meshcentral.js

Go to the documentation of this file.

/**
 * @file meshcentral.js
 * @description MeshCentral integration routes for web-based remote desktop access with multi-tenant isolation.
 * Each tenant has dedicated user account and device group. Supports session generation, auto-linking,
 * device sync, hardware data population, and installer distribution. Includes both manual and automated
 * workflows for connecting agents to MeshCentral nodes.
 * @module routes/meshcentral
 */
 
/**
 * @apiDefine MeshCentralGroup MeshCentral Remote Desktop Integration
 * Web-based remote desktop via MeshCentral with multi-tenant isolation
 */
 
/**
 * MeshCentral Integration Routes
 * Provides web-based remote desktop access with true multi-tenant isolation
 */
 
const express = require('express');
const router = express.Router();
const crypto = require('crypto');
const authenticateToken = require('../middleware/auth');
const db = require('../db');
const MeshCentralAPI = require('../lib/meshcentral-api');
const { encrypt, decrypt } = require('../lib/encryption');
 
const MESHCENTRAL_URL = process.env.MESHCENTRAL_URL || 'https://rmm-psa-meshcentral-aq48h.ondigitalocean.app';
const MESHCENTRAL_ADMIN_USERNAME = process.env.MESHCENTRAL_USERNAME || 'admin';
const MESHCENTRAL_ADMIN_PASSWORD = process.env.MESHCENTRAL_PASSWORD;
 
// Cache for tenant-specific MeshCentral API clients
const tenantAPIClients = new Map();
 
/**
 * Get MeshCentral API client for a specific tenant
 * Each tenant has their own user account and device group in MeshCentral
 * @param tenantId
 */
async function getTenantMeshAPI(tenantId) {
  // Root tenant (MSP) uses admin account
  if (tenantId === 1 || tenantId === '00000000-0000-0000-0000-000000000001') {
    return getAdminMeshAPI();
  }
  
  // Check cache first
  const cacheKey = `tenant_${tenantId}`;
  if (tenantAPIClients.has(cacheKey)) {
    return tenantAPIClients.get(cacheKey);
  }
  
  // Get tenant's MeshCentral credentials from database
  const tenantResult = await db.query(
    'SELECT meshcentral_username, meshcentral_password_encrypted, meshcentral_setup_complete FROM tenants WHERE tenant_id = $1',
    [tenantId]
  );
  
  if (tenantResult.rows.length === 0) {
    throw new Error('Tenant not found');
  }
  
  const tenant = tenantResult.rows[0];
  
  // If tenant doesn't have MeshCentral setup yet, create it
  if (!tenant.meshcentral_setup_complete) {
    console.log(`Setting up MeshCentral for tenant ${tenantId}...`);
    await setupTenantMeshCentral(tenantId);
    
    // Fetch updated credentials
    const updatedResult = await db.query(
      'SELECT meshcentral_username, meshcentral_password_encrypted FROM tenants WHERE tenant_id = $1',
      [tenantId]
    );
    tenant.meshcentral_username = updatedResult.rows[0].meshcentral_username;
    tenant.meshcentral_password_encrypted = updatedResult.rows[0].meshcentral_password_encrypted;
  }
  
  // Decrypt password
  const password = decrypt(tenant.meshcentral_password_encrypted);
  
  if (!password) {
    throw new Error('Failed to decrypt MeshCentral password');
  }
  
  // Create API client with tenant credentials
  const api = new MeshCentralAPI(MESHCENTRAL_URL, tenant.meshcentral_username, password);
  await api.login();
  
  // Cache for future requests
  tenantAPIClients.set(cacheKey, api);
  
  return api;
}
 
/**
 * Get admin MeshCentral API client (for root tenant/MSP)
 */
let adminMeshAPI = null;
let adminLoginPromise = null;
 
/**
 *
 */
async function getAdminMeshAPI() {
  if (!adminMeshAPI) {
    adminMeshAPI = new MeshCentralAPI(MESHCENTRAL_URL, MESHCENTRAL_ADMIN_USERNAME, MESHCENTRAL_ADMIN_PASSWORD);
  }
  
  // Only login once, even if multiple requests come in
  if (!adminLoginPromise) {
    adminLoginPromise = adminMeshAPI.login().then(success => {
      adminLoginPromise = null;
      return success;
    });
  }
  
  await adminLoginPromise;
  return adminMeshAPI;
}
 
/**
 * Setup MeshCentral for a new tenant (create user + device group)
 * @param tenantId
 */
async function setupTenantMeshCentral(tenantId) {
  try {
    // Get tenant details
    const tenantResult = await db.query(
      'SELECT tenant_id, subdomain, status FROM tenants WHERE tenant_id = $1',
      [tenantId]
    );
    
    if (tenantResult.rows.length === 0) {
      throw new Error('Tenant not found');
    }
    
    const tenant = tenantResult.rows[0];
    
    // Use admin API to create tenant user and mesh
    const adminAPI = await getAdminMeshAPI();
    
    const setup = await adminAPI.setupTenant({
      tenantId: tenant.tenant_id,
      tenantName: tenant.subdomain || `Tenant ${tenantId}`,
      subdomain: tenant.subdomain
    });
    
    // Encrypt password before storing
    const encryptedPassword = encrypt(setup.password);
    
    // Store credentials in database
    await db.query(
      `UPDATE tenants 
       SET meshcentral_username = $1,
           meshcentral_password_encrypted = $2,
           meshcentral_group_id = $3,
           meshcentral_group_name = $4,
           meshcentral_setup_complete = true
       WHERE tenant_id = $5`,
      [setup.username, encryptedPassword, setup.meshId, setup.meshName, tenantId]
    );
    
    console.log(`✅ MeshCentral setup complete for tenant ${tenantId}`);
    
    return setup;
  } catch (error) {
    console.error(`Failed to setup MeshCentral for tenant ${tenantId}:`, error.message);
    throw error;
  }
}
 
/**
 * @api {post} /api/meshcentral/session/:agentId Generate MeshCentral Session
 * @apiName CreateMeshCentralSession
 * @apiGroup MeshCentralGroup
 * @apiDescription Generates secure MeshCentral session with JWT token authentication for iframe embedding.
 * Returns authenticated URL with embedded token, session tracking, and 4-hour expiration. Supports
 * multiple view modes (General, Desktop, Terminal). Enforces tenant isolation.
 * @apiParam {string} agentId Agent ID or UUID
 * @apiParam {number} [viewMode=11] View mode (10=General, 11=Desktop, 12=Terminal, etc.)
 * @apiSuccess {boolean} success Session created successfully
 * @apiSuccess {string} sessionToken Session tracking token
 * @apiSuccess {string} expiresAt Session expiration timestamp (4 hours)
 * @apiSuccess {object} agent Agent details
 * @apiSuccess {string} agent.id Agent database ID
 * @apiSuccess {string} agent.uuid Agent UUID
 * @apiSuccess {string} agent.hostname Agent hostname
 * @apiSuccess {string} agent.platform Agent platform/OS
 * @apiSuccess {string} agent.nodeId MeshCentral node ID
 * @apiSuccess {string} iframeUrl Complete iframe URL with embedded JWT token
 * @apiSuccess {number} viewMode View mode used
 * @apiError 404 Agent not found
 * @apiError 400 Agent not connected to MeshCentral (no node ID)
 * @apiError 401 No JWT token provided
 * @apiError 500 Failed to create session
 * @apiExample {curl} Example:
 *   curl -X POST https://api.example.com/api/meshcentral/session/abc-123 \
 *     -H "Authorization: Bearer YOUR_TOKEN" \
 *     -H "Content-Type: application/json" \
 *     -d '{"viewMode":11}'
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "sessionToken": "abc123...",
 *     "expiresAt": "2026-03-12T18:00:00Z",
 *     "agent": {
 *       "id": 123,
 *       "uuid": "abc-123",
 *       "hostname": "DESKTOP-01",
 *       "platform": "Windows 10",
 *       "nodeId": "node//abc123..."
 *     },
 *     "iframeUrl": "https://meshcentral.example.com/?token=eyJhbGc...&gotonode=node//abc123&viewmode=11&hide=31",
 *     "viewMode": 11
 *   }
 */
/**
 * Generate secure MeshCentral session for dashboard
 * Returns an authenticated iframe URL with embedded session cookie
 */
router.post('/session/:agentId', authenticateToken, async (req, res) => {
  try {
    const { agentId } = req.params;
    const { viewMode = 11 } = req.body; // 10=General, 11=Desktop, 12=Terminal, etc.
 
