import DOMPurify from 'dompurify';
import { escape } from 'html-escaper';

// 1. HTML context - escape <, >, &, ", '
function renderComment(userInput: string): string {
  return escape(userInput); // safe: &lt;script&gt; not executed
}

// 2. When you must allow some HTML (e.g. rich text) - sanitize, don't escape
function renderRichText(userHtml: string): string {
  // DOMPurify strips disallowed tags/attributes; allowlist only what you need
  return DOMPurify.sanitize(userHtml, {
    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p', 'ul', 'li'],
    ALLOWED_ATTR: ['href', 'title'],
  });
}

// 3. JavaScript context - use JSON.stringify, never template-inject
// WRONG:  <script>var name = "<%= userInput %>";</script>
// RIGHT:
function inlineJsonData(data: unknown): string {
  // JSON.stringify encodes <, >, & to unicode escapes automatically
  return `<script>var __DATA__ = ${JSON.stringify(data)};</script>`;
}

import { Pool } from 'pg';

const pool = new Pool();

// WRONG - string interpolation:
// const rows = await pool.query(`SELECT * FROM users WHERE email = '${email}'`);

// RIGHT - parameterized ($1, $2 for pg):
async function findUserByEmail(email: string) {
  const { rows } = await pool.query(
    'SELECT id, name, email FROM users WHERE email = $1',
    [email]
  );
  return rows[0] ?? null;
}

// RIGHT - ORM (Prisma example):
// const user = await prisma.user.findUnique({ where: { email } });

// Dynamic ORDER BY (column names can't be parameterized - use an allowlist):
const ALLOWED_SORT_COLUMNS = new Set(['name', 'created_at', 'email'] as const);

async function listUsers(sortBy: string, order: 'ASC' | 'DESC') {
  if (!ALLOWED_SORT_COLUMNS.has(sortBy as any)) {
    throw new Error(`Invalid sort column: ${sortBy}`);
  }
  const direction = order === 'DESC' ? 'DESC' : 'ASC'; // only two valid values
  const { rows } = await pool.query(
    `SELECT id, name FROM users ORDER BY ${sortBy} ${direction}`
  );
  return rows;
}

import crypto from 'crypto';
import { Request, Response, NextFunction } from 'express';

// --- Token pattern (for traditional server-rendered forms) ---

function generateCsrfToken(): string {
  return crypto.randomBytes(32).toString('hex');
}

function setCsrfToken(req: Request, res: Response): string {
  const token = generateCsrfToken();
  // Store in httpOnly session, expose to page via non-httpOnly cookie or meta tag
  req.session.csrfToken = token;
  return token;
}

function verifyCsrf(req: Request, res: Response, next: NextFunction): void {
  const sessionToken = req.session?.csrfToken;
  const submittedToken =
    (req.headers['x-csrf-token'] as string) ?? req.body?._csrf;

  if (
    !sessionToken ||
    !submittedToken ||
    !crypto.timingSafeEqual(
      Buffer.from(sessionToken),
      Buffer.from(submittedToken)
    )
  ) {
    res.status(403).json({ error: 'Invalid CSRF token' });
    return;
  }
  next();
}

// --- SameSite cookies (for SPAs with JWT or session cookies) ---
// Set on login response:
res.cookie('session', token, {
  httpOnly: true,
  secure: true,          // HTTPS only
  sameSite: 'strict',    // never sent on cross-site requests
  path: '/',
});

import helmet from 'helmet';
import { Express } from 'express';

function applySecurityHeaders(app: Express): void {
  app.use(
    helmet({
      // HSTS: force HTTPS for 2 years, include subdomains, add to preload list
      hsts: {
        maxAge: 63072000,
        includeSubDomains: true,
        preload: true,
      },

      // CSP: restrict resource loading to same origin; tighten per-app
      contentSecurityPolicy: {
        directives: {
          defaultSrc: ["'self'"],
          scriptSrc: ["'self'"],          // no inline scripts, no eval
          styleSrc: ["'self'", "'unsafe-inline'"], // relax only if needed
          imgSrc: ["'self'", 'data:', 'https://cdn.example.com'],
          connectSrc: ["'self'", 'https://api.example.com'],
          fontSrc: ["'self'"],
          objectSrc: ["'none'"],
          frameAncestors: ["'none'"],     // replaces X-Frame-Options
          upgradeInsecureRequests: [],
        },
      },

      // Clickjacking: frameAncestors in CSP is preferred; keep this as fallback
      frameguard: { action: 'deny' },

      // Prevent MIME sniffing
      noSniff: true,

      // Limit referrer leakage
      referrerPolicy: { policy: 'strict-origin-when-cross-origin' },

      // Disable browser features not used by the app
      permittedCrossDomainPolicies: false,
    })
  );

