// JWT Strategy Configuration
@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
  constructor(config: ConfigService, private prisma: PrismaService) {
    super({
      jwtFromRequest: ExtractJwt.fromExtractors([
        (req) => req.cookies?.['access_token'],
        ExtractJwt.fromAuthHeaderAsBearerToken(),
      ]),
      secretOrKey: config.get<string>('JWT_SECRET'),
      ignoreExpiration: false,
    });
  }
}

// Password hashing implementation
import * as argon from 'argon2';

export class AuthService {
  async hashPassword(password: string): Promise<string> {
    return argon.hash(password, {
      type: argon.argon2id,
      memoryCost: 2 ** 16, // 64MB
      timeCost: 3,
      parallelism: 1,
    });
  }

  async verifyPassword(hash: string, password: string): Promise<boolean> {
    return argon.verify(hash, password);
  }
}

// Secure cookie configuration
export const ACCESS_COOKIE_OPTIONS = (secure: boolean) => ({
  httpOnly: true,
  secure,
  sameSite: 'strict' as const,
  maxAge: 15 * 60 * 1000, // 15 minutes
  path: '/',
});

export const REFRESH_COOKIE_OPTIONS = (secure: boolean) => ({
  httpOnly: true,
  secure,
  sameSite: 'strict' as const,
  maxAge: 7 * 24 * 60 * 60 * 1000, // 7 days
  path: '/',
});

// User data export
async exportUserData(userId: string): Promise<UserDataExport> {
  const user = await this.prisma.user.findUnique({
    where: { id: userId },
    include: {
      posts: true,
      likes: true,
      bookmarks: true,
      // ... other relations
    },
  });

  return {
    personalData: {
      email: user.email,
      userName: user.userName,
      displayName: user.displayName,
      // ... other fields
    },
    posts: user.posts,
    interactions: {
      likes: user.likes,
      bookmarks: user.bookmarks,
      // ... other interactions
    },
    exportedAt: new Date(),
  };
}

// User data deletion
async deleteUserData(userId: string): Promise<void> {
  await this.prisma.$transaction(async (tx) => {
    // Delete user data in correct order (respecting foreign keys)
    await tx.like.deleteMany({ where: { userId } });
    await tx.bookmark.deleteMany({ where: { userId } });
    await tx.repost.deleteMany({ where: { userId } });
    await tx.quote.deleteMany({ where: { userId } });
    await tx.follow.deleteMany({ 
      where: { OR: [{ followerId: userId }, { followingId: userId }] }
    });
    await tx.post.deleteMany({ where: { userId } });
    await tx.user.delete({ where: { id: userId } });
  });
}

// User signup validation
export class SignupDto {
  @IsEmail()
  @IsNotEmpty()
  email: string;

  @IsString()
  @Length(3, 20)
  @Matches(/^[a-zA-Z0-9_]+$/, {
    message: 'Username can only contain letters, numbers, and underscores',
  })
  userName: string;

  @IsString()
  @MinLength(8)
  @Matches(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/, {
    message: 'Password must contain at least one uppercase letter, one lowercase letter, and one number',
  })
  password: string;

  @IsOptional()
  @IsString()
  @MaxLength(50)
  firstName?: string;

  @IsOptional()
  @IsString()
  @MaxLength(50)
  lastName?: string;
}

// File upload validation
export class FileUploadValidator {
  static validateImage(file: Express.Multer.File): void {
    const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
    const maxSize = 5 * 1024 * 1024; // 5MB

    if (!allowedMimeTypes.includes(file.mimetype)) {
      throw new BadRequestException('Invalid file type. Only JPEG, PNG, GIF, and WebP are allowed.');
    }

    if (file.size > maxSize) {
      throw new BadRequestException('File size too large. Maximum size is 5MB.');
    }
  }
}

// Safe database query
async findUserByEmail(email: string): Promise<User | null> {
  // Prisma automatically sanitizes the input
  return this.prisma.user.findUnique({
    where: { email }, // Safe parameterized query
  });
}

// Unsafe - avoid this pattern
async unsafeQuery(email: string): Promise<any> {
  // DON'T DO THIS - vulnerable to SQL injection
  return this.prisma.$queryRaw`SELECT * FROM users WHERE email = ${email}`;
}

// Rate limiting configuration
@Throttle({ auth: {} })
@Post('signin')
async signin(@Body() dto: SigninDto) {
  // Limited to 5 requests per minute
}

// Global throttler configuration
ThrottlerModule.forRoot([
  {
    name: 'short',
    ttl: 1000,
    limit: 3,
  },
  {
    name: 'medium',
    ttl: 10000,
    limit: 20,
  },
  {
    name: 'long',
    ttl: 60000,
    limit: 100,
  },
])

// Secure CORS configuration
app.enableCors({
  origin: [process.env.FRONTEND_URL], // Specific allowed origins
  methods: 'GET,HEAD,PUT,PATCH,POST,DELETE',
  credentials: true,
  allowedHeaders: ['Content-Type', 'Authorization'],
  maxAge: 86400, // 24 hours
});

// Security headers middleware
import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      scriptSrc: ["'self'"],
      imgSrc: ["'self'", "data:", "https:"],
    },
  },
  hsts: {
    maxAge: 31536000,
    includeSubDomains: true,
    preload: true,
  },
}));

// Prisma connection configuration
const prisma = new PrismaClient({
  datasources: {
    db: {
      url: process.env.DATABASE_URL,
    },
  },
  log: ['error', 'warn'],
});

// Secure error handling
@Catch()
export class GlobalExceptionFilter implements ExceptionFilter {
  catch(exception: unknown, host: ArgumentsHost) {
    const ctx = host.switchToHttp();
    const response = ctx.getResponse<Response>();
    const request = ctx.getRequest<Request>();

    let status = HttpStatus.INTERNAL_SERVER_ERROR;
    let message = 'Internal server error';

    if (exception instanceof HttpException) {
      status = exception.getStatus();
      message = exception.message;
    }

    // Log error without sensitive data
    this.logger.error(`Error ${status}: ${message}`, {
      url: request.url,
      method: request.method,
      userAgent: request.get('User-Agent'),
      ip: request.ip,
    });

    // Don't expose internal errors to client
    const errorResponse = {
      statusCode: status,
      message: status >= 500 ? 'Internal server error' : message,
      timestamp: new Date().toISOString(),
      path: request.url,
    };

    response.status(status).json(errorResponse);
  }
}

// Security event logging
@Injectable()
export class SecurityLogger {
  private readonly logger = new Logger(SecurityLogger.name);

  logFailedLogin(email: string, ip: string) {
    this.logger.warn('Failed login attempt', {
      email,
      ip,
      timestamp: new Date(),
      event: 'failed_login',
    });
  }

  logSuspiciousActivity(userId: string, activity: string, details: any) {
    this.logger.warn('Suspicious activity detected', {
      userId,
      activity,
      details,
      timestamp: new Date(),
      event: 'suspicious_activity',
    });
  }
}

// Security incident detection
@Injectable()
export class SecurityIncidentService {
  async detectIncident(event: SecurityEvent): Promise<void> {
    const severity = this.assessSeverity(event);
    
    if (severity >= SeverityLevel.HIGH) {
      await this.triggerIncidentResponse(event);
    }
    
    await this.logIncident(event);
  }

  private async triggerIncidentResponse(event: SecurityEvent): Promise<void> {
    // Notify security team
    await this.notifySecurityTeam(event);
    
    // Implement containment measures
    await this.implementContainment(event);
    
    // Begin investigation
    await this.startInvestigation(event);
  }
}