const assistantConfig = {
  name: "HVAC Service Agent",
  model: {
    provider: "openai",
    model: "gpt-4",
    temperature: 0.3,
    systemPrompt: `You are an HVAC service dispatcher. Extract: customer name, address, issue type (heating/cooling/maintenance), urgency level, preferred time window. Ask clarifying questions: "Is the system making unusual noises?" "When did you last have maintenance?" Keep responses under 20 words. Never promise specific arrival times - say "within your requested window".`
  },
  voice: {
    provider: "11labs",
    voiceId: "21m00Tcm4TlvDq8ikWAM",
    stability: 0.7,
    similarityBoost: 0.8
  },
  transcriber: {
    provider: "deepgram",
    model: "nova-2",
    language: "en-US",
    keywords: ["HVAC", "furnace", "AC", "thermostat", "refrigerant", "SEER"]
  },
  firstMessage: "Thanks for calling. What's your address and the issue with your HVAC system?",
  endCallMessage: "We'll dispatch a technician to your location. You'll receive a confirmation text shortly.",
  recordingEnabled: true,
  endCallFunctionEnabled: true,
  serverUrl: process.env.WEBHOOK_URL,
  serverUrlSecret: process.env.WEBHOOK_SECRET
};

flowchart LR
    A[Customer Calls] --> B[Twilio Number]
    B --> C[Vapi Assistant]
    C --> D{Extract Info}
    D --> E[Webhook to Server]
    E --> F[Validate Address]
    F --> G[Check Technician Availability]
    G --> H[Create Service Ticket]
    H --> I[Send Confirmation SMS]
    I --> J[End Call]

const express = require('express');
const crypto = require('crypto');
const app = express();

app.use(express.json());

// Validate webhook signature
function validateSignature(req) {
  const signature = req.headers['x-vapi-signature'];
  const payload = JSON.stringify(req.body);
  const hash = crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(payload)
    .digest('hex');
  return signature === hash;
}

app.post('/webhook/vapi', async (req, res) => {
  // YOUR server receives webhooks here
  if (!validateSignature(req)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const { message } = req.body;
  
  if (message.type === 'function-call') {
    const { name, parameters } = message.functionCall;
    
    if (name === 'scheduleService') {
      try {
        // Validate address via Google Maps API
        const addressValid = await validateAddress(parameters.address);
        if (!addressValid) {
          return res.json({
            result: "I couldn't verify that address. Can you provide the street number and name?"
          });
        }

        // Check technician availability
        const availableSlot = await checkAvailability(
          parameters.preferredDate,
          parameters.issueType
        );

        if (!availableSlot) {
          return res.json({
            result: "We're fully booked that day. Can you do the next day at 9 AM?"
          });
        }

        // Create ticket in your system
        const ticket = await createServiceTicket({
          customer: parameters.customerName,
          address: parameters.address,
          issue: parameters.issueType,
          urgency: parameters.urgency,
          scheduledTime: availableSlot
        });

        // Send SMS confirmation via Twilio
        await sendConfirmationSMS(parameters.phone, ticket.id, availableSlot);

        return res.json({
          result: `Confirmed. Technician arrives ${availableSlot}. Ticket #${ticket.id}.`
        });

      } catch (error) {
        console.error('Scheduling error:', error);
        return res.json({
          result: "System error. Let me transfer you to dispatch."
        });
      }
    }
  }

  res.sendStatus(200);
});

app.listen(3000);

functions: [{
  name: "scheduleService",
  description: "Schedule HVAC service appointment after collecting all required info",
  parameters: {
    type: "object",
    properties: {
      customerName: { type: "string" },
      address: { type: "string" },
      phone: { type: "string" },
      issueType: { 
        type: "string",
        enum: ["heating", "cooling", "maintenance", "emergency"]
      },
      urgency: {
        type: "string",
        enum: ["routine", "urgent", "emergency"]
      },
      preferredDate: { type: "string", format: "date" }
    },
    required: ["customerName", "address", "phone", "issueType"]
  }
}]

const bookingLocks = new Map();

async function checkAvailability(date, issueType) {
  const lockKey = `${date}-${issueType}`;
  if (bookingLocks.has(lockKey)) {
    return null; // Slot being booked by another call
  }
  
  bookingLocks.set(lockKey, Date.now());
  setTimeout(() => bookingLocks.delete(lockKey), 30000);
  
