// Middleware for authorization
async function authorizeAction(req, res, next) {
  const user = req.user;
  const resource = req.params.id;
  
  const hasPermission = await checkPermission(user.id, 'action', resource);
  if (!hasPermission) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  
  next();
}

// Use bcrypt for password hashing
const bcrypt = require('bcrypt');

async function hashPassword(password) {
  const salt = await bcrypt.genSalt(10);
  return bcrypt.hash(password, salt);
}

// Verify password
async function verifyPassword(password, hash) {
  return bcrypt.compare(password, hash);
}

// Use KMS for secrets
async function encryptSecret(secret, kmsKeyId) {
  const result = await kms.encrypt({
    KeyId: kmsKeyId,
    Plaintext: secret,
  }).promise();
  return result.CiphertextBlob;
}

// ✓ Safe: Parameterized query
db.query('SELECT * FROM users WHERE email = $1', [userEmail]);

// ✗ Unsafe: String concatenation
db.query(`SELECT * FROM users WHERE email = '${userEmail}'`);

// ✓ Safe: ORM usage
User.findByEmail(userEmail);

// Validate and sanitize input
const { body, validationResult } = require('express-validator');

app.post('/api/users', [
  body('email').isEmail().normalizeEmail(),
  body('password').isLength({ min: 8 }).trim().escape(),
  body('name').trim().escape().isLength({ min: 1, max: 100 }),
], (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }
  // Process validated input
});

// ✓ Safe: Use child_process with array arguments
const { execFile } = require('child_process');
execFile('command', [arg1, arg2], (error, stdout) => {
  // Process output
});

// ✗ Unsafe: Shell interpolation
const { exec } = require('child_process');
exec(`command ${userInput}`); // VULNERABLE!

// Rate limiting
const rateLimit = require('express-rate-limit');

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5, // 5 attempts
  message: 'Too many login attempts, try again later',
  skipSuccessfulRequests: true,
});

app.post('/api/login', loginLimiter, (req, res) => {
  // Login logic
});

// Account lockout
async function recordFailedLogin(userId) {
  const failures = await redis.incr(`login_failures:${userId}`);
  
  if (failures >= 5) {
    await User.update(userId, { locked: true });
    await sendSecurityAlert(userId, 'Account locked due to failed logins');
  }
  
  // Expire after 1 hour
  await redis.expire(`login_failures:${userId}`, 3600);
}

// Secure session configuration
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true, // HTTPS only
    httpOnly: true, // No JavaScript access
    sameSite: 'strict', // CSRF protection
    maxAge: 30 * 60 * 1000, // 30 minutes
  },
}));

// MFA support
async function enableMFA(userId) {
  const secret = speakeasy.generateSecret({
    name: `kit (${userEmail})`,
  });
  
  // Store secret securely
  await User.update(userId, {
    mfaSecret: encrypt(secret.base32),
    mfaEnabled: true,
  });
  
  return secret.qr_code_url;
}

// Verify MFA
async function verifyMFA(userId, token) {
  const secret = decrypt(user.mfaSecret);
  return speakeasy.totp.verify({
    secret,
    encoding: 'base32',
    token,
    window: 2, // Allow 30 seconds of drift
  });
}

// Security headers
const helmet = require('helmet');
app.use(helmet());

// Custom CSP for XSS protection
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "'unsafe-inline'"],
    styleSrc: ["'self'", "'unsafe-inline'"],
    imgSrc: ["'self'", 'data:', 'https:'],
    connectSrc: ["'self'"],
  },
}));

// CORS configuration
const cors = require('cors');
app.use(cors({
  origin: process.env.ALLOWED_ORIGINS.split(','),
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH'],
  allowedHeaders: ['Content-Type', 'Authorization'],
}));

// Disable unnecessary HTTP methods
app.disable('x-powered-by');

// Environment-based configuration
if (process.env.NODE_ENV === 'production') {
  // Disable detailed error messages
  app.use((err, req, res, next) => {
    console.error('Internal error:', err);
    res.status(500).json({ error: 'Internal server error' });
  });
}

// JWT validation
const jwt = require('jsonwebtoken');

function verifyToken(token) {
  try {
    return jwt.verify(token, process.env.JWT_SECRET, {
      algorithms: ['HS256'], // Specify algorithm
      issuer: 'kit',
      audience: 'kit-users',
      maxAge: '24h',
    });
  } catch (err) {
    if (err.name === 'TokenExpiredError') {
      throw new Error('Token expired');
    }
    throw new Error('Invalid token');
  }
}

// Token revocation (blacklist)
const tokenBlacklist = new Set();

function revokeToken(token) {
  const decoded = jwt.decode(token);
  tokenBlacklist.add(decoded.jti);
  
