// ❌ VULNERABLE: Weak password validation
function validatePassword(password) {
  return password.length >= 6; // Too weak!
}

// ❌ Storing tokens in localStorage (XSS vulnerable)
localStorage.setItem('authToken', token);

// ❌ No token expiration check
function isAuthenticated() {
  return !!localStorage.getItem('authToken');
}

// ✅ SECURE: Strong password validation
function validatePassword(password) {
  const minLength = 12;
  const hasUpperCase = /[A-Z]/.test(password);
  const hasLowerCase = /[a-z]/.test(password);
  const hasNumbers = /d/.test(password);
  const hasSpecialChar = /[!@#$%^&*(),.?":{}|<>]/.test(password);
  
  return password.length >= minLength && 
         hasUpperCase && hasLowerCase && 
         hasNumbers && hasSpecialChar;
}

// ✅ Secure token storage using httpOnly cookies
function setAuthToken(token) {
  // Set via server-side with httpOnly, secure, sameSite flags
  document.cookie = `authToken=${token}; HttpOnly; Secure; SameSite=Strict; Max-Age=3600`;
}

// ✅ JWT token validation with expiration
function isAuthenticated() {
  const token = getTokenFromSecureCookie();
  if (!token) return false;
  
  try {
    const payload = JSON.parse(atob(token.split('.')[1]));
    return payload.exp * 1000 > Date.now(); // Check expiration
  } catch {
    return false;
  }
}

// ✅ Role-based access control
function hasPermission(user, resource, action) {
  return user.roles.some(role => 
    role.permissions.includes(`${resource}:${action}`)
  );
}

// ✅ Email validation with regex and DNS check
function validateEmail(email) {
  const emailRegex = /^[^s@]+@[^s@]+.[^s@]+$/;
  if (!emailRegex.test(email)) return false;
  
  // Additional checks
  const domain = email.split('@')[1];
  return domain.length > 0 && !domain.includes('..');
}

// ✅ SQL injection prevention for search queries
function sanitizeSearchQuery(query) {
  return query
    .replace(/[<>]/g, '') // Remove angle brackets
    .replace(/['";]/g, '') // Remove quotes and semicolons
    .trim()
    .substring(0, 100); // Limit length
}

// ✅ File upload validation
function validateFileUpload(file) {
  const allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
  const maxSize = 5 * 1024 * 1024; // 5MB
  const allowedExtensions = ['.jpg', '.jpeg', '.png', '.gif'];
  
  const fileExtension = file.name.toLowerCase().substring(file.name.lastIndexOf('.'));
  
  return allowedTypes.includes(file.type) &&
         file.size <= maxSize &&
         allowedExtensions.includes(fileExtension);
}

// ✅ React form validation with Zod
import { z } from 'zod';

const userSchema = z.object({
  name: z.string().min(2).max(50).regex(/^[a-zA-Zs]+$/),
  email: z.string().email(),
  age: z.number().min(13).max(120),
  website: z.string().url().optional()
});

function validateUserData(data) {
  try {
    return userSchema.parse(data);
  } catch (error) {
    throw new Error(`Validation failed: ${error.message}`);
  }
}

// ✅ Client-side encryption for non-sensitive cached data
import CryptoJS from 'crypto-js';

class SecureStorage {
  constructor() {
    this.key = this.generateSessionKey();
  }
  
  generateSessionKey() {
    return CryptoJS.lib.WordArray.random(256/8).toString();
  }
  
  encrypt(data) {
    return CryptoJS.AES.encrypt(JSON.stringify(data), this.key).toString();
  }
  
  decrypt(encryptedData) {
    const bytes = CryptoJS.AES.decrypt(encryptedData, this.key);
    return JSON.parse(bytes.toString(CryptoJS.enc.Utf8));
  }
  
  setItem(key, value) {
    const encrypted = this.encrypt(value);
    sessionStorage.setItem(key, encrypted);
  }
  
  getItem(key) {
    const encrypted = sessionStorage.getItem(key);
    return encrypted ? this.decrypt(encrypted) : null;
  }
}

// ✅ Force HTTPS redirect (Next.js)
module.exports = {
  async redirects() {
    return [
      {
        source: '/(.*)',
        has: [
          {
            type: 'header',
            key: 'x-forwarded-proto',
            value: 'http',
          },
        ],
        destination: 'https://yourdomain.com/:path*',
        permanent: true,
      },
    ];
  },
};

// ✅ Security headers
module.exports = {
  async headers() {
    return [
      {
        source: '/(.*)',
        headers: [
          {
            key: 'Strict-Transport-Security',
            value: 'max-age=31536000; includeSubDomains; preload'
          },
          {
            key: 'X-Content-Type-Options',
            value: 'nosniff'
          },
          {
            key: 'X-Frame-Options',
            value: 'DENY'
          },
          {
            key: 'X-XSS-Protection',
            value: '1; mode=block'
          }
        ]
      }
    ];
  }
};

// ✅ Secure API calls
async function secureApiCall(endpoint, data) {
  const response = await fetch(`https://api.yourdomain.com${endpoint}`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      'Authorization': `Bearer ${await getSecureToken()}`
    },
    body: JSON.stringify(data)
  });
  
  if (!response.ok) {
    throw new Error(`API call failed: ${response.status}`);
  }
  
  return response.json();
}