// Security happens BEFORE any API code runs
new Bootstrap($request); // All sanitization happens in Request constructor

// Security checks in OpenSwooleServer.php BEFORE Bootstrap
if (!$this->security->isRequestAllowed($requestUri)) {
    $this->security->sendSecurityResponse($response); // Returns 403
    return;
}
// THEN sanitization happens in SwooleRequest constructor
new SwooleBootstrap($sr->request); // All sanitization already done

/app          // Application code
/vendor       // Composer dependencies
/bin          // Executable files
/templates    // Template files
/config       // Configuration files
/logs         // Log files
/storage      // Storage files
/.env         // Environment variables
/.git         // Version control

.php, .env, .ini, .conf, .config,
.log, .sql, .db, .sqlite,
.md, .txt, .json, .xml, .yml, .yaml

// OpenSwooleServer.php - Line 159
// ✅ AUTOMATIC - Happens for EVERY request before processing
if (!$this->security->isRequestAllowed($requestUri)) {
    $this->security->sendSecurityResponse($response); // Returns 403
    return;
}

// ✅ No developer code needed - Already protected!

// ApacheRequest.php - Line 41-56
private function sanitizeAllServerHttpRequestHeaders(): void
{
    foreach ($_SERVER as $key => $value) {
        if (strpos($key, 'HTTP_') === 0) {
            // All HTTP headers sanitized
            $_SERVER[$key] = $this->sanitizeInput($value);
        }
    }
}

// Blocks dangerous cookie names:
- Session hijacking: PHPSESSID, JSESSIONID, ASP.NET_SessionId
- Auth bypass: auth, token, jwt, api_key, password
- CSRF tokens: csrf_token, xsrf_token
- Admin tokens: admin_token, admin_session

// Blocks dangerous cookie value patterns:
- Script injection: <script>, javascript:, vbscript:
- SQL injection: UNION SELECT, INSERT INTO, DROP TABLE
- Command injection: ;, |, `, $, system, exec
- Path traversal: ../, ..\\
- Null bytes and control characters

// ApacheRequest.php - Line 189-195
private function sanitizeInput(mixed $input): mixed
{
    if(!is_string($input)) {
        return $input;
    }
    return filter_var(trim($input), FILTER_SANITIZE_FULL_SPECIAL_CHARS);
}

// Schema: ['email' => 'email', 'password' => 'string']
// Request: {email: "...", password: "...", is_admin: true}

❌ REJECTED: "Unwanted post field: is_admin"

// Schema: ['email' => 'email', 'password' => 'string']
// Request: {email: "user@example.com"}

❌ REJECTED: "Missing required field: password"

// Schema: ['email' => 'email', 'age' => 'int']
// Request: {email: "not-an-email", age: "twenty"}

❌ REJECTED: 
"Invalid value for required field email, expected type: email"
"Invalid value for required field age, expected type: int"

// Schema: ['email' => 'email', '?phone' => 'string']
// Request: {email: "user@example.com", phone: 12345}

❌ REJECTED: "Invalid value for optional field phone, expected type: string"

// app/api/User.php
public function create(): JsonResponse {
    // Layer 1: Schema Validation
    if (!$this->request->definePostSchema([
        'name' => 'string',      // Required string
        'email' => 'email',      // Required valid email
        'password' => 'string',  // Required string
        '?phone' => 'string',   // Optional string
        '?age' => 'int'          // Optional integer
    ])) {
        return $this->request->returnResponse(); // 400 Bad Request
    }
    
    // Layer 2: String Length Validation
    if (!$this->request->validateStringPosts([
        'name' => '2|100',       // 2-100 characters
        'password' => '8|128',   // 8-128 characters
        '?phone' => '10|15'      // 10-15 characters if provided
    ])) {
        return $this->request->returnResponse(); // 400 Bad Request
    }
    
    // ✅ Only valid requests reach here!
    return (new UserController($this->request))->create();
}

// Access Token (short-lived)
$token = (new JWTToken())->createAccessToken($userId);
// Default: 300 seconds (5 minutes)

// Refresh Token (medium-lived)
$token = (new JWTToken())->createRefreshToken($userId);
// Default: 3600 seconds (1 hour)

// Login Token (long-lived)
$token = (new JWTToken())->createLoginToken($userId);
// Default: 604800 seconds (7 days)

{
    "token_id": "unique-token-id",
    "user_id": 123,
    "role": "admin,user",
    "role_id": 1,
    "company_id": 5,
    "employee_id": 10,
    "branch_id": 2,
    "exp": 1234567890,
    "iss": "MyCompany",
    "type": "access"
}

// In API Service
public function create(): JsonResponse {
    // Authentication check
    if (!$this->request->auth()) {
        return $this->request->returnResponse(); // 401 Unauthorized
    }
    
