// Secure JWT implementation
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');

// Generate secure JWT
function generateToken(user) {
  const payload = {
    userId: user.id,
    email: user.email,
    role: user.role,
    // Don't include sensitive data
    iat: Math.floor(Date.now() / 1000),
    exp: Math.floor(Date.now() / 1000) + (60 * 60) // 1 hour
  };
  
  return jwt.sign(payload, process.env.JWT_SECRET, {
    algorithm: 'HS256',
    issuer: 'your-app',
    audience: 'your-users'
  });
}

// Verify JWT middleware
function verifyToken(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  
  if (!token) {
    return res.status(401).json({ error: 'No token provided' });
  }
  
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET, {
      algorithms: ['HS256'],
      issuer: 'your-app',
      audience: 'your-users'
    });
    
    req.user = decoded;
    next();
  } catch (error) {
    return res.status(401).json({ error: 'Invalid token' });
  }
}

// Secure password handling
const bcrypt = require('bcrypt');

// Hash password with salt
async function hashPassword(plainPassword) {
  const saltRounds = 12; // Higher = more secure, slower
  return await bcrypt.hash(plainPassword, saltRounds);
}

// Verify password
async function verifyPassword(plainPassword, hashedPassword) {
  return await bcrypt.compare(plainPassword, hashedPassword);
}

// Password strength validation
function validatePassword(password) {
  const minLength = 8;
  const hasUpperCase = /[A-Z]/.test(password);
  const hasLowerCase = /[a-z]/.test(password);
  const hasNumbers = /d/.test(password);
  const hasSpecialChar = /[!@#$%^&*(),.?":{}|<>]/.test(password);
  
  return password.length >= minLength && 
         hasUpperCase && 
         hasLowerCase && 
         hasNumbers && 
         hasSpecialChar;
}

// Rate limiting for login attempts
const loginAttempts = new Map();

function checkRateLimit(ip) {
  const attempts = loginAttempts.get(ip) || { count: 0, lastAttempt: 0 };
  const now = Date.now();
  
  if (now - attempts.lastAttempt > 15 * 60 * 1000) { // 15 minutes
    attempts.count = 0;
  }
  
  if (attempts.count >= 5) {
    throw new Error('Too many failed attempts. Try again later.');
  }
  
  return attempts;
}