// Strong password hashing with bcrypt
const saltRounds = 12;
const hashedPassword = await bcrypt.hash(password, saltRounds);

// Password validation
const passwordSchema = Joi.string()
  .min(8)
  .pattern(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[@$!%*?&])[A-Za-z\d@$!%*?&]/)
  .required()
  .messages({
    'string.pattern.base': 'Password must contain at least one uppercase letter, one lowercase letter, one number, and one special character'
  });

// Secure JWT configuration
const token = jwt.sign(
  { userId: user._id, role: user.role },
  process.env.JWT_SECRET,
  { 
    expiresIn: '24h',
    issuer: 'quantumlogics.io',
    audience: 'quantumlogics-users'
  }
);

// Token validation middleware
const authenticateToken = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];
  
  if (!token) {
    return res.status(401).json({ error: 'Access token required' });
  }
  
  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) {
      return res.status(403).json({ error: 'Invalid or expired token' });
    }
    req.user = user;
    next();
  });
};

const authorize = (roles) => {
  return (req, res, next) => {
    if (!req.user) {
      return res.status(401).json({ error: 'Authentication required' });
    }
    
    if (!roles.includes(req.user.role)) {
      return res.status(403).json({ error: 'Insufficient permissions' });
    }
    
    next();
  };
};

// Usage
app.post('/api/jobs', authenticateToken, authorize(['admin']), createJob);

// Express-validator configuration
const { body, validationResult } = require('express-validator');

const validateJobCreation = [
  body('title')
    .trim()
    .isLength({ min: 3, max: 100 })
    .escape()
    .withMessage('Title must be 3-100 characters'),
  
  body('description')
    .trim()
    .isLength({ min: 10, max: 2000 })
    .escape()
    .withMessage('Description must be 10-2000 characters'),
  
  body('email')
    .isEmail()
    .normalizeEmail()
    .withMessage('Valid email required'),
  
  (req, res, next) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    next();
  }
];

// Content Security Policy
app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'", "https://fonts.googleapis.com"],
      fontSrc: ["'self'", "https://fonts.gstatic.com"],
      scriptSrc: ["'self'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'", process.env.API_URL]
    }
  }
}));

// Input sanitization
const sanitizeInput = (req, res, next) => {
  for (const key in req.body) {
    if (typeof req.body[key] === 'string') {
      req.body[key] = DOMPurify.sanitize(req.body[key]);
    }
  }
  next();
};

// Secure MongoDB connection
const mongoOptions = {
  useNewUrlParser: true,
  useUnifiedTopology: true,
  authSource: 'admin',
  ssl: process.env.NODE_ENV === 'production',
  sslValidate: true,
  maxPoolSize: 10,
  serverSelectionTimeoutMS: 5000,
  socketTimeoutMS: 45000,
};

mongoose.connect(process.env.MONGO_URI, mongoOptions);

// Input sanitization for queries
const getUserById = async (userId) => {
  if (!mongoose.Types.ObjectId.isValid(userId)) {
    throw new Error('Invalid user ID');
  }
  
  return await User.findById(userId).select('-password');
};

// Safe query construction
const searchJobs = async (searchTerm, filters) => {
  const query = { active: true };
  
  // Safe text search
  if (searchTerm) {
    query.$text = { $search: searchTerm };
  }
  
  // Safe filter application
  if (filters.department) {
    query.department = filters.department;
  }
  
  if (filters.type) {
    query.type = { $in: filters.type };
  }
  
  return await Job.find(query)
    .sort({ postedAt: -1 })
    .limit(50);
};

const rateLimit = require('express-rate-limit');

const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // limit each IP to 100 requests per windowMs
  message: 'Too many requests from this IP, please try again later',
  standardHeaders: true,
  legacyHeaders: false,
});

const authLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5, // limit each IP to 5 auth requests per windowMs
  skipSuccessfulRequests: true,
});

app.use('/api/', apiLimiter);
app.post('/api/auth/login', authLimiter);

const corsOptions = {
  origin: function (origin, callback) {
    const allowedOrigins = [
      'http://localhost:3000',
      'https://quantumlogics.io',
      'https://www.quantumlogics.io'
    ];
    
    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      callback(new Error('Not allowed by CORS'));
    }
  },
  credentials: true,
  optionsSuccessStatus: 200
};

app.use(cors(corsOptions));

// Validate required environment variables
const requiredEnvVars = [
  'MONGO_URI',
  'JWT_SECRET',
  'EMAIL_USER',
  'EMAIL_PASS'
];

requiredEnvVars.forEach(varName => {
  if (!process.env[varName]) {
    throw new Error(`Missing required environment variable: ${varName}`);
  }
});

// Secure secret generation
const generateSecureSecret = (length = 32) => {
  return require('crypto').randomBytes(length).toString('hex');
};

// Avoid eval() and similar functions
// BAD
const result = eval(userInput);

// GOOD
const result = JSON.parse(userInput);

// Safe JSON parsing
const safeJsonParse = (str) => {
  try {
    return JSON.parse(str);
  } catch (error) {
    throw new Error('Invalid JSON format');
  }
};

// Version checking for security updates
const checkSecurityUpdates = async () => {
  const currentVersion = require('./package.json').version;
  const latestVersion = await getLatestVersion();
  
  if (semver.gt(latestVersion, currentVersion)) {
    console.warn(`Security update available: ${latestVersion}`);
    // Notify administrators
  }
};

// Security event logging
const securityLogger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json()
  ),
  transports: [
    new winston.transports.File({ filename: 'security.log' })
  ]
});

// Log security events
const logSecurityEvent = (event, details) => {
  securityLogger.info({
    event,
    details,
    timestamp: new Date().toISOString(),
    ip: details.ip,
    userAgent: details.userAgent
  });
};