// The Node.js Event Loop Phases:
// 1. Timers        → executes setTimeout() and setInterval() callbacks
// 2. Pending       → executes I/O callbacks deferred to the next loop
// 3. Idle/Prepare  → internal use only
// 4. Poll          → retrieves new I/O events, executes I/O callbacks
// 5. Check         → executes setImmediate() callbacks
// 6. Close         → executes close event callbacks (socket.on('close'))

// Example showing execution order:
console.log('1 - Start');

setTimeout(() => console.log('2 - setTimeout'), 0);

setImmediate(() => console.log('3 - setImmediate'));

process.nextTick(() => console.log('4 - nextTick'));

Promise.resolve().then(() => console.log('5 - Promise'));

console.log('6 - End');

// Output:
// 1 - Start
// 6 - End
// 4 - nextTick (microtask queue - runs before next phase)
// 5 - Promise (microtask queue - runs after nextTick)
// 2 - setTimeout (timers phase)
// 3 - setImmediate (check phase)

// process.nextTick() — runs BEFORE the next event loop iteration
// It is added to the microtask queue, which is processed between phases

// setImmediate() — runs in the CHECK phase of the event loop
// It is processed after the poll phase completes

// Example:
setImmediate(() => console.log('setImmediate'));
process.nextTick(() => console.log('nextTick'));

// Output: nextTick, setImmediate
// nextTick always runs first because microtask queue has priority

// WARNING: Recursive process.nextTick() can starve the event loop
function recursiveNextTick() {
    process.nextTick(recursiveNextTick); // BAD — blocks I/O forever
}

// setImmediate is safer for recursive operations
function recursiveImmediate() {
    setImmediate(recursiveImmediate); // OK — allows I/O between calls
}

// The event loop is single-threaded — YES
// But Node.js is NOT purely single-threaded

// libuv provides a thread pool (default 4 threads) for:
// - File system operations (fs.readFile, fs.writeFile)
// - DNS lookups (dns.lookup)
// - Crypto operations (crypto.pbkdf2)
// - Compression (zlib)

// Network I/O uses OS-level async mechanisms (epoll, kqueue, IOCP)
// NOT the thread pool — this is why Node.js handles thousands of connections

// For CPU-intensive tasks, use Worker Threads:
const { Worker } = require('worker_threads');

const worker = new Worker('./heavy-computation.js');
worker.on('message', (result) => {
    console.log('Result from worker:', result);
});
worker.postMessage({ data: largeDataSet });

// You can increase the thread pool size:
// UV_THREADPOOL_SIZE=8 node app.js (default is 4, max is 1024)

const fs = require('fs');

// 1. Callback pattern (original Node.js way)
fs.readFile('data.json', 'utf8', (err, data) => {
    if (err) {
        console.error('Error:', err);
        return;
    }
    console.log(data);
});
// Problem: callback hell when nesting multiple async operations

// 2. Promise pattern
const fsPromises = require('fs').promises;
fsPromises.readFile('data.json', 'utf8')
    .then(data => console.log(data))
    .catch(err => console.error('Error:', err));
// Better: chainable, avoids deep nesting

// 3. Async/Await pattern (cleanest)
async function readData() {
    try {
        const data = await fsPromises.readFile('data.json', 'utf8');
        console.log(data);
    } catch (err) {
        console.error('Error:', err);
    }
}
// Best: reads like synchronous code, easy error handling with try/catch

// When to use each:
// Callbacks: legacy code, event emitters (stream.on('data', callback))
// Promises: when you need Promise.all/race for parallel operations
// Async/Await: default choice for most new code

const fetchUser = fetch('/api/user');
const fetchOrders = fetch('/api/orders');
const fetchNotifications = fetch('/api/notifications');

// Promise.all — fails fast on first rejection
// Use when ALL results are required
try {
    const [user, orders, notifications] = await Promise.all([
        fetchUser, fetchOrders, fetchNotifications
    ]);
} catch (err) {
    // If ANY promise rejects, entire Promise.all rejects
    console.error('One request failed:', err);
}

