external' ? new Date(Date.now() + request.years * 365 * 24 * 60 * 60 * 1000) : null),
            JSON.stringify(registrationResult.nameservers || request.nameservers || []),
            JSON.stringify(registrant),
            request.price || 0,
            request.currency || 'USD',
            actualRegistrar === 'external' ? 'cloudflare' : actualRegistrar,
            domainNotes || null
          ]
        );
 
        const domainId = domainResult.rows[0].domain_id;
 
        // Update request to registered status
        await pool.query(
          `UPDATE domain_registration_requests 
           SET status = 'registered', domain_id = $1, updated_at = NOW()
           WHERE request_id = $2`,
          [domainId, id]
        );
 
        // Notify customer of success
        if (request.customer_id) {
          let notificationMessage = '';
          if (actualRegistrar === 'external') {
            notificationMessage = `Your domain ${request.domain_name} has been added to Cloudflare. Update nameservers to: ${registrationResult.nameservers.join(', ')}`;
          } else {
            notificationMessage = `Your domain ${request.domain_name} has been successfully registered via ${actualRegistrar}`;
          }
          
          await pool.query(
            `INSERT INTO notifications (tenant_id, customer_id, title, message, type)
             VALUES ($1, $2, $3, $4, $5)`,
            [
              request.tenant_id,
              request.customer_id,
              actualRegistrar === 'external' ? 'DNS Zone Created' : 'Domain Registration Successful',
              notificationMessage,
              'success'
            ]
          );
        }
 
        res.json({ 
          success: true, 
          message: `Domain ${actualRegistrar === 'external' ? 'DNS zone created' : 'registered'} successfully via ${actualRegistrar}`,
          domain_id: domainId,
          registrar: actualRegistrar,
          nameservers: registrationResult.nameservers,
          zone_id: registrationResult.zoneId
        });
      } else {
        // Registration failed - update request with error
        await pool.query(
          `UPDATE domain_registration_requests 
           SET status = 'failed', registration_error = $1, updated_at = NOW()
           WHERE request_id = $2`,
          [registrationResult.error || 'Unknown registration error', id]
        );
 
        // Notify customer of failure
        if (request.customer_id) {
          await pool.query(
            `INSERT INTO notifications (tenant_id, customer_id, title, message, type)
             VALUES ($1, $2, $3, $4, $5)`,
            [
              request.tenant_id,
              request.customer_id,
              'Domain Registration Failed',
              `Registration of ${request.domain_name} failed: ${registrationResult.error}`,
              'error'
            ]
          );
        }
 
        // Notify root tenant admin of failure
        const rootTenantResult = await pool.query(
          `SELECT tenant_id FROM tenants WHERE subdomain = 'admin' OR is_msp = true LIMIT 1`
        );
        if (rootTenantResult.rows.length > 0) {
          await pool.query(
            `INSERT INTO notifications (tenant_id, title, message, type)
             VALUES ($1, $2, $3, $4)`,
            [
              rootTenantResult.rows[0].tenant_id,
              'Domain Registration Failed',
              `Failed to register ${request.domain_name}: ${registrationResult.error}`,
              'error'
            ]
          );
        }
 
        res.status(500).json({ 
          error: `Domain registration approved but ${registrar} registration failed`, 
          details: registrationResult.error 
        });
      }
    } catch (regErr) {
      console.error(`${registrar} registration error:`, regErr);
      
      // Update request with error
      await pool.query(
        `UPDATE domain_registration_requests 
         SET status = 'failed', registration_error = $1, updated_at = NOW()
         WHERE request_id = $2`,
        [regErr.message, id]
      );
 
      // Notify customer of failure
      if (request.customer_id) {
        await pool.query(
          `INSERT INTO notifications (tenant_id, customer_id, title, message, type)
           VALUES ($1, $2, $3, $4, $5)`,
          [
            request.tenant_id,
            request.customer_id,
            'Domain Registration Failed',
            `Registration of ${request.domain_name} failed: ${regErr.message}`,
            'error'
          ]
        );
      }
 
      // Notify root tenant admin of failure
      const rootTenantResult = await pool.query(
        `SELECT tenant_id FROM tenants WHERE subdomain = 'admin' OR is_msp = true LIMIT 1`
      );
      if (rootTenantResult.rows.length > 0) {
        await pool.query(
          `INSERT INTO notifications (tenant_id, title, message, type)
           VALUES ($1, $2, $3, $4)`,
          [
            rootTenantResult.rows[0].tenant_id,
            'Domain Registration Error',
            `Error registering ${request.domain_name}: ${regErr.message}`,
            'error'
          ]
        );
      }
 
      res.status(500).json({ 
        error: `Domain registration approved but ${registrar} API error occurred`, 
        details: regErr.message 
      });
    }
  } catch (err) {
    await client.query('ROLLBACK');
    console.error('Error approving domain registration request:', err);
    res.status(500).json({ error: 'Failed to approve domain registration request', details: err.message });
  } finally {
    client.release();
  }
});
 
