// server/config/env.ts
export const securityConfig = {
  bcryptRounds: parseInt(process.env.BCRYPT_ROUNDS || '10', 10),
};

// server/auth/utils.ts
export async function hashPassword(password: string): Promise<string> {
  const hash = await bcrypt.hash(password, securityConfig.bcryptRounds);
  return hash;
}

export function validatePassword(password: string): { isValid: boolean; error?: string } {
  if (password.length < 8) {
    return { isValid: false, error: 'Password must be at least 8 characters long' };
  }
  if (!/[A-Z]/.test(password)) {
    return { isValid: false, error: 'Password must contain at least one uppercase letter' };
  }
  if (!/[a-z]/.test(password)) {
    return { isValid: false, error: 'Password must contain at least one lowercase letter' };
  }
  if (!/[0-9]/.test(password)) {
    return { isValid: false, error: 'Password must contain at least one number' };
  }
  return { isValid: true };
}

// NEVER store passwords in plain text
const user = { password: 'mypassword' };  // WRONG

// NEVER log passwords
console.log('User password:', password);  // WRONG

// NEVER send passwords in URLs
fetch(`/api?password=${password}`);  // WRONG

// Always hash passwords before storing
const passwordHash = await hashPassword(password);

// Never log sensitive data
console.log('User authenticated:', userId);  // GOOD

// Always send passwords in request body over HTTPS
fetch('/api/auth/login', {
  method: 'POST',
  body: JSON.stringify({ email, password }),
});

// server/config/env.ts
export const jwtConfig = {
  accessTokenSecret: process.env.JWT_ACCESS_SECRET || 'dev-access-secret-change-in-production',
  refreshTokenSecret: process.env.JWT_REFRESH_SECRET || 'dev-refresh-secret-change-in-production',
  accessTokenExpiry: process.env.JWT_ACCESS_EXPIRY || '15m',
  refreshTokenExpiry: process.env.JWT_REFRESH_EXPIRY || '7d',
};

// Short-lived access token
JWT_ACCESS_EXPIRY=15m

// Longer-lived refresh token
JWT_REFRESH_EXPIRY=7d

// POST /api/auth/refresh
export async function refreshToken(req: AuthRequest, res: Response): Promise<void> {
  const { refreshToken } = req.body;

  // Verify refresh token
  const decoded = verifyRefreshToken(refreshToken);

  // Get user from database
  const user = await query<User>('SELECT * FROM users WHERE id = $1', [decoded.userId]);

  // Generate new token pair
  const tokens = generateTokenPair(user[0]);

  res.json({ success: true, data: tokens });
}

// Refresh token 1 minute before expiry
const REFRESH_THRESHOLD = 60 * 1000; // 1 minute

async function refreshTokenIfNeeded(accessToken: string) {
  const decoded = jwtDecode(accessToken);
  const expiresIn = decoded.exp * 1000 - Date.now();

  if (expiresIn < REFRESH_THRESHOLD) {
    const refreshToken = localStorage.getItem('refreshToken');
    const response = await fetch('/api/auth/refresh', {
      method: 'POST',
      body: JSON.stringify({ refreshToken }),
    });
    const { data } = await response.json();
    localStorage.setItem('accessToken', data.accessToken);
    localStorage.setItem('refreshToken', data.refreshToken);
    return data.accessToken;
  }

  return accessToken;
}

// Blacklist a token
async function blacklistToken(token: string, userId: string, reason: string) {
  const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
  const decoded = jwt.decode(token) as any;

  await query(
    `INSERT INTO token_blacklist (token_hash, user_id, expires_at, reason)
     VALUES ($1, $2, $3, $4)`,
    [tokenHash, userId, new Date(decoded.exp * 1000), reason]
  );
}

