// Worker-side LLM proxy
class LLMProxy {
  private rateLimiter: RateLimiter;
  private validator: RequestValidator;
  
  async forward(request: LLMRequest): Promise<LLMResponse> {
    // Validate request
    this.validator.validate(request);
    
    // Rate limit
    await this.rateLimiter.acquire();
    
    // Forward to LLM API
    const response = await this.llmClient.complete(request);
    
    // Sanitize response
    return this.sanitize(response);
  }
}

interface KeyRotationPolicy {
  llmApiKey: {
    rotationInterval: '30d';
    gracePeriod: '24h';
  };
  sessionSecret: {
    rotationInterval: '7d';
    gracePeriod: '1h';
  };
  databasePassword: {
    rotationInterval: '90d';
    gracePeriod: '1h';
  };
}

const sessionConfig = {
  name: 'prazium_session',
  secret: process.env.SESSION_SECRET,
  cookie: {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
    maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
    domain: '.prazium.com',
  },
  rolling: true,
  resave: false,
  saveUninitialized: false,
};

// Generate API key
function generateApiKey(): { key: string; hash: string; prefix: string } {
  const key = `pzm_${randomBytes(32).toString('base64url')}`;
  const hash = createHash('sha256').update(key).digest('hex');
  const prefix = key.substring(0, 8);
  
  return { key, hash, prefix };
}

// Validate API key
async function validateApiKey(key: string): Promise<User | null> {
  const hash = createHash('sha256').update(key).digest('hex');
  
  const apiKey = await db.apiKeys.findOne({
    where: { keyHash: hash },
    include: { user: true },
  });
  
  if (!apiKey || (apiKey.expiresAt && apiKey.expiresAt < new Date())) {
    return null;
  }
  
  // Update last used
  await db.apiKeys.update({
    where: { id: apiKey.id },
    data: { lastUsedAt: new Date() },
  });
  
  return apiKey.user;
}

interface Permission {
  resource: 'project' | 'run' | 'export' | 'deploy';
  action: 'read' | 'write' | 'delete' | 'admin';
}

const ROLE_PERMISSIONS: Record<string, Permission[]> = {
  viewer: [
    { resource: 'project', action: 'read' },
    { resource: 'run', action: 'read' },
  ],
  builder: [
    { resource: 'project', action: 'read' },
    { resource: 'project', action: 'write' },
    { resource: 'run', action: 'read' },
    { resource: 'run', action: 'write' },
    { resource: 'export', action: 'read' },
  ],
  admin: [
    { resource: 'project', action: 'admin' },
    { resource: 'run', action: 'admin' },
    { resource: 'export', action: 'admin' },
    { resource: 'deploy', action: 'admin' },
  ],
};

import { z } from 'zod';

const createProjectSchema = z.object({
  name: z.string()
    .min(1)
    .max(100)
    .regex(/^[a-zA-Z0-9\s\-_]+$/),
  description: z.string()
    .min(10)
    .max(10000)
    .transform(sanitizeHtml),
});

const submitAnswersSchema = z.object({
  answers: z.array(z.object({
    questionId: z.string().uuid(),
    answer: z.union([
      z.string().max(1000),
      z.boolean(),
      z.array(z.string().max(100)),
    ]),
  })).max(10),
});

function validatePath(path: string): boolean {
  // No path traversal
  if (path.includes('..')) return false;
  
  // No absolute paths
  if (path.startsWith('/')) return false;
  
  // No hidden files (except specific allowed ones)
  const allowedHidden = ['.env.example', '.gitignore', '.eslintrc'];
  if (path.includes('/.') && !allowedHidden.some(h => path.endsWith(h))) {
    return false;
  }
  
  // No sensitive files
  const forbidden = ['.env', '.env.local', 'id_rsa', 'id_ed25519'];
  if (forbidden.some(f => path.endsWith(f))) {
    return false;
  }
  
  return true;
}

const COMMAND_ALLOWLIST = new Set([
  'pnpm',
  'npm',
  'npx',
  'node',
  'tsc',
  'eslint',
  'prettier',
  'vitest',
  'git',
  'mkdir',
  'rm',
  'cp',
  'mv',
  'cat',
  'echo',
  'ls',
]);

function validateCommand(command: string): boolean {
  const parts = command.split(/\s+/);
  const baseCommand = parts[0];
  
  if (!COMMAND_ALLOWLIST.has(baseCommand)) {
    return false;
  }
  
  // No shell operators
  if (/[;&|`$()]/.test(command)) {
    return false;
  }
  
  // No redirects to sensitive locations
  if (/>\s*\//.test(command)) {
    return false;
  }
  
  return true;
}

const securityHeaders = {
  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
  'X-Content-Type-Options': 'nosniff',
  'X-Frame-Options': 'DENY',
  'X-XSS-Protection': '1; mode=block',
  'Content-Security-Policy': [
    "default-src 'self'",
    "script-src 'self' 'unsafe-inline'",
    "style-src 'self' 'unsafe-inline'",
    "img-src 'self' data: https:",
    "connect-src 'self' wss:",
    "frame-ancestors 'none'",
  ].join('; '),
  'Referrer-Policy': 'strict-origin-when-cross-origin',
  'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
};