// next.config.ts - Force HTTPS in production
const nextConfig = {
  async headers() {
    return [
      {
        source: "/:path*",
        headers: [
          {
            key: "Strict-Transport-Security",
            value: "max-age=63072000; includeSubDomains; preload",
          },
          {
            key: "X-Content-Type-Options",
            value: "nosniff",
          },
          {
            key: "X-Frame-Options",
            value: "DENY",
          },
          {
            key: "X-XSS-Protection",
            value: "1; mode=block",
          },
        ],
      },
    ];
  },
};

// Do NOT implement password hashing yourself
// Use established libraries like bcrypt or argon2

import bcrypt from "bcrypt";

// Hash password (development only - use proper auth library)
const hash = await bcrypt.hash(password, 12);

// Verify password
const isValid = await bcrypt.compare(password, hash);

// Use established session libraries
// Examples:
// - NextAuth.js (recommended for Next.js)
// - Iron Session
// - Lucia

// Requirements:
// 1. Secure cookies (httpOnly, secure, sameSite)
// 2. CSRF protection tokens
// 3. Session timeout
// 4. Secure session storage

enum UserRole {
  ADMIN = "admin",          // Full access
  MODERATOR = "moderator",  // Can moderate complaints
  BUSINESS_OWNER = "owner", // Can manage own business
  ANALYST = "analyst",      // Read-only access
  USER = "user",            // Basic access
}

// Authorization middleware
function requireRole(allowedRoles: UserRole[]) {
  return (req: NextRequest, context) => {
    const userRole = req.headers.get("x-user-role");
    if (!allowedRoles.includes(userRole)) {
      return NextResponse.json({ error: "Forbidden" }, { status: 403 });
    }
  };
}

// lib/validation.ts
import { z } from "zod";

export const businessSearchSchema = z.object({
  search: z.string().max(255).optional(),
  industry: z.enum([
    "technology",
    "banking_finance",
    "agriculture",
    // ...
  ]).optional(),
  minRating: z.number().min(0).max(5).optional(),
  page: z.number().int().positive().default(1),
  limit: z.number().int().min(1).max(100).default(20),
});

// Usage in API route
const validated = businessSearchSchema.safeParse(queryParams);
if (!validated.success) {
  return NextResponse.json(
    { error: "Invalid parameters" },
    { status: 400 }
  );
}

// ❌ NEVER trust user input
const name = req.body.name; // Unsafe!

// ✅ ALWAYS validate
const schema = z.object({
  name: z.string().min(1).max(255),
  email: z.string().email(),
  phone: z.string().regex(/^\+?[1-9]\d{1,14}$/), // E.164 format
});

const validated = schema.safeParse(req.body);

// Sanitize HTML input
import DOMPurify from "isomorphic-dompurify";

const cleanInput = DOMPurify.sanitize(userInput);

// Validate URLs
const urlSchema = z.string().url().max(2048);

// Validate phone numbers
const phoneSchema = z.string().regex(/^\+232\d{9}$/);

// Validate registration numbers
const regNumberSchema = z.string().regex(/^[A-Z]{2}\d{8}$/);

// app/api/explore/route.ts
const querySchema = z.object({
  page: z.coerce.number().int().positive().default(1),
  limit: z.coerce.number().int().min(1).max(100).default(20), // Max 100
  search: z.string().max(255).optional(),
  // ... other fields
});

// Prevents parameter pollution and abuse

// ❌ VULNERABLE - Never use string concatenation
const query = `SELECT * FROM business WHERE name = '${search}'`;

// ✅ SAFE - Use Drizzle ORM with parameterized queries
const businesses = await db
  .select()
  .from(business)
  .where(ilike(business.name, `%${search}%`))
  .execute();

// Recommended: Use middleware like express-rate-limit or custom implementation

import rateLimit from "express-rate-limit";

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // Limit each IP to 100 requests per windowMs
  message: "Too many requests from this IP",
  standardHeaders: true, // Return rate limit info in headers
  legacyHeaders: false, // Disable X-RateLimit-* headers
});

// Apply to routes
export const GET = limiter(handler);

// Future implementation for cross-origin requests

const corsHeaders = {
  "Access-Control-Allow-Origin": process.env.ALLOWED_ORIGINS || "*",
  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
  "Access-Control-Allow-Headers": "Content-Type, Authorization",
  "Access-Control-Max-Age": "86400",
};

// Only allow specific origins in production
const allowedOrigins = [
  "https://yourdomain.com",
  "https://admin.yourdomain.com",
];

function setCorsHeaders(origin: string) {
  if (allowedOrigins.includes(origin)) {
    return { "Access-Control-Allow-Origin": origin };
  }
  return {};
}

// lib/errorHandler.ts
export function errorResponse(
  statusCode: number,
  error: Error | string | any,
  publicMessage: string,
) {
  if (process.env.NODE_ENV === "development") {
    // Show detailed errors in development
    console.error("API Error:", error);
  }

  // ❌ NEVER expose internal errors to users
  // ✅ Always return generic message in production
  return NextResponse.json(
    {
      ok: false,
      message: publicMessage, // User-friendly message
      error: publicMessage,
      data: null,
    },
    { status: statusCode }
  );
}

// Enable query logging for security audits
// In Drizzle ORM config:

import { defineConfig } from "drizzle-kit";

export default defineConfig({
  schema: "./db/schema.ts",
  dialect: "postgresql",
  dbCredentials: {
    url: process.env.DATABASE_URL,
  },
  // Enable query logging in development
  verbose: process.env.NODE_ENV === "development",
});

// Monitor for suspicious activity
import { logger } from "@/lib/logger";

logger.error("Unusual query pattern detected", {
  userId,
  endpoint,
  method,
  timestamp,
});

// Validate input
const schema = z.object({
  email: z.string().email(),
  age: z.number().min(18).max(120),
});

const result = schema.safeParse(input);
if (!result.success) {
  return errorResponse(400, result.error);
}

// Use parameterized queries
const user = await db
  .select()
  .from(users)
  .where(eq(users.email, validatedEmail))
  .execute();

// Hash passwords
const hashed = await bcrypt.hash(password, 12);

// Set secure headers
res.setHeader("X-Content-Type-Options", "nosniff");

// Concatenate user input into SQL
const query = `SELECT * FROM users WHERE email = '${email}'`;

// Trust user input without validation
const limit = req.query.limit; // Could be 999999999

// Expose sensitive errors
catch (error) {
  res.json({ error: error.message }); // Exposes DB structure
}

// Store secrets in code
const dbPassword = "hardcoded_password";

// Log sensitive data
console.log("User password:", password);

// Trust client-side validation only
// Always validate server-side