// ✅ 正确的输入验证
import { z } from 'zod';

const userInputSchema = z.object({
  email: z.string().email().max(255),
  password: z.string().min(8).max(128),
});

app.post('/api/auth/login', (req, res) => {
  const validation = userInputSchema.safeParse(req.body);
  if (!validation.success) {
    return res.status(400).json({ error: '输入验证失败' });
  }
  // 处理验证通过的数据
});

// ✅ 使用参数化查询
const user = await db.select()
  .from(users)
  .where(eq(users.email, email))
  .limit(1);

// ❌ 避免字符串拼接
// const query = `SELECT * FROM users WHERE email = '${email}'`;

// ✅ 中间件验证
const authenticateUser = (req: Request, res: Response, next: NextFunction) => {
  const sessionData = req.session as any;
  if (!sessionData?.userId) {
    return res.status(401).json({ error: '未授权访问' });
  }
  req.user = { id: sessionData.userId };
  next();
};

// 保护敏感端点
app.get('/api/reports', authenticateUser, getReports);

// 安全的会话配置
app.use(session({
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: process.env.NODE_ENV === 'production', // HTTPS only in production
    httpOnly: true, // 防止 XSS
    maxAge: 24 * 60 * 60 * 1000, // 24小时
    sameSite: 'strict' // CSRF 保护
  }
}));

import rateLimit from 'express-rate-limit';

// API 速率限制
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15分钟
  max: 100, // 每个IP最多100次请求
  message: '请求过于频繁，请稍后再试',
  standardHeaders: true,
  legacyHeaders: false,
});

// 登录速率限制
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15分钟
  max: 5, // 每个IP最多5次登录尝试
  skipSuccessfulRequests: true,
});

app.use('/api/', apiLimiter);
app.use('/api/auth/login', loginLimiter);

import multer from 'multer';
import path from 'path';

// 安全的文件上传配置
const upload = multer({
  storage: multer.diskStorage({
    destination: './uploads/',
    filename: (req, file, cb) => {
      // 生成安全的文件名
      const uniqueSuffix = Date.now() + '-' + Math.round(Math.random() * 1E9);
      cb(null, 'file-' + uniqueSuffix + path.extname(file.originalname));
    }
  }),
  fileFilter: (req, file, cb) => {
    // 白名单文件类型
    const allowedTypes = [
      'image/jpeg',
      'image/png',
      'image/gif',
      'application/pdf',
      'video/mp4'
    ];
    
    if (allowedTypes.includes(file.mimetype)) {
      cb(null, true);
    } else {
      cb(new Error('不支持的文件类型'));
    }
  },
  limits: {
    fileSize: 50 * 1024 * 1024, // 50MB
    files: 10
  }
});

// 安全事件日志
const securityLogger = {
  logFailedLogin: (ip: string, email: string) => {
    console.log(JSON.stringify({
      event: 'failed_login',
      ip,
      email,
      timestamp: new Date().toISOString(),
      level: 'warning'
    }));
  },
  
  logSuspiciousActivity: (ip: string, activity: string) => {
    console.log(JSON.stringify({
      event: 'suspicious_activity',
      ip,
      activity,
      timestamp: new Date().toISOString(),
      level: 'critical'
    }));
  }
};

// 安全健康检查端点
app.get('/api/health', (req, res) => {
  const checks = {
    database: checkDatabaseConnection(),
    redis: checkRedisConnection(),
    storage: checkStorageAccess(),
    timestamp: new Date().toISOString()
  };
  
  const allHealthy = Object.values(checks).every(check => 
    check === true || check === 'connected'
  );
  
  res.status(allHealthy ? 200 : 503).json(checks);
});