    // Extract userId from JWT (could be user_id, userId, or id)
    const userId = req.user.user_id || req.user.userId || req.user.id;
    
    console.log(`🔍 Session request: agentId=${agentId}, userId=${userId}, tenantId=${req.user.tenantId}, user=`, req.user);
 
    // Get agent details with tenant isolation
    // Note: tenant_id is UUID in agents table, tenantId from JWT is also UUID
    // Root tenant UUID is '00000000-0000-0000-0000-000000000001'
    const agentResult = await db.query(
      'SELECT agent_id, agent_uuid, hostname, meshcentral_nodeid, platform, tenant_id FROM agents WHERE (agent_id::text = $1 OR agent_uuid::text = $1) AND (tenant_id::text = $2 OR $2 = \'00000000-0000-0000-0000-000000000001\')',
      [agentId, req.user.tenantId]
    );
 
    console.log(`🔍 Agent query result: ${agentResult.rows.length} rows`);
 
    if (agentResult.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
 
    const agent = agentResult.rows[0];
 
    if (!agent.meshcentral_nodeid) {
      return res.status(400).json({ 
        error: 'Agent not connected to MeshCentral',
        message: 'Please install MeshCentral agent on this device first'
      });
    }
 
    // Get JWT token from request authorization header
    const authHeader = req.headers.authorization;
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return res.status(401).json({ error: 'No JWT token provided' });
    }
    
    const jwtToken = authHeader.substring(7); // Remove 'Bearer ' prefix
    console.log(`🔍 Using JWT token for authentication: ${jwtToken.substring(0, 20)}...`);
 
    // Generate a secure session token for tracking
    const sessionToken = crypto.randomBytes(32).toString('hex');
    const expiresAt = new Date(Date.now() + 4 * 60 * 60 * 1000); // 4 hours
 
    // Build authenticated MeshCentral URL with JWT token
    // The forked MeshCentral supports ?token=JWT_TOKEN for authentication
    let meshcentralUrl = `${MESHCENTRAL_URL}/?token=${encodeURIComponent(jwtToken)}`;
    
    // Add node and view mode parameters
    meshcentralUrl += `&gotonode=${agent.meshcentral_nodeid}`;
    meshcentralUrl += `&viewmode=${viewMode}`;
    meshcentralUrl += `&hide=31`; // Hide UI elements (header=1, tabs=2, footer=4, title=8, toolbar=16)
    
    console.log(`🔍 Generated MeshCentral URL: ${MESHCENTRAL_URL}/?token=***&gotonode=${agent.meshcentral_nodeid}&viewmode=${viewMode}&hide=31`);
    
    // Store session in database for audit trail
    console.log(`🔍 Storing session: token=${sessionToken}, userId=${userId}, agentId=${agent.agent_id}, nodeId=${agent.meshcentral_nodeid}`);
    
    await db.query(`
      INSERT INTO meshcentral_sessions (
        session_token, user_id, agent_id, node_id, view_mode, 
        meshcentral_cookie, expires_at, created_at
      ) VALUES ($1, $2, $3, $4, $5, $6, $7, NOW())
      ON CONFLICT (session_token) DO UPDATE 
      SET expires_at = $7, last_used_at = NOW()
    `, [sessionToken, userId, agent.agent_id, agent.meshcentral_nodeid, viewMode, jwtToken, expiresAt]);
 
    console.log(`✅ MeshCentral session created: user=${userId}, agent=${agent.agent_id}, node=${agent.meshcentral_nodeid}`);
 
    res.json({
      success: true,
      sessionToken,
      expiresAt,
      agent: {
        id: agent.agent_id,
        uuid: agent.agent_uuid,
        hostname: agent.hostname,
        platform: agent.platform,
        nodeId: agent.meshcentral_nodeid
      },
      iframeUrl: meshcentralUrl,
      viewMode
    });
 
  } catch (error) {
    console.error('❌ Error creating MeshCentral session:', error);
    console.error('Stack trace:', error.stack);
    res.status(500).json({ error: 'Failed to create session', message: error.message });
  }
});
 
/**
 * Proxy MeshCentral requests through backend (keeps credentials secure)
 * NOTE: This is a stub - full HTTP/WebSocket proxy needs implementation
 */
router.use('/proxy/:sessionToken', async (req, res, next) => {
  try {
    const { sessionToken } = req.params;
    const proxyPath = req.path || '';
 
    // Validate session and ensure tenant isolation
    const sessionResult = await db.query(`
      SELECT s.*, a.meshcentral_nodeid, a.tenant_id
      FROM meshcentral_sessions s
      JOIN agents a ON s.agent_id = a.agent_id
      JOIN users u ON s.user_id = u.user_id
      WHERE s.session_token = $1 
        AND s.expires_at > NOW()
        AND (a.tenant_id = u.tenant_id OR u.tenant_id = 1)
    `, [sessionToken]);
 
    if (sessionResult.rows.length === 0) {
      return res.status(401).json({ error: 'Invalid or expired session' });
    }
 
    const session = sessionResult.rows[0];
 
    // Get MeshCentral API client
    const api = await getMeshAPI();
    
    // Proxy the request to MeshCentral
    const meshUrl = `${MESHCENTRAL_URL}/${proxyPath}${req.url.includes('?') ? req.url.substring(req.url.indexOf('?')) : ''}`;
    
    // For now, return the proxy setup info
    // In production, you'd actually proxy the HTTP request
    res.json({
      proxyInfo: {
        targetUrl: meshUrl,
        nodeId: session.meshcentral_nodeid,
        viewMode: session.view_mode,
        message: 'Proxy endpoint - implement full HTTP proxying here'
      }
    });
 
  } catch (error) {
    console.error('Error proxying MeshCentral request:', error);
    res.status(500).json({ error: 'Proxy error', message: error.message });
  }
});
 
/**
 * @api {post} /api/meshcentral/connect/:agentId Connect to Agent (Legacy)
 * @apiName ConnectToAgent
 * @apiGroup MeshCentralGroup
 * @apiDescription Legacy endpoint for getting MeshCentral iframe URL with embedded authentication.
 * Less secure than /session endpoint. Generates login token and stores in database.
 * @apiParam {string} agentId Agent database ID
 * @apiSuccess {boolean} success Connection created successfully
 * @apiSuccess {object} agent Agent details
 * @apiSuccess {number} agent.id Agent database ID
 * @apiSuccess {string} agent.hostname Agent hostname
 * @apiSuccess {string} agent.platform Agent platform/OS
 * @apiSuccess {string} agent.nodeId MeshCentral node ID
 * @apiSuccess {string} embedUrl MeshCentral embed URL with token
 * @apiSuccess {string} token Login token
 * @apiSuccess {string} expiresAt Token expiration timestamp
 * @apiError 404 Agent not found
 * @apiError 400 Agent not connected to MeshCentral
 * @apiError 500 Failed to create connection
 * @apiExample {curl} Example:
 *   curl -X POST https://api.example.com/api/meshcentral/connect/123 \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 */
/**
 * Get MeshCentral iframe URL with embedded auth (legacy, less secure)
 */
router.post('/connect/:agentId', authenticateToken, async (req, res) => {
  try {
    const { agentId } = req.params;
 