/**
 * @api {post} /domain-requests/:id/deny Deny Domain Registration Request
 * @apiName DenyDomainRequest
 * @apiGroup DomainRequests
 * @apiDescription
 * Denies a pending domain registration request with optional explanation notes.
 * Updates request status to "denied" and sends notification to requesting customer.
 * Only root tenant/MSP administrators have permission to deny requests.
 * @apiPermission rootAdmin
 * @apiUse AuthHeader
 * @apiNote Only root tenant/MSP administrators can deny domain requests
 * @apiParam {number} id Domain registration request ID
 * @apiBody {string} [approval_notes] Admin notes explaining reason for denial
 * @apiSuccess {boolean} success Operation success status (true)
 * @apiSuccess {string} message "Domain registration request denied"
 * @apiError (400) {String} error "Cannot deny request with status: X" (if not pending)
 * @apiError (403) {String} error "Only root tenant admins can deny domain registration requests"
 * @apiError (404) {String} error "Domain registration request not found"
 * @apiError (500) {String} error "Failed to deny domain registration request"
 * @apiError (500) {String} details Detailed error description
 * @apiExample {curl} Example Request:
 *     curl -X POST https://api.ibghub.com/api/domain-requests/42/deny \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 *       -H "Content-Type: application/json" \
 *       -d '{"approval_notes":"Domain name conflicts with trademark policy"}'
 * @apiExample {json} Example Response:
 *     {
 *       "success": true,
 *       "message": "Domain registration request denied"
 *     }
 */
 
// POST /domain-requests/:id/deny - Deny domain registration request
router.post('/:id/deny', async (req, res) => {
  const { id } = req.params;
  const { approval_notes } = req.body;
  const userId = req.user?.user_id;
 
  // Only root tenant admins can deny
  const isRootAdmin = req.tenant?.subdomain === 'admin' || req.tenant?.isMsp === true || req.user?.is_msp === true;
  if (!isRootAdmin) {
    return res.status(403).json({ error: 'Only root tenant admins can deny domain registration requests' });
  }
 
  try {
    // Get request details for notification
    const requestResult = await pool.query(
      'SELECT * FROM domain_registration_requests WHERE request_id = $1',
      [id]
    );
 
    if (requestResult.rows.length === 0) {
      return res.status(404).json({ error: 'Domain registration request not found' });
    }
 
    const request = requestResult.rows[0];
 
    if (request.status !== 'pending') {
      return res.status(400).json({ error: `Cannot deny request with status: ${request.status}` });
    }
 
    // Update request to denied status
    await pool.query(
      `UPDATE domain_registration_requests 
       SET status = 'denied', reviewed_by = $1, reviewed_at = NOW(), approval_notes = $2, updated_at = NOW()
       WHERE request_id = $3`,
      [userId, approval_notes, id]
    );
 
    // Notify customer of denial
    if (request.customer_id) {
      await pool.query(
        `INSERT INTO notifications (tenant_id, customer_id, title, message, type)
         VALUES ($1, $2, $3, $4, $5)`,
        [
          request.tenant_id,
          request.customer_id,
          'Domain Registration Request Denied',
          `Your domain registration request for ${request.domain_name} has been denied${approval_notes ? `: ${approval_notes}` : ''}`,
          'warning'
        ]
      );
    }
 
    res.json({ success: true, message: 'Domain registration request denied' });
  } catch (err) {
    console.error('Error denying domain registration request:', err);
    res.status(500).json({ error: 'Failed to deny domain registration request', details: err.message });
  }
});
 
