// Check user capabilities
if (!current_user_can('manage_options')) {
    wp_die(__('You do not have sufficient permissions to access this page.'));
}

// Verify nonce
check_ajax_referer('piper_privacy_sorn_nonce', 'nonce');

// Sanitize text input
$name = sanitize_text_field($_POST['name']);

// Validate URLs
$url = esc_url_raw($_POST['url']);

// Sanitize file uploads
$allowed_types = ['pdf', 'txt', 'json'];
$file_type = wp_check_filetype($file['name']);

// Escape HTML content
echo esc_html($content);

// Escape HTML attributes
echo esc_attr($value);

// Escape URLs
echo esc_url($url);

// Add nonce to forms
wp_nonce_field('piper_privacy_sorn_action', 'piper_privacy_sorn_nonce');

// Verify nonce
if (!wp_verify_nonce($_POST['piper_privacy_sorn_nonce'], 'piper_privacy_sorn_action')) {
    wp_die(__('Invalid security token sent.'));
}

// Validate file uploads
public function validate_file_upload($file) {
    // Check file type
    $allowed_types = ['pdf', 'txt', 'json'];
    $file_type = wp_check_filetype($file['name']);
    
    if (!in_array($file_type['ext'], $allowed_types)) {
        throw new \InvalidArgumentException('Invalid file type.');
    }
    
    // Check file size
    $max_size = 5 * 1024 * 1024; // 5MB
    if ($file['size'] > $max_size) {
        throw new \InvalidArgumentException('File too large.');
    }
    
    // Additional security checks
    if (!wp_verify_nonce($_POST['upload_nonce'], 'file_upload')) {
        throw new \InvalidArgumentException('Invalid security token.');
    }
}

// Secure API requests
private function make_api_request($endpoint, $data) {
    $headers = [
        'Authorization' => 'Bearer ' . $this->get_api_token(),
        'User-Agent' => 'SORN Manager WordPress Plugin/' . PIPER_PRIVACY_SORN_VERSION,
        'X-WP-Nonce' => wp_create_nonce('wp_rest')
    ];
    
    return wp_remote_post($endpoint, [
        'headers' => $headers,
        'body' => $data,
        'timeout' => 30,
        'sslverify' => true
    ]);
}

// Secure token storage
private function store_api_token($token) {
    if (empty($token)) {
        return false;
    }
    
    return update_option('gpt_trainer_api_token', $this->encrypt_token($token));
}

// Secure token retrieval
private function get_api_token() {
    $token = get_option('gpt_trainer_api_token');
    return $this->decrypt_token($token);
}

// Secure error logging
private function log_error($message, $context = []) {
    // Remove sensitive data
    $context = $this->sanitize_log_data($context);
    
    // Log error
    error_log(sprintf(
        '[SORN Manager] %s: %s',
        $message,
        wp_json_encode($context)
    ));
}

// Sanitize sensitive data
private function sanitize_log_data($data) {
    $sensitive_keys = ['api_token', 'password', 'key'];
    
    array_walk_recursive($data, function(&$value, $key) use ($sensitive_keys) {
        if (in_array($key, $sensitive_keys)) {
            $value = '***REDACTED***';
        }
    });
    
    return $data;
}

// Example of role capability checks
public function check_sorn_access($sorn_id): bool {
    if (!current_user_can('edit_sorns')) {
        return false;
    }

    // Check agency-specific permissions
    $user_agency = get_user_meta(get_current_user_id(), 'agency', true);
    $sorn_agency = $this->get_sorn_agency($sorn_id);
    
    return $user_agency === $sorn_agency || current_user_can('manage_options');
}

// Example of data encryption
public function encrypt_sensitive_data(string $data): string {
    if (empty($data)) {
        return '';
    }

    $key = $this->get_encryption_key();
    $method = 'aes-256-gcm';
    $iv = random_bytes(12);
    $tag = '';

    $encrypted = openssl_encrypt(
        $data,
        $method,
        $key,
        OPENSSL_RAW_DATA,
        $iv,
        $tag,
        '',
        16
    );

    return base64_encode($iv . $tag . $encrypted);
}

// Example of API request validation
public function validate_api_request(WP_REST_Request $request): bool {
    // Verify nonce
    $nonce = $request->get_header('X-WP-Nonce');
    if (!wp_verify_nonce($nonce, 'wp_rest')) {
        return false;
    }

    // Verify user capabilities
    if (!current_user_can('edit_sorns')) {
        return false;
    }

    return true;
}

// Example of rate limiting
public function check_rate_limit(): bool {
    $user_id = get_current_user_id();
    $key = "rate_limit_$user_id";
    $limit = 1000; // requests per hour
    
    $count = get_transient($key) ?: 0;
    if ($count >= $limit) {
        return false;
    }
    
    set_transient($key, $count + 1, HOUR_IN_SECONDS);
    return true;
}

// Example of audit logging
public function log_security_event(
    string $action,
    int $user_id,
    array $data = []
): void {
    global $wpdb;
    
    $wpdb->insert(
        $wpdb->prefix . 'piper_privacy_audit_log',
        [
            'action' => $action,
            'user_id' => $user_id,
            'ip_address' => $_SERVER['REMOTE_ADDR'],
            'data' => json_encode($data),
            'created_at' => current_time('mysql')
        ]
    );
}

// Example of form security
public function render_secure_form(): void {
    ?>
    <form method="post" action="<?php echo esc_url(admin_url('admin-post.php')); ?>">
        <?php wp_nonce_field('sorn_action', 'sorn_nonce'); ?>
        <input type="hidden" name="action" value="save_sorn">
        <!-- Form fields -->
    </form>
    <?php
}

public function validate_form(): bool {
    if (!isset($_POST['sorn_nonce']) || 
        !wp_verify_nonce($_POST['sorn_nonce'], 'sorn_action')) {
        wp_die('Invalid nonce');
    }
    return true;
}

// Example of input validation
public function sanitize_sorn_input(array $data): array {
    return [
        'title' => sanitize_text_field($data['title']),
        'content' => wp_kses_post($data['content']),
        'agency' => sanitize_text_field($data['agency']),
        'system_number' => sanitize_text_field($data['system_number'])
    ];
}