    // Get agent details
    const agentResult = await db.query(
      'SELECT agent_id, hostname, meshcentral_nodeid, platform FROM agents WHERE agent_id = $1 AND tenant_id = $2',
      [agentId, req.user.tenantId]
    );
 
    if (agentResult.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
 
    const agent = agentResult.rows[0];
 
    if (!agent.meshcentral_nodeid) {
      return res.status(400).json({ 
        error: 'Agent not connected to MeshCentral',
        message: 'Please install MeshCentral agent on this device first'
      });
    }
 
    // Get MeshCentral API client
    const api = await getMeshAPI();
    
    // Generate login token and embed URL
    const tokenData = await api.generateLoginToken(agent.meshcentral_nodeid);
    
    // Store token in our database
    await db.query(`
      INSERT INTO meshcentral_tokens (token, agent_id, user_id, node_id, expires_at)
      VALUES ($1, $2, $3, $4, $5)
    `, [tokenData.token, agentId, req.user.userId, agent.meshcentral_nodeid, tokenData.expiresAt]);
 
    res.json({
      success: true,
      agent: {
        id: agent.agent_id,
        hostname: agent.hostname,
        platform: agent.platform,
        nodeId: agent.meshcentral_nodeid
      },
      embedUrl: tokenData.embedUrl,
      token: tokenData.token,
      expiresAt: tokenData.expiresAt
    });
 
  } catch (error) {
    console.error('Error creating MeshCentral connection:', error);
    res.status(500).json({ error: 'Failed to create connection', message: error.message });
  }
});
 
/**
 * @api {get} /api/meshcentral/status/:agentId Get Agent MeshCentral Status
 * @apiName GetAgentMeshCentralStatus
 * @apiGroup MeshCentralGroup
 * @apiDescription Retrieves MeshCentral connection status for agent. Includes both database cache and live
 * status from MeshCentral server if available. Enforces tenant isolation.
 * @apiParam {string} agentId Agent database ID
 * @apiSuccess {boolean} success Status retrieved successfully
 * @apiSuccess {boolean} installed MeshCentral agent installed (has node ID)
 * @apiSuccess {boolean} connected Currently connected to MeshCentral
 * @apiSuccess {string} lastSeen Last connection timestamp
 * @apiSuccess {string} nodeId MeshCentral node ID
 * @apiSuccess {object} [liveStatus] Live status from MeshCentral server (if available)
 * @apiError 404 Agent not found
 * @apiError 500 Failed to check status
 * @apiExample {curl} Example:
 *   curl https://api.example.com/api/meshcentral/status/123 \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "installed": true,
 *     "connected": true,
 *     "lastSeen": "2026-03-12T14:30:00Z",
 *     "nodeId": "node//abc123...",
 *     "liveStatus": {"connected": true, "lastSeen": "2026-03-12T14:30:00Z"}
 *   }
 */
/**
 * Get agent MeshCentral status
 */
router.get('/status/:agentId', authenticateToken, async (req, res) => {
  try {
    const { agentId } = req.params;
 
    const result = await db.query(
      'SELECT meshcentral_nodeid, meshcentral_connected, meshcentral_last_seen FROM agents WHERE agent_id = $1 AND tenant_id = $2',
      [agentId, req.user.tenantId]
    );
 
    if (result.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
 
    const agent = result.rows[0];
    
    // If we have a node ID, try to get live status from MeshCentral
    let liveStatus = null;
    if (agent.meshcentral_nodeid) {
      try {
        const api = await getMeshAPI();
        const node = await api.getNode(agent.meshcentral_nodeid);
        if (node) {
          liveStatus = MeshCentralAPI.parseNodeData(node);
        }
      } catch (error) {
        console.warn('Failed to get live MeshCentral status:', error.message);
      }
    }
 
    res.json({
      success: true,
      installed: !!agent.meshcentral_nodeid,
      connected: liveStatus?.connected || agent.meshcentral_connected || false,
      lastSeen: liveStatus?.lastSeen || agent.meshcentral_last_seen,
      nodeId: agent.meshcentral_nodeid,
      liveStatus: liveStatus
    });
 
  } catch (error) {
    console.error('Error checking MeshCentral status:', error);
    res.status(500).json({ error: 'Failed to check status' });
  }
});
 
/**
 * @api {get} /api/meshcentral/installer Get Agent Installer URL
 * @apiName GetMeshCentralInstaller
 * @apiGroup MeshCentralGroup
 * @apiDescription Returns MeshCentral agent installer download URL for specified platform and mesh ID.
 * Requires mesh ID query parameter.
 * @apiParam (Query) {string} meshId MeshCentral mesh/group ID (required)
 * @apiParam (Query) {string} [platform=windows] Target platform (windows, linux, macos)
 * @apiSuccess {boolean} success Installer URL retrieved successfully
 * @apiSuccess {string} platform Target platform
 * @apiSuccess {string} installerUrl Download URL for installer
 * @apiSuccess {string} instructions Installation instructions
 * @apiError 400 Missing meshId
 * @apiError 500 Failed to get installer URL
 * @apiExample {curl} Example:
 *   curl "https://api.example.com/api/meshcentral/installer?meshId=mesh123&platform=windows" \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "platform": "windows",
 *     "installerUrl": "https://meshcentral.example.com/meshagents?id=mesh123...",
 *     "instructions": "Download and run this installer on the target windows machine"
 *   }
 */
/**
 * Get MeshCentral agent installer
 */
router.get('/installer', authenticateToken, async (req, res) => {
  try {
    const { platform = 'windows', meshId } = req.query;
 
    if (!meshId) {
      return res.status(400).json({ 
        error: 'meshId required',
        message: 'Please provide the MeshCentral mesh ID'
      });
    }
 
    const api = await getMeshAPI();
    const installerUrl = api.getAgentInstallerUrl(meshId, platform);
 
    res.json({
      success: true,
      platform,
      installerUrl,
      instructions: `Download and run this installer on the target ${platform} machine`
    });
 
  } catch (error) {
    console.error('Error getting MeshCentral installer:', error);
    res.status(500).json({ error: 'Failed to get installer URL' });
  }
});
 
/**
 * @api {get} /api/meshcentral/devices Get All MeshCentral Devices
 * @apiName GetMeshCentralDevices
 * @apiGroup MeshCentralGroup
 * @apiDescription Retrieves all MeshCentral devices with tenant filtering. Root tenant (tenant_id=1) sees all
 * devices, other tenants see only their linked agents. Returns parsed device data.
 * @apiSuccess {boolean} success Devices retrieved successfully
 * @apiSuccess {number} count Number of devices returned
 * @apiSuccess {object[]} devices Array of device objects
 * @apiSuccess {string} devices.nodeId MeshCentral node ID
 * @apiSuccess {string} devices.hostname Device hostname
 * @apiSuccess {string} devices.platform Device platform/OS
 * @apiSuccess {boolean} devices.connected Connection status
 * @apiSuccess {string} devices.lastSeen Last connection timestamp
 * @apiSuccess {string} tenantId Current tenant ID
 * @apiSuccess {boolean} isRootTenant Whether current tenant is root/MSP
 * @apiError 500 Failed to get devices
 * @apiExample {curl} Example:
 *   curl https://api.example.com/api/meshcentral/devices \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "count": 3,
 *     "devices": [{"nodeId": "node//abc", "hostname": "DESKTOP-01", "connected": true}],
 *     "tenantId": "00000000-0000-0000-0000-000000000001",
 *     "isRootTenant": true
 *   }
 */
/**
 * Get all MeshCentral devices (for sync)
 * Root tenant (tenant_id=1) sees all devices, others see only their own
 */
router.get('/devices', authenticateToken, async (req, res) => {
  try {
    const api = await getMeshAPI();
    const nodes = await api.getNodes();
    
    // Parse all nodes
    const parsedNodes = nodes.map(node => MeshCentralAPI.parseNodeData(node));
 