  // Query your scheduling system
  return await queryAvailableSlots(date, issueType);
}

graph LR
    A[Microphone] --> B[Audio Buffer]
    B --> C[Voice Activity Detection]
    C -->|Speech Detected| D[Speech-to-Text]
    C -->|Silence| E[Error: No Speech Detected]
    D --> F[Large Language Model]
    F --> G[Intent Detection]
    G --> H[Response Generation]
    H --> I[Text-to-Speech]
    I --> J[Speaker]
    D -->|Error: Unrecognized Speech| K[Error Handling]
    F -->|Error: Processing Failed| K
    H -->|Error: Response Generation Failed| K
    K --> L[Log Error]

// Start ngrok tunnel (run in terminal)
// ngrok http 3000

// Test webhook signature validation with curl
const testPayload = JSON.stringify({
  message: {
    type: "function-call",
    functionCall: {
      name: "bookService",
      parameters: {
        customerName: "John Smith",
        address: "123 Main St",
        phone: "555-0100",
        issueType: "no_cooling",
        urgency: "high",
        preferredDate: "2024-01-15"
      }
    }
  }
});

// Generate test signature
const hash = crypto
  .createHmac('sha256', process.env.VAPI_SERVER_SECRET)
  .update(testPayload)
  .digest('hex');

// Test with curl (replace YOUR_NGROK_URL)
// curl -X POST https://YOUR_NGROK_URL.ngrok.io/webhook \
//   -H "Content-Type: application/json" \
//   -H "x-vapi-signature: ${hash}" \
//   -d '${testPayload}'

app.post('/webhook', express.json(), async (req, res) => {
  const signature = req.headers['x-vapi-signature'];
  const payload = JSON.stringify(req.body);
  
  // Validate signature FIRST (prevents replay attacks)
  if (!validateSignature(payload, signature)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Return 200 immediately (prevents timeout)
  res.status(200).json({ received: true });

  // Process async (CRM calls can take 3-8 seconds)
  const { functionCall } = req.body.message;
  if (functionCall?.name === 'bookService') {
    const { customerName, address, issueType, preferredDate } = functionCall.parameters;
    
    // Check for race conditions on same address
    const lockKey = `${address}_${preferredDate}`;
    if (bookingLocks.has(lockKey)) {
      console.error('Duplicate booking attempt blocked:', lockKey);
      return;
    }
    
    bookingLocks.add(lockKey);
    setTimeout(() => bookingLocks.delete(lockKey), 30000); // 30s lock
    
    // Validate address format (catches 15% of bad inputs)
    const addressValid = /^\d+\s+[A-Za-z\s]+$/.test(address);
    if (!addressValid) {
      console.error('Invalid address format:', address);
      return;
    }
  }
});

// Barge-in handler with buffer flush
const handleInterruption = async (callId, partialTranscript) => {
  const session = sessions[callId];
  
  // Race condition guard - critical for overlapping speech
  if (session.isProcessing) {
    session.pendingInterrupt = partialTranscript;
    return;
  }
  
  session.isProcessing = true;
  
  try {
    // Flush TTS buffer immediately - prevents old audio playback
    if (session.audioBuffer && session.audioBuffer.length > 0) {
      session.audioBuffer = [];
      console.log(`[${callId}] Buffer flushed: ${session.audioBuffer.length} chunks cleared`);
    }
    
    // Check for urgency keywords in partial transcript
    const urgentKeywords = ['today', 'now', 'emergency', 'immediately', 'asap'];
    const isUrgent = urgentKeywords.some(kw => partialTranscript.toLowerCase().includes(kw));
    
    if (isUrgent) {
      // Override scheduled slot check - prioritize same-day dispatch
      const emergencySlot = await checkAvailability(session.address, 'today', true);
      session.context.urgency = 'emergency';
      session.context.preferredDate = new Date().toISOString().split('T')[0];
    }
    
  } catch (error) {
    console.error(`[${callId}] Interrupt handling failed:`, error);
    session.context.error = 'interrupt_processing_failed';
  } finally {
    session.isProcessing = false;
    
    // Process any interrupts that occurred during handling
    if (session.pendingInterrupt) {
      const pending = session.pendingInterrupt;
      session.pendingInterrupt = null;
      await handleInterruption(callId, pending);
    }
  }
};

// Production-grade slot locking with TTL
const bookingLocks = new Map();
const LOCK_TTL = 30000; // 30s timeout

async function checkAvailability(params) {
  const lockKey = `${params.preferredDate}_${params.address}`;
  