  // Permissions-Policy (not yet in helmet stable - set manually)
  app.use((_req, res, next) => {
    res.setHeader(
      'Permissions-Policy',
      'camera=(), microphone=(), geolocation=(), payment=()'
    );
    next();
  });
}

import bcrypt from 'bcrypt';
import jwt from 'jsonwebtoken';
import { Request, Response } from 'express';

const BCRYPT_ROUNDS = 12; // increase as hardware improves
const JWT_SECRET = process.env.JWT_SECRET!; // loaded from secrets manager
const ACCESS_TOKEN_TTL = '15m';
const REFRESH_TOKEN_TTL = '7d';

// --- Password hashing ---
async function hashPassword(plain: string): Promise<string> {
  return bcrypt.hash(plain, BCRYPT_ROUNDS);
}

async function verifyPassword(plain: string, hash: string): Promise<boolean> {
  return bcrypt.compare(plain, hash);
}

// --- JWT issuance ---
interface TokenPayload {
  sub: string; // user ID
  role: string;
}

function issueAccessToken(payload: TokenPayload): string {
  return jwt.sign(payload, JWT_SECRET, { expiresIn: ACCESS_TOKEN_TTL });
}

// --- Secure login handler ---
async function login(req: Request, res: Response): Promise<void> {
  const { email, password } = req.body;

  const user = await findUserByEmail(email);

  // Always run bcrypt even on missing user - prevent timing-based user enumeration
  const hash = user?.passwordHash ?? '$2b$12$invalidhashpadding000000000000000000000000000000000000';
  const valid = await verifyPassword(password, hash);

  if (!user || !valid) {
    res.status(401).json({ error: 'Invalid email or password' }); // generic message
    return;
  }

  const accessToken = issueAccessToken({ sub: user.id, role: user.role });

  // Store access token in httpOnly cookie - not localStorage
  res.cookie('access_token', accessToken, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
    maxAge: 15 * 60 * 1000, // 15 minutes in ms
  });

  res.json({ ok: true });
}

import { URL } from 'url';
import dns from 'dns/promises';
import { isPrivate } from 'private-ip'; // npm i private-ip

const ALLOWED_SCHEMES = new Set(['https:']);
const ALLOWED_HOSTS = new Set(['api.example.com', 'cdn.example.com']);

async function isSafeUrl(rawUrl: string): Promise<boolean> {
  let parsed: URL;
  try {
    parsed = new URL(rawUrl);
  } catch {
    return false; // not a valid URL
  }

  // 1. Allowlist scheme
  if (!ALLOWED_SCHEMES.has(parsed.protocol)) return false;

  // 2. If you can't use a host allowlist, at least block private/internal ranges
  if (!ALLOWED_HOSTS.has(parsed.hostname)) {
    // Resolve the hostname and check its IP
    try {
      const addresses = await dns.lookup(parsed.hostname, { all: true });
      for (const { address } of addresses) {
        if (isPrivate(address)) return false; // blocks 10.x, 172.16-31.x, 192.168.x, 127.x, etc.
      }
    } catch {
      return false; // DNS resolution failure - deny
    }
  }

  return true;
}

async function fetchWebhook(userProvidedUrl: string, payload: unknown) {
  if (!(await isSafeUrl(userProvidedUrl))) {
    throw new Error('URL not allowed');
  }
  // Proceed with fetch - also set a tight timeout
  const res = await fetch(userProvidedUrl, {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify(payload),
    signal: AbortSignal.timeout(5000), // 5-second hard timeout
  });
  return res;
}

import { z } from 'zod'; // npm i zod

// Define strict schemas - unknown fields are stripped by default
const CreateUserSchema = z.object({
  email: z.string().email().max(254).toLowerCase(),
  name: z.string().min(1).max(100).regex(/^[\p{L}\p{N} '-]+$/u), // letters, digits, space, hyphen, apostrophe
  role: z.enum(['viewer', 'editor', 'admin']), // strict allowlist, not a free string
  age: z.number().int().min(13).max(120).optional(),
});

type CreateUserInput = z.infer<typeof CreateUserSchema>;

function validateCreateUser(body: unknown): CreateUserInput {
  // parse() throws ZodError with field-level detail on failure
  return CreateUserSchema.parse(body);
}

// Use in Express middleware
import { Request, Response, NextFunction } from 'express';

function validateBody<T>(schema: z.ZodSchema<T>) {
  return (req: Request, res: Response, next: NextFunction) => {
    const result = schema.safeParse(req.body);
    if (!result.success) {
      res.status(400).json({
        error: 'Validation failed',
        issues: result.error.flatten().fieldErrors,
      });
      return;
    }
    req.body = result.data; // replace with validated + stripped data
    next();
  };
}

// router.post('/users', validateBody(CreateUserSchema), createUserHandler);