    // For non-root tenants, filter to only their agents
    let filteredNodes = parsedNodes;
    if (req.user.tenantId !== 1) {
      // Get list of node IDs for this tenant's agents
      const tenantAgents = await db.query(
        'SELECT meshcentral_nodeid FROM agents WHERE tenant_id = $1 AND meshcentral_nodeid IS NOT NULL',
        [req.user.tenantId]
      );
      const tenantNodeIds = new Set(tenantAgents.rows.map(a => a.meshcentral_nodeid));
      filteredNodes = parsedNodes.filter(node => tenantNodeIds.has(node.nodeId));
    }
 
    res.json({
      success: true,
      count: filteredNodes.length,
      devices: filteredNodes,
      tenantId: req.user.tenantId,
      isRootTenant: req.user.tenantId === 1
    });
 
  } catch (error) {
    console.error('Error getting MeshCentral devices:', error);
    res.status(500).json({ error: 'Failed to get devices', message: error.message });
  }
});
 
/**
 * @api {get} /api/meshcentral/meshes Get All Device Groups
 * @apiName GetMeshCentralMeshes
 * @apiGroup MeshCentralGroup
 * @apiDescription Retrieves all MeshCentral device groups (meshes) from server. No tenant filtering.
 * @apiSuccess {boolean} success Meshes retrieved successfully
 * @apiSuccess {number} count Number of device groups
 * @apiSuccess {object[]} meshes Array of mesh/group objects
 * @apiError 500 Failed to get meshes
 * @apiExample {curl} Example:
 *   curl https://api.example.com/api/meshcentral/meshes \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "count": 5,
 *     "meshes": [{"_id": "mesh//abc", "name": "Tenant 1 Devices"}]
 *   }
 */
/**
 * Get all MeshCentral device groups (meshes)
 */
router.get('/meshes', authenticateToken, async (req, res) => {
  try {
    const api = await getMeshAPI();
    const meshes = await api.getMeshes();
 
    res.json({
      success: true,
      count: meshes.length,
      meshes: meshes
    });
 
  } catch (error) {
    console.error('Error getting MeshCentral meshes:', error);
    res.status(500).json({ error: 'Failed to get meshes', message: error.message });
  }
});
 
/**
 * @api {post} /api/meshcentral/sync-with-hardware Sync Devices with Hardware Data
 * @apiName SyncMeshCentralDevicesWithHardware
 * @apiGroup MeshCentralGroup
 * @apiDescription Enhanced device sync that retrieves and stores detailed hardware information (CPU, memory, network).
 * Auto-links devices by hostname or MAC address, populates hardware_data column. Creates new agents
 * for unmatched devices. Tenant-filtered (non-root tenants sync only their linked agents).
 * @apiSuccess {boolean} success Sync completed successfully
 * @apiSuccess {number} synced Number of devices updated
 * @apiSuccess {number} new Number of new agents created
 * @apiSuccess {number} errors Number of errors encountered
 * @apiSuccess {number} total Total devices processed
 * @apiSuccess {object[]} matchDetails Details of matching methods used
 * @apiSuccess {string} matchDetails.hostname Device hostname
 * @apiSuccess {string} matchDetails.method Match method (existing, hostname, mac_address, new)
 * @apiSuccess {number} [matchDetails.agentId] Agent database ID (if matched)
 * @apiError 500 Failed to sync devices
 * @apiExample {curl} Example:
 *   curl -X POST https://api.example.com/api/meshcentral/sync-with-hardware \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "synced": 5,
 *     "new": 2,
 *     "errors": 0,
 *     "total": 7,
 *     "matchDetails": [
 *       {"hostname": "DESKTOP-01", "method": "hostname", "agentId": 123}
 *     ]
 *   }
 */
/**
 * Enhanced sync with hardware data population
 * POST /api/meshcentral/sync-with-hardware
 */
router.post('/sync-with-hardware', authenticateToken, async (req, res) => {
  try {
    const api = await getMeshAPI();
    let nodes = await api.getNodes();
    
    // For non-root tenants, filter to only their existing agents
    if (req.user.tenantId !== 1) {
      const tenantAgents = await db.query(
        'SELECT meshcentral_nodeid FROM agents WHERE tenant_id = $1 AND meshcentral_nodeid IS NOT NULL',
        [req.user.tenantId]
      );
     const tenantNodeIds = new Set(tenantAgents.rows.map(a => a.meshcentral_nodeid));
      nodes = nodes.filter(node => {
        const parsed = MeshCentralAPI.parseNodeData(node);
        return tenantNodeIds.has(parsed.nodeId);
      });
    }
    
    let syncedCount = 0;
    let newCount = 0;
    let errorCount = 0;
    const matchDetails = [];
 
    for (const node of nodes) {
      try {
        const parsed = MeshCentralAPI.parseNodeData(node);
        
        // Get detailed system info if available
        let sysinfo = null;
        try {
          sysinfo = await api.getNodeSystemInfo(parsed.nodeId);
        } catch (err) {
          console.log(`⚠️  Could not get sysinfo for ${parsed.hostname}:`, err.message);
        }
 
        const hardwareData = sysinfo ? MeshCentralAPI.parseSystemInfo(sysinfo) : null;
        
        // Check if we already have an agent with this node ID
        let existingAgent = await db.query(
          'SELECT agent_id, hostname FROM agents WHERE meshcentral_nodeid = $1 AND (tenant_id = $2 OR $2 = 1)',
          [parsed.nodeId, req.user.tenantId]
        );
 
        if (existingAgent.rows.length > 0) {
          // Update existing agent with hardware data
          await db.query(`
            UPDATE agents 
            SET meshcentral_connected = $1,
                meshcentral_last_seen = $2,
                hostname = COALESCE(hostname, $3),
                platform = COALESCE(platform, $4),
                last_seen = GREATEST(last_seen, $2),
                hardware_data = COALESCE($5, hardware_data)
            WHERE meshcentral_nodeid = $6
          `, [
            parsed.connected,
            parsed.lastSeen,
            parsed.hostname,
            parsed.platform,
            hardwareData ? JSON.stringify(hardwareData) : null,
            parsed.nodeId
          ]);
          syncedCount++;
          matchDetails.push({ hostname: parsed.hostname, method: 'existing', agentId: existingAgent.rows[0].agent_id });
        } else {
          // Try to match by multiple identifiers
          let matchedAgent = null;
          let matchMethod = null;
 
          // Try hostname match first
          const hostnameMatch = await db.query(
            'SELECT agent_id, hostname FROM agents WHERE LOWER(hostname) = LOWER($1) AND meshcentral_nodeid IS NULL AND (tenant_id = $2 OR $2 = 1) LIMIT 1',
            [parsed.hostname, req.user.tenantId]
          );
 
          if (hostnameMatch.rows.length > 0) {
            matchedAgent = hostnameMatch.rows[0];
            matchMethod = 'hostname';
          } else if (parsed.hardware.macAddresses.length > 0 && hardwareData) {
            // Try MAC address match
            // Note: This requires the hardware_data column to be populated with previous data
            const macMatch = await db.query(`
              SELECT agent_id, hostname, hardware_data
              FROM agents 
              WHERE meshcentral_nodeid IS NULL 
              AND (tenant_id = $1 OR $1 = 1)
              AND hardware_data IS NOT NULL
              AND hardware_data::jsonb->'network' @> $2::jsonb
              LIMIT 1
            `, [
              req.user.tenantId,
              JSON.stringify([{ mac: parsed.hardware.macAddresses[0] }])
            ]);
 
            if (macMatch.rows.length > 0) {
              matchedAgent = macMatch.rows[0];
              matchMethod = 'mac_address';
            }
          }
 
