server.js

import express from "express";
import crypto from "crypto";
import jwt from "jsonwebtoken";
import fetch from "node-fetch";

import computeRiskScore from "./signals/riskScore.js";
import astSecuritySignals from "./signals/astSecurity.js";
import securitySignals from "./signals/security.js";
import qualitySignals from "./signals/quality.js";
import riskSignals from "./signals/risk.js";

const app = express();

console.log("🔥 Manthan PR Gate Started");

// =======================
// ENV
// =======================
const WEBHOOK_SECRET = process.env.GITHUB_WEBHOOK_SECRET;
const MANTHAN_URL = "https://manthan-core.fly.dev/evaluate";
const PORT = process.env.PORT || 3000;

// =======================
// RAW BODY
// =======================
app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf;
  }
}));

// =======================
// VERIFY SIGNATURE
// =======================
function verifySignature(req) {
  const signature = req.headers["x-hub-signature-256"];
  if (!signature) return false;

  const hmac = crypto.createHmac("sha256", WEBHOOK_SECRET);
  const digest = "sha256=" + hmac.update(req.rawBody).digest("hex");

  try {
    return crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(digest)
    );
  } catch {
    return false;
  }
}

// =======================
// FETCH WITH TIMEOUT
// =======================
async function fetchWithTimeout(url, options, timeout = 5000) {
  const controller = new AbortController();
  const id = setTimeout(() => controller.abort(), timeout);

  try {
    return await fetch(url, { ...options, signal: controller.signal });
  } finally {
    clearTimeout(id);
  }
}

// =======================
// INSTALLATION TOKEN
// =======================
async function getInstallationToken() {
  const payload = {
    iat: Math.floor(Date.now() / 1000) - 60,
    exp: Math.floor(Date.now() / 1000) + 600,
    iss: process.env.APP_ID,
  };

  const privateKey = Buffer
    .from(process.env.PRIVATE_KEY, "base64")
    .toString("utf-8");

  const jwtToken = jwt.sign(payload, privateKey, {
    algorithm: "RS256"
  });

  const res = await fetchWithTimeout(
    `https://api.github.com/app/installations/${process.env.INSTALLATION_ID}/access_tokens`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${jwtToken}`,
        Accept: "application/vnd.github+json",
      },
    }
  );

  const data = await res.json();

  if (!data.token) {
    throw new Error("Installation token failed");
  }

  return data.token;
}

// =======================
// FETCH PR FILES
// =======================
async function getPRFiles(repo, prNumber, token) {
  const res = await fetchWithTimeout(
    `https://api.github.com/repos/${repo}/pulls/${prNumber}/files`,
    {
      headers: {
        Authorization: `Bearer ${token}`,
        Accept: "application/vnd.github+json",
      },
    }
  );

  return await res.json();
}

// =======================
// CONTEXT EXTRACTION
// =======================
function extractContextFromFiles(files) {
  let context = {
    hasTestFiles: false,
    touchesAuth: false,
    touchesConfig: false,
    touchesCore: false,
  };

  for (const file of files) {
    const name = file.filename.toLowerCase();

    if (name.includes("test") || name.includes(".spec")) {
      context.hasTestFiles = true;
    }

    if (name.includes("auth")) context.touchesAuth = true;
    if (name.includes("config")) context.touchesConfig = true;
    if (name.includes("core") || name.includes("service")) {
      context.touchesCore = true;
    }
  }

  return context;
}

// =======================
// SIGNAL ANALYSIS
// =======================
function analyzeDiff(files) {
  const security = securitySignals(files);
  const quality = qualitySignals(files);
  const risk = riskSignals(files);
  const ast = astSecuritySignals(files);
  const context = extractContextFromFiles(files);

  const combined = {
    ...security,
    ...quality,
    ...risk,
    ...ast,
    ...context,
  };

  const score = computeRiskScore(combined);

  return {
    ...combined,
    ...score,
    maxRiskThreshold: 0.7
  };
}

// =======================
// BUILD INPUT
// =======================
async function buildPayload(req) {
  const pr = req.body.pull_request;
  const repo = req.body.repository.full_name;

  const token = await getInstallationToken();