    // Authorization check (role-based)
    if (!$this->request->auth(['admin', 'moderator'])) {
        return $this->request->returnResponse(); // 403 Forbidden
    }
    
    // ✅ Authenticated and authorized
    return (new UserController($this->request))->create();
}

private function normalizeFilesArray(array $files): array
{
    foreach ($files as $key => $file) {
        // Sanitize file name
        if (is_string($file['name'])) {
            $normalized[$key]['name'] = $this->sanitizeInput($file['name']);
        }
        // Sanitize MIME type
        if (is_string($file['type'])) {
            $normalized[$key]['type'] = $this->sanitizeInput($file['type']);
        }
    }
}

// ImageHelper.php - Line 202-206
public function convertToWebP(int $quality = 80): bool
{
    // Uses getimagesize() which reads FILE MAGIC BYTES!
    $info = getimagesize($this->sourceFile);
    
    if ($info === false) {
        $this->error = "Unable to get image info";
        return false; // Not a valid image!
    }
    
    // Validates actual file signature
    $image = $this->createImageFromFile($info[2]);
}

// Encrypt file
$file = new FileHelper('document.pdf', 'document.pdf.enc');
$file->secret = 'my-secret-key';
$encryptedPath = $file->encrypt();

// Decrypt file
$file = new FileHelper('document.pdf.enc', 'document_decrypted.pdf');
$file->secret = 'my-secret-key';
$decryptedPath = $file->decrypt();

// AES-256-CBC Encryption
- Algorithm: AES-256-CBC
- IV: Random IV per file (prevents pattern analysis)
- HMAC: SHA-256 HMAC for integrity verification
- Encoding: Base64 for safe storage

public function query(string $query): void
{
    // Validate query length (max 1MB)
    if (strlen($query) > 1000000) {
        $this->setError('Query exceeds maximum length');
        return;
    }
    
    // Prepare statement (SQL injection prevention)
    $this->statement = $this->db->prepare($query);
}

public function bind(string $param, mixed $value): void
{
    // Automatic type detection
    $type = match (true) {
        is_int($value) => PDO::PARAM_INT,
        is_bool($value) => PDO::PARAM_BOOL,
        is_null($value) => PDO::PARAM_NULL,
        default => PDO::PARAM_STR,
    };
    
    // Bind with type safety (NOT string concatenation!)
    $this->statement->bindValue($param, $value, $type);
}

// All queries use prepared statements automatically
$users = (new UserTable())
    ->select('id,name,email')
    ->where('email', "admin' OR '1'='1")  // Sanitized input
    ->run();

// Generated SQL:
// SELECT id,name,email FROM users WHERE email = :email
// Bound: [':email' => "admin' OR '1'='1"]
// Database treats as literal string, NOT SQL code!

// INSERT - Uses prepared statements
$user->insertSingleQuery();

// SELECT - Uses prepared statements
$user->select()->where()->run();

// UPDATE - Uses prepared statements
$user->updateSingleQuery();

// DELETE - Uses prepared statements
$user->deleteSingleQuery();

// Password hashing
$hashedPassword = CryptHelper::hashPassword($password);
// Uses: PASSWORD_ARGON2I (industry standard)

// Password verification
$isValid = CryptHelper::passwordVerify($password, $hashedPassword);

// Bootstrap.php - Line 134-135
echo '<p>' . htmlspecialchars($e->getMessage()) . '</p>';
echo '<pre>' . htmlspecialchars($e->getTraceAsString()) . '</pre>';

// ✅ GOOD - Validate before processing
if (!$this->request->definePostSchema(['email' => 'email'])) {
    return $this->request->returnResponse();
}

// ❌ BAD - Process without validation
$email = $this->request->post['email']; // No validation!

// ✅ GOOD - Type-safe
$id = $this->request->intValueGet('id');

// ❌ BAD - No type checking
$id = $this->request->get['id']; // Could be anything!

// ✅ GOOD - Check authentication
if (!$this->request->auth(['admin'])) {
    return $this->request->returnResponse();
}

// ❌ BAD - No authentication check
// Anyone can access!

// ✅ GOOD - Uses prepared statements automatically
$user->where('email', $email)->run();

// ✅ AUTOMATIC - Framework enforces prepared statements
// ❌ NOT POSSIBLE - GEMVC doesn't allow raw SQL concatenation
// All queries automatically use prepared statements!

// ✅ GOOD - Validate file signature
$image = new ImageHelper($uploadedFile);
if ($image->convertToWebP()) {
    // File is valid image (signature verified)
}

// ❌ BAD - Trust file extension
if (pathinfo($file, PATHINFO_EXTENSION) === 'jpg') {
    // Dangerous! Extension can be spoofed!
}