          if (matchedAgent) {
            // Link existing agent
            await db.query(`
              UPDATE agents 
              SET meshcentral_nodeid = $1, 
                  meshcentral_connected = $2, 
                  meshcentral_last_seen = $3,
                  hardware_data = COALESCE($4, hardware_data)
              WHERE agent_id = $5
            `, [
              parsed.nodeId,
              parsed.connected,
              parsed.lastSeen,
              hardwareData ? JSON.stringify(hardwareData) : null,
              matchedAgent.agent_id
            ]);
            syncedCount++;
            matchDetails.push({ hostname: parsed.hostname, method: matchMethod, agentId: matchedAgent.agent_id });
            console.log(`✅ Auto-linked agent ${matchedAgent.agent_id} to MeshCentral node ${parsed.nodeId} (method: ${matchMethod})`);
          } else {
            // Create new agent entry
            await db.query(`
              INSERT INTO agents (
                tenant_id, hostname, platform, agent_uuid, 
                meshcentral_nodeid, meshcentral_connected, meshcentral_last_seen,
                last_seen, created_at, hardware_data
              ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW(), $9)
            `, [
              req.user.tenantId,
              parsed.hostname || parsed.name,
              parsed.platform || 'unknown',
              parsed.nodeId, // Use node ID as agent UUID temporarily
              parsed.nodeId,
              parsed.connected,
              parsed.lastSeen,
              parsed.lastSeen || new Date(),
              hardwareData ? JSON.stringify(hardwareData) : null
            ]);
            newCount++;
            matchDetails.push({ hostname: parsed.hostname, method: 'new', agentId: null });
          }
        }
      } catch (err) {
        console.error('Error syncing node:', node._id, err);
        errorCount++;
      }
    }
 
    res.json({
      success: true,
      synced: syncedCount,
      new: newCount,
      errors: errorCount,
      total: nodes.length,
      matchDetails: matchDetails
    });
 
  } catch (error) {
    console.error('Error syncing MeshCentral devices with hardware:', error);
    res.status(500).json({ error: 'Failed to sync devices', message: error.message });
  }
});
 
/**
 * @api {post} /api/meshcentral/sync Sync MeshCentral Devices (Deprecated)
 * @apiName SyncMeshCentralDevices
 * @apiGroup MeshCentralGroup
 * @apiDescription Basic device synchronization without hardware data. Auto-links devices by hostname.
 * **DEPRECATED**: Use auto-sync worker (meshcentral-device-sync.js) or /api/sync/meshcentral instead.
 * This endpoint will be removed in future version. Tenant-filtered.
 * @apiSuccess {boolean} success Sync completed successfully
 * @apiSuccess {number} synced Number of devices updated or linked
 * @apiSuccess {number} new Number of new agents created
 * @apiSuccess {number} errors Number of errors encountered
 * @apiSuccess {number} total Total devices processed
 * @apiError 500 Failed to sync devices
 * @apiExample {curl} Example (deprecated):
 *   curl -X POST https://api.example.com/api/meshcentral/sync \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 */
/**
 * Sync MeshCentral devices to our agents table
 * Root tenant (tenant_id=1) syncs all devices, others sync only their own
 * @deprecated This endpoint is deprecated. Use the auto-sync worker instead:
 * - Primary: meshcentral-device-sync.js (runs every 5 minutes automatically)
 * - Manual: POST /api/sync/meshcentral (triggers immediate sync)
 * - Backup: meshcentralSync.js BullMQ worker (runs daily at 3 AM)
 * 
 * This endpoint will be removed in a future version. It still works but is
 * no longer the recommended way to sync devices.
 */
router.post('/sync', authenticateToken, async (req, res) => {
  try {
    const api = await getMeshAPI();
    let nodes = await api.getNodes();
    
    // For non-root tenants, filter to only their existing agents
    if (req.user.tenantId !== 1) {
      const tenantAgents = await db.query(
        'SELECT meshcentral_nodeid FROM agents WHERE tenant_id = $1 AND meshcentral_nodeid IS NOT NULL',
        [req.user.tenantId]
      );
      const tenantNodeIds = new Set(tenantAgents.rows.map(a => a.meshcentral_nodeid));
      nodes = nodes.filter(node => {
        const parsed = MeshCentralAPI.parseNodeData(node);
        return tenantNodeIds.has(parsed.nodeId);
      });
    }
    
    let syncedCount = 0;
    let newCount = 0;
    let errorCount = 0;
 
    for (const node of nodes) {
      try {
        const parsed = MeshCentralAPI.parseNodeData(node);
        
        // Check if we already have an agent with this node ID (within tenant scope)
        const existingAgent = await db.query(
          'SELECT agent_id FROM agents WHERE meshcentral_nodeid = $1 AND (tenant_id = $2 OR $2 = 1)',
          [parsed.nodeId, req.user.tenantId]
        );
 
        if (existingAgent.rows.length > 0) {
          // Update existing agent
          await db.query(`
            UPDATE agents 
            SET meshcentral_connected = $1,
                meshcentral_last_seen = $2,
                hostname = COALESCE(hostname, $3),
                platform = COALESCE(platform, $4),
                last_seen = GREATEST(last_seen, $2)
            WHERE meshcentral_nodeid = $5
          `, [
            parsed.connected,
            parsed.lastSeen,
            parsed.hostname,
            parsed.platform,
            parsed.nodeId
          ]);
          syncedCount++;
        } else {
          // Try to match by hostname to link existing agents (within tenant scope)
          const hostnameMatch = await db.query(
            'SELECT agent_id FROM agents WHERE LOWER(hostname) = LOWER($1) AND meshcentral_nodeid IS NULL AND (tenant_id = $2 OR $2 = 1) LIMIT 1',
            [parsed.hostname, req.user.tenantId]
          );
 
          if (hostnameMatch.rows.length > 0) {
            // Link existing agent
            await db.query(
              'UPDATE agents SET meshcentral_nodeid = $1, meshcentral_connected = $2, meshcentral_last_seen = $3 WHERE agent_id = $4',
              [parsed.nodeId, parsed.connected, parsed.lastSeen, hostnameMatch.rows[0].agent_id]
            );
            syncedCount++;
            console.log(`✅ Auto-linked agent ${hostnameMatch.rows[0].agent_id} to MeshCentral node ${parsed.nodeId} (hostname: ${parsed.hostname})`);
          } else {
            // Create new agent entry
            await db.query(`
              INSERT INTO agents (
                tenant_id, hostname, platform, agent_uuid, 
                meshcentral_nodeid, meshcentral_connected, meshcentral_last_seen,
                last_seen, created_at
              ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, NOW())
            `, [
              req.user.tenantId,
              parsed.hostname || parsed.name,
              parsed.platform || 'unknown',
              parsed.nodeId, // Use node ID as agent UUID temporarily
              parsed.nodeId,
              parsed.connected,
              parsed.lastSeen,
              parsed.lastSeen || new Date()
            ]);
            newCount++;
          }
        }
      } catch (err) {
        console.error('Error syncing node:', node._id, err);
        errorCount++;
      }
    }
 
    res.json({
      success: true,
      synced: syncedCount,
      new: newCount,
      errors: errorCount,
      total: nodes.length
    });
 
  } catch (error) {
    console.error('Error syncing MeshCentral devices:', error);
    res.status(500).json({ error: 'Failed to sync devices', message: error.message });
  }
});
 