  // REVIEWS
  const reviewRes = await fetchWithTimeout(
    `https://api.github.com/repos/${repo}/pulls/${pr.number}/reviews`,
    {
      headers: {
        Authorization: `Bearer ${token}`,
        Accept: "application/vnd.github+json",
      },
    }
  );

  const reviews = await reviewRes.json();

  const approved = Array.isArray(reviews)
    ? reviews.filter(r => r.state === "APPROVED")
    : [];

  const isApproved = approved.length > 0;

  let hasNewCommitsAfterApproval = false;

  if (isApproved) {
    const lastApproval = new Date(
      approved[approved.length - 1].submitted_at
    );

    const lastCommit = new Date(pr.head.repo.pushed_at);

    hasNewCommitsAfterApproval = lastCommit > lastApproval;
  }

  // FILES
  const files = await getPRFiles(repo, pr.number, token);
  const codeSignals = analyzeDiff(files);

  console.log("🔍 Signals:", codeSignals);

  return {
    prNumber: pr.number,
    repository: repo,
    isApproved,
    hasNewCommitsAfterApproval,
    ...codeSignals,
  };
}

// =======================
// STATUS
// =======================
async function setCommitStatus(repo, sha, state, description) {
  const token = await getInstallationToken();

  await fetchWithTimeout(
    `https://api.github.com/repos/${repo}/statuses/${sha}`,
    {
      method: "POST",
      headers: {
        Authorization: `Bearer ${token}`,
        Accept: "application/vnd.github+json",
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        state,
        context: "manthan/pr-gate",
        description,
      }),
    }
  );
}

// =======================
// COMMENT
// =======================
async function upsertComment(repo, prNumber, body) {
  const token = await getInstallationToken();

  const res = await fetchWithTimeout(
    `https://api.github.com/repos/${repo}/issues/${prNumber}/comments`,
    {
      headers: {
        Authorization: `Bearer ${token}`,
        Accept: "application/vnd.github+json",
      },
    }
  );

  const comments = await res.json();

  const existing = comments.find(c =>
    c.body && c.body.includes("<!-- manthan:decision -->")
  );

  if (existing) {
    await fetchWithTimeout(
      `https://api.github.com/repos/${repo}/issues/comments/${existing.id}`,
      {
        method: "PATCH",
        headers: {
          Authorization: `Bearer ${token}`,
          Accept: "application/vnd.github+json",
          "Content-Type": "application/json",
        },
        body: JSON.stringify({ body }),
      }
    );
  } else {
    await fetchWithTimeout(
      `https://api.github.com/repos/${repo}/issues/${prNumber}/comments`,
      {
        method: "POST",
        headers: {
          Authorization: `Bearer ${token}`,
          Accept: "application/vnd.github+json",
          "Content-Type": "application/json",
        },
        body: JSON.stringify({ body }),
      }
    );
  }
}

// =======================
// WEBHOOK
// =======================
app.post("/webhook", async (req, res) => {
  try {
    if (!verifySignature(req)) {
      return res.status(401).send("Invalid signature");
    }

    const event = req.headers["x-github-event"];

    if (!["pull_request", "pull_request_review"].includes(event)) {
      return res.sendStatus(200);
    }

    if (event === "pull_request") {
      const allowed = ["opened", "synchronize", "reopened", "edited"];
      if (!allowed.includes(req.body.action)) return res.sendStatus(200);
    }

    if (event === "pull_request_review") {
      if (req.body.review?.state !== "approved") {
        return res.sendStatus(200);
      }
    }

    const payload = await buildPayload(req);

    console.log("🧠 Input:", payload);

    const response = await fetchWithTimeout(MANTHAN_URL, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        intent: "pr_merge_safety",
        decision_input: payload,
      }),
    });

    const repo = req.body.repository.full_name;
    const sha = req.body.pull_request.head.sha;
    const prNumber = req.body.pull_request.number;

    if (!response.ok) {
      await setCommitStatus(repo, sha, "failure", "Manthan error");
      return res.sendStatus(200);
    }

    const result = await response.json();

    console.log("📊 Result:", result);

    const explanation =
      result.explanation || result.reason || "No explanation";

    const commentBody = `
<!-- manthan:decision -->

🧠 **Manthan Decision**

**Result:** ${result.decision}

**Rules:**
${explanation}
`;

    // ✅ FINAL FIX
    if (result.decision === "ALLOW") {
      await setCommitStatus(repo, sha, "success", "Allowed");
    } else if (result.decision === "ESCALATE") {
      await setCommitStatus(repo, sha, "pending", "Needs review");
    } else {
      await setCommitStatus(repo, sha, "failure", "Blocked");
    }

    await upsertComment(repo, prNumber, commentBody);

  } catch (err) {
    console.error("🔥 Error:", err);
  }

  res.sendStatus(200);
});

// =======================
// HEALTH
// =======================
app.get("/", (req, res) => res.send("OK"));

// =======================
// START
// =======================
app.listen(PORT, "0.0.0.0", () => {
  console.log(`🚀 Running on ${PORT}`);
});