/**
 * @api {put} /domain-requests/:id Update Domain Registration Request
 * @apiName UpdateDomainRequest
 * @apiGroup DomainRequests
 * @apiDescription
 * Updates fields of a domain registration request before approval. Typically used by
 * root tenant administrators to correct information, adjust pricing, update contacts,
 * or change registration parameters prior to processing with registrar APIs.
 *
 * All fields are optional - only provided fields will be updated. Contact objects
 * are stored as JSON and completely replace existing contact data when updated.
 * @apiPermission rootAdmin
 * @apiUse AuthHeader
 * @apiNote Only root tenant/MSP administrators can update domain requests
 * @apiParam {number} id Domain registration request ID
 * @apiBody {number} [customer_id] Update customer association
 * @apiBody {number} [contract_id] Update contract association
 * @apiBody {number} [years] Update registration duration
 * @apiBody {number} [price] Update domain cost
 * @apiBody {string} [currency] Update currency code (USD, EUR, GBP, etc.)
 * @apiBody {string[]} [nameservers] Update custom nameservers
 * @apiBody {Object} [registrant_contact] Update WHOIS registrant contact (full object required)
 * @apiBody {Object} [admin_contact] Update WHOIS admin contact (full object required)
 * @apiBody {Object} [tech_contact] Update WHOIS technical contact (full object required)
 * @apiBody {Object} [billing_contact] Update WHOIS billing contact (full object required)
 * @apiSuccess {number} request_id Updated request ID
 * @apiSuccess {number} tenant_id Tenant ID
 * @apiSuccess {number} customer_id Customer ID
 * @apiSuccess {number} contract_id Contract ID
 * @apiSuccess {string} domain_name Domain name (immutable)
 * @apiSuccess {string} domain_type Domain type (immutable)
 * @apiSuccess {string} status Request status
 * @apiSuccess {number} years Registration years
 * @apiSuccess {number} price Domain cost
 * @apiSuccess {String} currency Currency code
 * @apiSuccess {String[]} nameservers Nameservers array
 * @apiSuccess {Object} registrant_contact Updated registrant contact
 * @apiSuccess {Object} admin_contact Updated admin contact
 * @apiSuccess {Object} tech_contact Updated tech contact
 * @apiSuccess {Object} billing_contact Updated billing contact
 * @apiSuccess {String} updated_at ISO timestamp of last update
 *
 * @apiError (400) {String} error "No fields to update" (if request body is empty)
 * @apiError (403) {String} error "Only root tenant admins can update domain registration requests"
 * @apiError (404) {String} error "Domain registration request not found"
 * @apiError (500) {String} error "Failed to update domain registration request"
 * @apiError (500) {String} details Detailed error description
 *
 * @apiExample {curl} Example Request:
 *     curl -X PUT https://api.ibghub.com/api/domain-requests/42 \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN" \
 *       -H "Content-Type: application/json" \
 *       -d '{"years":2,"price":24.99,"registrant_contact":{"firstName":"Jane","lastName":"Doe",...}}'
 *
 * @apiExample {json} Example Response:
 *     {
 *       "request_id": 42,
 *       "tenant_id": 5,
 *       "customer_id": 123,
 *       "contract_id": 456,
 *       "domain_name": "example.com",
 *       "domain_type": "registration",
 *       "status": "pending",
 *       "years": 2,
 *       "price": 24.99,
 *       "currency": "USD",
 *       "registrant_contact": {"firstName": "Jane", "lastName": "Doe", ...},
 *       "updated_at": "2025-01-15T14:22:00Z"
 *     }
 */
 
// PUT /domain-requests/:id - Update domain registration request (admin edits before approval)
router.put('/:id', async (req, res) => {
  const { id } = req.params;
  const {
    customer_id,
    contract_id,
    years,
    price,
    currency,
    nameservers,
    registrant_contact,
    admin_contact,
    tech_contact,
    billing_contact
  } = req.body;
 
  // Only root tenant admins can update
  const isRootAdmin = req.tenant?.subdomain === 'admin' || req.tenant?.is_msp === true;
  if (!isRootAdmin) {
    return res.status(403).json({ error: 'Only root tenant admins can update domain registration requests' });
  }
 
  try {
    const updates = [];
    const params = [];
    let paramIndex = 1;
 
    if (customer_id !== undefined) {
      updates.push(`customer_id = $${paramIndex++}`);
      params.push(customer_id);
    }
    if (contract_id !== undefined) {
      updates.push(`contract_id = $${paramIndex++}`);
      params.push(contract_id);
    }
    if (years !== undefined) {
      updates.push(`years = $${paramIndex++}`);
      params.push(years);
    }
    if (price !== undefined) {
      updates.push(`price = $${paramIndex++}`);
      params.push(price);
    }
    if (currency !== undefined) {
      updates.push(`currency = $${paramIndex++}`);
      params.push(currency);
    }
    if (nameservers !== undefined) {
      updates.push(`nameservers = $${paramIndex++}`);
      params.push(JSON.stringify(nameservers));
    }
    if (registrant_contact !== undefined) {
      updates.push(`registrant_contact = $${paramIndex++}`);
      params.push(JSON.stringify(registrant_contact));
    }
    if (admin_contact !== undefined) {
      updates.push(`admin_contact = $${paramIndex++}`);
      params.push(JSON.stringify(admin_contact));
    }
    if (tech_contact !== undefined) {
      updates.push(`tech_contact = $${paramIndex++}`);
      params.push(JSON.stringify(tech_contact));
    }
    if (billing_contact !== undefined) {
      updates.push(`billing_contact = $${paramIndex++}`);
      params.push(JSON.stringify(billing_contact));
    }
 
    if (updates.length === 0) {
      return res.status(400).json({ error: 'No fields to update' });
    }
 
    updates.push(`updated_at = NOW()`);
    params.push(id);
 
    const query = `
      UPDATE domain_registration_requests 
      SET ${updates.join(', ')}
      WHERE request_id = $${paramIndex}
      RETURNING *
    `;
 
    const result = await pool.query(query, params);
 