// Promise.allSettled — waits for ALL, returns status of each
// Use when you want results regardless of individual failures
const results = await Promise.allSettled([
    fetchUser, fetchOrders, fetchNotifications
]);
results.forEach(result => {
    if (result.status === 'fulfilled') console.log(result.value);
    if (result.status === 'rejected') console.log(result.reason);
});

// Promise.race — resolves/rejects with the FIRST settled promise
// Use for timeouts or fastest-response-wins scenarios
const result = await Promise.race([
    fetch('/api/data'),
    new Promise((_, reject) =>
        setTimeout(() => reject(new Error('Timeout')), 5000)
    )
]);

// Method 1: try/catch blocks
async function getUser(id) {
    try {
        const user = await UserModel.findById(id);
        if (!user) throw new Error('User not found');
        return user;
    } catch (err) {
        console.error('Failed to get user:', err.message);
        throw err; // Re-throw for the caller to handle
    }
}

// Method 2: Express error-handling middleware
app.get('/api/users/:id', async (req, res, next) => {
    try {
        const user = await getUser(req.params.id);
        res.json(user);
    } catch (err) {
        next(err); // Pass to error middleware
    }
});

// Error-handling middleware (4 parameters — Express recognizes this)
app.use((err, req, res, next) => {
    console.error(err.stack);
    res.status(err.status || 500).json({
        error: err.message || 'Internal Server Error'
    });
});

// Common mistake: forgetting to catch rejected promises
// This causes UnhandledPromiseRejection warnings/crashes
async function bad() {
    const data = await riskyOperation(); // No try/catch = dangerous
}

const express = require('express');
const app = express();

// Built-in middleware
app.use(express.json());              // Parse JSON bodies
app.use(express.urlencoded({ extended: true })); // Parse URL-encoded bodies

// Custom logging middleware
app.use((req, res, next) => {
    console.log(`${req.method} ${req.url}`);
    next(); // MUST call next() or request hangs
});

// Routes
app.get('/api/users', async (req, res, next) => {
    try {
        const users = await User.find();
        res.json(users);
    } catch (err) {
        next(err);
    }
});

app.get('/api/users/:id', async (req, res, next) => {
    try {
        const user = await User.findById(req.params.id);  // req.params
        if (!user) return res.status(404).json({ error: 'User not found' });
        res.json(user);
    } catch (err) {
        next(err);
    }
});

// Query params: /api/users/search?name=John&age=25
app.get('/api/users/search', async (req, res, next) => {
    const { name, age } = req.query;  // req.query
    // ... search logic
});

app.post('/api/users', async (req, res, next) => {
    try {
        const user = new User(req.body);  // req.body
        await user.save();
        res.status(201).json(user);
    } catch (err) {
        next(err);
    }
});

// Error-handling middleware (must have 4 parameters)
app.use((err, req, res, next) => {
    res.status(err.status || 500).json({ error: err.message });
});

app.listen(3000);

// Middleware = function with (req, res, next)
// Executes in ORDER they are defined — order matters!

// Authentication middleware example
function authenticate(req, res, next) {
    const token = req.headers.authorization?.split(' ')[1];

    if (!token) {
        return res.status(401).json({ error: 'No token provided' });
    }

    try {
        const decoded = jwt.verify(token, process.env.JWT_SECRET);
        req.user = decoded; // Attach user to request object
        next();             // Pass to next middleware/route handler
    } catch (err) {
        return res.status(403).json({ error: 'Invalid token' });
    }
}

// Apply to specific routes
app.get('/api/profile', authenticate, (req, res) => {
    res.json(req.user); // req.user was set by authenticate middleware
});

// Apply to all routes under a path
app.use('/api/admin', authenticate, adminRoutes);

// Middleware chain: request → logger → auth → route handler → error handler
// If any middleware does NOT call next(), the request stops there

const mongoose = require('mongoose');

// Connect to MongoDB
mongoose.connect(process.env.MONGODB_URI);

// Schema definition
const userSchema = new mongoose.Schema({
    name: { type: String, required: true, trim: true },
    email: { type: String, required: true, unique: true, lowercase: true },
    age: { type: Number, min: 18 },
    role: { type: String, enum: ['user', 'admin'], default: 'user' },
    createdAt: { type: Date, default: Date.now }
});

// Model creation
const User = mongoose.model('User', userSchema);

