// JWT token validation middleware
func AuthMiddleware(c *fiber.Ctx) error {
    token := c.Get("Authorization")
    if token == "" {
        return c.Status(401).JSON(fiber.Map{
            "error": "Missing authorization header",
        })
    }
    
    // Validate JWT token
    claims, err := validateJWT(token)
    if err != nil {
        return c.Status(401).JSON(fiber.Map{
            "error": "Invalid token",
        })
    }
    
    c.Locals("user", claims)
    return c.Next()
}

// RBAC implementation
type Role string

const (
    RoleAdmin     Role = "admin"
    RoleEditor    Role = "editor"
    RoleViewer    Role = "viewer"
)

type User struct {
    ID    uint   `json:"id"`
    Email string `json:"email"`
    Role  Role   `json:"role"`
}

func RequireRole(role Role) fiber.Handler {
    return func(c *fiber.Ctx) error {
        user := c.Locals("user").(*User)
        if user.Role != role && user.Role != RoleAdmin {
            return c.Status(403).JSON(fiber.Map{
                "error": "Insufficient permissions",
            })
        }
        return c.Next()
    }
}

// Input validation for media processing parameters
type MediaParams struct {
    Width   int    `validate:"min=1,max=4096"`
    Height  int    `validate:"min=1,max=4096"`
    Quality int    `validate:"min=1,max=100"`
    Format  string `validate:"oneof=jpg png gif webp avif mp4 webm"`
}

func ValidateParams(params *MediaParams) error {
    validate := validator.New()
    return validate.Struct(params)
}

// Prevent path traversal attacks
func SanitizePath(path string) (string, error) {
    // Remove any path traversal attempts
    cleaned := filepath.Clean(path)
    
    // Ensure path doesn't go outside allowed directories
    if strings.Contains(cleaned, "..") {
        return "", errors.New("invalid path")
    }
    
    // Remove leading slashes
    cleaned = strings.TrimPrefix(cleaned, "/")
    
    return cleaned, nil
}

// Validate file content type
func ValidateContentType(file []byte, allowedTypes []string) error {
    contentType := http.DetectContentType(file)
    
    for _, allowed := range allowedTypes {
        if strings.HasPrefix(contentType, allowed) {
            return nil
        }
    }
    
    return fmt.Errorf("invalid content type: %s", contentType)
}

// Rate limiter implementation
type RateLimiter struct {
    requests map[string][]time.Time
    mutex    sync.RWMutex
    limit    int
    window   time.Duration
}

func NewRateLimiter(limit int, window time.Duration) *RateLimiter {
    return &RateLimiter{
        requests: make(map[string][]time.Time),
        limit:    limit,
        window:   window,
    }
}

func (rl *RateLimiter) Allow(clientIP string) bool {
    rl.mutex.Lock()
    defer rl.mutex.Unlock()
    
    now := time.Now()
    cutoff := now.Add(-rl.window)
    
    // Clean old requests
    requests := rl.requests[clientIP]
    validRequests := []time.Time{}
    for _, req := range requests {
        if req.After(cutoff) {
            validRequests = append(validRequests, req)
        }
    }
    
    // Check if limit exceeded
    if len(validRequests) >= rl.limit {
        return false
    }
    
    // Add current request
    validRequests = append(validRequests, now)
    rl.requests[clientIP] = validRequests
    
    return true
}

// CORS middleware configuration
func CORSMiddleware() fiber.Handler {
    return cors.New(cors.Config{
        AllowOrigins:     "https://your-frontend.com,https://admin.your-domain.com",
        AllowMethods:     "GET,POST,PUT,DELETE,OPTIONS",
        AllowHeaders:     "Origin,Content-Type,Accept,Authorization,X-Debug",
        ExposeHeaders:    "X-Trace-ID,X-Cache-Status",
        AllowCredentials: true,
        MaxAge:           86400, // 24 hours
    })
}

// TLS configuration for database connections
func configureTLS() *tls.Config {
    return &tls.Config{
        MinVersion: tls.VersionTLS12,
        CipherSuites: []uint16{
            tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
            tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
            tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        },
    }
}

// Security headers middleware
func SecurityHeaders() fiber.Handler {
    return func(c *fiber.Ctx) error {
        // Prevent clickjacking
        c.Set("X-Frame-Options", "DENY")
        
        // Prevent MIME type sniffing
        c.Set("X-Content-Type-Options", "nosniff")
        
        // XSS protection
        c.Set("X-XSS-Protection", "1; mode=block")
        
        // Referrer policy
        c.Set("Referrer-Policy", "strict-origin-when-cross-origin")
        
        // Content Security Policy
        c.Set("Content-Security-Policy", "default-src 'self'; img-src 'self' data: https:; script-src 'self'")
        
        return c.Next()
    }
}

// Security event logging
type SecurityEvent struct {
    Timestamp   time.Time `json:"timestamp"`
    EventType   string    `json:"event_type"`
    ClientIP    string    `json:"client_ip"`
    UserAgent   string    `json:"user_agent"`
    RequestPath string    `json:"request_path"`
    Severity    string    `json:"severity"`
    Message     string    `json:"message"`
}

func LogSecurityEvent(eventType, clientIP, userAgent, path, severity, message string) {
    event := SecurityEvent{
        Timestamp:   time.Now(),
        EventType:   eventType,
        ClientIP:    clientIP,
        UserAgent:   userAgent,
        RequestPath: path,
        Severity:    severity,
        Message:     message,
    }
    
    log.Warn("Security event", "event", event)
}

// Simple intrusion detection
type IntrusionDetector struct {
    failedAttempts map[string]int
    mutex          sync.RWMutex
    threshold      int
    window         time.Duration
}

func (id *IntrusionDetector) RecordFailedAttempt(clientIP string) bool {
    id.mutex.Lock()
    defer id.mutex.Unlock()
    
    id.failedAttempts[clientIP]++
    
    if id.failedAttempts[clientIP] >= id.threshold {
        LogSecurityEvent("intrusion_detected", clientIP, "", "", "high", 
            fmt.Sprintf("Too many failed attempts: %d", id.failedAttempts[clientIP]))
        return true
    }
    
    return false
}

// Data retention policy
type DataRetentionPolicy struct {
    LogRetention   time.Duration // 90 days
    CacheRetention time.Duration // 24 hours
    BackupRetention time.Duration // 7 years
}

// Data anonymization
func AnonymizeUserData(userID string) error {
    // Remove or hash personal identifiers
    return db.Model(&User{}).Where("id = ?", userID).Updates(map[string]interface{}{
        "email": fmt.Sprintf("deleted_%s@example.com", generateHash(userID)),
        "name":  "Deleted User",
    })
}