/**
 * @api {post} /api/meshcentral/auto-link Auto-Link Agent to MeshCentral Device
 * @apiName AutoLinkAgent
 * @apiGroup MeshCentralGroup
 * @apiDescription Automatically links RMM agent to MeshCentral device by hostname matching. Searches all
 * MeshCentral nodes for hostname match (case-insensitive). No authentication required for agent calls,
 * optional authentication for dashboard usage. Returns available nodes if no match found.
 * @apiParam {string} agentUuid RMM agent UUID (required)
 * @apiParam {string} [hardwareId] Hardware ID (unused)
 * @apiParam {string} [hostname] Override hostname for matching (uses agent's hostname if not provided)
 * @apiSuccess {boolean} success Link operation completed
 * @apiSuccess {boolean} [alreadyLinked] Agent already linked (true if already has node ID)
 * @apiSuccess {number} agentId Agent database ID
 * @apiSuccess {string} agentUuid Agent UUID
 * @apiSuccess {string} meshcentralNodeId MeshCentral node ID
 * @apiSuccess {string} matchMethod Matching method used ("hostname")
 * @apiSuccess {string} hostname Matched hostname
 * @apiSuccess {string} message Status message
 * @apiError 400 Missing agentUuid
 * @apiError 404 Agent not found or no matching MeshCentral node found
 * @apiError 500 Failed to auto-link
 * @apiExample {curl} Example:
 *   curl -X POST https://api.example.com/api/meshcentral/auto-link \
 *     -H "Content-Type: application/json" \
 *     -d '{"agentUuid":"abc-123", "hostname":"DESKTOP-01"}'
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "agentId": 123,
 *     "agentUuid": "abc-123",
 *     "meshcentralNodeId": "node//abc123...",
 *     "matchMethod": "hostname",
 *     "hostname": "DESKTOP-01",
 *     "message": "Agents linked successfully"
 *   }
 * @apiExample {json} Error-Response (404) - No Match:
 *   {
 *     "error": "No matching MeshCentral node found",
 *     "message": "Please ensure MeshAgent is installed and connected. Looking for hostname: DESKTOP-01",
 *     "availableNodes": [{"hostname": "DESKTOP-02", "nodeId": "node//abc", "connected": true}]
 *   }
 */
/**
 * Auto-link MeshAgent with our agent by hostname or hardware ID
 */
router.post('/auto-link', async (req, res) => {
  try {
    const { agentUuid, hardwareId, hostname } = req.body;
 
    if (!agentUuid) {
      return res.status(400).json({ error: 'agentUuid required' });
    }
 
    // Get our agent (with tenant check if authenticated)
    const tenantFilter = req.user ? ' AND (tenant_id = $2 OR $2 = 1)' : '';
    const params = req.user ? [agentUuid, req.user.tenantId] : [agentUuid];
    
    const agentResult = await db.query(
      `SELECT agent_id, hostname, meshcentral_nodeid, tenant_id FROM agents WHERE agent_uuid = $1${tenantFilter}`,
      params
    );
 
    if (agentResult.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
 
    const agent = agentResult.rows[0];
 
    // Check if already linked
    if (agent.meshcentral_nodeid) {
      return res.json({
        success: true,
        alreadyLinked: true,
        agentId: agent.agent_id,
        meshcentralNodeId: agent.meshcentral_nodeid,
        message: 'Agent already linked to MeshCentral'
      });
    }
 
    // Get all MeshCentral nodes
    const api = await getMeshAPI();
    const nodes = await api.getNodes();
 
    // Find matching node by hostname (primary method)
    let matchedNode = null;
    const searchHostname = hostname || agent.hostname;
    
    for (const node of nodes) {
      const parsed = MeshCentralAPI.parseNodeData(node);
      
      // Match by hostname (case-insensitive)
      if (parsed.hostname && searchHostname && 
          parsed.hostname.toLowerCase() === searchHostname.toLowerCase()) {
        matchedNode = parsed;
        break;
      }
    }
 
    if (!matchedNode) {
      return res.status(404).json({ 
        error: 'No matching MeshCentral node found',
        message: `Please ensure MeshAgent is installed and connected. Looking for hostname: ${searchHostname}`,
        availableNodes: nodes.map(n => {
          const p = MeshCentralAPI.parseNodeData(n);
          return { hostname: p.hostname, nodeId: p.nodeId, connected: p.connected };
        })
      });
    }
 
    // Link the two agents (ensure tenant ownership is preserved)
    const updateParams = req.user 
      ? [matchedNode.nodeId, matchedNode.connected, matchedNode.lastSeen, agentUuid, req.user.tenantId]
      : [matchedNode.nodeId, matchedNode.connected, matchedNode.lastSeen, agentUuid];
    
    const updateQuery = req.user
      ? 'UPDATE agents SET meshcentral_nodeid = $1, meshcentral_connected = $2, meshcentral_last_seen = $3 WHERE agent_uuid = $4 AND (tenant_id = $5 OR $5 = 1)'
      : 'UPDATE agents SET meshcentral_nodeid = $1, meshcentral_connected = $2, meshcentral_last_seen = $3 WHERE agent_uuid = $4';
    
    await db.query(updateQuery, updateParams);
 
    res.json({
      success: true,
      agentId: agent.agent_id,
      agentUuid: agentUuid,
      meshcentralNodeId: matchedNode.nodeId,
      matchMethod: 'hostname',
      hostname: matchedNode.hostname,
      message: 'Agents linked successfully'
    });
 
  } catch (error) {
    console.error('Error auto-linking agents:', error);
    res.status(500).json({ error: 'Failed to auto-link', message: error.message });
  }
});
 
/**
 * @api {post} /api/meshcentral/setup-tenant/:tenantId Setup Tenant MeshCentral
 * @apiName SetupTenantMeshCentral
 * @apiGroup MeshCentralGroup
 * @apiDescription Creates isolated MeshCentral user account and device group for tenant. Only root tenant (MSP)
 * can setup other tenants. Generates credentials, creates mesh, and stores encrypted password in database.
 * Idempotent (returns existing setup if already complete).
 * @apiParam {string} tenantId Tenant UUID to setup
 * @apiSuccess {boolean} success Setup completed successfully
 * @apiSuccess {string} message Status message
 * @apiSuccess {string} username MeshCentral username for tenant
 * @apiSuccess {string} meshId MeshCentral mesh/group ID
 * @apiSuccess {string} meshName Mesh/group name
 * @apiError 403 Only MSP can setup tenants (non-root tenant attempted)
 * @apiError 404 Tenant not found
 * @apiError 500 Failed to setup tenant
 * @apiExample {curl} Example:
 *   curl -X POST https://api.example.com/api/meshcentral/setup-tenant/tenant-uuid-123 \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "message": "Tenant MeshCentral setup complete",
 *     "username": "tenant_tenant-uuid-123",
 *     "meshId": "mesh//abc123...",
 *     "meshName": "Tenant 1 Devices"
 *   }
 */
/**
 * Setup MeshCentral for a tenant
 * Creates isolated user account and device group
 * 
 * POST /api/meshcentral/setup-tenant/:tenantId
 */
router.post('/setup-tenant/:tenantId', authenticateToken, async (req, res) => {
  try {
    // Only root tenant (MSP) can setup other tenants
    if (req.user.tenantId !== 1 && req.user.tenantId !== '00000000-0000-0000-0000-000000000001') {
      return res.status(403).json({ error: 'Only MSP can setup tenants' });
    }
 
    const { tenantId } = req.params;
 
    // Check if already setup
    const checkResult = await db.query(
      'SELECT meshcentral_setup_complete, meshcentral_username FROM tenants WHERE tenant_id = $1',
      [tenantId]
    );
 
    if (checkResult.rows.length === 0) {
      return res.status(404).json({ error: 'Tenant not found' });
    }
 
    if (checkResult.rows[0].meshcentral_setup_complete) {
      return res.json({
        success: true,
        message: 'Tenant already setup',
        username: checkResult.rows[0].meshcentral_username
      });
    }
 
    // Setup tenant
    const setup = await setupTenantMeshCentral(tenantId);
 
    res.json({
      success: true,
      message: 'Tenant MeshCentral setup complete',
      username: setup.username,
      meshId: setup.meshId,
      meshName: setup.meshName
    });
 
  } catch (error) {
    console.error('Error setting up tenant:', error);
    res.status(500).json({ error: 'Failed to setup tenant', message: error.message });
  }
});
 