  // Check if slot is locked by another call
  if (bookingLocks.has(lockKey)) {
    const lockTime = bookingLocks.get(lockKey);
    if (Date.now() - lockTime < LOCK_TTL) {
      return { 
        blocked: true, 
        message: "Slot temporarily held. Checking alternatives..." 
      };
    }
    // Lock expired, clean up
    bookingLocks.delete(lockKey);
  }
  
  // Acquire lock before DB query
  bookingLocks.set(lockKey, Date.now());
  
  try {
    const availableSlot = await db.query(
      'SELECT * FROM slots WHERE date = ? AND available = true',
      [params.preferredDate]
    );
    
    if (!availableSlot) {
      bookingLocks.delete(lockKey); // Release lock on failure
      return { blocked: true, message: "No slots available" };
    }
    
    return { blocked: false, slot: availableSlot };
  } catch (error) {
    bookingLocks.delete(lockKey); // Always release on error
    throw error;
  }
}

// Clean up expired locks every 60s
setInterval(() => {
  const now = Date.now();
  for (const [key, timestamp] of bookingLocks.entries()) {
    if (now - timestamp > LOCK_TTL) {
      bookingLocks.delete(key);
    }
  }
}, 60000);

function validateSignature(payload, signature) {
  const hash = crypto
    .createHmac('sha256', process.env.VAPI_SERVER_SECRET)
    .update(JSON.stringify(payload))
    .digest('hex');
  
  // Timing-safe comparison prevents timing attacks
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(hash)
  );
}

app.post('/webhook/vapi', express.json(), (req, res) => {
  const signature = req.headers['x-vapi-signature'];
  
  if (!signature || !validateSignature(req.body, signature)) {
    console.error('Invalid webhook signature');
    return res.status(401).json({ error: 'Unauthorized' });
  }
  
  // Process valid webhook
  const { functionCall } = req.body.message;
  // ... handle function call
});

const assistantConfig = {
  transcriber: {
    provider: "deepgram",
    model: "nova-2",
    language: "en-US",
    keywords: [
      "HVAC:5",           // Boost HVAC acronym recognition
      "furnace:3",
      "compressor:3",
      "refrigerant:4",
      "José:5",           // Boost technician names
      "R-22:5",           // Refrigerant codes
      "SEER:4"            // Efficiency ratings
    ]
  },
  model: {
    provider: "openai",
    model: "gpt-4",
    messages: [{
      role: "system",
      content: `You are an HVAC service scheduler. Common terms:
- HVAC (heating, ventilation, air conditioning)
- Furnace, compressor, condenser
- Refrigerant types: R-22, R-410A
- SEER ratings (efficiency)

When customer says "H-V-A-C" or "H back", interpret as HVAC system.`
    }]
  }
};

const express = require('express');
const crypto = require('crypto');
const app = express();

app.use(express.json());

// Session state for tracking active calls
const sessions = new Map();
const bookingLocks = new Map();
const LOCK_TTL = 300000; // 5 minutes

// Webhook signature validation (CRITICAL - prevents spoofed requests)
function validateSignature(payload, signature) {
  const hash = crypto
    .createHmac('sha256', process.env.VAPI_SERVER_SECRET)
    .update(JSON.stringify(payload))
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(hash)
  );
}

// Check technician availability (simulated - replace with real scheduling API)
function checkAvailability(preferredDate, urgency) {
  const urgentKeywords = ['no heat', 'no cooling', 'gas leak', 'water leak'];
  const isUrgent = urgentKeywords.some(kw => urgency.toLowerCase().includes(kw));
  
  if (isUrgent) {
    // Emergency slots within 2 hours
    const emergencySlot = new Date(Date.now() + 2 * 60 * 60 * 1000);
    return { available: true, slot: emergencySlot.toISOString(), emergency: true };
  }
  
  // Standard scheduling - check if date is within business hours
  const requestedDate = new Date(preferredDate);
  const dayOfWeek = requestedDate.getDay();
  const hour = requestedDate.getHours();
  
  if (dayOfWeek === 0 || dayOfWeek === 6 || hour < 8 || hour > 17) {
    // Suggest next business day at 9 AM
    const nextSlot = new Date(requestedDate);
    nextSlot.setDate(nextSlot.getDate() + (dayOfWeek === 6 ? 2 : 1));
    nextSlot.setHours(9, 0, 0, 0);
    return { available: false, nextAvailable: nextSlot.toISOString() };
  }
  
  return { available: true, slot: requestedDate.toISOString(), emergency: false };
}