// CRUD operations in controller
async function createUser(req, res) {
    const user = new User(req.body);
    await user.save();
    res.status(201).json(user);
}

async function getUsers(req, res) {
    const users = await User.find({ role: 'user' })
        .select('name email')       // Select specific fields
        .sort({ createdAt: -1 })    // Sort by newest first
        .limit(10);                  // Pagination
    res.json(users);
}

async function updateUser(req, res) {
    const user = await User.findByIdAndUpdate(
        req.params.id,
        req.body,
        { new: true, runValidators: true } // Return updated doc, validate
    );
    res.json(user);
}

async function deleteUser(req, res) {
    await User.findByIdAndDelete(req.params.id);
    res.status(204).send();
}

const { Pool } = require('pg');
const pool = new Pool({ connectionString: process.env.DATABASE_URL });

// VULNERABLE — never do this!
async function unsafeQuery(userId) {
    // String concatenation = SQL injection risk
    const result = await pool.query(
        "SELECT * FROM users WHERE id = '" + userId + "'"
    );
    // If userId = "1' OR '1'='1" → returns ALL users
    return result.rows;
}

// SAFE — parameterized query
async function safeQuery(userId) {
    const result = await pool.query(
        'SELECT * FROM users WHERE id = $1',  // $1 is a parameter placeholder
        [userId]                                // Parameters passed separately
    );
    return result.rows;
}

// SAFE — multiple parameters
async function searchUsers(name, minAge) {
    const result = await pool.query(
        'SELECT * FROM users WHERE name ILIKE $1 AND age >= $2',
        [`%${name}%`, minAge]
    );
    return result.rows;
}

// The database driver handles escaping — you never build SQL strings manually
// This applies to any SQL database: PostgreSQL, MySQL, SQLite

// Architecture:
// Client ↔ Socket.io ↔ Node.js Server ↔ Redis (pub/sub) ↔ MongoDB (persistence)

const express = require('express');
const http = require('http');
const { Server } = require('socket.io');
const Redis = require('ioredis');

const app = express();
const server = http.createServer(app);
const io = new Server(server, { cors: { origin: '*' } });

// Redis for pub/sub (enables multiple server instances)
const pub = new Redis();
const sub = new Redis();

sub.subscribe('chat');
sub.on('message', (channel, message) => {
    io.emit('newMessage', JSON.parse(message));
});

io.on('connection', (socket) => {
    console.log('User connected:', socket.id);

    socket.on('joinRoom', (room) => {
        socket.join(room);
    });

    socket.on('sendMessage', async (data) => {
        // Persist to MongoDB
        await Message.create(data);
        // Publish to Redis (all server instances receive this)
        pub.publish('chat', JSON.stringify(data));
    });

    socket.on('disconnect', () => {
        console.log('User disconnected:', socket.id);
    });
});

// Scaling: Redis pub/sub ensures messages reach users
// connected to ANY server instance, not just the one that
// received the message. This is how you scale WebSockets.

const multer = require('multer');
const AWS = require('aws-sdk');

// Option 1: Store on disk
const diskStorage = multer.diskStorage({
    destination: (req, file, cb) => cb(null, 'uploads/'),
    filename: (req, file, cb) => {
        const uniqueName = Date.now() + '-' + file.originalname;
        cb(null, uniqueName);
    }
});

// Option 2: Store in memory (for small files only)
const memoryStorage = multer({ storage: multer.memoryStorage() });

// Option 3: Stream directly to S3 (best for large files)
const s3 = new AWS.S3();

const upload = multer({ storage: diskStorage, limits: { fileSize: 5 * 1024 * 1024 } }); // 5MB limit

app.post('/api/upload', upload.single('file'), async (req, res) => {
    // req.file contains the uploaded file info
    const params = {
        Bucket: process.env.S3_BUCKET,
        Key: req.file.filename,
        Body: require('fs').createReadStream(req.file.path) // Stream, not buffer
    };
    const result = await s3.upload(params).promise();
    res.json({ url: result.Location });
});

// Memory considerations:
// - multer.memoryStorage() loads entire file into RAM — dangerous for large files
// - Disk storage + streaming to S3 is the production pattern
// - Always set file size limits to prevent memory exhaustion