// ❌ DANGEROUS — Raw HTML injection
function DangerousComment({ content }: { content: string }) {
  return <div dangerouslySetInnerHTML={{ __html: content }} />;
}

// ✅ SAFE — React escapes automatically
function SafeComment({ content }: { content: string }) {
  return <div>{content}</div>;
}

// ✅ SAFE — Sanitize when you MUST use raw HTML (e.g., rich text editors)
import DOMPurify from 'isomorphic-dompurify';

function SanitizedContent({ html }: { html: string }) {
  const clean = DOMPurify.sanitize(html, {
    ALLOWED_TAGS: ['p', 'b', 'i', 'em', 'strong', 'a'],
    ALLOWED_ATTR: ['href'],
  });
  return <div dangerouslySetInnerHTML={{ __html: clean }} />;
}

// For forms — use SameSite cookies + CSRF token
// NextAuth sets cookies with SameSite=lax by default
// For extra protection, use CSRF tokens:

import { randomBytes } from 'crypto';
import { cookies } from 'next/headers';

export async function generateCsrfToken(): Promise<string> {
  const token = randomBytes(32).toString('hex');
  cookies().set('csrf-token', token, {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'strict',
    path: '/',
  });
  return token;
}

export function validateCsrfToken(requestToken: string): boolean {
  const storedToken = cookies().get('csrf-token')?.value;
  return !!storedToken && storedToken === requestToken;
}

// ❌ NEVER DO THIS — string concatenation
async function dangerousQuery(email: string) {
  // SQL injection possible!
  return db.execute(`SELECT * FROM users WHERE email = '${email}'`);
}

// ✅ ALWAYS use parameterized queries or an ORM
import { db } from '@/lib/db'; // e.g., Drizzle, Prisma, Postgres.js

// Option 1: Parameterized query (raw SQL)
async function safeQuery(email: string) {
  return db.execute('SELECT * FROM users WHERE email = $1', [email]);
}

// Option 2: ORM (Prisma) — safe by default
import { prisma } from '@/lib/prisma';

async function findUser(email: string) {
  return prisma.user.findUnique({
    where: { email }, // Prisma handles escaping automatically
  });
}

// Option 3: Drizzle ORM
import { users } from '@/db/schema';
import { eq } from 'drizzle-orm';

async function findUserDrizzle(email: string) {
  return db.select().from(users).where(eq(users.email, email));
}

import bcrypt from 'bcryptjs';

const SALT_ROUNDS = 12; // Higher = slower but more secure

export async function hashPassword(plaintext: string): Promise<string> {
  // bcrypt automatically generates a salt and hashes
  return bcrypt.hash(plaintext, SALT_ROUNDS);
}

export async function verifyPassword(
  plaintext: string,
  hashed: string
): Promise<boolean> {
  // Constant-time comparison prevents timing attacks
  return bcrypt.compare(plaintext, hashed);
}

import { NextRequest, NextResponse } from 'next/server';
import { z } from 'zod';
import { prisma } from '@/lib/prisma';
import { verifyPassword } from '@/lib/auth/password';
import { createSession } from '@/lib/auth/session';
import { rateLimit } from '@/lib/rate-limit';

const LoginSchema = z.object({
  email: z.string().email(),
  password: z.string().min(8).max(100),
});

export async function POST(request: NextRequest) {
  // 1. Rate limiting — prevent brute force
  const ip = request.ip ?? '127.0.0.1';
  const { success } = await rateLimit.check(ip, 5); // 5 attempts per minute

  if (!success) {
    return NextResponse.json(
      { error: 'Too many attempts. Please try again later.' },
      { status: 429 }
    );
  }

  try {
    // 2. Validate input
    const body = await request.json();
    const parsed = LoginSchema.safeParse(body);

    if (!parsed.success) {
      return NextResponse.json({ error: 'Invalid input' }, { status: 400 });
    }

    const { email, password } = parsed.data;

    // 3. Find user — use generic error message (don't reveal if email exists)
    const user = await prisma.user.findUnique({ where: { email } });

    // ✅ Constant-time check even when user doesn't exist (prevents enumeration)
    const passwordMatch = user
      ? await verifyPassword(password, user.passwordHash)
      : await verifyPassword(password, '$2b$12$fakehashfortimingnormalization');

    if (!user || !passwordMatch) {
      return NextResponse.json(
        { error: 'Invalid email or password' }, // Generic message
        { status: 401 }
      );
    }

    // 4. Create session
    const session = await createSession(user.id);

    const response = NextResponse.json({ success: true });

    // 5. Set secure HTTP-only cookie
    response.cookies.set('session', session.token, {
      httpOnly: true,       // Not accessible via JavaScript
      secure: true,         // HTTPS only
      sameSite: 'lax',      // CSRF protection
      maxAge: 60 * 60 * 24 * 7, // 7 days
      path: '/',
    });

    return response;

  } catch (error) {
    console.error('[Login Error]', error);
    return NextResponse.json({ error: 'Server error' }, { status: 500 });
  }
}

export type Role = 'admin' | 'editor' | 'viewer';

export const permissions = {
  'admin':  ['read', 'write', 'delete', 'manage_users'],
  'editor': ['read', 'write'],
  'viewer': ['read'],
} as const;

type Permission = typeof permissions[Role][number];

export function hasPermission(role: Role, permission: Permission): boolean {
  return (permissions[role] as readonly string[]).includes(permission);
}

import { SignJWT, jwtVerify } from 'jose';

const secret = new TextEncoder().encode(process.env.JWT_SECRET);

export async function signToken(payload: Record<string, unknown>): Promise<string> {
  return new SignJWT(payload)
    .setProtectedHeader({ alg: 'HS256' })
    .setIssuedAt()
    .setExpirationTime('1h')        // Short expiry
    .setIssuer('https://yourdomain.com')
    .setAudience('https://yourdomain.com')
    .sign(secret);
}

export async function verifyToken(token: string) {
  const { payload } = await jwtVerify(token, secret, {
    issuer: 'https://yourdomain.com',
    audience: 'https://yourdomain.com',
  });
  return payload;
}

import { LRUCache } from 'lru-cache';

type RateLimitOptions = {
  uniqueTokenPerInterval?: number;
  interval?: number; // milliseconds
};

export function rateLimiter(options: RateLimitOptions = {}) {
  const tokenCache = new LRUCache<string, number[]>({
    max: options.uniqueTokenPerInterval || 500,
    ttl: options.interval || 60_000, // 1 minute
  });

  return {
    check: (token: string, limit: number): { success: boolean; remaining: number } => {
      const tokenCount = tokenCache.get(token) ?? [];
      const now = Date.now();
      const windowStart = now - (options.interval || 60_000);

      // Filter out old requests
      const recentRequests = tokenCount.filter(t => t > windowStart);
      recentRequests.push(now);
      tokenCache.set(token, recentRequests);

      const remaining = Math.max(0, limit - recentRequests.length);
      return {
        success: recentRequests.length <= limit,
        remaining,
      };
    },
  };
}

// Usage in API route
const limiter = rateLimiter({ interval: 60_000, uniqueTokenPerInterval: 500 });

export async function POST(request: Request) {
  const ip = request.headers.get('x-forwarded-for') ?? '127.0.0.1';
  const { success, remaining } = limiter.check(ip, 10);

  if (!success) {
    return Response.json(
      { error: 'Rate limit exceeded' },
      {
        status: 429,
        headers: {
          'Retry-After': '60',
          'X-RateLimit-Remaining': String(remaining),
        },
      }
    );
  }
  // ... handle request
}