// Handle barge-in interruptions (prevents double-booking during user speech)
function handleInterruption(sessionId) {
  const session = sessions.get(sessionId);
  if (!session) return;
  
  // Cancel any pending booking operations
  if (session.pending) {
    clearTimeout(session.pending);
    session.pending = null;
  }
  
  // Release booking lock if held
  const lockKey = `${session.address}_${session.preferredDate}`;
  if (bookingLocks.has(lockKey)) {
    const lockTime = bookingLocks.get(lockKey);
    const now = Date.now();
    if (now - lockTime < LOCK_TTL) {
      bookingLocks.delete(lockKey);
    }
  }
}

// Main webhook handler - receives function calls from Vapi
app.post('/webhook/vapi', async (req, res) => {
  const signature = req.headers['x-vapi-signature'];
  const payload = req.body;
  
  // Validate webhook signature (NEVER skip this in production)
  if (!validateSignature(payload, signature)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }
  
  // Handle speech-started event (user interrupted bot)
  if (payload.message?.type === 'speech-started') {
    handleInterruption(payload.call?.id);
    return res.status(200).json({ received: true });
  }
  
  // Handle function call for booking service
  if (payload.message?.type === 'function-call') {
    const { functionCall } = payload.message;
    
    if (functionCall.name === 'bookService') {
      const { customerName, address, phone, issueType, urgency, preferredDate } = functionCall.parameters;
      
      // Validate address format (prevents bad data in scheduling system)
      const addressValid = /^\d+\s+[A-Za-z\s]+,\s*[A-Z]{2}\s+\d{5}$/.test(address);
      if (!addressValid) {
        return res.status(200).json({
          result: {
            success: false,
            message: 'Invalid address format. Please provide street, city, state, and ZIP code.'
          }
        });
      }
      
      // Acquire booking lock (prevents race condition if user repeats request)
      const lockKey = `${address}_${preferredDate}`;
      if (bookingLocks.has(lockKey)) {
        const lockTime = bookingLocks.get(lockKey);
        if (Date.now() - lockTime < LOCK_TTL) {
          return res.status(200).json({
            result: {
              success: false,
              message: 'A booking for this address and time is already being processed.'
            }
          });
        }
      }
      bookingLocks.set(lockKey, Date.now());
      
      // Check availability and book
      const availableSlot = checkAvailability(preferredDate, urgency);
      
      if (availableSlot.available) {
        // Create service ticket (replace with real CRM/scheduling API call)
        const ticket = {
          id: `HVAC-${Date.now()}`,
          customer: customerName,
          address,
          phone,
          issue: issueType,
          urgency,
          scheduled: availableSlot.slot,
          emergency: availableSlot.emergency,
          status: 'confirmed'
        };
        
        // Store session state
        sessions.set(payload.call?.id, {
          ticket,
          address,
          preferredDate,
          pending: null
        });
        
        const responseMessage = availableSlot.emergency
          ? `Emergency service booked. Technician dispatched for ${new Date(availableSlot.slot).toLocaleString()}. Ticket ${ticket.id}.`
          : `Service confirmed for ${new Date(availableSlot.slot).toLocaleString()}. Ticket ${ticket.id}. You'll receive a confirmation text at ${phone}.`;
        
        return res.status(200).json({
          result: {
            success: true,
            message: responseMessage,
            ticketId: ticket.id
          }
        });
      } else {
        // Suggest alternative slot
        return res.status(200).json({
          result: {
            success: false,
            message: `Requested time unavailable. Next available slot: ${new Date(availableSlot.nextAvailable).toLocaleString()}. Would you like to book this time?`
          }
        });
      }
    }
  }
  
  res.status(200).json({ received: true });
});

// Health check endpoint
app.get('/health', (req, res) => {
  res.json({ status: 'ok', sessions: sessions.size, locks: bookingLocks.size });
});

// Cleanup expired locks every 5 minutes
setInterval(() => {
  const now = Date.now();
  for (const [key, lockTime] of bookingLocks.entries()) {
    if (now - lockTime > LOCK_TTL) {
      bookingLocks.delete(key);
    }
  }
}, 300000);

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`HVAC Voice AI server running on port ${PORT}`);
  console.log(`Webhook endpoint: http://localhost:${PORT}/webhook/vapi`);
});