/**
 * @api {get} /api/meshcentral/installer/:tenantId Get Tenant Agent Installer URL
 * @apiName GetTenantInstallerURL
 * @apiGroup MeshCentralGroup
 * @apiDescription Returns tenant-specific MeshAgent installer download URL configured for tenant's mesh group.
 * Includes platform-specific installation instructions. Verifies tenant access (tenant can get own
 * installer, MSP can get any).
 * @apiParam {string} tenantId Tenant UUID
 * @apiParam (Query) {string} [platform=win32] Target platform (win32, linux, darwin)
 * @apiSuccess {boolean} success Installer URL retrieved successfully
 * @apiSuccess {string} installerUrl Direct download URL for agent installer
 * @apiSuccess {string} meshId Tenant's MeshCentral mesh/group ID
 * @apiSuccess {string} platform Target platform
 * @apiSuccess {object} instructions Platform-specific installation commands
 * @apiSuccess {string} instructions.windows Windows installation command
 * @apiSuccess {string} instructions.linux Linux installation command
 * @apiSuccess {string} instructions.macos macOS installation command
 * @apiError 403 Access denied (tenant accessing another tenant's installer)
 * @apiError 404 Tenant not found
 * @apiError 400 Tenant MeshCentral not setup (run setup-tenant first)
 * @apiError 500 Failed to get installer URL
 * @apiExample {curl} Example:
 *   curl "https://api.example.com/api/meshcentral/installer/tenant-uuid-123?platform=win32" \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "installerUrl": "https://meshcentral.example.com/meshagents?id=mesh123&installflags=0&meshinstall=meshagent.exe",
 *     "meshId": "mesh//abc123...",
 *     "platform": "win32",
 *     "instructions": {
 *       "windows": "Download and run: https://...",
 *       "linux": "wget https://... && chmod +x meshagent && sudo ./meshagent -install",
 *       "macos": "curl -O https://... && chmod +x meshagent && sudo ./meshagent -install"
 *     }
 *   }
 */
/**
 * Get tenant's MeshAgent installer URL
 * Returns download link for agent installer configured for tenant's mesh
 * 
 * GET /api/meshcentral/installer/:tenantId
 */
router.get('/installer/:tenantId', authenticateToken, async (req, res) => {
  try {
    const { tenantId } = req.params;
    const { platform = 'win32' } = req.query;
 
    // Verify access (tenant can get their own, MSP can get any)
    if (req.user.tenantId !== tenantId && 
        req.user.tenantId !== 1 && 
        req.user.tenantId !== '00000000-0000-0000-0000-000000000001') {
      return res.status(403).json({ error: 'Access denied' });
    }
 
    // Get tenant's mesh ID
    const tenantResult = await db.query(
      'SELECT meshcentral_group_id, meshcentral_setup_complete FROM tenants WHERE tenant_id = $1',
      [tenantId]
    );
 
    if (tenantResult.rows.length === 0) {
      return res.status(404).json({ error: 'Tenant not found' });
    }
 
    if (!tenantResult.rows[0].meshcentral_setup_complete) {
      return res.status(400).json({ 
        error: 'Tenant MeshCentral not setup',
        message: 'Run setup-tenant first'
      });
    }
 
    const meshId = tenantResult.rows[0].meshcentral_group_id;
 
    // Build installer URL
    const platformMap = {
      'win32': 'meshagent.exe',
      'linux': 'meshagent',
      'darwin': 'meshagent'
    };
 
    const filename = platformMap[platform] || 'meshagent.exe';
    const installerUrl = `${MESHCENTRAL_URL}/meshagents?id=${meshId}&installflags=0&meshinstall=${filename}`;
 
    res.json({
      success: true,
      installerUrl: installerUrl,
      meshId: meshId,
      platform: platform,
      instructions: {
        windows: `Download and run: ${installerUrl}`,
        linux: `wget ${installerUrl} && chmod +x meshagent && sudo ./meshagent -install`,
        macos: `curl -O ${installerUrl} && chmod +x meshagent && sudo ./meshagent -install`
      }
    });
 
  } catch (error) {
    console.error('Error getting installer URL:', error);
    res.status(500).json({ error: 'Failed to get installer URL', message: error.message });
  }
});
 
/**
 * @api {post} /api/meshcentral/manual-link Manually Link Agent to Device
 * @apiName ManualLinkAgent
 * @apiGroup MeshCentralGroup
 * @apiDescription Manually links RMM agent to specific MeshCentral device by node ID. Overrides any existing
 * link. Enforces tenant isolation. Useful when auto-link fails or for correcting incorrect links.
 * @apiParam {string} agentUuid RMM agent UUID (required)
 * @apiParam {string} meshcentralNodeId MeshCentral device node ID (required)
 * @apiSuccess {boolean} success Link operation completed
 * @apiSuccess {number} agentId Agent database ID
 * @apiSuccess {string} agentUuid Agent UUID
 * @apiSuccess {string} hostname Agent hostname
 * @apiSuccess {string} oldNodeId Previous MeshCentral node ID (null if not linked before)
 * @apiSuccess {string} newNodeId New MeshCentral node ID
 * @apiSuccess {string} message Success message
 * @apiError 400 Missing agentUuid or meshcentralNodeId
 * @apiError 404 Agent not found
 * @apiError 500 Failed to link agent
 * @apiExample {curl} Example:
 *   curl -X POST https://api.example.com/api/meshcentral/manual-link \
 *     -H "Authorization: Bearer YOUR_TOKEN" \
 *     -H "Content-Type: application/json" \
 *     -d '{"agentUuid":"abc-123", "meshcentralNodeId":"node//abc123..."}'
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "agentId": 123,
 *     "agentUuid": "abc-123",
 *     "hostname": "DESKTOP-01",
 *     "oldNodeId": null,
 *     "newNodeId": "node//abc123...",
 *     "message": "Agent linked to MeshCentral device successfully"
 *   }
 */
/**
 * Manually link an agent to a MeshCentral device
 * POST /api/meshcentral/manual-link
 * Body: { agentUuid, meshcentralNodeId }
 */
router.post('/manual-link', authenticateToken, async (req, res) => {
  try {
    const { agentUuid, meshcentralNodeId } = req.body;
 
    if (!agentUuid || !meshcentralNodeId) {
      return res.status(400).json({ error: 'agentUuid and meshcentralNodeId required' });
    }
 
    // Get our agent (with tenant check)
    const agentResult = await db.query(
      'SELECT agent_id, hostname, meshcentral_nodeid, tenant_id FROM agents WHERE agent_uuid = $1 AND (tenant_id = $2 OR $2 = 1)',
      [agentUuid, req.user.tenantId]
    );
 
    if (agentResult.rows.length === 0) {
      return res.status(404).json({ error: 'Agent not found' });
    }
 
    const agent = agentResult.rows[0];
    const oldNodeId = agent.meshcentral_nodeid;
 
    // Update the agent with new node ID
    await db.query(
      `UPDATE agents 
       SET meshcentral_nodeid = $1,
           meshcentral_connected = true,
           meshcentral_last_seen = NOW()
       WHERE agent_uuid = $2 AND (tenant_id = $3 OR $3 = 1)`,
      [meshcentralNodeId, agentUuid, req.user.tenantId]
    );
 
    res.json({
      success: true,
      agentId: agent.agent_id,
      agentUuid: agentUuid,
      hostname: agent.hostname,
      oldNodeId: oldNodeId || null,
      newNodeId: meshcentralNodeId,
      message: 'Agent linked to MeshCentral device successfully'
    });
 
  } catch (error) {
    console.error('Error manually linking agent:', error);
    res.status(500).json({ error: 'Failed to link agent', message: error.message });
  }
});
 