// Check if token is blacklisted
async function isTokenBlacklisted(token: string): Promise<boolean> {
  const tokenHash = crypto.createHash('sha256').update(token).digest('hex');
  const result = await query(
    'SELECT 1 FROM token_blacklist WHERE token_hash = $1 AND expires_at > CURRENT_TIMESTAMP',
    [tokenHash]
  );
  return result.length > 0;
}

// server/index.ts
if (serverConfig.isProduction) {
  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
}

// Add preload directive for maximum security
res.setHeader(
  'Strict-Transport-Security',
  'max-age=63072000; includeSubDomains; preload'
);

// server/index.ts
const corsOptions = {
  origin: serverConfig.corsOrigin,
  credentials: true,
  optionsSuccessStatus: 200,
  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization'],
};

app.use(cors(corsOptions));

const allowedOrigins = process.env.CORS_ORIGIN?.split(',') || [];

const corsOptions = {
  origin: (origin: string | undefined, callback: (err: Error | null, allow?: boolean) => void) => {
    // Allow requests with no origin (mobile apps, Postman)
    if (!origin) return callback(null, true);

    if (allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      console.warn(`CORS blocked origin: ${origin}`);
      callback(new Error('Not allowed by CORS'));
    }
  },
  credentials: true,
  optionsSuccessStatus: 200,
  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  exposedHeaders: ['X-Total-Count', 'X-Page-Count'],
  maxAge: 86400, // 24 hours
};

// NEVER DO THIS IN PRODUCTION
const corsOptions = {
  origin: '*',  // WRONG - allows any origin
  credentials: true,  // WRONG - contradicts wildcard
};

// Handle OPTIONS requests
app.options('*', cors(corsOptions));

// Or specific routes
app.options('/api/auth/*', cors(corsOptions));

// server/db/pool.ts
export async function query<T = any>(
  text: string,
  params?: any[]
): Promise<T[]> {
  const result = await pool.query(text, params);
  return result.rows as T[];
}

// Usage in controller
const users = await query<User>(
  'SELECT * FROM users WHERE email = $1',  // ✓ Parameterized
  [email.toLowerCase()]
);

// NEVER DO THIS - Vulnerable to SQL injection
const users = await query(
  `SELECT * FROM users WHERE email = '${email}'`  // ✗ VULNERABLE
);

// Attacker input: email = "admin' OR '1'='1"
// Results in: SELECT * FROM users WHERE email = 'admin' OR '1'='1'
// This returns ALL users!

// ALWAYS DO THIS - Safe from SQL injection
const users = await query<User>(
  'SELECT * FROM users WHERE email = $1',  // ✓ SAFE
  [email]
);

// Attacker input: email = "admin' OR '1'='1"
// Database treats entire input as literal string, not SQL code

// SECURE way to build dynamic queries
export async function updateProfile(req: AuthRequest, res: Response): Promise<void> {
  const { name, email } = req.body;

  // Build query dynamically but safely
  const updates: string[] = [];
  const values: unknown[] = [];
  let paramCount = 1;

  if (name) {
    updates.push(`name = $${paramCount}`);
    values.push(name.trim());
    paramCount++;
  }

  if (email) {
    updates.push(`email = $${paramCount}`);
    values.push(email.toLowerCase());
    paramCount++;
  }

  values.push(req.user.userId);

  // Final query uses parameters
  const updatedUsers = await query<User>(
    `UPDATE users SET ${updates.join(', ')}, updated_at = CURRENT_TIMESTAMP
     WHERE id = $${paramCount}
     RETURNING *`,
    values
  );
}

// SECURE LIKE query
async function searchUsers(searchTerm: string) {
  // Escape special characters
  const sanitized = searchTerm.replace(/[%_]/g, '\\$&');

  // Use parameterized query
  const users = await query<User>(
    'SELECT * FROM users WHERE name ILIKE $1',
    [`%${sanitized}%`]
  );
  return users;
}

// Validate email format
if (!isValidEmail(email)) {
  throw new ValidationError('Invalid email format');
}

// Validate UUID format
if (!isValidUUID(userId)) {
  throw new ValidationError('Invalid user ID format');
}

