import { NestFactory } from '@nestjs/core';
import { NestExpressApplication } from '@nestjs/platform-express';
import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
import { configureApp } from './app.config';
import { resolveRole } from './runtime/role';
import { isHttpRole, rootModuleFor } from './runtime/root-module';
import { assertStartupEnvironment } from './runtime/startup-checks';

async function bootstrap() {
  const role = resolveRole('main');
  // resolveRole('main') admits no other role; this only narrows the type.
  if (!isHttpRole(role)) {
    throw new Error(`APICORE_ROLE=${role} cannot start dist/main.js`);
  }
  assertStartupEnvironment(role);

  const app = await NestFactory.create<NestExpressApplication>(
    rootModuleFor(role),
  );
  app.enableShutdownHooks();

  configureApp(app);

  // Swagger is mounted as raw Express middleware outside Nest's routing, so
  // it is never covered by the global JwtAuthGuard - anyone reaching the
  // host could otherwise read the full API schema (every endpoint and DTO
  // shape) with no authentication at all. Off by default; an operator who
  // wants it in a given environment opts in explicitly.
  if (process.env.ENABLE_SWAGGER === 'true') {
    const swaggerConfig = new DocumentBuilder()
      .setTitle('ApiCore API')
      .setDescription('Digitale Imkereiverwaltung – API-Dokumentation')
      .setVersion('1.0')
      .addBearerAuth()
      .build();
    const swaggerDocument = SwaggerModule.createDocument(app, swaggerConfig);
    SwaggerModule.setup('api/v1/docs', app, swaggerDocument);
  }

  await app.listen(process.env.PORT ?? 3001);
}
void bootstrap();