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Domain registration request not found' });
    }
 
    res.json(result.rows[0]);
  } catch (err) {
    console.error('Error updating domain registration request:', err);
    res.status(500).json({ error: 'Failed to update domain registration request', details: err.message });
  }
});
 
/**
 * @api {post} /domain-requests/backfill-notifications Backfill Notifications for Domain Requests
 * @apiName BackfillDomainRequestNotifications
 * @apiGroup DomainRequests
 * @apiDescription
 * Administrative utility endpoint to create notifications for existing domain registration
 * requests that don't have associated notifications. Useful after database migrations or
 * when notification system was temporarily unavailable. Only processes requests that don't
 * already have notifications mentioning their domain name.
 *
 * Creates notifications with:
 * - Title: "New Domain Registration Request"
 * - Message: "[domain_name] registration requested by [requester_name]"
 * - Type: "info"
 * - Created timestamp: Matches original request timestamp
 * - Target: Root tenant notification area
 * @apiPermission admin
 * @apiUse AuthHeader
 * @apiNote Only system administrators with role='admin' can run this utility
 * @apiSuccess {string} message Summary of operation
 * @apiSuccess {object[]} created Array of created notification records
 * @apiSuccess {string} created.domain Domain name that received notification
 * @apiSuccess {number} created.notification_id Created notification ID
 * @apiError (403) {String} error "Admin access required"
 * @apiError (404) {String} error "Root tenant not found"
 * @apiError (500) {String} error "Failed to backfill notifications"
 * @apiError (500) {String} details Detailed error description
 * @apiExample {curl} Example Request:
 *     curl -X POST https://api.ibghub.com/api/domain-requests/backfill-notifications \
 *       -H "Authorization: Bearer YOUR_JWT_TOKEN"
 * @apiExample {json} Example Response:
 *     {
 *       "message": "Successfully created 3 notifications",
 *       "created": [
 *         {"domain": "example.com", "notification_id": 101},
 *         {"domain": "test.org", "notification_id": 102},
 *         {"domain": "demo.net", "notification_id": 103}
 *       ]
 *     }
 */
 
// POST /domain-requests/backfill-notifications - Backfill notifications for existing requests (admin only)
router.post('/backfill-notifications', async (req, res) => {
  try {
    // Admin only
    if (!req.user || req.user.role !== 'admin') {
      return res.status(403).json({ error: 'Admin access required' });
    }
 
    // Get root tenant
    const rootTenantResult = await pool.query(
      `SELECT tenant_id FROM tenants WHERE subdomain = 'admin' OR is_msp = true LIMIT 1`
    );
    
    if (rootTenantResult.rows.length === 0) {
      return res.status(404).json({ error: 'Root tenant not found' });
    }
    
    const rootTenantId = rootTenantResult.rows[0].tenant_id;
    
    // Get all domain requests that don't have notifications
    const requestsResult = await pool.query(`
      SELECT dr.request_id, dr.domain_name, dr.customer_id, dr.requested_at,
             dr.registrant_contact
      FROM domain_registration_requests dr
      WHERE NOT EXISTS (
        SELECT 1 FROM notifications n 
        WHERE n.message LIKE '%' || dr.domain_name || '%'
      )
      ORDER BY dr.requested_at DESC
    `);
    
    // Create notifications for each request
    const created = [];
    for (const request of requestsResult.rows) {
      const registrant = request.registrant_contact;
      const fullName = `${registrant.firstName || ''} ${registrant.lastName || ''}`.trim() || 'Unknown';
      
      const notifResult = await pool.query(
        `INSERT INTO notifications (tenant_id, title, message, type, customer_id, created_at)
         VALUES ($1, $2, $3, $4, $5, $6)
         RETURNING notification_id`,
        [
          rootTenantId,
          'New Domain Registration Request',
          `${request.domain_name} registration requested by ${fullName}`,
          'info',
          request.customer_id,
          request.requested_at
        ]
      );
      
      created.push({
        domain: request.domain_name,
        notification_id: notifResult.rows[0].notification_id
      });
    }
    
    res.json({
      message: `Successfully created ${created.length} notifications`,
      created
    });
    
  } catch (err) {
    console.error('Error backfilling notifications:', err);
    res.status(500).json({ error: 'Failed to backfill notifications', details: err.message });
  }
});
 
module.exports = router;