// Validate and sanitize strings
const sanitizedName = name.trim().slice(0, 100);

// server/middleware/validateRequest.ts
export function sanitizeString(input: string): string {
  return input.trim().replace(/\s+/g, ' ');
}

import validator from 'validator';

// Escape HTML entities
const safeName = validator.escape(name);

// Remove script tags
const safeContent = content.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');

// server/index.ts
app.use((req: Request, res: Response, next: NextFunction) => {
  res.setHeader(
    'Content-Security-Policy',
    "default-src 'self'; " +
    "script-src 'self' 'unsafe-inline' 'unsafe-eval'; " +
    "style-src 'self' 'unsafe-inline'; " +
    "img-src 'self' data: https:; " +
    "font-src 'self' data:; " +
    "connect-src 'self' " + process.env.VITE_API_URL + "; " +
    "frame-ancestors 'none';"
  );
  next();
});

res.setHeader(
  'Content-Security-Policy',
  "default-src 'none'; " +
  "script-src 'self'; " +
  "style-src 'self'; " +
  "img-src 'self'; " +
  "font-src 'self'; " +
  "connect-src 'self'; " +
  "base-uri 'self'; " +
  "form-action 'self'; " +
  "frame-ancestors 'none';"
);

// server/index.ts
res.setHeader('X-XSS-Protection', '1; mode=block');

res.cookie('refreshToken', token, {
  httpOnly: true,  // Prevent JavaScript access
  secure: true,    // HTTPS only
  sameSite: 'strict',  // CSRF protection
  maxAge: 7 * 24 * 60 * 60 * 1000,  // 7 days
});

// Client sends token in header
fetch('/api/auth/me', {
  headers: {
    'Authorization': `Bearer ${accessToken}`,
  },
});

import csrf from 'csurf';

// Enable CSRF protection
const csrfProtection = csrf({ cookie: true });

app.use(csrfProtection);

// Send CSRF token to client
app.get('/api/csrf-token', (req, res) => {
  res.json({ csrfToken: req.csrfToken() });
});

// Verify CSRF token on protected routes
app.post('/api/protected', csrfProtection, (req, res) => {
  res.json({ success: true });
});

// Get CSRF token
const response = await fetch('/api/csrf-token');
const { csrfToken } = await response.json();

// Include in requests
fetch('/api/protected', {
  method: 'POST',
  headers: {
    'X-CSRF-Token': csrfToken,
  },
  body: JSON.stringify(data),
});

res.cookie('token', value, {
  sameSite: 'strict',  // Best protection, may break some workflows
  // sameSite: 'lax',  // Good balance
  // sameSite: 'none',  // No protection (requires secure: true)
});

// Set CSRF token as cookie
res.cookie('XSRF-TOKEN', csrfToken, {
  httpOnly: false,  // Allow JavaScript access
  sameSite: 'strict',
});

// Verify token matches in request
app.use((req, res, next) => {
  const cookieToken = req.cookies['XSRF-TOKEN'];
  const headerToken = req.headers['x-xsrf-token'];

  if (cookieToken !== headerToken) {
    return res.status(403).json({ error: 'Invalid CSRF token' });
  }

  next();
});

// server/index.ts
const limiter = rateLimit({
  windowMs: securityConfig.rateLimitWindowMs,  // 15 minutes
  max: securityConfig.rateLimitMaxRequests,    // 100 requests
  message: {
    success: false,
    error: 'Too many requests',
    message: 'Too many requests from this IP, please try again later.',
  },
  standardHeaders: true,
  legacyHeaders: false,
});

// server/middleware/rateLimiter.ts

// Login: 5 attempts per 15 minutes
export const loginRateLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,
  skipSuccessfulRequests: true,
});

// Registration: 3 attempts per hour
export const registerRateLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  max: 3,
  skipSuccessfulRequests: true,
});

