// totals-sync-server.bun.mjs, a minimal self-hosted backend for Totals Data Sync.
// Zero dependencies. Bun 1.1+ (uses the built-in bun:sqlite).
//
//   API_KEY=change-me bun totals-sync-server.bun.mjs
//
// Same contract as the Node variant: per-record and bulk-array rules,
// deletes, auth, and the HEAD probe.

import { Database } from "bun:sqlite";

const PORT = process.env.PORT ?? 8787;
const API_KEY = process.env.API_KEY ?? "change-me";

const db = new Database("totals.db");
db.run(`
  CREATE TABLE IF NOT EXISTS records (
    entity     TEXT NOT NULL,
    ref        TEXT NOT NULL,
    body       TEXT NOT NULL,
    updated_at TEXT NOT NULL DEFAULT (datetime('now')),
    PRIMARY KEY (entity, ref)
  )
`);

const upsert = db.prepare(`
  INSERT INTO records (entity, ref, body) VALUES (?, ?, ?)
  ON CONFLICT (entity, ref)
  DO UPDATE SET body = excluded.body, updated_at = datetime('now')
`);
const remove = db.prepare("DELETE FROM records WHERE entity = ? AND ref = ?");

// How Totals identifies each record. Upserts MUST be keyed on these:
// the same record can arrive more than once (retries, edits, backfills).
const identityOf = {
  transactions: (r) => r.reference,
  accounts: (r) =>
    r.accountNumber != null && r.bank != null
      ? r.accountNumber + "|" + r.bank
      : undefined,
  budgets: (r) => (r.id != null ? "budget:" + r.id : undefined),
};
const identityFields = {
  transactions: ["reference"],
  accounts: ["accountNumber", "bank"],
  budgets: ["id"],
};

// A delete arrives as the same request, but its body carries ONLY the
// identity fields. Upserts always include the full field set.
const isDelete = (entity, record) =>
  Object.keys(record).every((key) => identityFields[entity].includes(key));

Bun.serve({
  port: PORT,
  async fetch(req) {
    // Totals' "Test connection" button sends HEAD to the base URL.
    if (req.method === "HEAD") return new Response(null, { status: 204 });

    if (req.headers.get("x-api-key") !== API_KEY) {
      // Any 4xx other than 408/429 tells Totals to give up on the record,
      // which is correct for bad auth. Fix the key in the app, then
      // reset & resend from the Data Sync screen to recover dropped records.
      return new Response(null, { status: 401 });
    }

    const [entity] = new URL(req.url).pathname.split("/").filter(Boolean);
    if (!identityOf[entity] || !["POST", "PUT", "PATCH"].includes(req.method)) {
      return new Response(null, { status: 404 });
    }

    let parsed;
    try {
      parsed = await req.json();
    } catch {
      return new Response("body must be JSON", { status: 400 });
    }

    // Per-record rules send one object; bulk-array rules send an array
    // of up to 500 records.
    const records = Array.isArray(parsed) ? parsed : [parsed];
    try {
      for (const record of records) {
        const ref = identityOf[entity](record);
        if (ref == null) continue;
        if (isDelete(entity, record)) remove.run(entity, String(ref));
        else upsert.run(entity, String(ref), JSON.stringify(record));
      }
      return Response.json({ ok: true, received: records.length });
    } catch (error) {
      console.error(error);
      // 5xx means "try again later". Totals retries with backoff.
      return new Response(null, { status: 500 });
    }
  },
});

console.log("totals sync server listening on port " + PORT);

# totals_sync_server.py, a minimal self-hosted backend for Totals Data Sync.
# Zero dependencies. Python 3.10+ (stdlib sqlite3).
#
#   API_KEY=change-me python3 totals_sync_server.py
#
# Same contract as the Node variant: per-record and bulk-array rules,
# deletes, auth, and the HEAD probe.

import json
import os
import sqlite3
from http.server import BaseHTTPRequestHandler, HTTPServer

PORT = int(os.environ.get("PORT", "8787"))
API_KEY = os.environ.get("API_KEY", "change-me")

db = sqlite3.connect("totals.db")
db.execute("""
    CREATE TABLE IF NOT EXISTS records (
      entity     TEXT NOT NULL,
      ref        TEXT NOT NULL,
      body       TEXT NOT NULL,
      updated_at TEXT NOT NULL DEFAULT (datetime('now')),
      PRIMARY KEY (entity, ref)
    )
""")
db.commit()

# How Totals identifies each record. Upserts MUST be keyed on these:
# the same record can arrive more than once (retries, edits, backfills).
IDENTITY_FIELDS = {
    "transactions": ["reference"],
    "accounts": ["accountNumber", "bank"],
    "budgets": ["id"],
}


def identity_of(entity, record):
    values = [record.get(field) for field in IDENTITY_FIELDS[entity]]
    if any(value is None for value in values):
        return None
    return "|".join(str(value) for value in values)


# A delete arrives as the same request, but its body carries ONLY the
# identity fields. Upserts always include the full field set.
def is_delete(entity, record):
    return all(key in IDENTITY_FIELDS[entity] for key in record)


class Handler(BaseHTTPRequestHandler):
    # Totals' "Test connection" button sends HEAD to the base URL.
    def do_HEAD(self):
        self.send_response(204)
        self.end_headers()

    def _write(self):
        if self.headers.get("X-API-Key") != API_KEY:
            # Any 4xx other than 408/429 tells Totals to give up on the
            # record, which is correct for bad auth. Fix the key in the app,
            # then reset & resend from the Data Sync screen.
            self.send_response(401)
            self.end_headers()
            return

        entity = self.path.split("?")[0].strip("/").split("/")[0]
        if entity not in IDENTITY_FIELDS:
            self.send_response(404)
            self.end_headers()
            return

        length = int(self.headers.get("Content-Length") or 0)
        try:
            parsed = json.loads(self.rfile.read(length))
        except ValueError:
            self.send_response(400)
            self.end_headers()
            self.wfile.write(b"body must be JSON")
            return

        # Per-record rules send one object; bulk-array rules send an array
        # of up to 500 records.
        records = parsed if isinstance(parsed, list) else [parsed]
        try:
            for record in records:
                ref = identity_of(entity, record)
                if ref is None:
                    continue
                if is_delete(entity, record):
                    db.execute(
                        "DELETE FROM records WHERE entity = ? AND ref = ?",
                        (entity, ref),
                    )
                else:
                    db.execute(
                        """INSERT INTO records (entity, ref, body)
                           VALUES (?, ?, ?)
                           ON CONFLICT (entity, ref) DO UPDATE SET
                             body = excluded.body,
                             updated_at = datetime('now')""",
                        (entity, ref, json.dumps(record)),
                    )
            db.commit()
            body = json.dumps({"ok": True, "received": len(records)}).encode()
            self.send_response(200)
            self.send_header("Content-Type", "application/json")
            self.end_headers()
            self.wfile.write(body)
        except Exception as error:
            print(error)
            # 5xx means "try again later". Totals retries with backoff.
            self.send_response(500)
            self.end_headers()

    do_POST = _write
    do_PUT = _write
    do_PATCH = _write


if __name__ == "__main__":
    print(f"totals sync server listening on port {PORT}")
    HTTPServer(("", PORT), Handler).serve_forever()