/**
 * @api {post} /api/meshcentral/trigger-sync Trigger Manual Sync Job
 * @apiName TriggerMeshCentralSync
 * @apiGroup MeshCentralGroup
 * @apiDescription Manually triggers MeshCentral device sync job via BullMQ worker. Returns job ID for status tracking.
 * Sync runs asynchronously in background.
 * @apiSuccess {boolean} success Sync job queued successfully
 * @apiSuccess {string} message Status message
 * @apiSuccess {string} jobId BullMQ job ID for tracking
 * @apiError 500 Failed to trigger sync
 * @apiExample {curl} Example:
 *   curl -X POST https://api.example.com/api/meshcentral/trigger-sync \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "message": "MeshCentral sync job queued",
 *     "jobId": "123"
 *   }
 */
/**
 * Trigger manual MeshCentral sync
 * POST /api/meshcentral/trigger-sync
 */
router.post('/trigger-sync', authenticateToken, async (req, res) => {
  try {
    // Import the worker module
    const { triggerManualSync } = require('../workers/meshcentralSync');
    
    const jobId = await triggerManualSync();
    
    res.json({
      success: true,
      message: 'MeshCentral sync job queued',
      jobId: jobId
    });
  } catch (error) {
    console.error('Error triggering sync:', error);
    res.status(500).json({ error: 'Failed to trigger sync', message: error.message });
  }
});
 
/**
 * @api {get} /api/meshcentral/sync-status Get Sync Job Status
 * @apiName GetMeshCentralSyncStatus
 * @apiGroup MeshCentralGroup
 * @apiDescription Retrieves current status and history of MeshCentral sync jobs from BullMQ. Shows waiting,
 * active, completed, and failed jobs along with cron schedule.
 * @apiSuccess {boolean} success Status retrieved successfully
 * @apiSuccess {object} status Current job counts
 * @apiSuccess {number} status.waiting Number of waiting jobs
 * @apiSuccess {number} status.active Number of active jobs
 * @apiSuccess {number} status.recentCompleted Number of recent completed jobs (last 10)
 * @apiSuccess {number} status.recentFailed Number of recent failed jobs (last 10)
 * @apiSuccess {object[]} schedule Cron schedule for automatic sync
 * @apiSuccess {string} schedule.pattern Cron pattern
 * @apiSuccess {string} schedule.nextRun Next scheduled run timestamp
 * @apiSuccess {Object} recentJobs Recent job details
 * @apiSuccess {Object[]} recentJobs.completed Recent completed jobs
 * @apiSuccess {Object[]} recentJobs.failed Recent failed jobs
 * @apiError 500 Failed to get sync status
 * @apiExample {curl} Example:
 *   curl https://api.example.com/api/meshcentral/sync-status \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "status": {"waiting": 0, "active": 1, "recentCompleted": 5, "recentFailed": 0},
 *     "schedule": [{"pattern": "0 3 * * *", "nextRun": "2026-03-13T03:00:00Z"}],
 *     "recentJobs": {
 *       "completed": [{"id": "123", "timestamp": 1678886400000, "result": {"synced": 10}}],
 *       "failed": []
 *     }
 *   }
 */
/**
 * Get sync status and history
 * GET /api/meshcentral/sync-status
 */
router.get('/sync-status', authenticateToken, async (req, res) => {
  try {
    const { meshSyncQueue } = require('../workers/meshcentralSync');
    
    const [waiting, active, completed, failed] = await Promise.all([
      meshSyncQueue.getWaiting(),
      meshSyncQueue.getActive(),
      meshSyncQueue.getCompleted(0, 9),
      meshSyncQueue.getFailed(0, 9)
    ]);
    
    const repeatableJobs = await meshSyncQueue.getRepeatableJobs();
    
    res.json({
      success: true,
      status: {
        waiting: waiting.length,
        active: active.length,
        recentCompleted: completed.length,
        recentFailed: failed.length
      },
      schedule: repeatableJobs.map(job => ({
        pattern: job.pattern,
        nextRun: new Date(job.next).toISOString()
      })),
      recentJobs: {
        completed: completed.map(job => ({
          id: job.id,
          timestamp: job.timestamp,
          result: job.returnvalue
        })),
        failed: failed.map(job => ({
          id: job.id,
          timestamp: job.timestamp,
          error: job.failedReason
        }))
      }
    });
  } catch (error) {
    console.error('Error getting sync status:', error);
    res.status(500).json({ error: 'Failed to get sync status', message: error.message });
  }
});
 
/**
 * @api {post} /api/meshcentral/tag-devices Tag Devices with Tenant Metadata
 * @apiName TagMeshCentralDevices
 * @apiGroup MeshCentralGroup
 * @apiDescription Tags all devices in tenant's MeshCentral mesh with tenant UUID and customer ID metadata.
 * Updates MeshCentral device metadata for filtering and organization. Retrieves customer ID from
 * database agent records.
 * @apiSuccess {boolean} success Tagging completed successfully
 * @apiSuccess {string} tenant Tenant name
 * @apiSuccess {string} meshId Tenant's mesh/group ID
 * @apiSuccess {number} devicesTagged Number of devices tagged
 * @apiSuccess {object[]} devices Array of tagged device details
 * @apiSuccess {string} devices.hostname Device hostname
 * @apiSuccess {string} devices.nodeId MeshCentral node ID
 * @apiSuccess {string} devices.tenantId Tenant UUID applied
 * @apiSuccess {string} [devices.customerId] Customer UUID applied (if available)
 * @apiError 404 Tenant mesh not found
 * @apiError 500 Failed to tag devices
 * @apiExample {curl} Example:
 *   curl -X POST https://api.example.com/api/meshcentral/tag-devices \
 *     -H "Authorization: Bearer YOUR_TOKEN"
 * @apiExample {json} Success-Response (200):
 *   {
 *     "success": true,
 *     "tenant": "Tenant 1",
 *     "meshId": "mesh//abc123...",
 *     "devicesTagged": 5,
 *     "devices": [
 *       {"hostname": "DESKTOP-01", "nodeId": "node//abc", "tenantId": "tenant-uuid", "customerId": "cust-uuid"}
 *     ]
 *   }
 */
/**
 * Tag all devices in tenant's mesh with tenant UUID
 * POST /api/meshcentral/tag-devices
 */
router.post('/tag-devices', authenticateToken, async (req, res) => {
  try {
    const tenantId = req.user.tenantId;
    
    // Get tenant's mesh ID
    const tenantResult = await db.query(
      'SELECT meshcentral_group_id, name FROM tenants WHERE tenant_id = $1',
      [tenantId]
    );
    
    if (tenantResult.rows.length === 0 || !tenantResult.rows[0].meshcentral_group_id) {
      return res.status(404).json({ error: 'Tenant mesh not found' });
    }
    
    const { meshcentral_group_id: meshId, name: tenantName } = tenantResult.rows[0];
    
    // Connect to MeshCentral
    const api = await getAdminMeshAPI();
    const nodes = await api.getNodes();
    const meshNodes = nodes.filter(n => n.meshid === meshId);
    
    console.log(`📋 Found ${meshNodes.length} devices in ${tenantName} mesh`);
    
    let taggedCount = 0;
    const results = [];
    
    for (const node of meshNodes) {
      const parsed = MeshCentralAPI.parseNodeData(node);
      const tagData = MeshCentralAPI.parseDeviceTags(node.tags);
      
      // Get database agent for customer ID
      const agentResult = await db.query(
        'SELECT customer_id FROM agents WHERE meshcentral_nodeid = $1',
        [parsed.nodeId]
      );
      
      const customerId = agentResult.rows[0]?.customer_id;
      
      // Update device tags
      await api.updateDeviceMetadata(parsed.nodeId, {
        tenantId: tenantId,
        customerId: customerId,
        tags: tagData.customTags
      });
      
      taggedCount++;
      results.push({
        hostname: parsed.hostname,
        nodeId: parsed.nodeId,
        tenantId: tenantId,
        customerId: customerId
      });
      
      console.log(`  ✅ Tagged ${parsed.hostname} (tenant:${tenantId}, customer:${customerId || 'none'})`);
    }
    
    res.json({
      success: true,
      tenant: tenantName,
      meshId: meshId,
      devicesTagged: taggedCount,
      devices: results
    });
  } catch (error) {
    console.error('Error tagging devices:', error);
    res.status(500).json({ error: 'Failed to tag devices', message: error.message });
  }
});
 
module.exports = router;