// Password reset: 3 attempts per hour
export const passwordResetRateLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  max: 3,
});

import RedisStore from 'rate-limit-redis';
import Redis from 'ioredis';

const redis = new Redis({
  host: process.env.REDIS_HOST,
  port: parseInt(process.env.REDIS_PORT || '6379'),
});

const limiter = rateLimit({
  store: new RedisStore({
    client: redis,
    prefix: 'rate_limit:',
  }),
  windowMs: 15 * 60 * 1000,
  max: 100,
});

function keyGenerator(req: Request): string {
  // Rate limit by user ID if authenticated, else by IP
  if (req.user?.userId) {
    return `user:${req.user.userId}`;
  }
  return `ip:${getClientIp(req)}`;
}

const limiter = rateLimit({
  keyGenerator,
  windowMs: 15 * 60 * 1000,
  max: 100,
});

function getMaxRequests(req: Request): number {
  // Premium users get higher limits
  if (req.user?.subscriptionTier === 'premium') {
    return 1000;
  }
  if (req.user?.subscriptionTier === 'pro') {
    return 500;
  }
  return 100;  // Free tier
}

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: (req) => getMaxRequests(req),
});

async function logRateLimitHit(
  endpoint: string,
  ip: string,
  limitType: string,
  userId?: string
): Promise<void> {
  await query(
    `INSERT INTO rate_limit_logs (endpoint, ip_address, user_id, limit_type, hit_time)
     VALUES ($1, $2, $3, $4, CURRENT_TIMESTAMP)`,
    [endpoint, ip, userId || null, limitType]
  );
}

// server/middleware/validateRequest.ts
export function validateRequired(requiredFields: string[]) {
  return (req: Request, res: Response, next: NextFunction): void => {
    const missingFields = requiredFields.filter((field) => {
      const value = req.body?.[field];
      return value === undefined || value === null || value === '';
    });

    if (missingFields.length > 0) {
      throw new ValidationError(
        `Missing required fields: ${missingFields.join(', ')}`
      );
    }

    next();
  };
}

export function isValidEmail(email: string): boolean {
  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  return emailRegex.test(email);
}

export function validatePassword(password: string): { isValid: boolean; error?: string } {
  if (password.length < 8) {
    return { isValid: false, error: 'Password must be at least 8 characters long' };
  }
  if (!/[A-Z]/.test(password)) {
    return { isValid: false, error: 'Password must contain at least one uppercase letter' };
  }
  if (!/[a-z]/.test(password)) {
    return { isValid: false, error: 'Password must contain at least one lowercase letter' };
  }
  if (!/[0-9]/.test(password)) {
    return { isValid: false, error: 'Password must contain at least one number' };
  }
  return { isValid: true };
}

export function isValidUUID(uuid: string): boolean {
  const uuidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
  return uuidRegex.test(uuid);
}

export function sanitizeString(input: string): string {
  return input.trim().replace(/\s+/g, ' ');
}

function validateLength(value: string, min: number, max: number): boolean {
  return value.length >= min && value.length <= max;
}

// Usage
if (!validateLength(name, 2, 100)) {
  throw new ValidationError('Name must be between 2 and 100 characters');
}

interface RegisterRequest {
  email: string;
  password: string;
  name: string;
}

export async function register(
  req: AuthRequest,
  res: Response
): Promise<void> {
  const { email, password, name } = req.body as RegisterRequest;
  // TypeScript ensures correct types
}

import { z } from 'zod';

const registerSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8).regex(/[A-Z]/).regex(/[a-z]/).regex(/[0-9]/),
  name: z.string().min(2).max(100),
});

export function validateRegistration() {
  return (req: Request, res: Response, next: NextFunction) => {
    try {
      registerSchema.parse(req.body);
      next();
    } catch (error) {
      if (error instanceof z.ZodError) {
        throw new ValidationError('Validation failed', {
          errors: error.errors,
        });
      }
      throw error;
    }
  };
}

