// Resolves the tenant from the subdomain and scopes every downstream query.// RestroSanjal: one codebase, one DB per plan, zero cross-tenant leaks.
const { Tenant } = require('../models/tenant');
// Attach the tenant to the request before route handlers or models run.async function tenantResolver(req, res, next) {  const host = req.headers.host || ''; // "cafe-himal.example.com"  const subdomain = host.split('.')[0];
  if (!subdomain || subdomain === 'www' || subdomain === 'localhost') {    return res.status(400).json({ error: 'Unknown tenant subdomain' });  }
  try {    const tenant = await Tenant.findOne({ subdomain }).lean();
    if (!tenant || tenant.status !== 'active') {      return res.status(404).json({ error: 'Tenant not found or inactive' });    }
    // Stash on req so models/controllers can read it without parsing again.    req.tenant = { id: tenant._id, plan: tenant.plan, subdomain };
    // Every mongoose query in this request should apply this scope.    req.scopeTenant = (query) => query.where({ tenant_id: tenant._id });
    next();  } catch (err) {    next(err);  }}
// Usage in a route: scope instantly, no WHERE clause scattered everywhere.// router.get('/tables', tenantResolver, async (req, res) => {//   const tables = await Table.find().where({ tenant_id: req.tenant.id });//   res.json(tables);// });
module.exports = tenantResolver;

// Buildzilla compatibility engine — one rule per pairing, composed at the end.
// Reality check: a CPU and mobo must share a socket AND a supported generation.const RESULT = { COMPATIBLE: 'compatible', WARNING: 'warning', INCOMPATIBLE: 'incompatible' };
function checkCpuMotherboard(cpu, motherboard) {  // Same physical socket? No socket, no seat.  if (cpu.socket !== motherboard.socket) {    return {      check: 'CPU <-> Motherboard Socket',      status: RESULT.INCOMPATIBLE,      detail: `${cpu.socket} CPU does not fit a ${motherboard.socket} board`,    };  }
  // Same socket but a locked-down board (B-series) with a K-series CPU?  // It will slot in but can't overclock — a warning, not a hard fail.  if (cpu.unlockedCore && motherboard.chipset.startsWith('B')) {    return {      check: 'CPU <-> Motherboard Socket',      status: RESULT.WARNING,      detail: `${motherboard.chipset} board slots it, but unlocked overclocking is off the table`,    };  }
  return {    check: 'CPU <-> Motherboard Socket',    status: RESULT.COMPATIBLE,    detail: `${cpu.socket} socket supported`,  };}
// Every part submits its checks; the builder aggregates them into one verdict.module.exports = { checkCpuMotherboard };

// Auth middleware: proves the token before any protected route runs.const jwt = require('jsonwebtoken');const { User } = require('../models/user');
const JWT_SECRET = process.env.JWT_SECRET; // never commit this
async function requireAuth(req, res, next) {  const header = req.headers.authorization || '';
  // Expect: "Bearer <token>". Anything else fails fast and loud.  if (!header.startsWith('Bearer ')) {    return res.status(401).json({ error: 'Missing authorization header' });  }
  const token = header.slice('Bearer '.length);
  try {    const payload = jwt.verify(token, JWT_SECRET);
    // Don't trust the payload alone — confirm the user still exists    // and the token id matches the current session.    const user = await User.findById(payload.sub).select('-password');    if (!user || user.sessionVersion !== payload.sessionVersion) {      return res.status(401).json({ error: 'Session revoked' });    }
    // Downstream handlers get req.user typed and free of token parsing.    req.user = user;    next();  } catch (err) {    // Expired, malformed, or signed with the wrong secret.    return res.status(401).json({ error: 'Invalid or expired token' });  }}
module.exports = { requireAuth };

// Build one 30-day price series from raw price-events collection.// Input: { modelId, price, capturedAt }   Output: [{ date, avgPrice }]
const PRICE_EVENTS = 'price_events';
async function dailyPriceTrend(modelId, days = 30) {  const since = new Date();  since.setDate(since.getDate() - days);
  return PriceEvent.aggregate([    // 1. Only this model, only recent events.    { $match: { model_id: modelId, captured_at: { $gte: since } } },
    // 2. Bucket by calendar day using the date part of captured_at.    {      $group: {        _id: { $dateToString: { format: '%Y-%m-%d', date: '$captured_at' } },        avgPrice: { $avg: '$price' },        samples: { $sum: 1 },      },    },
    // 3. Pad missing days so the chart has no holes.    { $sort: { _id: 1 } },    { $set: { date: '$_id' } },    { $unset: '_id' },  ]);}
// Chart-ready shape:// [{ date: '2025-06-01', avgPrice: 4525000, samples: 14 }, ...]module.exports = { dailyPriceTrend };

import { useEffect, useState } from 'react';
// Returns a "settled" copy of `value` that only updates// after `delay` ms of silence. While the user types, the// previous value is kept, so no fetch fires mid-keystroke.export function useDebounce<T>(value: T, delay = 400): T {  const [debounced, setDebounced] = useState<T>(value);
  useEffect(() => {    const timer = window.setTimeout(() => setDebounced(value), delay);
    // Clear the pending timer on change or unmount — the    // classic cleanup that prevents "setState on unmounted".    return () => window.clearTimeout(timer);  }, [value, delay]);
  return debounced;}
// Usage in a search box:// const [query, setQuery] = useState('');// const debouncedQuery = useDebounce(query, 400);// useEffect(() => {//   if (debouncedQuery.length >= 2) searchProducts(debouncedQuery);// }, [debouncedQuery]);