  // Expire from memory after token lifetime
  setTimeout(() => {
    tokenBlacklist.delete(decoded.jti);
  }, 24 * 60 * 60 * 1000);
}

async function isTokenRevoked(jti) {
  return tokenBlacklist.has(jti);
}

// Security event logging
const winston = require('winston');

const logger = winston.createLogger({
  level: 'info',
  format: winston.format.json(),
  defaultMeta: { service: 'kit' },
  transports: [
    new winston.transports.File({
      filename: 'logs/error.log',
      level: 'error',
    }),
    new winston.transports.File({
      filename: 'logs/security.log',
    }),
  ],
});

// Log security events
function logSecurityEvent(event, details) {
  logger.warn('SECURITY_EVENT', {
    event,
    timestamp: new Date().toISOString(),
    userId: details.userId,
    action: details.action,
    resource: details.resource,
    result: details.result,
    // Don't log sensitive data
  });
}

// Example usage
logSecurityEvent('AUTH_FAILURE', {
  userId: '...',
  action: 'login',
  resource: 'authentication',
  result: 'failed_password',
});

logSecurityEvent('PRIVILEGE_ESCALATION_ATTEMPT', {
  userId: '...',
  action: 'modify_permissions',
  resource: 'user:123',
  result: 'denied',
});

// SSRF protection
const url = require('url');
const axios = require('axios');

// Whitelist of allowed domains
const ALLOWED_DOMAINS = ['api.example.com', 'cdn.example.com'];

async function makeSecureRequest(requestUrl) {
  // Validate URL
  const parsed = url.parse(requestUrl);
  
  // Check domain whitelist
  if (!ALLOWED_DOMAINS.includes(parsed.hostname)) {
    throw new Error('Domain not allowed');
  }
  
  // Prevent internal IP access
  const blockedRanges = [
    /^127\./, // localhost
    /^192\.168\./, // private
    /^10\./, // private
    /^172\.(1[6-9]|2[0-9]|3[01])\./, // private
    /^169\.254\./, // link-local
  ];
  
  for (const range of blockedRanges) {
    if (range.test(parsed.hostname)) {
      throw new Error('Internal IP access denied');
    }
  }
  
  // Make request with timeout
  try {
    return await axios.get(requestUrl, {
      timeout: 5000, // 5 second timeout
      maxRedirects: 5,
    });
  } catch (error) {
    if (error.code === 'ECONNABORTED') {
      throw new Error('Request timeout');
    }
    throw error;
  }
}

const schema = {
  username: {
    type: 'string',
    minLength: 3,
    maxLength: 30,
    pattern: '^[a-zA-Z0-9_-]+$',
  },
  email: {
    type: 'string',
    format: 'email',
  },
  age: {
    type: 'integer',
    minimum: 0,
    maximum: 150,
  },
};

// Validate using JSON Schema
const ajv = new Ajv();
const validate = ajv.compile(schema);

app.post('/api/users', (req, res) => {
  const valid = validate(req.body);
  
  if (!valid) {
    return res.status(400).json({
      error: 'Validation failed',
      details: validate.errors,
    });
  }
  
  // Process valid input
});

// Encode output based on context
const entities = require('html-entities');

// HTML context
const htmlSafe = entities.encode(userInput);

// JavaScript context
const jsSafe = userInput.replace(/['"\\]/g, '\\$&');

// URL context
const urlSafe = encodeURIComponent(userInput);

// Example: Render user data safely
res.render('profile', {
  username: htmlSafe,
  bio: htmlSafe,
});

app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'"],
    styleSrc: ["'self'", 'fonts.googleapis.com'],
    imgSrc: ["'self'", 'data:', 'https:'],
    fontSrc: ["'self'", 'fonts.gstatic.com'],
    connectSrc: ["'self'"],
    frameSrc: ["'none'"],
    objectSrc: ["'none'"],
    upgradeInsecureRequests: [],
  },
}));

// Consent management
async function recordConsent(userId, type) {
  await db.insert('consents', {
    userId,
    type, // 'marketing', 'analytics', etc.
    timestamp: new Date(),
    version: 1, // Consent version
  });
}

// Data access request
async function exportUserData(userId) {
  const user = await User.findById(userId);
  const issues = await Issue.find({ userId });
  const activities = await Activity.find({ userId });
  
  return {
    user,
    issues,
    activities,
    exportedAt: new Date().toISOString(),
  };
}

// Right to be forgotten
async function deleteUserData(userId) {
  // Delete personal data
  await User.delete(userId);
  await Issue.deleteMany({ userId });
  
  // Keep anonymized data for audit
  await AuditLog.create({
    action: 'user_deletion',
    userId: 'anonymized',
    timestamp: new Date(),
  });
}