// server/index.ts
app.use(express.json({ limit: '10mb' }));
app.use(express.urlencoded({ extended: true, limit: '10mb' }));

export function validateBodySize(maxSizeBytes: number = 1024 * 1024) {
  return (req: Request, res: Response, next: NextFunction): void => {
    const contentLength = req.headers['content-length'];

    if (contentLength && parseInt(contentLength) > maxSizeBytes) {
      throw new ValidationError('Request body too large');
    }

    next();
  };
}

// server/middleware/errorHandler.ts
export function errorHandler(
  err: Error,
  req: Request,
  res: Response,
  next: NextFunction
): void {
  // Log full error for debugging
  console.error('Error:', err);

  // Send safe error to client
  if (err instanceof ValidationError) {
    res.status(400).json({
      success: false,
      error: 'Validation error',
      message: err.message,
    });
  } else if (err instanceof AuthenticationError) {
    res.status(401).json({
      success: false,
      error: 'Authentication failed',
      message: err.message,
    });
  } else {
    // Generic error for unknown errors
    res.status(500).json({
      success: false,
      error: 'Internal server error',
      message: serverConfig.isProduction
        ? 'An error occurred'
        : err.message,
    });
  }
}

// NEVER DO THIS
res.status(500).json({
  error: 'Database error: SELECT * FROM users WHERE email = \'test@example.com\'',
  stack: err.stack,
  file: __filename,
});

// NEVER DO THIS - Reveals user existence
if (!user) {
  res.status(404).json({ error: 'User not found' });
} else if (!passwordMatch) {
  res.status(401).json({ error: 'Incorrect password' });
}

// DO THIS - Generic message
res.status(500).json({
  success: false,
  error: 'Internal server error',
  message: 'An error occurred processing your request',
});

// DO THIS - Don't reveal user existence
if (!user || !passwordMatch) {
  res.status(401).json({
    success: false,
    error: 'Invalid credentials',
    message: 'Invalid email or password',
  });
}

// server/auth/controller.ts
export async function login(req: AuthRequest, res: Response): Promise<void> {
  const user = users[0];

  if (!user) {
    // Don't reveal whether user exists or not
    res.status(401).json({
      success: false,
      error: 'Invalid credentials',
      message: 'Invalid email or password',
    });
    return;
  }

  const isPasswordValid = await comparePassword(password, user.password_hash);

  if (!isPasswordValid) {
    // Same error message as above
    res.status(401).json({
      success: false,
      error: 'Invalid credentials',
      message: 'Invalid email or password',
    });
    return;
  }
}

// Full error logging (server-side only)
console.error('Authentication error:', {
  timestamp: new Date().toISOString(),
  ip: getClientIp(req),
  email: req.body.email,
  error: err.message,
  stack: err.stack,
});

// Send generic error to client
res.status(500).json({
  success: false,
  error: 'Internal server error',
  message: 'An error occurred',
});

import winston from 'winston';

const logger = winston.createLogger({
  level: 'info',
  format: winston.format.json(),
  transports: [
    new winston.transports.File({ filename: 'error.log', level: 'error' }),
    new winston.transports.File({ filename: 'combined.log' }),
  ],
});

// Log errors
logger.error('Authentication failed', {
  ip: req.ip,
  email: req.body.email,
  error: err.message,
});

interface ErrorResponse {
  success: false;
  error: string;      // Error type/category
  message: string;    // User-friendly message
  code?: string;      // Optional error code
  details?: any;      // Optional details (development only)
}

// Example
res.status(400).json({
  success: false,
  error: 'Validation error',
  message: 'Email is required',
  code: 'MISSING_EMAIL',
  details: serverConfig.isDevelopment ? { field: 'email' } : undefined,
});

// Client-side (localStorage)
localStorage.setItem('accessToken', data.accessToken);
localStorage.setItem('refreshToken', data.refreshToken);

