// Google Apps Script Backend (Production Secured)
// Sensitive IDs, hashes, and session secrets are stored securely in Script Properties.
const SCRIPT_PROPERTIES = PropertiesService.getScriptProperties();

function isAuthorized(token) {
  if (!token) return false;
  const activeToken = SCRIPT_PROPERTIES.getProperty('SESSION_TOKEN');
  return Boolean(token && token === activeToken);
}

function sanitizeCell(v) {
  const s = String(v == null ? '' : v).trim();
  return /^[=+\-@\t\r]/.test(s) ? "'" + s : s;
}

function doGet(e) {
  const token = (e && e.parameter && e.parameter.token) || '';
  if (!isAuthorized(token)) {
    return ContentService.createTextOutput(JSON.stringify({
      status: 'error',
      code: 401,
      message: 'Unauthorized or session expired'
    })).setMimeType(ContentService.MimeType.JSON);
  }

  const ssComprasId = SCRIPT_PROPERTIES.getProperty('SHEET_COMPRAS_ID') || 'YOUR_SPREADSHEET_ID_COMPRAS_HERE';
  const ssPanelId = SCRIPT_PROPERTIES.getProperty('SHEET_PANEL_ID') || 'YOUR_SPREADSHEET_ID_PANEL_HERE';
  const ssStockId = SCRIPT_PROPERTIES.getProperty('SHEET_STOCK_ID') || 'YOUR_SPREADSHEET_ID_STOCK_HERE';

  const ssCompras = SpreadsheetApp.openById(ssComprasId);
  const ssPanel = SpreadsheetApp.openById(ssPanelId);
  const ssStock = SpreadsheetApp.openById(ssStockId);

  const sheetTN = ssStock.getSheetByName('Inventario_TN');
  const sheetEgresos = ssStock.getSheetByName('Egresos_No_Comerciales');

  const threads = GmailApp.search('from:ventas@ejemplo.com "Nueva venta"', 0, 20);
  const ventas = threads.map(t => ({
    subject: t.getFirstMessageSubject(),
    date: t.getLastMessageDate(),
    snippet: t.getMessages()[0].getPlainBody().slice(0, 350)
  }));

  const payload = {
    status: 'success',
    updatedAt: new Date().toISOString(),
    ventasRecientes: ventas,
    inventarioTN: sheetTN ? sheetTN.getDataRange().getValues() : [],
    egresosNoComerciales: sheetEgresos ? sheetEgresos.getDataRange().getValues() : [],
    comprasRows: ssCompras.getSheets()[0].getDataRange().getValues(),
    panelRows: ssPanel.getSheets()[0].getDataRange().getValues()
  };

  return ContentService.createTextOutput(JSON.stringify(payload))
    .setMimeType(ContentService.MimeType.JSON);
}

function doPost(e) {
  try {
    const body = JSON.parse(e.postData.contents);
    if (!body.authToken || !isAuthorized(body.authToken)) {
      return ContentService.createTextOutput(JSON.stringify({ status: 'error', code: 401, message: 'Unauthorized' }))
        .setMimeType(ContentService.MimeType.JSON);
    }

    const ssStockId = SCRIPT_PROPERTIES.getProperty('SHEET_STOCK_ID') || 'YOUR_SPREADSHEET_ID_STOCK_HERE';
    const ssStock = SpreadsheetApp.openById(ssStockId);

    if (body.action === 'ADD_NON_COMMERCIAL') {
      const qty = Math.max(1, parseInt(body.qty, 10) || 1);
      const unitCost = Math.max(0, parseFloat(body.unitCost) || 0);
      const sheetEgresos = ssStock.getSheetByName('Egresos_No_Comerciales');
      sheetEgresos.appendRow([
        new Date(),
        sanitizeCell(body.sku),
        sanitizeCell(body.productName),
        qty,
        sanitizeCell(body.reason),
        unitCost,
        qty * unitCost,
        sanitizeCell(body.notes || '')
      ]);
      return ContentService.createTextOutput(JSON.stringify({ status: 'success' }))
        .setMimeType(ContentService.MimeType.JSON);
    }
  } catch (err) {
    return ContentService.createTextOutput(JSON.stringify({ status: 'error', code: 400, message: 'Invalid request' }))
      .setMimeType(ContentService.MimeType.JSON);
  }
}