// AYW Generated + Human Approved
// File: package.json
// Why this stack: Express for REST API, AYW SDK for AI assistance
// Security: helmet for headers, cors with whitelist
// Approved by: [your-name] at 2026-04-29

{
  "name": "ayw-support-bot",
  "version": "1.0.0",
  "dependencies": {
    "express": "^4.18.2",
    "helmet": "^7.0.0",
    "cors": "^2.8.5",
    "express-validator": "^7.0.1",
    "@ayw/sdk": "^1.0.0"
  }
}

// AYW Generated + Human Approved
// File: src/bot.js
// Purpose: Handle incoming chat messages with intent recognition
// Security: Input validated, rate-limited, audit-logged
// Approved by: [your-name] at 2026-04-29

const { body, validationResult } = require('express-validator');

// AYW Note: Intent mapping - what users want vs. what bot understands
const intents = {
  'order_status': ['order', 'status', 'where', 'shipping'],
  'return_item': ['return', 'refund', 'exchange'],
  'faq': ['hours', 'location', 'contact', 'help'],
  'escalate': ['human', 'agent', 'real person', 'speak to someone']
};

async function handleMessage(req, res) {
  // AYW Security: Validate input first
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ error: 'Invalid input' });
  }

  const { message, userId } = req.body;

  // AYW Generated: Intent recognition (explained)
  const intent = detectIntent(message, intents);

  // Audit log (required for compliance)
  await auditLog('message_received', { userId, intent, timestamp: new Date() });

  switch(intent) {
    case 'order_status':
      return handleOrderStatus(userId, res);
    case 'return_item':
      return handleReturn(userId, res);
    case 'faq':
      return handleFAQ(message, res);
    case 'escalate':
      return escalateToHuman(userId, res);
    default:
      return res.json({ 
        message: "I'm not sure I understand. Can you rephrase?",
        escalate: true 
      });
  }
}

// AYW Note: Simple keyword matching (v1), can upgrade to ML later
function detectIntent(message, intents) {
  const lowerMsg = message.toLowerCase();
  for (const [intent, keywords] of Object.entries(intents)) {
    if (keywords.some(kw => lowerMsg.includes(kw))) {
      return intent;
    }
  }
  return 'unknown';
}

// AYW Generated + Human Approved
// File: src/routes.js
// Purpose: Expose chat endpoint with security middleware
// Rate limiting: 10 messages per IP per hour
// Authentication: JWT required (explained below)

const rateLimit = require('express-rate-limit');

const chatLimiter = rateLimit({
  windowMs: 3600000, // 1 hour
  max: 10,
  message: 'Too many messages, please try again later.'
});

app.post('/api/chat',
  chatLimiter,
  [
    body('message').isLength({ min: 5, max: 1000 }).trim().escape(),
    body('userId').isUUID()
  ],
  handleMessage
);

// AYW Note: Why JWT auth? So we can track user conversations
// Alternative considered: Session-based (rejected - API-first design)
app.post('/api/chat', authenticateJWT, handleMessage);

// AYW Generated Test
// File: test/bot.test.js
// Purpose: Verify bot handles edge cases

describe('Chatbot Tests', () => {
  test('Handles angry user gracefully', async () => {
    const response = await request(app)
      .post('/api/chat')
      .send({ message: "This is ridiculous! I've been waiting 3 hours!" });

    expect(response.body.message).toContain('understand');
    expect(response.status).toBe(200);
  });

  test('Escalates when requested', async () => {
    const response = await request(app)
      .post('/api/chat')
      .send({ message: "I want to speak to a human" });

    expect(response.body.escalate).toBe(true);
  });

  test('Validates input (security)', async () => {
    const response = await request(app)
      .post('/api/chat')
      .send({ message: "<script>alert('xss')</script>" });

    expect(response.status).toBe(400);
  });
});

# AYW Generated + Human Approved
# Dockerfile
# Base: Node 18 Alpine (security + small image)
# Why Alpine: 80% fewer CVEs than standard Node image

FROM node:18-alpine

# AYW Security: Non-root user
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production

COPY . .
USER appuser

EXPOSE 3000
CMD ["node", "src/index.js"]