// Only store tokens in localStorage if necessary
// Clear tokens on logout
function logout() {
  localStorage.removeItem('accessToken');
  localStorage.removeItem('refreshToken');
}

// Clear tokens on security events
window.addEventListener('storage', (e) => {
  if (e.key === 'accessToken' && !e.newValue) {
    // Token was removed, log out
    window.location.href = '/login';
  }
});

export async function login(req: AuthRequest, res: Response): Promise<void> {
  const tokens = generateTokenPair(user);

  // Set refresh token in httpOnly cookie
  res.cookie('refreshToken', tokens.refreshToken, {
    httpOnly: true,      // Not accessible via JavaScript
    secure: true,        // HTTPS only
    sameSite: 'strict',  // CSRF protection
    maxAge: 7 * 24 * 60 * 60 * 1000,  // 7 days
  });

  // Send access token in response
  res.json({
    success: true,
    data: {
      user: sanitizeUser(user),
      accessToken: tokens.accessToken,
    },
  });
}

// Access token still in memory or localStorage
let accessToken = '';

// Refresh token automatically sent via cookie
async function refreshToken() {
  const response = await fetch('/api/auth/refresh', {
    method: 'POST',
    credentials: 'include',  // Include cookies
  });
  const { data } = await response.json();
  accessToken = data.accessToken;
}

// Store tokens in module-scope variable
let accessToken: string | null = null;
let refreshToken: string | null = null;

export function setTokens(access: string, refresh: string) {
  accessToken = access;
  refreshToken = refresh;
}

export function getAccessToken() {
  return accessToken;
}

export function clearTokens() {
  accessToken = null;
  refreshToken = null;
}

// Tokens lost on page refresh - must re-authenticate

// Refresh 1 minute before expiry
const REFRESH_THRESHOLD = 60 * 1000;

async function fetchWithAuth(url: string, options: RequestInit = {}) {
  let token = localStorage.getItem('accessToken');

  // Check if token needs refresh
  if (token) {
    const decoded = jwtDecode(token);
    const expiresIn = decoded.exp * 1000 - Date.now();

    if (expiresIn < REFRESH_THRESHOLD) {
      token = await refreshAccessToken();
    }
  }

  return fetch(url, {
    ...options,
    headers: {
      ...options.headers,
      'Authorization': `Bearer ${token}`,
    },
  });
}

const INACTIVITY_TIMEOUT = 30 * 60 * 1000; // 30 minutes
let inactivityTimer: NodeJS.Timeout;

function resetInactivityTimer() {
  clearTimeout(inactivityTimer);

  inactivityTimer = setTimeout(() => {
    // Log out user due to inactivity
    logout();
    window.location.href = '/login?reason=inactivity';
  }, INACTIVITY_TIMEOUT);
}

// Reset timer on user activity
document.addEventListener('click', resetInactivityTimer);
document.addEventListener('keypress', resetInactivityTimer);
document.addEventListener('scroll', resetInactivityTimer);

// Start timer
resetInactivityTimer();

async function createSession(userId: string, token: string, req: Request) {
  const tokenHash = crypto.createHash('sha256').update(token).digest('hex');

  // Limit to 5 concurrent sessions per user
  const sessions = await query(
    'SELECT COUNT(*) as count FROM user_sessions WHERE user_id = $1 AND expires_at > CURRENT_TIMESTAMP',
    [userId]
  );

  if (sessions[0].count >= 5) {
    // Remove oldest session
    await query(
      'DELETE FROM user_sessions WHERE id IN (SELECT id FROM user_sessions WHERE user_id = $1 ORDER BY created_at ASC LIMIT 1)',
      [userId]
    );
  }

  // Create new session
  await query(
    `INSERT INTO user_sessions (user_id, token_hash, ip_address, user_agent, expires_at)
     VALUES ($1, $2, $3, $4, $5)`,
    [userId, tokenHash, getClientIp(req), req.headers['user-agent'], expiresAt]
  );
}